@clear-capabilities/agentic-security-scanner 0.185.0 → 0.186.2

package/dist/2773.index.js

@@ -1,98 +0,0 @@
-export const id = 2773;
-export const ids = [2773];
-export const modules = {
-
-/***/ 2773:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   persistLanguageArtifacts: () => (/* binding */ persistLanguageArtifacts)
-/* harmony export */ });
-/* unused harmony exports LANGUAGE_ANALYSIS_FILE, LANGUAGE_BOM_FILE, LANGUAGE_ARTIFACT_SCHEMA, hasLanguageContent, buildLanguageArtifacts */
-/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
-/* harmony import */ var _posture_state_dir_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(69259);
-/* harmony import */ var _posture_integrity_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(37455);
-/* harmony import */ var _context_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(70634);
-// Haskell and Nix analysis metadata as registered state artifacts (X-016).
-//
-// An ordinary scan already leaves last-scan.json. Two things a reviewer, auditor or retention policy needs about the
-// Haskell/Nix side were not artifacts of their own: WHAT analysed the sources (parser/resolver outcomes, capability
-// status, limitations, optional modes) and WHICH components the language BOM recorded. They are written beside
-// last-scan.json as `language-analysis.json` and `language-bom.json`, each with a detached signature, registered in
-// posture/artifact-registry.js (so export, retention, legal hold and `reset` all see them), and described by a record
-// that carries sha256 digests of every input and of the artifact bodies. No source text is ever written: paths and
-// digests only, so the file is metadata, not a copy of customer code.
-
-
-
-
-
-
-const LANGUAGE_ANALYSIS_FILE = 'language-analysis.json';
-const LANGUAGE_BOM_FILE = 'language-bom.json';
-const LANGUAGE_ARTIFACT_SCHEMA = 'agentic-security/language-analysis@1';
-
-const sha256 = (s) => node_crypto__WEBPACK_IMPORTED_MODULE_0__.createHash('sha256').update(s).digest('hex');
-function canonical(v) {
-  if (Array.isArray(v)) return `[${v.map(canonical).join(',')}]`;
-  if (v && typeof v === 'object') return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${canonical(v[k])}`).join(',')}}`;
-  return JSON.stringify(v === undefined ? null : v);
-}
-
-/** True when the scan has anything Haskell/Nix to record. */
-function hasLanguageContent(scan) {
-  const lc = scan && scan.scanHealth && scan.scanHealth.languageCoverage;
-  const files = lc && lc.totals && Number(lc.totals.files || lc.totals.analyzed || 0);
-  return !!((lc && (files > 0 || (lc.capabilities && Object.keys(lc.capabilities).length))) || (scan && scan.languageBom && (scan.languageBom.components || []).length));
-}
-
-/**
- * The analysis record for `scan`, plus the BOM body. `inputs` is [{path, sha256}] over the Haskell/Nix sources and
- * manifests (digests only). Pure: no I/O.
- */
-function buildLanguageArtifacts(scan, inputs = []) {
-  const lc = (scan && scan.scanHealth && scan.scanHealth.languageCoverage) || null;
-  const bom = (scan && scan.languageBom) || null;
-  const bridges = (scan && scan.languageBridges) || null;
-  const bomBody = bom ? JSON.stringify(bom, null, 2) : null;
-  const record = {
-    schema: LANGUAGE_ARTIFACT_SCHEMA,
-    classification: { class: 'scan-metadata', containsSourceText: false, containsSecrets: false },
-    inputs: inputs.map((i) => ({ path: String(i.path), sha256: String(i.sha256) })).sort((a, b) => (a.path < b.path ? -1 : 1)),
-    analysis: lc ? { totals: lc.totals, byKind: lc.byKind, conditions: lc.conditions, limitations: lc.limitations, capabilities: lc.capabilities, optionalModes: lc.optionalModes } : null,
-    bom: bom ? { file: LANGUAGE_BOM_FILE, sha256: sha256(bomBody), components: (bom.components || []).length } : null,
-    bridges: bridges ? { sha256: sha256(canonical(bridges)) } : null,
-  };
-  return { record, bomBody };
-}
-
-/**
- * Writes the artifacts under the project's state directory, each with a `.sig`. Returns {written:[{name, sha256}], skipped}.
- * Never throws and never blocks a scan; a project that disallows state writes gets `skipped: 'state-writes-disabled'`.
- */
-function persistLanguageArtifacts(root, scan) {
-  if (!hasLanguageContent(scan)) return { written: [], skipped: 'no-language-content' };
-  let inputs = [];
-  try {
-    const proj = (0,_context_js__WEBPACK_IMPORTED_MODULE_3__.loadLanguageProject)(root);
-    inputs = [...Object.entries(proj.files), ...Object.entries(proj.manifests)].map(([path, text]) => ({ path, sha256: sha256(text) }));
-  } catch { /* the record then says it has no input digests */ }
-  const { record, bomBody } = buildLanguageArtifacts(scan, inputs);
-  const out = [];
-  const put = (name, body) => {
-    const fp = (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_1__.statePath)(root, name);
-    if (!(0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_1__.safeWriteState)(fp, body)) return false;
-    try { (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_1__.safeWriteState)(`${fp}.sig`, (0,_posture_integrity_js__WEBPACK_IMPORTED_MODULE_2__/* .signLastScan */ .lU)(body)); } catch { /* the signature is best effort, as for last-scan.json */ }
-    out.push({ name, sha256: sha256(body) });
-    return true;
-  };
-  const body = JSON.stringify(record, null, 2);
-  if (!put(LANGUAGE_ANALYSIS_FILE, body)) return { written: [], skipped: 'state-writes-disabled' };
-  if (bomBody) put(LANGUAGE_BOM_FILE, bomBody);
-  return { written: out, skipped: null };
-}
-
-
-/***/ })
-
-};

package/dist/2775.index.js

@@ -1,32 +0,0 @@
-export const id = 2775;
-export const ids = [2775];
-export const modules = {
-
-/***/ 72775:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   correlateImageVulnerabilities: () => (/* binding */ correlateImageVulnerabilities)
-/* harmony export */ });
-// PRD 5 P0 §4 — Container Vulnerability Analysis. "Reuse current SCA
-// semantics where technically valid": this module does nothing but hand an
-// image's OS + application package inventory to the engine's existing
-// OSV/KEV/EPSS query path (`queryOSV`, imported via `src/sca/index.js`),
-// exactly as every other SCA finding in this codebase gets its CVE data.
-// `queryOSVFn` is injected (not imported directly) so this module's own
-// tests never make a real network call and stay independent of engine.js's
-// load cost; the CLI wiring passes the real `queryOSV`.
-async function correlateImageVulnerabilities({ inventory, fileContents, queryOSVFn }) {
-  if (typeof queryOSVFn !== 'function') throw new TypeError('correlateImageVulnerabilities requires queryOSVFn(components, allFileContents)');
-  if (!inventory || !Array.isArray(inventory.osPackages) || !Array.isArray(inventory.appPackages)) {
-    throw new TypeError('correlateImageVulnerabilities requires an inventory with osPackages/appPackages arrays');
-  }
-  const components = [...inventory.osPackages, ...inventory.appPackages];
-  const vulnerabilities = await queryOSVFn(components, fileContents || {});
-  return { components, vulnerabilities };
-}
-
-
-/***/ })
-
-};

package/dist/2966.index.js

@@ -1,171 +0,0 @@
-export const id = 2966;
-export const ids = [2966];
-export const modules = {
-
-/***/ 72966:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   queryFindingsMemory: () => (/* binding */ queryFindingsMemory)
-/* harmony export */ });
-/* unused harmony export _internals */
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
-/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(69259);
-// Findings memory — natural-language Q&A over the institutional knowledge
-// the scanner has accumulated. Backs the MCP query_findings_memory tool.
-//
-// Sources searched, in this order:
-//
-//   1. .agentic-security/last-scan.json          current findings
-//   2. .agentic-security/triage-memory.jsonl     past wont-fix / FP decisions
-//   3. .agentic-security/scan-history/*.json     prior scans
-//   4. .agentic-security/AGENTS.md               continual-learning narrative
-//
-// Naive keyword matching for v1. Each match has a `score` (count of query
-// terms matched) and a `source` ('finding' | 'triage' | 'history' |
-// 'agents-md'). Returns top-10 by score.
-
-
-
-
-
-
-function _read(scanRoot, name) {
-  try { return node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync((0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.statePath)(scanRoot, name), 'utf8'); } catch { return null; }
-}
-
-function _readJson(scanRoot, name) {
-  const raw = _read(scanRoot, name);
-  if (!raw) return null;
-  try { return JSON.parse(raw); } catch { return null; }
-}
-
-function _terms(query) {
-  return String(query || '').toLowerCase().split(/\s+/).filter(t => t.length >= 2);
-}
-
-function _score(haystack, terms) {
-  const lower = String(haystack || '').toLowerCase();
-  let s = 0;
-  for (const t of terms) if (lower.includes(t)) s++;
-  return s;
-}
-
-function _findingHaystack(f) {
-  return [f.vuln, f.family, f.file, f.severity, f.description, f.cwe, f.id]
-    .filter(Boolean).join(' | ');
-}
-
-function _truncate(s, n = 160) {
-  return String(s || '').replace(/\s+/g, ' ').slice(0, n);
-}
-
-/**
- * Run a natural-language query over the scanner's accumulated memory.
- */
-function queryFindingsMemory(scanRoot, query) {
-  const terms = _terms(query);
-  if (!terms.length) return { results: [], count: 0 };
-
-  const results = [];
-
-  // 1. Current findings.
-  const scan = _readJson(scanRoot, 'last-scan.json');
-  if (scan && Array.isArray(scan.findings)) {
-    for (const f of scan.findings) {
-      const hay = _findingHaystack(f);
-      const score = _score(hay, terms);
-      if (!score) continue;
-      results.push({
-        source: 'finding',
-        score,
-        finding_id: f.id || null,
-        severity: f.severity,
-        family: f.family,
-        file: f.file,
-        line: f.line,
-        snippet: _truncate(f.vuln || f.description || f.family),
-      });
-    }
-  }
-
-  // 2. Triage memory (past decisions).
-  const triageRaw = _read(scanRoot, 'triage-memory.jsonl');
-  if (triageRaw) {
-    const lines = triageRaw.split('\n').filter(Boolean);
-    for (const ln of lines) {
-      let entry; try { entry = JSON.parse(ln); } catch { continue; }
-      const hay = [entry.decision, entry.reason, entry.family, entry.vuln, entry.file].join(' ');
-      const score = _score(hay, terms);
-      if (!score) continue;
-      results.push({
-        source: 'triage',
-        score,
-        decision: entry.decision,
-        at: entry.at,
-        family: entry.family,
-        snippet: _truncate(entry.reason || entry.vuln),
-        bucket: entry.bucket,
-      });
-    }
-  }
-
-  // 3. Scan history.
-  try {
-    const histDir = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.statePath)(scanRoot, 'scan-history');
-    if (node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(histDir)) {
-      const files = node_fs__WEBPACK_IMPORTED_MODULE_0__.readdirSync(histDir).filter(f => f.endsWith('.json')).slice(-10);
-      for (const f of files) {
-        try {
-          const hist = JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(node_path__WEBPACK_IMPORTED_MODULE_1__.join(histDir, f), 'utf8'));
-          if (!Array.isArray(hist.findings)) continue;
-          for (const x of hist.findings.slice(0, 50)) {
-            const hay = _findingHaystack(x);
-            const score = _score(hay, terms);
-            if (!score) continue;
-            results.push({
-              source: 'history',
-              score,
-              from: f.replace(/\.json$/, ''),
-              severity: x.severity,
-              family: x.family,
-              file: x.file,
-              snippet: _truncate(x.vuln || x.description),
-            });
-          }
-        } catch {}
-      }
-    }
-  } catch {}
-
-  // 4. AGENTS.md narrative.
-  const agents = _read(scanRoot, 'AGENTS.md');
-  if (agents) {
-    const sections = agents.split(/^##\s+/m);
-    for (const sec of sections) {
-      const score = _score(sec, terms);
-      if (!score) continue;
-      const title = sec.split('\n')[0] || '';
-      results.push({
-        source: 'agents-md',
-        score,
-        title: _truncate(title, 80),
-        snippet: _truncate(sec.replace(title, ''), 200),
-      });
-    }
-  }
-
-  // Top-10 by score, ties broken by source priority (finding > triage >
-  // history > agents-md so live data wins).
-  const PRI = { finding: 4, triage: 3, history: 2, 'agents-md': 1 };
-  results.sort((a, b) => (b.score - a.score) || (PRI[b.source] - PRI[a.source]));
-  return { results: results.slice(0, 10), count: results.length };
-}
-
-const _internals = { _terms, _score, _findingHaystack };
-
-
-/***/ })
-
-};

package/dist/2972.index.js

@@ -1,87 +0,0 @@
-export const id = 2972;
-export const ids = [2972];
-export const modules = {
-
-/***/ 72972:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   checkSecretLive: () => (/* binding */ checkSecretLive)
-/* harmony export */ });
-/* unused harmony export _internal */
-// Live-secret validation (#22) — label a detected secret live | dead | unknown.
-//
-// "This Stripe/GitHub key is LIVE and was committed 40 commits ago" is a P0 the
-// vibecoder must rotate now; "you have a high-entropy string" is noise. This
-// closes that gap for the providers with a cheap, read-only "whoami" check.
-//
-// STRICTLY opt-in (a --validate-secrets flag / AGENTIC_SECURITY_VALIDATE_SECRETS)
-// and OFFLINE-DEGRADING: any network error, timeout, or unrecognized provider
-// yields 'unknown' — never a false 'dead'. No runtime cloud calls by default,
-// per the scanner's no-network-by-default convention. The request builder is
-// pure (no I/O) so it's testable without hitting a provider.
-
-// Map a detected secret to a read-only validation request, or null when we have
-// no safe check for that provider. Only providers whose token is a self-
-// contained bearer/token credential (no signing, no extra params) are covered.
-function buildLiveCheckRequest(secret) {
-  const val = (secret && (secret.match || secret.value || secret.secret || secret.token)) || '';
-  if (typeof val !== 'string' || val.length < 8) return null;
-
-  // GitHub PAT / OAuth token → GET /user (200 = live, 401 = dead).
-  if (/^gh[posru]_[A-Za-z0-9]{20,}$/.test(val) || /^github_pat_[A-Za-z0-9_]{20,}$/.test(val)) {
-    return { provider: 'github', method: 'GET', url: 'https://api.github.com/user',
-      headers: { Authorization: `token ${val}`, 'User-Agent': 'agentic-security', Accept: 'application/vnd.github+json' } };
-  }
-  // Stripe secret key → GET /v1/account (200 = live, 401 = dead).
-  if (/^sk_live_[A-Za-z0-9]{16,}$/.test(val) || /^rk_live_[A-Za-z0-9]{16,}$/.test(val)) {
-    return { provider: 'stripe', method: 'GET', url: 'https://api.stripe.com/v1/account',
-      headers: { Authorization: `Bearer ${val}` } };
-  }
-  // OpenAI key → GET /v1/models.
-  if (/^sk-[A-Za-z0-9]{20,}$/.test(val) && !/^sk_live_/.test(val)) {
-    return { provider: 'openai', method: 'GET', url: 'https://api.openai.com/v1/models',
-      headers: { Authorization: `Bearer ${val}` } };
-  }
-  // SendGrid key → GET /v3/scopes.
-  if (/^SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}$/.test(val)) {
-    return { provider: 'sendgrid', method: 'GET', url: 'https://api.sendgrid.com/v3/scopes',
-      headers: { Authorization: `Bearer ${val}` } };
-  }
-  return null;
-}
-
-// Classify an HTTP status into a liveness verdict. 200-2xx = live; 401/403 =
-// dead (rejected credential); anything else = unknown (rate-limit, 5xx, etc. —
-// we don't know, so don't claim dead).
-function classifyStatus(status) {
-  if (status >= 200 && status < 300) return 'live';
-  if (status === 401 || status === 403) return 'dead';
-  return 'unknown';
-}
-
-// Perform the validation. Returns { verdict: 'live'|'dead'|'unknown', provider }.
-// Offline-degrading: on any error/timeout, verdict is 'unknown'.
-async function checkSecretLive(secret, { timeoutMs = 4000 } = {}) {
-  const req = buildLiveCheckRequest(secret);
-  if (!req) return { verdict: 'unknown', provider: null };
-  const ctrl = new AbortController();
-  const t = setTimeout(() => ctrl.abort(), timeoutMs);
-  try {
-    const r = await fetch(req.url, { method: req.method, headers: req.headers, signal: ctrl.signal });
-    return { verdict: classifyStatus(r.status), provider: req.provider };
-  } catch {
-    return { verdict: 'unknown', provider: req.provider };
-  } finally {
-    clearTimeout(t);
-  }
-}
-
-// Pure surfaces exposed for tests (no network) — kept off the public API so the
-// dead-module guard doesn't flag them; `checkSecretLive` is the wired entry.
-const _internal = { buildLiveCheckRequest, classifyStatus };
-
-
-/***/ })
-
-};

package/dist/2991.index.js

@@ -1,131 +0,0 @@
-export const id = 2991;
-export const ids = [2991];
-export const modules = {
-
-/***/ 2991:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   diffScans: () => (/* binding */ diffScans),
-/* harmony export */   renderDiff: () => (/* binding */ renderDiff)
-/* harmony export */ });
-/* unused harmony export summarizeDiff */
-// Scan-result baseline comparison.
-//
-// Distinct from agentic-security-diff (which runs two SCANNER VERSIONS
-// against the same code). This module diffs TWO SCAN RESULTS, regardless
-// of scanner version — i.e., it compares findings between yesterday's
-// scan and today's scan to surface what was introduced / what was fixed.
-//
-// Keys per-finding on `stableId` when present (refactor-stable), else on
-// `(file, line, family)`. Output:
-//   {
-//     added:    [...],   // present in current, absent in previous
-//     removed:  [...],   // present in previous, absent in current
-//     changed:  [...],   // same key, different severity / verdict
-//     unchanged: <count>
-//   }
-
-function _keyOf(f) {
-  if (!f || typeof f !== 'object') return '';
-  if (f.stableId) return `sid:${f.stableId}`;
-  return `pos:${f.file || '?'}:${f.line || 0}:${f.family || f.vuln || '?'}`;
-}
-
-function _indexBy(findings, keyFn) {
-  const m = new Map();
-  if (!Array.isArray(findings)) return m;
-  for (const f of findings) {
-    const k = keyFn(f);
-    if (!k) continue;
-    if (!m.has(k)) m.set(k, f);
-  }
-  return m;
-}
-
-function diffScans(previous, current) {
-  const prevFindings = (previous && Array.isArray(previous.findings)) ? previous.findings : [];
-  const currFindings = (current && Array.isArray(current.findings)) ? current.findings : [];
-  const prevIdx = _indexBy(prevFindings, _keyOf);
-  const currIdx = _indexBy(currFindings, _keyOf);
-
-  const added = [], removed = [], changed = [];
-  let unchanged = 0;
-  for (const [k, c] of currIdx) {
-    const p = prevIdx.get(k);
-    if (!p) { added.push(c); continue; }
-    const sevChanged = p.severity !== c.severity;
-    const verdictChanged = p.mitigationVerdict !== c.mitigationVerdict;
-    const validatorChanged = p.validator_verdict !== c.validator_verdict;
-    if (sevChanged || verdictChanged || validatorChanged) {
-      changed.push({ before: p, after: c, fields: {
-        severity: sevChanged ? [p.severity, c.severity] : null,
-        mitigationVerdict: verdictChanged ? [p.mitigationVerdict, c.mitigationVerdict] : null,
-        validator_verdict: validatorChanged ? [p.validator_verdict, c.validator_verdict] : null,
-      }});
-    } else {
-      unchanged++;
-    }
-  }
-  for (const [k, p] of prevIdx) {
-    if (!currIdx.has(k)) removed.push(p);
-  }
-  return { added, removed, changed, unchanged };
-}
-
-function summarizeDiff(diff) {
-  const bySev = { critical: { added: 0, removed: 0 }, high: { added: 0, removed: 0 }, medium: { added: 0, removed: 0 }, low: { added: 0, removed: 0 } };
-  for (const f of diff.added)   if (bySev[f.severity]) bySev[f.severity].added++;
-  for (const f of diff.removed) if (bySev[f.severity]) bySev[f.severity].removed++;
-  return {
-    addedCount: diff.added.length,
-    removedCount: diff.removed.length,
-    changedCount: diff.changed.length,
-    unchangedCount: diff.unchanged,
-    bySeverity: bySev,
-  };
-}
-
-function renderDiff(diff, opts = {}) {
-  const color = opts.color !== false;
-  const C = color ? { RED: '\x1b[31m', GREEN: '\x1b[32m', YELLOW: '\x1b[33m', DIM: '\x1b[2m', BOLD: '\x1b[1m', RESET: '\x1b[0m' } : { RED:'', GREEN:'', YELLOW:'', DIM:'', BOLD:'', RESET:'' };
-  const sum = summarizeDiff(diff);
-  const out = [];
-  out.push('');
-  out.push(`${C.BOLD}Scan-result diff${C.RESET}`);
-  out.push(`  ${C.RED}+${sum.addedCount} added${C.RESET}   ${C.GREEN}-${sum.removedCount} removed${C.RESET}   ${C.YELLOW}~${sum.changedCount} changed${C.RESET}   ${C.DIM}${sum.unchangedCount} unchanged${C.RESET}`);
-  out.push('');
-  if (diff.added.length) {
-    out.push(`${C.RED}${C.BOLD}Added (${diff.added.length})${C.RESET}`);
-    for (const f of diff.added.slice(0, 25)) {
-      out.push(`  ${C.RED}+${C.RESET} [${(f.severity || '').toUpperCase()}] ${(f.vuln || '').slice(0, 60)}  ${C.DIM}${f.file || '?'}:${f.line || 0}${C.RESET}`);
-    }
-    if (diff.added.length > 25) out.push(`  ${C.DIM}... and ${diff.added.length - 25} more${C.RESET}`);
-    out.push('');
-  }
-  if (diff.removed.length) {
-    out.push(`${C.GREEN}${C.BOLD}Removed (${diff.removed.length})${C.RESET}`);
-    for (const f of diff.removed.slice(0, 25)) {
-      out.push(`  ${C.GREEN}-${C.RESET} [${(f.severity || '').toUpperCase()}] ${(f.vuln || '').slice(0, 60)}  ${C.DIM}${f.file || '?'}:${f.line || 0}${C.RESET}`);
-    }
-    if (diff.removed.length > 25) out.push(`  ${C.DIM}... and ${diff.removed.length - 25} more${C.RESET}`);
-    out.push('');
-  }
-  if (diff.changed.length) {
-    out.push(`${C.YELLOW}${C.BOLD}Changed (${diff.changed.length})${C.RESET}`);
-    for (const c of diff.changed.slice(0, 15)) {
-      const sevDelta = c.fields.severity ? `${c.fields.severity[0]} → ${c.fields.severity[1]}` : '';
-      const verdictDelta = c.fields.mitigationVerdict ? `verdict ${c.fields.mitigationVerdict[0]} → ${c.fields.mitigationVerdict[1]}` : '';
-      const validatorDelta = c.fields.validator_verdict ? `validator ${c.fields.validator_verdict[0]} → ${c.fields.validator_verdict[1]}` : '';
-      const delta = [sevDelta, verdictDelta, validatorDelta].filter(Boolean).join('; ');
-      out.push(`  ${C.YELLOW}~${C.RESET} ${(c.after.vuln || '').slice(0, 50)}  ${C.DIM}${c.after.file || '?'}:${c.after.line || 0}${C.RESET}   ${delta}`);
-    }
-    out.push('');
-  }
-  return out.join('\n');
-}
-
-
-/***/ })
-
-};