@darrenjcoxon/vibeguard 1.0.0

package/dist/scanners/npm-audit.js

@@ -0,0 +1,176 @@
+/**
+ * NPM Audit Scanner
+ *
+ * Dependency vulnerability scanning for JavaScript/Node.js projects
+ * Covers: dependency category
+ */
+import { exec } from 'child_process';
+import { promisify } from 'util';
+import { existsSync } from 'fs';
+import { join } from 'path';
+import { generateFingerprint } from '../types.js';
+const execAsync = promisify(exec);
+export class NpmAuditScanner {
+    name = 'npm-audit';
+    categories = ['dependency'];
+    async isAvailable() {
+        try {
+            const { stdout } = await execAsync('npm --version', { timeout: 5000 });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async scan(target, config) {
+        const startTime = Date.now();
+        // Check if this is a Node.js project
+        const packageJsonPath = join(target.path, 'package.json');
+        if (!existsSync(packageJsonPath)) {
+            return {
+                scanner: this.name,
+                success: true,
+                findings: [],
+                metrics: { duration: Date.now() - startTime },
+                metadata: { skipped: true, reason: 'No package.json found' }
+            };
+        }
+        if (!await this.isAvailable()) {
+            return {
+                scanner: this.name,
+                success: false,
+                error: 'npm not available',
+                findings: [],
+                metrics: { duration: Date.now() - startTime }
+            };
+        }
+        try {
+            const findings = await this.runNpmAudit(target);
+            return {
+                scanner: this.name,
+                success: true,
+                findings,
+                metrics: {
+                    duration: Date.now() - startTime
+                }
+            };
+        }
+        catch (error) {
+            return {
+                scanner: this.name,
+                success: false,
+                error: error instanceof Error ? error.message : String(error),
+                findings: [],
+                metrics: { duration: Date.now() - startTime }
+            };
+        }
+    }
+    async runNpmAudit(target) {
+        const cmd = `cd "${target.path}" && npm audit --json 2>/dev/null || true`;
+        try {
+            const { stdout } = await execAsync(cmd, {
+                timeout: 120000,
+                maxBuffer: 10 * 1024 * 1024
+            });
+            if (!stdout.trim()) {
+                return [];
+            }
+            const output = JSON.parse(stdout);
+            return this.transformFindings(output, target.path);
+        }
+        catch (error) {
+            // npm audit returns exit code 1 when vulnerabilities exist
+            if (error.stdout) {
+                try {
+                    const output = JSON.parse(error.stdout);
+                    return this.transformFindings(output, target.path);
+                }
+                catch {
+                    return [];
+                }
+            }
+            throw error;
+        }
+    }
+    transformFindings(output, basePath) {
+        const findings = [];
+        for (const [pkgName, vuln] of Object.entries(output.vulnerabilities || {})) {
+            // Get the most specific vulnerability info
+            const viaDetails = vuln.via.filter(v => typeof v === 'object')[0];
+            if (!viaDetails)
+                continue;
+            const severity = this.mapSeverity(vuln.severity);
+            const fixInfo = this.getFixInfo(vuln.fixAvailable);
+            const finding = {
+                id: `npm-${pkgName}-${viaDetails.source || Date.now()}`,
+                source: this.name,
+                severity,
+                category: 'dependency',
+                file: 'package.json',
+                title: `Vulnerable dependency: ${pkgName}`,
+                description: `${viaDetails.title || 'Security vulnerability'}\n\n` +
+                    `Package: ${pkgName}\n` +
+                    `Vulnerable versions: ${vuln.range}\n` +
+                    `Dependency path: ${vuln.isDirect ? 'Direct dependency' : 'Transitive dependency'}\n` +
+                    (viaDetails.url ? `\nMore info: ${viaDetails.url}` : ''),
+                cwe: viaDetails.cwe?.[0] ? `CWE-${viaDetails.cwe[0]}` : undefined,
+                cvss: viaDetails.cvss?.score,
+                suggestion: fixInfo.suggestion,
+                fixAvailable: fixInfo.available,
+                autoFixable: fixInfo.autoFixable,
+                ruleId: `npm-advisory-${viaDetails.source}`,
+                ruleUrl: viaDetails.url,
+                confidence: 'high',
+                effort: fixInfo.effort,
+                fingerprint: ''
+            };
+            finding.fingerprint = generateFingerprint(finding);
+            findings.push(finding);
+        }
+        return findings;
+    }
+    mapSeverity(npmSeverity) {
+        const mapping = {
+            'critical': 'critical',
+            'high': 'high',
+            'moderate': 'medium',
+            'low': 'low',
+            'info': 'info'
+        };
+        return mapping[npmSeverity.toLowerCase()] || 'medium';
+    }
+    getFixInfo(fixAvailable) {
+        if (fixAvailable === true) {
+            return {
+                available: true,
+                autoFixable: true,
+                suggestion: 'Run `npm audit fix` to automatically fix this vulnerability',
+                effort: 'trivial'
+            };
+        }
+        if (typeof fixAvailable === 'object' && fixAvailable !== null) {
+            if (fixAvailable.isSemVerMajor) {
+                return {
+                    available: true,
+                    autoFixable: false,
+                    suggestion: `Update to ${fixAvailable.name}@${fixAvailable.version} (breaking change - review required). Run \`npm audit fix --force\` with caution`,
+                    effort: 'medium'
+                };
+            }
+            return {
+                available: true,
+                autoFixable: true,
+                suggestion: `Update to ${fixAvailable.name}@${fixAvailable.version}. Run \`npm audit fix\``,
+                effort: 'easy'
+            };
+        }
+        return {
+            available: false,
+            autoFixable: false,
+            suggestion: 'No fix currently available. Consider using an alternative package or implementing mitigations',
+            effort: 'hard'
+        };
+    }
+}
+export default NpmAuditScanner;
+//# sourceMappingURL=npm-audit.js.map

package/dist/scanners/npm-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-audit.js","sourceRoot":"","sources":["../../src/scanners/npm-audit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAQL,mBAAmB,EACpB,MAAM,aAAa,CAAC;AAErB,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AAqDlC,MAAM,OAAO,eAAe;IAC1B,IAAI,GAAG,WAAW,CAAC;IACnB,UAAU,GAAsB,CAAC,YAAY,CAAC,CAAC;IAE/C,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACvE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAkB,EAAE,MAAsB;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,qCAAqC;QACrC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE;gBAC7C,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE;aAC7D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9B,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE;aAC9C,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAEhD,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,OAAO,EAAE,IAAI;gBACb,QAAQ;gBACR,OAAO,EAAE;oBACP,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACjC;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE;aAC9C,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,MAAkB;QAC1C,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,IAAI,2CAA2C,CAAC;QAE1E,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;gBACtC,OAAO,EAAE,MAAM;gBACf,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;aAC5B,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnB,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,MAAM,MAAM,GAAmB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAErD,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,2DAA2D;YAC3D,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAmB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACxD,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,MAAsB,EAAE,QAAgB;QAChE,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3E,2CAA2C;YAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAElE,IAAI,CAAC,UAAU;gBAAE,SAAS;YAE1B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAEnD,MAAM,OAAO,GAAY;gBACvB,EAAE,EAAE,OAAO,OAAO,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;gBACvD,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,QAAQ;gBACR,QAAQ,EAAE,YAAY;gBACtB,IAAI,EAAE,cAAc;gBACpB,KAAK,EAAE,0BAA0B,OAAO,EAAE;gBAC1C,WAAW,EAAE,GAAG,UAAU,CAAC,KAAK,IAAI,wBAAwB,MAAM;oBAChE,YAAY,OAAO,IAAI;oBACvB,wBAAwB,IAAI,CAAC,KAAK,IAAI;oBACtC,oBAAoB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,uBAAuB,IAAI;oBACrF,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;gBACjE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,YAAY,EAAE,OAAO,CAAC,SAAS;gBAC/B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,MAAM,EAAE,gBAAgB,UAAU,CAAC,MAAM,EAAE;gBAC3C,OAAO,EAAE,UAAU,CAAC,GAAG;gBACvB,UAAU,EAAE,MAAM;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,WAAW,EAAE,EAAE;aAChB,CAAC;YAEF,OAAO,CAAC,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACnD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,WAAW,CAAC,WAAmB;QACrC,MAAM,OAAO,GAAkC;YAC7C,UAAU,EAAE,UAAU;YACtB,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,QAAQ;YACpB,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,MAAM;SACf,CAAC;QACF,OAAO,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,IAAI,QAAQ,CAAC;IACxD,CAAC;IAEO,UAAU,CAAC,YAAmD;QAMpE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,6DAA6D;gBACzE,MAAM,EAAE,SAAS;aAClB,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC9D,IAAI,YAAY,CAAC,aAAa,EAAE,CAAC;gBAC/B,OAAO;oBACL,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE,KAAK;oBAClB,UAAU,EAAE,aAAa,YAAY,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,kFAAkF;oBACpJ,MAAM,EAAE,QAAQ;iBACjB,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,aAAa,YAAY,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,yBAAyB;gBAC3F,MAAM,EAAE,MAAM;aACf,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,WAAW,EAAE,KAAK;YAClB,UAAU,EAAE,+FAA+F;YAC3G,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;CACF;AAED,eAAe,eAAe,CAAC"}

package/dist/scanners/semgrep.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Semgrep Scanner
+ *
+ * Provides SAST scanning using Semgrep CLI with fallback to MCP
+ * Covers: security, quality, style categories
+ */
+import { Scanner, ScanTarget, ScannerConfig, ScannerResult, FindingCategory } from '../types.js';
+export declare class SemgrepScanner implements Scanner {
+    name: string;
+    categories: FindingCategory[];
+    private rulesets;
+    constructor(rulesets?: string[]);
+    isAvailable(): Promise<boolean>;
+    scan(target: ScanTarget, config?: ScannerConfig): Promise<ScannerResult>;
+    private runSemgrep;
+    private transformFindings;
+    private mapSeverity;
+    private mapCategory;
+    private mapConfidence;
+}
+export default SemgrepScanner;
+//# sourceMappingURL=semgrep.d.ts.map

package/dist/scanners/semgrep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep.d.ts","sourceRoot":"","sources":["../../src/scanners/semgrep.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EACL,OAAO,EACP,UAAU,EACV,aAAa,EACb,aAAa,EAEb,eAAe,EAGhB,MAAM,aAAa,CAAC;AAiCrB,qBAAa,cAAe,YAAW,OAAO;IAC5C,IAAI,SAAa;IACjB,UAAU,EAAE,eAAe,EAAE,CAAoC;IAEjE,OAAO,CAAC,QAAQ,CAAW;gBAEf,QAAQ,GAAE,MAAM,EAAa;IAYnC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAS/B,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;YAoChE,UAAU;IA0CxB,OAAO,CAAC,iBAAiB;IAkCzB,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,WAAW;IAiBnB,OAAO,CAAC,aAAa;CAQtB;AAED,eAAe,cAAc,CAAC"}

package/dist/scanners/semgrep.js

@@ -0,0 +1,175 @@
+/**
+ * Semgrep Scanner
+ *
+ * Provides SAST scanning using Semgrep CLI with fallback to MCP
+ * Covers: security, quality, style categories
+ */
+import { execSync, exec } from 'child_process';
+import { promisify } from 'util';
+import { generateFingerprint } from '../types.js';
+const execAsync = promisify(exec);
+export class SemgrepScanner {
+    name = 'semgrep';
+    categories = ['security', 'quality', 'style'];
+    rulesets;
+    constructor(rulesets = ['auto']) {
+        // Default rulesets for comprehensive scanning
+        this.rulesets = rulesets.length > 0 && rulesets[0] !== 'auto' ? rulesets : [
+            'p/security-audit', // Security vulnerabilities
+            'p/secrets', // Secret detection
+            'p/javascript', // JS best practices
+            'p/nodejs', // Node.js specific
+            'p/typescript', // TypeScript specific
+            'p/owasp-top-ten' // OWASP Top 10
+        ];
+    }
+    async isAvailable() {
+        try {
+            execSync('semgrep --version', { stdio: 'pipe' });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async scan(target, config) {
+        const startTime = Date.now();
+        if (!await this.isAvailable()) {
+            return {
+                scanner: this.name,
+                success: false,
+                error: 'Semgrep CLI not installed. Install with: pip install semgrep',
+                findings: [],
+                metrics: { duration: Date.now() - startTime }
+            };
+        }
+        try {
+            const findings = await this.runSemgrep(target);
+            return {
+                scanner: this.name,
+                success: true,
+                findings,
+                metrics: {
+                    duration: Date.now() - startTime,
+                    filesScanned: findings.length > 0 ? new Set(findings.map(f => f.file)).size : 0
+                }
+            };
+        }
+        catch (error) {
+            return {
+                scanner: this.name,
+                success: false,
+                error: error instanceof Error ? error.message : String(error),
+                findings: [],
+                metrics: { duration: Date.now() - startTime }
+            };
+        }
+    }
+    async runSemgrep(target) {
+        const configArgs = this.rulesets.map(r => `--config ${r}`).join(' ');
+        // Build exclude patterns
+        const defaultExcludes = [
+            'node_modules',
+            'vendor',
+            '.git',
+            'dist',
+            'build',
+            '__pycache__',
+            '*.min.js',
+            '*.bundle.js'
+        ];
+        const excludes = [...defaultExcludes, ...(target.exclude || [])];
+        const excludeArgs = excludes.map(e => `--exclude '${e}'`).join(' ');
+        const cmd = `semgrep ${configArgs} ${excludeArgs} --json --quiet ${target.path}`;
+        try {
+            const { stdout } = await execAsync(cmd, {
+                timeout: 300000, // 5 minutes
+                maxBuffer: 50 * 1024 * 1024 // 50MB buffer for large outputs
+            });
+            const output = JSON.parse(stdout);
+            return this.transformFindings(output.results);
+        }
+        catch (error) {
+            // Semgrep returns exit code 1 when findings exist
+            if (error.stdout) {
+                try {
+                    const output = JSON.parse(error.stdout);
+                    return this.transformFindings(output.results);
+                }
+                catch {
+                    throw new Error(`Failed to parse Semgrep output: ${error.message}`);
+                }
+            }
+            throw error;
+        }
+    }
+    transformFindings(semgrepFindings) {
+        return semgrepFindings.map(sf => {
+            const severity = this.mapSeverity(sf.extra.severity);
+            const category = this.mapCategory(sf.check_id, sf.extra.metadata);
+            const finding = {
+                id: `semgrep-${sf.check_id}-${sf.path}-${sf.start.line}`,
+                source: this.name,
+                severity,
+                category,
+                file: sf.path,
+                line: sf.start.line,
+                endLine: sf.end.line,
+                column: sf.start.col,
+                endColumn: sf.end.col,
+                title: sf.check_id.split('.').pop() || sf.check_id,
+                description: sf.extra.message,
+                snippet: sf.extra.lines,
+                cwe: sf.extra.metadata?.cwe?.[0],
+                owasp: sf.extra.metadata?.owasp?.[0],
+                suggestion: sf.extra.fix,
+                fixAvailable: !!sf.extra.fix,
+                autoFixable: !!sf.extra.fix,
+                ruleId: sf.check_id,
+                ruleUrl: sf.extra.metadata?.references?.[0],
+                confidence: this.mapConfidence(sf.extra.metadata?.confidence),
+                fingerprint: ''
+            };
+            finding.fingerprint = generateFingerprint(finding);
+            return finding;
+        });
+    }
+    mapSeverity(semgrepSeverity) {
+        const mapping = {
+            'ERROR': 'high',
+            'WARNING': 'medium',
+            'INFO': 'low'
+        };
+        return mapping[semgrepSeverity.toUpperCase()] || 'medium';
+    }
+    mapCategory(ruleId, metadata) {
+        // Check rule ID patterns
+        if (ruleId.includes('secret') || ruleId.includes('password') || ruleId.includes('key')) {
+            return 'secret';
+        }
+        if (ruleId.includes('security') || ruleId.includes('injection') || ruleId.includes('xss')) {
+            return 'security';
+        }
+        // Check metadata category
+        const cat = metadata?.category?.toLowerCase();
+        if (cat?.includes('security'))
+            return 'security';
+        if (cat?.includes('best-practice'))
+            return 'quality';
+        return 'security'; // Default for Semgrep
+    }
+    mapConfidence(confidence) {
+        if (!confidence)
+            return undefined;
+        const c = confidence.toLowerCase();
+        if (c === 'high')
+            return 'high';
+        if (c === 'medium')
+            return 'medium';
+        if (c === 'low')
+            return 'low';
+        return undefined;
+    }
+}
+export default SemgrepScanner;
+//# sourceMappingURL=semgrep.js.map

package/dist/scanners/semgrep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep.js","sourceRoot":"","sources":["../../src/scanners/semgrep.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,EAQL,mBAAmB,EACpB,MAAM,aAAa,CAAC;AAErB,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AA+BlC,MAAM,OAAO,cAAc;IACzB,IAAI,GAAG,SAAS,CAAC;IACjB,UAAU,GAAsB,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAEzD,QAAQ,CAAW;IAE3B,YAAY,WAAqB,CAAC,MAAM,CAAC;QACvC,8CAA8C;QAC9C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzE,kBAAkB,EAAO,2BAA2B;YACpD,WAAW,EAAc,mBAAmB;YAC5C,cAAc,EAAW,oBAAoB;YAC7C,UAAU,EAAe,mBAAmB;YAC5C,cAAc,EAAW,sBAAsB;YAC/C,iBAAiB,CAAQ,eAAe;SACzC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YACH,QAAQ,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAkB,EAAE,MAAsB;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9B,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,8DAA8D;gBACrE,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE;aAC9C,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAE/C,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,OAAO,EAAE,IAAI;gBACb,QAAQ;gBACR,OAAO,EAAE;oBACP,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAChC,YAAY,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;iBAChF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE;aAC9C,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAAkB;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAErE,yBAAyB;QACzB,MAAM,eAAe,GAAG;YACtB,cAAc;YACd,QAAQ;YACR,MAAM;YACN,MAAM;YACN,OAAO;YACP,aAAa;YACb,UAAU;YACV,aAAa;SACd,CAAC;QACF,MAAM,QAAQ,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEpE,MAAM,GAAG,GAAG,WAAW,UAAU,IAAI,WAAW,mBAAmB,MAAM,CAAC,IAAI,EAAE,CAAC;QAEjF,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;gBACtC,OAAO,EAAE,MAAM,EAAE,YAAY;gBAC7B,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,gCAAgC;aAC7D,CAAC,CAAC;YAEH,MAAM,MAAM,GAAkB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEhD,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,kDAAkD;YAClD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAkB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACvD,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChD,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,eAAiC;QACzD,OAAO,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAElE,MAAM,OAAO,GAAY;gBACvB,EAAE,EAAE,WAAW,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE;gBACxD,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,QAAQ;gBACR,QAAQ;gBACR,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI;gBACnB,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI;gBACpB,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG;gBACpB,SAAS,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG;gBACrB,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,QAAQ;gBAClD,WAAW,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO;gBAC7B,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK;gBACvB,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBAChC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;gBACpC,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG;gBACxB,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG;gBAC5B,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG;gBAC3B,MAAM,EAAE,EAAE,CAAC,QAAQ;gBACnB,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;gBAC3C,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;gBAC7D,WAAW,EAAE,EAAE;aAChB,CAAC;YAEF,OAAO,CAAC,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACnD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,WAAW,CAAC,eAAuB;QACzC,MAAM,OAAO,GAAkC;YAC7C,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,QAAQ;YACnB,MAAM,EAAE,KAAK;SACd,CAAC;QACF,OAAO,OAAO,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,IAAI,QAAQ,CAAC;IAC5D,CAAC;IAEO,WAAW,CAAC,MAAc,EAAE,QAA8C;QAChF,yBAAyB;QACzB,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACvF,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1F,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,0BAA0B;QAC1B,MAAM,GAAG,GAAG,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QAC9C,IAAI,GAAG,EAAE,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC;QACjD,IAAI,GAAG,EAAE,QAAQ,CAAC,eAAe,CAAC;YAAE,OAAO,SAAS,CAAC;QAErD,OAAO,UAAU,CAAC,CAAC,sBAAsB;IAC3C,CAAC;IAEO,aAAa,CAAC,UAAmB;QACvC,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAClC,MAAM,CAAC,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QAChC,IAAI,CAAC,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QACpC,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,eAAe,cAAc,CAAC"}