@clear-capabilities/agentic-security-scanner 0.172.0 → 0.173.0

package/dist/6972.index.js

@@ -0,0 +1,167 @@
+export const id = 6972;
+export const ids = [6972];
+export const modules = {
+
+/***/ 16972:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   describeTarget: () => (/* binding */ describeTarget),
+/* harmony export */   loadTargetManifest: () => (/* binding */ loadTargetManifest),
+/* harmony export */   validateTarget: () => (/* binding */ validateTarget)
+/* harmony export */ });
+/* unused harmony export _internals */
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
+// Verifier target harness (FR-LIVE-HARNESS).
+//
+// Customer projects describe how to bring up the app they want the verifier
+// to execute PoCs against. The manifest lives at
+// `.agentic-security/verifier-target.yaml` and the verifier reads it before
+// running `--live` mode. v1 supports two manifest shapes:
+//
+//   shape: docker-compose
+//   compose: docker-compose.yml
+//   service: web
+//   port: 3000
+//   wait-for: http://localhost:3000/healthz
+//
+//   ─── or ───
+//
+//   shape: command
+//   start: npm run dev
+//   port: 3000
+//   wait-for: http://localhost:3000/healthz
+//   stop: pkill -f "npm run dev"
+//
+// We DO NOT execute the manifest in this module — that's the verifier
+// sandbox's job (and the customer's explicit opt-in via --live). This
+// module parses, validates, and surfaces a structured object the verifier
+// can act on (or refuse to act on).
+
+
+
+
+const MANIFEST_PATH = node_path__WEBPACK_IMPORTED_MODULE_1__.join('.agentic-security', 'verifier-target.yaml');
+
+// Minimal YAML subset parser — keep parity with the polyglot bench parser,
+// scoped to the small set of keys this manifest uses. Standalone here to
+// avoid a runtime dep.
+function _parse(text) {
+  const out = {};
+  for (const raw of String(text || '').split(/\r?\n/)) {
+    const line = raw.replace(/#.*$/, '').trim();
+    if (!line) continue;
+    const m = line.match(/^([\w-]+)\s*:\s*(.*)$/);
+    if (!m) continue;
+    const [, key, val] = m;
+    out[key] = _coerce(val);
+  }
+  return out;
+}
+
+function _coerce(v) {
+  if (v === undefined || v === null) return null;
+  v = String(v).trim();
+  if (/^".*"$/.test(v)) return v.slice(1, -1);
+  if (/^'.*'$/.test(v)) return v.slice(1, -1);
+  if (/^-?\d+$/.test(v)) return parseInt(v, 10);
+  return v;
+}
+
+/**
+ * Read the verifier-target manifest from scanRoot. Returns:
+ *   { ok: true, target } — successfully parsed and validated
+ *   { ok: false, reason } — manifest missing or invalid
+ *
+ * Never throws.
+ */
+function loadTargetManifest(scanRoot) {
+  const fp = node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot || process.cwd(), MANIFEST_PATH);
+  if (!node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(fp)) return { ok: false, reason: 'no-manifest' };
+  let raw;
+  try { raw = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8'); }
+  catch (e) { return { ok: false, reason: `read-error:${e.message}` }; }
+  const parsed = _parse(raw);
+  const shape = parsed.shape;
+  if (shape !== 'docker-compose' && shape !== 'command') {
+    return { ok: false, reason: `unknown-shape:${shape || 'missing'}` };
+  }
+  if (shape === 'docker-compose') {
+    if (!parsed.compose || !parsed.service) {
+      return { ok: false, reason: 'docker-compose-shape-needs-compose-and-service' };
+    }
+  }
+  if (shape === 'command') {
+    if (!parsed.start) {
+      return { ok: false, reason: 'command-shape-needs-start' };
+    }
+  }
+  const target = {
+    shape,
+    compose: parsed.compose || null,
+    service: parsed.service || null,
+    start:   parsed.start   || null,
+    stop:    parsed.stop    || null,
+    port:    parsed.port    || null,
+    waitFor: parsed['wait-for'] || parsed.waitFor || null,
+    url:     parsed.url || (parsed.port ? `http://localhost:${parsed.port}` : null),
+  };
+  return { ok: true, target };
+}
+
+/**
+ * Render a quick summary for human consumption (CLI output, logs).
+ */
+function describeTarget(target) {
+  if (!target) return '(none)';
+  if (target.shape === 'docker-compose') {
+    return `docker-compose service ${target.service} from ${target.compose} on ${target.url || `:${target.port}`}`;
+  }
+  if (target.shape === 'command') {
+    return `command "${target.start}" on ${target.url || `:${target.port}`}`;
+  }
+  return `unknown-shape ${target.shape}`;
+}
+
+/**
+ * Pre-flight safety check: refuse to bring up a target whose start command
+ * looks dangerous. Curated allowlist of common shapes; everything else
+ * requires AGENTIC_SECURITY_VERIFY_TARGET_OK=1 to opt in explicitly.
+ */
+function validateTarget(target) {
+  if (!target) return { ok: false, reason: 'no-target' };
+  if (target.shape === 'docker-compose') {
+    // docker-compose is safe-ish by design.
+    return { ok: true };
+  }
+  if (target.shape === 'command') {
+    const SAFE_HINTS = [
+      /^npm\s+(?:run\s+)?(?:dev|start|serve)/,
+      /^yarn\s+(?:dev|start|serve)/,
+      /^pnpm\s+(?:run\s+)?(?:dev|start|serve)/,
+      /^node\s+/,
+      /^python(?:\d?)\s+-m\s+/,
+      /^python(?:\d?)\s+\S+\.py/,
+      /^uvicorn\s+/,
+      /^gunicorn\s+/,
+      /^flask\s+run/,
+      /^go\s+run\s+/,
+      /^java\s+-jar\s+/,
+      /^cargo\s+run/,
+    ];
+    if (process.env.AGENTIC_SECURITY_VERIFY_TARGET_OK === '1') return { ok: true, escaped: true };
+    if (!SAFE_HINTS.some(re => re.test(target.start))) {
+      return { ok: false, reason: `start-command-not-in-safe-allowlist (set AGENTIC_SECURITY_VERIFY_TARGET_OK=1 to override)` };
+    }
+    return { ok: true };
+  }
+  return { ok: false, reason: `unknown-shape:${target.shape}` };
+}
+
+const _internals = { MANIFEST_PATH };
+
+
+/***/ })
+
+};

package/dist/6995.index.js

@@ -0,0 +1,163 @@
+export const id = 6995;
+export const ids = [6995];
+export const modules = {
+
+/***/ 66995:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   addLegalHold: () => (/* binding */ addLegalHold),
+/* harmony export */   isUnderHold: () => (/* binding */ isUnderHold),
+/* harmony export */   listLegalHolds: () => (/* binding */ listLegalHolds),
+/* harmony export */   loadLegalHolds: () => (/* binding */ loadLegalHolds),
+/* harmony export */   removeLegalHold: () => (/* binding */ removeLegalHold)
+/* harmony export */ });
+/* unused harmony export LEGAL_HOLD_FILE */
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(69259);
+/* harmony import */ var _artifact_registry_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(81734);
+// FR-707 (assurance-hardening PRD): "Support legal hold and policy-
+// authorized retention exceptions | Legal hold is identity-bound, reasoned,
+// time-bounded where applicable, and auditable."
+//
+// A third instance of the recurring {owner, reason, expires_at} exception
+// shape this codebase already uses twice — `posture/suppressions.js`'s
+// pro-tier exception (scoped to a FINDING) and `posture/compliance-policy.js`'s
+// structured `not-applicable` (scoped to a COMPLIANCE CONTROL). Per D-0025,
+// these are deliberately distinct mechanisms serving different subjects, not
+// one shared module — this file is the third subject: a STATE ARTIFACT.
+//
+// Field naming matches the existing two schemas' snake_case convention
+// (`owner`, `reason`, `expires_at`) rather than inventing a fourth style.
+//
+//   identity-bound   -> `owner` (required, who placed the hold and is
+//                        accountable for lifting it)
+//   reasoned         -> `reason` (required — "we might need this later" is
+//                        not a reason; same discipline suppressions.js
+//                        already enforces for its own exceptions)
+//   time-bounded
+//     where applicable -> `expires_at` is OPTIONAL: a null/absent value is
+//                        an INDEFINITE hold, which the acceptance
+//                        criterion's own "where applicable" phrase
+//                        explicitly allows (a genuine legal matter may have
+//                        no known end date) — an ISO date value behaves
+//                        exactly like FR-506/FR-1004's own expiring
+//                        exceptions: once past, the hold is no longer
+//                        active and the artifact is exposed to its normal
+//                        retention TTL again.
+//   auditable        -> persisted as a single JSON array under
+//                        `.agentic-security/legal-holds.json` (itself
+//                        registered as operator-config — an operator/legal
+//                        team's own input, never scanner-written from scan
+//                        results), readable via `listLegalHolds`.
+//
+// Consulted from TWO places, not one: `retention-policy.js#findExpiredArtifacts`
+// (defense in depth for any caller reaching it directly) AND `cmdReset`
+// itself for its PLAIN (non-`--expired`) path, which deletes every
+// registered 'generated' artifact unconditionally and would otherwise blow
+// through a hold that only gated TTL expiry.
+
+
+
+
+
+const LEGAL_HOLD_FILE = 'legal-holds.json';
+
+function _loadRaw(scanRoot) {
+  let fp;
+  try { fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__.statePath)(scanRoot, LEGAL_HOLD_FILE); } catch { return []; }
+  let raw;
+  try { raw = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8'); } catch { return []; }
+  try {
+    const doc = JSON.parse(raw);
+    return Array.isArray(doc) ? doc : [];
+  } catch { return []; }
+}
+
+/**
+ * All legal holds ever recorded for this project, malformed entries
+ * dropped rather than throwing. Never filters by expiry — see
+ * `isUnderHold`/`listLegalHolds` for that.
+ */
+function loadLegalHolds(scanRoot) {
+  return _loadRaw(scanRoot).filter(h => h && typeof h === 'object' && typeof h.artifact === 'string' && typeof h.owner === 'string' && typeof h.reason === 'string');
+}
+
+/**
+ * Is `artifactName` currently protected by an active (non-expired) hold?
+ * Returns the matching hold record, or null. Multiple holds on the same
+ * artifact are permitted (e.g. two independent legal matters); the first
+ * still-active one found is returned.
+ */
+function isUnderHold(artifactName, holds, now = Date.now()) {
+  for (const h of holds) {
+    if (h.artifact !== artifactName) continue;
+    if (!h.expires_at) return h; // indefinite hold — always active
+    const t = Date.parse(h.expires_at);
+    if (!Number.isFinite(t) || t >= now) return h;
+  }
+  return null;
+}
+
+/**
+ * Active (non-expired) holds only, unless `includeExpired`. For
+ * `legal-hold list` / auditing.
+ */
+function listLegalHolds(scanRoot, { includeExpired = false, now = Date.now() } = {}) {
+  const holds = loadLegalHolds(scanRoot);
+  if (includeExpired) return holds;
+  return holds.filter(h => {
+    if (!h.expires_at) return true;
+    const t = Date.parse(h.expires_at);
+    return !Number.isFinite(t) || t >= now;
+  });
+}
+
+/**
+ * Add a legal hold. Validates identity-bound + reasoned up front (both
+ * required, non-empty) and that `expires_at`, if given, is a parseable
+ * date in the future — an already-expired hold would be a hold that
+ * protects nothing, which is never a legitimate request. `artifact` must
+ * name a real registered artifact (artifact-registry.js) — a hold on an
+ * unrecognised name can never protect anything and almost always means a
+ * typo. Returns `{ok:true, hold}` or `{ok:false, reason}`; never throws.
+ */
+function addLegalHold(scanRoot, { artifact, owner, reason, expires_at } = {}) {
+  if (!artifact || typeof artifact !== 'string') return { ok: false, reason: '--artifact is required' };
+  if (!(0,_artifact_registry_js__WEBPACK_IMPORTED_MODULE_2__/* .isRegisteredArtifact */ .Jl)(artifact)) return { ok: false, reason: `"${artifact}" is not a registered state artifact` };
+  if (!owner || typeof owner !== 'string') return { ok: false, reason: '--owner is required (identity-bound)' };
+  if (!reason || typeof reason !== 'string') return { ok: false, reason: '--reason is required (reasoned)' };
+  if (expires_at) {
+    const t = Date.parse(expires_at);
+    if (!Number.isFinite(t)) return { ok: false, reason: 'expires_at must be a parseable date' };
+    if (t < Date.now()) return { ok: false, reason: 'expires_at is in the past — a hold that already expired protects nothing' };
+  }
+  const hold = { artifact, owner, reason, expires_at: expires_at || null, created_at: new Date().toISOString() };
+  const holds = _loadRaw(scanRoot);
+  holds.push(hold);
+  const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__.statePath)(scanRoot, LEGAL_HOLD_FILE);
+  if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__.safeWriteState)(fp, JSON.stringify(holds, null, 2) + '\n')) {
+    return { ok: false, reason: 'state writes are disabled (--no-state) or this is not a safe state directory' };
+  }
+  return { ok: true, hold };
+}
+
+/**
+ * Remove every hold on `artifact` (lifting a hold, not letting it expire).
+ * Returns the number removed. A no-op (0) if none existed — never an error.
+ */
+function removeLegalHold(scanRoot, artifact) {
+  const holds = _loadRaw(scanRoot);
+  const remaining = holds.filter(h => !(h && h.artifact === artifact));
+  const removedCount = holds.length - remaining.length;
+  if (removedCount > 0) {
+    const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__.statePath)(scanRoot, LEGAL_HOLD_FILE);
+    (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__.safeWriteState)(fp, JSON.stringify(remaining, null, 2) + '\n');
+  }
+  return removedCount;
+}
+
+
+/***/ })
+
+};

package/dist/7249.index.js

@@ -0,0 +1,191 @@
+export const id = 7249;
+export const ids = [7249];
+export const modules = {
+
+/***/ 27249:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   renderPrComment: () => (/* binding */ renderPrComment)
+/* harmony export */ });
+/* unused harmony export _internal */
+/* harmony import */ var _util_untrusted_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(11274);
+// Advisor-tone PR comment renderer (v0.72).
+//
+// Replaces the typical "12 findings detected, see SARIF" wall of text
+// with a single security-advisor's note:
+//
+//   "I noticed you added /api/admin/users in this PR. I checked 4 things:
+//    ✓ auth (route is behind requireAdmin)
+//    ⚠ rate-limit (no rateLimit() middleware found)
+//    ✓ input validation (express-validator chain present)
+//    ✓ audit log (logger.security() called on success path)
+//
+//    The rate-limit gap matters because /admin endpoints are common
+//    credential-stuffing targets. A 5-line fix:
+//
+//    ```js
+//    import rateLimit from 'express-rate-limit';
+//    app.use('/api/admin', rateLimit({ windowMs: 15*60_000, max: 30 }));
+//    ```"
+//
+// The pure-narrative format optimizes for SCREENSHOTABILITY — engineers
+// share security-tool comments that read like a person, not a table.
+//
+// Generation is deterministic (no LLM) for the v1: we render from the
+// delta + a per-CWE narrative template. A future v2 could optionally
+// route through an LLM for richer prose when AGENTIC_SECURITY_LLM_ENDPOINT
+// is configured.
+
+
+
+const SEVERITY_GLYPH = {
+  critical: '🟥',
+  high:     '🟧',
+  medium:   '🟨',
+  low:      '🟦',
+  info:     '⬜',
+};
+
+const CWE_NARRATIVE = {
+  'CWE-89':   { name: 'SQL injection',          why: 'A malicious payload like `1\' OR 1=1--` would dump every row.' },
+  'CWE-79':   { name: 'XSS',                    why: 'An attacker who controls this string can execute JavaScript in another user\'s browser.' },
+  'CWE-78':   { name: 'Command injection',      why: 'A `;rm -rf /` style payload would run with the privileges of your service account.' },
+  'CWE-22':   { name: 'path traversal',         why: 'A `../../etc/passwd` style payload would read files outside the intended directory.' },
+  'CWE-918':  { name: 'SSRF',                   why: 'An attacker can pivot to the cloud metadata endpoint (`169.254.169.254`) or internal services.' },
+  'CWE-502':  { name: 'insecure deserialization', why: 'A crafted payload triggers gadget chains — typically remote code execution.' },
+  'CWE-611':  { name: 'XXE',                    why: 'A malicious DOCTYPE can exfiltrate local files or trigger SSRF via entity expansion.' },
+  'CWE-94':   { name: 'template injection',     why: 'A `{{7*7}}` style payload escapes to the template engine\'s expression evaluator (often RCE).' },
+  'CWE-1321': { name: 'prototype pollution',    why: 'A `__proto__` injection can alter the behavior of every downstream object check.' },
+  'CWE-352':  { name: 'CSRF',                   why: 'A cross-origin form can trigger authenticated state changes without the user\'s knowledge.' },
+  'CWE-601':  { name: 'open redirect',          why: 'Trusted-domain bouncer for phishing — credentials get harvested on the second hop.' },
+  'CWE-113':  { name: 'HTTP response splitting', why: 'CR/LF injection lets an attacker forge an entire response, including cache poisoning.' },
+  'CWE-798':  { name: 'hardcoded secret',       why: 'Committed credentials are scraped by automated scanners minutes after a push.' },
+  'CWE-327':  { name: 'weak crypto',            why: 'Modern adversaries can crack MD5/SHA-1/RC4/3DES at practical cost.' },
+  'CWE-1333': { name: 'regex DoS',              why: 'A pathological input freezes the worker for seconds — DoS without much effort.' },
+  'CWE-90':   { name: 'LDAP injection',         why: 'An attacker can extend the filter to enumerate users or bypass auth.' },
+  'CWE-643':  { name: 'XPath injection',        why: 'A `\' or \'1\'=\'1` payload can return data the query never intended to expose.' },
+  'CWE-1336': { name: 'prompt injection',       why: 'Untrusted text in the LLM context can override your system prompt.' },
+  'CWE-269':  { name: 'privilege escalation',   why: 'A low-privilege actor can reach a higher-privilege capability through this surface.' },
+};
+
+function _topCwes(findings, n = 3) {
+  const counts = new Map();
+  for (const f of findings) {
+    const k = f.cwe || 'unknown';
+    counts.set(k, (counts.get(k) || 0) + 1);
+  }
+  return [...counts.entries()].sort((a, b) => b[1] - a[1]).slice(0, n);
+}
+
+function _route(f) {
+  // Best-effort: pull a route-ish string from the file path / vuln text.
+  // Many SAST findings carry the route via `f.route` or in the vuln name.
+  if (f.route) return f.route;
+  const m = (f.vuln || '').match(/\b(GET|POST|PUT|DELETE|PATCH)\s+([\/\w:-]+)/i);
+  if (m) return `${m[1].toUpperCase()} ${m[2]}`;
+  return null;
+}
+
+/**
+ * Top-level renderer. Takes a delta produced by `computePrDelta` and
+ * emits a Markdown string suitable for posting as a single PR comment.
+ *
+ * Mode is chosen automatically:
+ *   - "clean":     no introduced + (resolved > 0 || persistent > 0)
+ *   - "trivial":   no introduced + nothing resolved
+ *   - "needs-work": one or more introduced findings
+ */
+function renderPrComment(delta, { repoName, prNumber, prTitle } = {}) {
+  if (!delta) return '_no security delta available_';
+  const intro = delta.introduced || [];
+  const resolved = delta.resolved || [];
+  const shifted = delta.shifted || [];
+  const heading = repoName && prNumber
+    ? `### 🛡 agentic-security on ${repoName}#${prNumber}`
+    : `### 🛡 agentic-security`;
+  if (intro.length === 0 && resolved.length === 0 && shifted.length === 0) {
+    return [
+      heading,
+      ``,
+      `No security delta from \`${delta.baseRef}\` → \`${delta.headRef}\`. ` +
+      `${delta.changedFiles.length} file${delta.changedFiles.length === 1 ? '' : 's'} touched; ` +
+      `nothing in those changes introduced or resolved a finding. **Safe to merge.**`,
+      ``,
+      `<sub>Scanned ${delta.head?.summary?.total ?? 0} pre-existing findings on the head ref ` +
+      `(${delta.base?.summary?.total ?? 0} on base) — none of them moved in this PR.</sub>`,
+    ].join('\n');
+  }
+  if (intro.length === 0 && (resolved.length || shifted.length)) {
+    const r = delta.summary?.resolved || {};
+    return [
+      heading,
+      ``,
+      `This PR **resolves** ${resolved.length} finding${resolved.length === 1 ? '' : 's'}` +
+      (r.critical || r.high ? ` (including ${r.critical} critical + ${r.high} high)` : '') +
+      ` and introduces **none**. Nice cleanup work — safe to merge. ✨`,
+      ``,
+      `<sub>${delta.changedFiles.length} file${delta.changedFiles.length === 1 ? '' : 's'} ` +
+      `touched between \`${delta.baseRef}\` and \`${delta.headRef}\`.</sub>`,
+    ].join('\n');
+  }
+  // needs-work mode: narrative + per-finding paragraphs.
+  const lines = [];
+  lines.push(heading);
+  lines.push('');
+  const topCwes = _topCwes(intro);
+  const cweSummary = topCwes.map(([cwe, n]) => {
+    const meta = CWE_NARRATIVE[cwe];
+    return meta ? `${n} ${meta.name}` : `${n} ${cwe}`;
+  }).join(', ');
+  const hint = prTitle ? ` in "${prTitle}"` : '';
+  lines.push(`I looked at the ${delta.changedFiles.length} file${delta.changedFiles.length === 1 ? '' : 's'} ` +
+    `you changed${hint} and noticed **${intro.length} new finding${intro.length === 1 ? '' : 's'}** ` +
+    `that wasn't on \`${delta.baseRef}\`. Top concerns: ${cweSummary}.`);
+  lines.push('');
+  // Per-introduced-finding paragraph (cap at 5 for readability).
+  const SHOW = intro.slice(0, 5);
+  for (const f of SHOW) {
+    const meta = CWE_NARRATIVE[f.cwe];
+    const sev = SEVERITY_GLYPH[f.severity] || '⬜';
+    const route = _route(f);
+    const where = route ? `\`${route}\` (\`${f.file}:${f.line}\`)` : `\`${f.file}:${f.line}\``;
+    lines.push(`${sev} **${meta?.name || (0,_util_untrusted_js__WEBPACK_IMPORTED_MODULE_0__/* .escapeMarkdown */ .FV)(f.vuln)}** — ${where}`);
+    if (meta) lines.push(`  > ${meta.why}`);
+    if (f.remediation) {
+      const onelineFix = String(f.remediation).split('\n')[0].slice(0, 240);
+      lines.push(`  Suggested fix: ${onelineFix}`);
+    }
+    if (f.confidence != null && f.confidence < 0.7) {
+      lines.push(`  <sub>Lower confidence (${(f.confidence * 100).toFixed(0)}%) — may be a false positive worth a quick look.</sub>`);
+    }
+    lines.push('');
+  }
+  if (intro.length > SHOW.length) {
+    lines.push(`<sub>+${intro.length - SHOW.length} more new finding${intro.length - SHOW.length === 1 ? '' : 's'} — see the scan output for the full list.</sub>`);
+    lines.push('');
+  }
+  if (resolved.length) {
+    lines.push(`On the bright side: this PR **resolved ${resolved.length} pre-existing finding${resolved.length === 1 ? '' : 's'}**. 👏`);
+    lines.push('');
+  }
+  const i = delta.summary?.introduced || {};
+  const blockMerge = (i.critical || 0) + (i.high || 0) > 0;
+  if (blockMerge) {
+    lines.push(`---`);
+    lines.push(`**Blocking merge:** ${i.critical || 0} critical + ${i.high || 0} high severity ` +
+      `finding${(i.critical || 0) + (i.high || 0) === 1 ? '' : 's'} introduced. ` +
+      `Fix or suppress with \`// agentic-security-ignore: <rule-id>\` before merging.`);
+  } else {
+    lines.push(`---`);
+    lines.push(`Non-blocking: no critical/high severity findings introduced — but consider addressing the items above before this becomes harder to revisit.`);
+  }
+  return lines.join('\n');
+}
+
+const _internal = { CWE_NARRATIVE, SEVERITY_GLYPH, _topCwes };
+
+
+/***/ })
+
+};