@clear-capabilities/agentic-security-scanner 0.172.1 → 0.173.0

package/dist/2773.index.js

@@ -0,0 +1,98 @@
+export const id = 2773;
+export const ids = [2773];
+export const modules = {
+
+/***/ 2773:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   persistLanguageArtifacts: () => (/* binding */ persistLanguageArtifacts)
+/* harmony export */ });
+/* unused harmony exports LANGUAGE_ANALYSIS_FILE, LANGUAGE_BOM_FILE, LANGUAGE_ARTIFACT_SCHEMA, hasLanguageContent, buildLanguageArtifacts */
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
+/* harmony import */ var _posture_state_dir_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(69259);
+/* harmony import */ var _posture_integrity_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(37455);
+/* harmony import */ var _context_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(70634);
+// Haskell and Nix analysis metadata as registered state artifacts (X-016).
+//
+// An ordinary scan already leaves last-scan.json. Two things a reviewer, auditor or retention policy needs about the
+// Haskell/Nix side were not artifacts of their own: WHAT analysed the sources (parser/resolver outcomes, capability
+// status, limitations, optional modes) and WHICH components the language BOM recorded. They are written beside
+// last-scan.json as `language-analysis.json` and `language-bom.json`, each with a detached signature, registered in
+// posture/artifact-registry.js (so export, retention, legal hold and `reset` all see them), and described by a record
+// that carries sha256 digests of every input and of the artifact bodies. No source text is ever written: paths and
+// digests only, so the file is metadata, not a copy of customer code.
+
+
+
+
+
+
+const LANGUAGE_ANALYSIS_FILE = 'language-analysis.json';
+const LANGUAGE_BOM_FILE = 'language-bom.json';
+const LANGUAGE_ARTIFACT_SCHEMA = 'agentic-security/language-analysis@1';
+
+const sha256 = (s) => node_crypto__WEBPACK_IMPORTED_MODULE_0__.createHash('sha256').update(s).digest('hex');
+function canonical(v) {
+  if (Array.isArray(v)) return `[${v.map(canonical).join(',')}]`;
+  if (v && typeof v === 'object') return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${canonical(v[k])}`).join(',')}}`;
+  return JSON.stringify(v === undefined ? null : v);
+}
+
+/** True when the scan has anything Haskell/Nix to record. */
+function hasLanguageContent(scan) {
+  const lc = scan && scan.scanHealth && scan.scanHealth.languageCoverage;
+  const files = lc && lc.totals && Number(lc.totals.files || lc.totals.analyzed || 0);
+  return !!((lc && (files > 0 || (lc.capabilities && Object.keys(lc.capabilities).length))) || (scan && scan.languageBom && (scan.languageBom.components || []).length));
+}
+
+/**
+ * The analysis record for `scan`, plus the BOM body. `inputs` is [{path, sha256}] over the Haskell/Nix sources and
+ * manifests (digests only). Pure: no I/O.
+ */
+function buildLanguageArtifacts(scan, inputs = []) {
+  const lc = (scan && scan.scanHealth && scan.scanHealth.languageCoverage) || null;
+  const bom = (scan && scan.languageBom) || null;
+  const bridges = (scan && scan.languageBridges) || null;
+  const bomBody = bom ? JSON.stringify(bom, null, 2) : null;
+  const record = {
+    schema: LANGUAGE_ARTIFACT_SCHEMA,
+    classification: { class: 'scan-metadata', containsSourceText: false, containsSecrets: false },
+    inputs: inputs.map((i) => ({ path: String(i.path), sha256: String(i.sha256) })).sort((a, b) => (a.path < b.path ? -1 : 1)),
+    analysis: lc ? { totals: lc.totals, byKind: lc.byKind, conditions: lc.conditions, limitations: lc.limitations, capabilities: lc.capabilities, optionalModes: lc.optionalModes } : null,
+    bom: bom ? { file: LANGUAGE_BOM_FILE, sha256: sha256(bomBody), components: (bom.components || []).length } : null,
+    bridges: bridges ? { sha256: sha256(canonical(bridges)) } : null,
+  };
+  return { record, bomBody };
+}
+
+/**
+ * Writes the artifacts under the project's state directory, each with a `.sig`. Returns {written:[{name, sha256}], skipped}.
+ * Never throws and never blocks a scan; a project that disallows state writes gets `skipped: 'state-writes-disabled'`.
+ */
+function persistLanguageArtifacts(root, scan) {
+  if (!hasLanguageContent(scan)) return { written: [], skipped: 'no-language-content' };
+  let inputs = [];
+  try {
+    const proj = (0,_context_js__WEBPACK_IMPORTED_MODULE_3__.loadLanguageProject)(root);
+    inputs = [...Object.entries(proj.files), ...Object.entries(proj.manifests)].map(([path, text]) => ({ path, sha256: sha256(text) }));
+  } catch { /* the record then says it has no input digests */ }
+  const { record, bomBody } = buildLanguageArtifacts(scan, inputs);
+  const out = [];
+  const put = (name, body) => {
+    const fp = (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_1__.statePath)(root, name);
+    if (!(0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_1__.safeWriteState)(fp, body)) return false;
+    try { (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_1__.safeWriteState)(`${fp}.sig`, (0,_posture_integrity_js__WEBPACK_IMPORTED_MODULE_2__/* .signLastScan */ .lU)(body)); } catch { /* the signature is best effort, as for last-scan.json */ }
+    out.push({ name, sha256: sha256(body) });
+    return true;
+  };
+  const body = JSON.stringify(record, null, 2);
+  if (!put(LANGUAGE_ANALYSIS_FILE, body)) return { written: [], skipped: 'state-writes-disabled' };
+  if (bomBody) put(LANGUAGE_BOM_FILE, bomBody);
+  return { written: out, skipped: null };
+}
+
+
+/***/ })
+
+};

package/dist/2775.index.js

@@ -0,0 +1,32 @@
+export const id = 2775;
+export const ids = [2775];
+export const modules = {
+
+/***/ 72775:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   correlateImageVulnerabilities: () => (/* binding */ correlateImageVulnerabilities)
+/* harmony export */ });
+// PRD 5 P0 §4 — Container Vulnerability Analysis. "Reuse current SCA
+// semantics where technically valid": this module does nothing but hand an
+// image's OS + application package inventory to the engine's existing
+// OSV/KEV/EPSS query path (`queryOSV`, imported via `src/sca/index.js`),
+// exactly as every other SCA finding in this codebase gets its CVE data.
+// `queryOSVFn` is injected (not imported directly) so this module's own
+// tests never make a real network call and stay independent of engine.js's
+// load cost; the CLI wiring passes the real `queryOSV`.
+async function correlateImageVulnerabilities({ inventory, fileContents, queryOSVFn }) {
+  if (typeof queryOSVFn !== 'function') throw new TypeError('correlateImageVulnerabilities requires queryOSVFn(components, allFileContents)');
+  if (!inventory || !Array.isArray(inventory.osPackages) || !Array.isArray(inventory.appPackages)) {
+    throw new TypeError('correlateImageVulnerabilities requires an inventory with osPackages/appPackages arrays');
+  }
+  const components = [...inventory.osPackages, ...inventory.appPackages];
+  const vulnerabilities = await queryOSVFn(components, fileContents || {});
+  return { components, vulnerabilities };
+}
+
+
+/***/ })
+
+};

package/dist/2966.index.js

@@ -0,0 +1,171 @@
+export const id = 2966;
+export const ids = [2966];
+export const modules = {
+
+/***/ 72966:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   queryFindingsMemory: () => (/* binding */ queryFindingsMemory)
+/* harmony export */ });
+/* unused harmony export _internals */
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(69259);
+// Findings memory — natural-language Q&A over the institutional knowledge
+// the scanner has accumulated. Backs the MCP query_findings_memory tool.
+//
+// Sources searched, in this order:
+//
+//   1. .agentic-security/last-scan.json          current findings
+//   2. .agentic-security/triage-memory.jsonl     past wont-fix / FP decisions
+//   3. .agentic-security/scan-history/*.json     prior scans
+//   4. .agentic-security/AGENTS.md               continual-learning narrative
+//
+// Naive keyword matching for v1. Each match has a `score` (count of query
+// terms matched) and a `source` ('finding' | 'triage' | 'history' |
+// 'agents-md'). Returns top-10 by score.
+
+
+
+
+
+
+function _read(scanRoot, name) {
+  try { return node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync((0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.statePath)(scanRoot, name), 'utf8'); } catch { return null; }
+}
+
+function _readJson(scanRoot, name) {
+  const raw = _read(scanRoot, name);
+  if (!raw) return null;
+  try { return JSON.parse(raw); } catch { return null; }
+}
+
+function _terms(query) {
+  return String(query || '').toLowerCase().split(/\s+/).filter(t => t.length >= 2);
+}
+
+function _score(haystack, terms) {
+  const lower = String(haystack || '').toLowerCase();
+  let s = 0;
+  for (const t of terms) if (lower.includes(t)) s++;
+  return s;
+}
+
+function _findingHaystack(f) {
+  return [f.vuln, f.family, f.file, f.severity, f.description, f.cwe, f.id]
+    .filter(Boolean).join(' | ');
+}
+
+function _truncate(s, n = 160) {
+  return String(s || '').replace(/\s+/g, ' ').slice(0, n);
+}
+
+/**
+ * Run a natural-language query over the scanner's accumulated memory.
+ */
+function queryFindingsMemory(scanRoot, query) {
+  const terms = _terms(query);
+  if (!terms.length) return { results: [], count: 0 };
+
+  const results = [];
+
+  // 1. Current findings.
+  const scan = _readJson(scanRoot, 'last-scan.json');
+  if (scan && Array.isArray(scan.findings)) {
+    for (const f of scan.findings) {
+      const hay = _findingHaystack(f);
+      const score = _score(hay, terms);
+      if (!score) continue;
+      results.push({
+        source: 'finding',
+        score,
+        finding_id: f.id || null,
+        severity: f.severity,
+        family: f.family,
+        file: f.file,
+        line: f.line,
+        snippet: _truncate(f.vuln || f.description || f.family),
+      });
+    }
+  }
+
+  // 2. Triage memory (past decisions).
+  const triageRaw = _read(scanRoot, 'triage-memory.jsonl');
+  if (triageRaw) {
+    const lines = triageRaw.split('\n').filter(Boolean);
+    for (const ln of lines) {
+      let entry; try { entry = JSON.parse(ln); } catch { continue; }
+      const hay = [entry.decision, entry.reason, entry.family, entry.vuln, entry.file].join(' ');
+      const score = _score(hay, terms);
+      if (!score) continue;
+      results.push({
+        source: 'triage',
+        score,
+        decision: entry.decision,
+        at: entry.at,
+        family: entry.family,
+        snippet: _truncate(entry.reason || entry.vuln),
+        bucket: entry.bucket,
+      });
+    }
+  }
+
+  // 3. Scan history.
+  try {
+    const histDir = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.statePath)(scanRoot, 'scan-history');
+    if (node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(histDir)) {
+      const files = node_fs__WEBPACK_IMPORTED_MODULE_0__.readdirSync(histDir).filter(f => f.endsWith('.json')).slice(-10);
+      for (const f of files) {
+        try {
+          const hist = JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(node_path__WEBPACK_IMPORTED_MODULE_1__.join(histDir, f), 'utf8'));
+          if (!Array.isArray(hist.findings)) continue;
+          for (const x of hist.findings.slice(0, 50)) {
+            const hay = _findingHaystack(x);
+            const score = _score(hay, terms);
+            if (!score) continue;
+            results.push({
+              source: 'history',
+              score,
+              from: f.replace(/\.json$/, ''),
+              severity: x.severity,
+              family: x.family,
+              file: x.file,
+              snippet: _truncate(x.vuln || x.description),
+            });
+          }
+        } catch {}
+      }
+    }
+  } catch {}
+
+  // 4. AGENTS.md narrative.
+  const agents = _read(scanRoot, 'AGENTS.md');
+  if (agents) {
+    const sections = agents.split(/^##\s+/m);
+    for (const sec of sections) {
+      const score = _score(sec, terms);
+      if (!score) continue;
+      const title = sec.split('\n')[0] || '';
+      results.push({
+        source: 'agents-md',
+        score,
+        title: _truncate(title, 80),
+        snippet: _truncate(sec.replace(title, ''), 200),
+      });
+    }
+  }
+
+  // Top-10 by score, ties broken by source priority (finding > triage >
+  // history > agents-md so live data wins).
+  const PRI = { finding: 4, triage: 3, history: 2, 'agents-md': 1 };
+  results.sort((a, b) => (b.score - a.score) || (PRI[b.source] - PRI[a.source]));
+  return { results: results.slice(0, 10), count: results.length };
+}
+
+const _internals = { _terms, _score, _findingHaystack };
+
+
+/***/ })
+
+};

package/dist/2972.index.js

@@ -0,0 +1,87 @@
+export const id = 2972;
+export const ids = [2972];
+export const modules = {
+
+/***/ 72972:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   checkSecretLive: () => (/* binding */ checkSecretLive)
+/* harmony export */ });
+/* unused harmony export _internal */
+// Live-secret validation (#22) — label a detected secret live | dead | unknown.
+//
+// "This Stripe/GitHub key is LIVE and was committed 40 commits ago" is a P0 the
+// vibecoder must rotate now; "you have a high-entropy string" is noise. This
+// closes that gap for the providers with a cheap, read-only "whoami" check.
+//
+// STRICTLY opt-in (a --validate-secrets flag / AGENTIC_SECURITY_VALIDATE_SECRETS)
+// and OFFLINE-DEGRADING: any network error, timeout, or unrecognized provider
+// yields 'unknown' — never a false 'dead'. No runtime cloud calls by default,
+// per the scanner's no-network-by-default convention. The request builder is
+// pure (no I/O) so it's testable without hitting a provider.
+
+// Map a detected secret to a read-only validation request, or null when we have
+// no safe check for that provider. Only providers whose token is a self-
+// contained bearer/token credential (no signing, no extra params) are covered.
+function buildLiveCheckRequest(secret) {
+  const val = (secret && (secret.match || secret.value || secret.secret || secret.token)) || '';
+  if (typeof val !== 'string' || val.length < 8) return null;
+
+  // GitHub PAT / OAuth token → GET /user (200 = live, 401 = dead).
+  if (/^gh[posru]_[A-Za-z0-9]{20,}$/.test(val) || /^github_pat_[A-Za-z0-9_]{20,}$/.test(val)) {
+    return { provider: 'github', method: 'GET', url: 'https://api.github.com/user',
+      headers: { Authorization: `token ${val}`, 'User-Agent': 'agentic-security', Accept: 'application/vnd.github+json' } };
+  }
+  // Stripe secret key → GET /v1/account (200 = live, 401 = dead).
+  if (/^sk_live_[A-Za-z0-9]{16,}$/.test(val) || /^rk_live_[A-Za-z0-9]{16,}$/.test(val)) {
+    return { provider: 'stripe', method: 'GET', url: 'https://api.stripe.com/v1/account',
+      headers: { Authorization: `Bearer ${val}` } };
+  }
+  // OpenAI key → GET /v1/models.
+  if (/^sk-[A-Za-z0-9]{20,}$/.test(val) && !/^sk_live_/.test(val)) {
+    return { provider: 'openai', method: 'GET', url: 'https://api.openai.com/v1/models',
+      headers: { Authorization: `Bearer ${val}` } };
+  }
+  // SendGrid key → GET /v3/scopes.
+  if (/^SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}$/.test(val)) {
+    return { provider: 'sendgrid', method: 'GET', url: 'https://api.sendgrid.com/v3/scopes',
+      headers: { Authorization: `Bearer ${val}` } };
+  }
+  return null;
+}
+
+// Classify an HTTP status into a liveness verdict. 200-2xx = live; 401/403 =
+// dead (rejected credential); anything else = unknown (rate-limit, 5xx, etc. —
+// we don't know, so don't claim dead).
+function classifyStatus(status) {
+  if (status >= 200 && status < 300) return 'live';
+  if (status === 401 || status === 403) return 'dead';
+  return 'unknown';
+}
+
+// Perform the validation. Returns { verdict: 'live'|'dead'|'unknown', provider }.
+// Offline-degrading: on any error/timeout, verdict is 'unknown'.
+async function checkSecretLive(secret, { timeoutMs = 4000 } = {}) {
+  const req = buildLiveCheckRequest(secret);
+  if (!req) return { verdict: 'unknown', provider: null };
+  const ctrl = new AbortController();
+  const t = setTimeout(() => ctrl.abort(), timeoutMs);
+  try {
+    const r = await fetch(req.url, { method: req.method, headers: req.headers, signal: ctrl.signal });
+    return { verdict: classifyStatus(r.status), provider: req.provider };
+  } catch {
+    return { verdict: 'unknown', provider: req.provider };
+  } finally {
+    clearTimeout(t);
+  }
+}
+
+// Pure surfaces exposed for tests (no network) — kept off the public API so the
+// dead-module guard doesn't flag them; `checkSecretLive` is the wired entry.
+const _internal = { buildLiveCheckRequest, classifyStatus };
+
+
+/***/ })
+
+};

package/dist/2991.index.js

@@ -0,0 +1,131 @@
+export const id = 2991;
+export const ids = [2991];
+export const modules = {
+
+/***/ 2991:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   diffScans: () => (/* binding */ diffScans),
+/* harmony export */   renderDiff: () => (/* binding */ renderDiff)
+/* harmony export */ });
+/* unused harmony export summarizeDiff */
+// Scan-result baseline comparison.
+//
+// Distinct from agentic-security-diff (which runs two SCANNER VERSIONS
+// against the same code). This module diffs TWO SCAN RESULTS, regardless
+// of scanner version — i.e., it compares findings between yesterday's
+// scan and today's scan to surface what was introduced / what was fixed.
+//
+// Keys per-finding on `stableId` when present (refactor-stable), else on
+// `(file, line, family)`. Output:
+//   {
+//     added:    [...],   // present in current, absent in previous
+//     removed:  [...],   // present in previous, absent in current
+//     changed:  [...],   // same key, different severity / verdict
+//     unchanged: <count>
+//   }
+
+function _keyOf(f) {
+  if (!f || typeof f !== 'object') return '';
+  if (f.stableId) return `sid:${f.stableId}`;
+  return `pos:${f.file || '?'}:${f.line || 0}:${f.family || f.vuln || '?'}`;
+}
+
+function _indexBy(findings, keyFn) {
+  const m = new Map();
+  if (!Array.isArray(findings)) return m;
+  for (const f of findings) {
+    const k = keyFn(f);
+    if (!k) continue;
+    if (!m.has(k)) m.set(k, f);
+  }
+  return m;
+}
+
+function diffScans(previous, current) {
+  const prevFindings = (previous && Array.isArray(previous.findings)) ? previous.findings : [];
+  const currFindings = (current && Array.isArray(current.findings)) ? current.findings : [];
+  const prevIdx = _indexBy(prevFindings, _keyOf);
+  const currIdx = _indexBy(currFindings, _keyOf);
+
+  const added = [], removed = [], changed = [];
+  let unchanged = 0;
+  for (const [k, c] of currIdx) {
+    const p = prevIdx.get(k);
+    if (!p) { added.push(c); continue; }
+    const sevChanged = p.severity !== c.severity;
+    const verdictChanged = p.mitigationVerdict !== c.mitigationVerdict;
+    const validatorChanged = p.validator_verdict !== c.validator_verdict;
+    if (sevChanged || verdictChanged || validatorChanged) {
+      changed.push({ before: p, after: c, fields: {
+        severity: sevChanged ? [p.severity, c.severity] : null,
+        mitigationVerdict: verdictChanged ? [p.mitigationVerdict, c.mitigationVerdict] : null,
+        validator_verdict: validatorChanged ? [p.validator_verdict, c.validator_verdict] : null,
+      }});
+    } else {
+      unchanged++;
+    }
+  }
+  for (const [k, p] of prevIdx) {
+    if (!currIdx.has(k)) removed.push(p);
+  }
+  return { added, removed, changed, unchanged };
+}
+
+function summarizeDiff(diff) {
+  const bySev = { critical: { added: 0, removed: 0 }, high: { added: 0, removed: 0 }, medium: { added: 0, removed: 0 }, low: { added: 0, removed: 0 } };
+  for (const f of diff.added)   if (bySev[f.severity]) bySev[f.severity].added++;
+  for (const f of diff.removed) if (bySev[f.severity]) bySev[f.severity].removed++;
+  return {
+    addedCount: diff.added.length,
+    removedCount: diff.removed.length,
+    changedCount: diff.changed.length,
+    unchangedCount: diff.unchanged,
+    bySeverity: bySev,
+  };
+}
+
+function renderDiff(diff, opts = {}) {
+  const color = opts.color !== false;
+  const C = color ? { RED: '\x1b[31m', GREEN: '\x1b[32m', YELLOW: '\x1b[33m', DIM: '\x1b[2m', BOLD: '\x1b[1m', RESET: '\x1b[0m' } : { RED:'', GREEN:'', YELLOW:'', DIM:'', BOLD:'', RESET:'' };
+  const sum = summarizeDiff(diff);
+  const out = [];
+  out.push('');
+  out.push(`${C.BOLD}Scan-result diff${C.RESET}`);
+  out.push(`  ${C.RED}+${sum.addedCount} added${C.RESET}   ${C.GREEN}-${sum.removedCount} removed${C.RESET}   ${C.YELLOW}~${sum.changedCount} changed${C.RESET}   ${C.DIM}${sum.unchangedCount} unchanged${C.RESET}`);
+  out.push('');
+  if (diff.added.length) {
+    out.push(`${C.RED}${C.BOLD}Added (${diff.added.length})${C.RESET}`);
+    for (const f of diff.added.slice(0, 25)) {
+      out.push(`  ${C.RED}+${C.RESET} [${(f.severity || '').toUpperCase()}] ${(f.vuln || '').slice(0, 60)}  ${C.DIM}${f.file || '?'}:${f.line || 0}${C.RESET}`);
+    }
+    if (diff.added.length > 25) out.push(`  ${C.DIM}... and ${diff.added.length - 25} more${C.RESET}`);
+    out.push('');
+  }
+  if (diff.removed.length) {
+    out.push(`${C.GREEN}${C.BOLD}Removed (${diff.removed.length})${C.RESET}`);
+    for (const f of diff.removed.slice(0, 25)) {
+      out.push(`  ${C.GREEN}-${C.RESET} [${(f.severity || '').toUpperCase()}] ${(f.vuln || '').slice(0, 60)}  ${C.DIM}${f.file || '?'}:${f.line || 0}${C.RESET}`);
+    }
+    if (diff.removed.length > 25) out.push(`  ${C.DIM}... and ${diff.removed.length - 25} more${C.RESET}`);
+    out.push('');
+  }
+  if (diff.changed.length) {
+    out.push(`${C.YELLOW}${C.BOLD}Changed (${diff.changed.length})${C.RESET}`);
+    for (const c of diff.changed.slice(0, 15)) {
+      const sevDelta = c.fields.severity ? `${c.fields.severity[0]} → ${c.fields.severity[1]}` : '';
+      const verdictDelta = c.fields.mitigationVerdict ? `verdict ${c.fields.mitigationVerdict[0]} → ${c.fields.mitigationVerdict[1]}` : '';
+      const validatorDelta = c.fields.validator_verdict ? `validator ${c.fields.validator_verdict[0]} → ${c.fields.validator_verdict[1]}` : '';
+      const delta = [sevDelta, verdictDelta, validatorDelta].filter(Boolean).join('; ');
+      out.push(`  ${C.YELLOW}~${C.RESET} ${(c.after.vuln || '').slice(0, 50)}  ${C.DIM}${c.after.file || '?'}:${c.after.line || 0}${C.RESET}   ${delta}`);
+    }
+    out.push('');
+  }
+  return out.join('\n');
+}
+
+
+/***/ })
+
+};