@oculum/scanner 1.0.12 → 1.0.13

package/src/postprocess/dedup.ts

@@ -0,0 +1,62 @@
+/**
+ * Deduplication — Remove duplicate vulnerabilities.
+ *
+ * Handles standard dedup (same file, line, category) and cross-layer URL dedup
+ * (e.g., Layer 1 sensitive_url + Layer 2 ai_pattern on same line).
+ */
+
+import type { Vulnerability } from '../shared/types'
+import { severityRank, confidenceRank } from '../shared/parsed-file'
+
+/**
+ * Remove duplicate vulnerabilities (same file, line, category)
+ * Also handles cross-layer URL duplicates (sensitive_url + ai_pattern)
+ */
+export function deduplicateVulnerabilities(vulnerabilities: Vulnerability[]): Vulnerability[] {
+  const seen = new Map<string, Vulnerability>()
+  const urlDedupMap = new Map<string, Vulnerability>()
+
+  for (const vuln of vulnerabilities) {
+    // Special handling for URL duplicates across layers
+    // (e.g., Layer 1 detects as sensitive_url, Layer 2 detects as ai_pattern on same line)
+    // Route based on category, not lineContent regex — a sensitive_url finding is a URL
+    // finding regardless of what scheme appears in the line content.
+    if (vuln.category === 'sensitive_url' || vuln.category === 'ai_pattern') {
+
+      // Create compound key that ignores category differences for URLs
+      const urlKey = `${vuln.filePath}:${vuln.lineNumber}:url_finding`
+      const existing = urlDedupMap.get(urlKey)
+
+      if (!existing) {
+        urlDedupMap.set(urlKey, vuln)
+      } else {
+        // Keep Layer 1 (more specific) over Layer 2 AI pattern
+        // Or keep higher severity
+        if (vuln.layer < existing.layer ||
+            severityRank(vuln.severity) > severityRank(existing.severity)) {
+          urlDedupMap.set(urlKey, vuln)
+        }
+      }
+      continue
+    }
+
+    // Standard deduplication for non-URL findings
+    const key = `${vuln.filePath}:${vuln.lineNumber}:${vuln.category}`
+    const existing = seen.get(key)
+
+    // Keep the higher severity or higher confidence finding
+    if (!existing) {
+      seen.set(key, vuln)
+    } else if (severityRank(vuln.severity) > severityRank(existing.severity)) {
+      seen.set(key, vuln)
+    } else if (
+      severityRank(vuln.severity) === severityRank(existing.severity) &&
+      confidenceRank(vuln.confidence) > confidenceRank(existing.confidence)
+    ) {
+      seen.set(key, vuln)
+    }
+  }
+
+  // Combine URL and non-URL findings
+  return [...Array.from(seen.values()), ...Array.from(urlDedupMap.values())]
+}

package/src/{filtering → postprocess/filtering}/__tests__/pipeline.test.ts

@@ -128,7 +128,7 @@ describe('FilterPipeline', () => {
       const stats = pipeline.getSummaryStats()
 
       expect(stats.auto_dismiss.dismissed).toBe(0)
-      expect(stats.tier_filter.kept).toBe(0)
+      expect(stats.confidence_scoring.kept).toBe(0)
     })
   })
 })

package/src/{filtering → postprocess/filtering}/context-adjustments.ts

@@ -9,8 +9,8 @@
  * all context-based severity downgrades in one place.
  */
 
-import type { Vulnerability } from '../types'
-import type { FileContext } from '../utils/context-helpers'
+import type { Vulnerability } from '../../shared/types'
+import type { FileContext } from '../../parse/file-classifier'
 
 /** Categories that are expected and not risky in tooling directories */
 const TOOLING_DOWNGRADABLE_CATEGORIES = [

package/src/{filtering → postprocess/filtering}/pipeline.ts

@@ -13,7 +13,7 @@ export type FilterStage =
   | 'localhost_aggregation'
   | 'noisy_aggregation'
   | 'auto_dismiss'
-  | 'tier_filter'
+  | 'confidence_scoring'
   | 'ai_validation'
   | 'global_context'
   | 'contradiction_resolution'
@@ -99,7 +99,7 @@ export class FilterPipeline {
       'localhost_aggregation',
       'noisy_aggregation',
       'auto_dismiss',
-      'tier_filter',
+      'confidence_scoring',
       'ai_validation',
       'global_context',
       'contradiction_resolution',

package/src/postprocess/index.ts

@@ -0,0 +1,118 @@
+/**
+ * Postprocessing Pipeline — Runs the full postprocessing chain on findings.
+ *
+ * Dedup → context adjustments → contradiction resolution → suppression.
+ * Records audit decisions for each sub-step via FilterPipeline.
+ */
+
+import type { Vulnerability, ScanFile } from '../shared/types'
+import type { MiddlewareAuthConfig } from '../model/middleware-detector'
+import type { FilterPipeline } from './filtering/pipeline'
+import type { SuppressionResult } from './suppression/types'
+import { deduplicateVulnerabilities } from './dedup'
+import { applyContextAdjustments } from './filtering/context-adjustments'
+import { resolveContradictions } from './contradictions'
+import { SuppressionManager } from './suppression'
+
+export interface PostprocessInput {
+  /** Raw findings to postprocess */
+  findings: Vulnerability[]
+  /** Source files (for inline suppression parsing) */
+  files: ScanFile[]
+  /** Middleware config for contradiction resolution */
+  middlewareConfig?: MiddlewareAuthConfig
+  /** Project path for suppression config loading */
+  projectPath?: string
+  /** FilterPipeline for audit recording */
+  filterPipeline: FilterPipeline
+  /** Whether to show suppressed findings */
+  showSuppressed?: boolean
+}
+
+export interface PostprocessResult {
+  /** Findings after all postprocessing */
+  findings: Vulnerability[]
+  /** Suppression result (for stats and suppressed findings) */
+  suppressionResult: SuppressionResult
+}
+
+const fid = (v: Pick<Vulnerability, 'filePath' | 'lineNumber' | 'category'>) =>
+  `${v.filePath}:${v.lineNumber}:${v.category}`
+
+/**
+ * Run the full postprocessing chain on findings.
+ *
+ * Pipeline: dedup → context adjustments → contradiction resolution → suppression
+ */
+export function postprocessFindings(input: PostprocessInput): PostprocessResult {
+  const {
+    findings,
+    files,
+    middlewareConfig,
+    projectPath,
+    filterPipeline,
+  } = input
+
+  // 1. Deduplicate vulnerabilities
+  const uniqueVulnerabilities = deduplicateVulnerabilities(findings)
+  if (filterPipeline.isEnabled) {
+    const uniqueIds = new Set(uniqueVulnerabilities.map(fid))
+    for (const v of findings) {
+      if (!uniqueIds.has(fid(v))) {
+        filterPipeline.record(fid(v), { stage: 'deduplication', action: 'deduplicated', reason: 'Duplicate finding removed' })
+      }
+    }
+  }
+
+  // 2. Apply file context-based severity adjustments (Phase 2b)
+  const contextAdjustedVulnerabilities = applyContextAdjustments(uniqueVulnerabilities)
+  if (filterPipeline.isEnabled) {
+    for (let i = 0; i < uniqueVulnerabilities.length; i++) {
+      const before = uniqueVulnerabilities[i]
+      const after = contextAdjustedVulnerabilities[i]
+      if (before.severity !== after.severity) {
+        filterPipeline.record(fid(after), { stage: 'global_context', action: 'downgraded', reason: after.validationNotes || 'Context-based severity downgrade', originalSeverity: before.severity, newSeverity: after.severity })
+      }
+    }
+  }
+
+  // 3. Resolve contradictions
+  const resolvedVulnerabilities = resolveContradictions(contextAdjustedVulnerabilities, middlewareConfig)
+  if (filterPipeline.isEnabled) {
+    const resolvedIds = new Set(resolvedVulnerabilities.map(fid))
+    for (const v of contextAdjustedVulnerabilities) {
+      if (!resolvedIds.has(fid(v))) {
+        filterPipeline.record(fid(v), { stage: 'contradiction_resolution', action: 'dismissed', reason: 'Removed by contradiction resolution' })
+      }
+    }
+    for (let i = 0; i < contextAdjustedVulnerabilities.length; i++) {
+      const before = contextAdjustedVulnerabilities[i]
+      const after = resolvedVulnerabilities.find(v => fid(v) === fid(before))
+      if (after && before.severity !== after.severity) {
+        filterPipeline.record(fid(after), { stage: 'contradiction_resolution', action: 'downgraded', reason: 'Downgraded by contradiction resolution', originalSeverity: before.severity, newSeverity: after.severity })
+      }
+    }
+  }
+
+  // 4. Apply suppressions (inline comments + config file)
+  const resolvedProjectPath = projectPath || process.cwd()
+  const suppressionManager = new SuppressionManager({ projectPath: resolvedProjectPath })
+  const suppressionResult = suppressionManager.applySuppressions(resolvedVulnerabilities, files)
+
+  if (filterPipeline.isEnabled) {
+    for (const s of suppressionResult.suppressed) {
+      filterPipeline.record(fid(s.vulnerability), { stage: 'user_suppression', action: 'suppressed', reason: s.suppression.reason || `Suppressed by ${s.suppression.type}` })
+    }
+  }
+
+  return {
+    findings: suppressionResult.findings,
+    suppressionResult,
+  }
+}
+
+// Re-export sub-modules for direct access
+export { deduplicateVulnerabilities } from './dedup'
+export { aggregateNoisyFindings } from './aggregation'
+export { resolveContradictions } from './contradictions'
+export { capValidationCandidatesPerFile, MAX_VALIDATION_CANDIDATES_PER_FILE } from './validation-cap'

package/src/{suppression → postprocess/suppression}/config-loader.ts

@@ -15,7 +15,7 @@ import {
   SUPPRESSION_CONFIG_FILES,
   DEFAULT_SUPPRESSION_CONFIG,
 } from './types'
-import type { VulnerabilityCategory } from '../types'
+import type { VulnerabilityCategory } from '../../shared/types'
 
 /**
  * Result of loading suppression config

package/src/{suppression → postprocess/suppression}/hash.ts

@@ -4,7 +4,7 @@
  */
 
 import { createHash } from 'crypto'
-import type { Vulnerability } from '../types'
+import type { Vulnerability } from '../../shared/types'
 
 /**
  * Normalize a file path for hashing

package/src/{suppression → postprocess/suppression}/inline-parser.ts

@@ -4,7 +4,7 @@
  */
 
 import type { InlineSuppression } from './types'
-import type { VulnerabilityCategory } from '../types'
+import type { VulnerabilityCategory } from '../../shared/types'
 
 /**
  * Valid suppression comment patterns:

package/src/{suppression → postprocess/suppression}/manager.ts

@@ -4,7 +4,7 @@
  */
 
 import { minimatch } from 'minimatch'
-import type { Vulnerability, ScanFile } from '../types'
+import type { Vulnerability, ScanFile } from '../../shared/types'
 import type {
   SuppressionConfig,
   SuppressionMatch,

package/src/{suppression → postprocess/suppression}/types.ts

@@ -3,7 +3,7 @@
  * Defines types for the finding suppression/ignore system
  */
 
-import type { VulnerabilityCategory, VulnerabilitySeverity } from '../types'
+import type { VulnerabilityCategory, VulnerabilitySeverity } from '../../shared/types'
 
 /**
  * Suppression configuration file structure
@@ -131,7 +131,7 @@ export interface SuppressedVulnerability {
  */
 export interface SuppressionResult {
   /** Findings that passed through (not suppressed) */
-  findings: import('../types').Vulnerability[]
+  findings: import('../../shared/types').Vulnerability[]
   /** Findings that were suppressed */
   suppressed: SuppressedVulnerability[]
   /** Count of expired suppressions (findings reappear) */

package/src/postprocess/validation-cap.ts

@@ -0,0 +1,66 @@
+/**
+ * Validation Cap — Per-file cap on AI validation candidates for cost control.
+ *
+ * Prioritizes findings by confidence score, severity, and category importance.
+ */
+
+import type { Vulnerability } from '../shared/types'
+import type { ScoredFinding } from '../score'
+import { severityRank } from '../shared/parsed-file'
+
+/** Maximum candidates per file to send to AI validation (cost control) */
+export const MAX_VALIDATION_CANDIDATES_PER_FILE = 10
+
+/**
+ * Cap validation candidates per file to control AI costs
+ * Prioritizes by:
+ * 1. Confidence score (higher score = more likely a real finding)
+ * 2. Severity (critical > high > medium > low > info)
+ * 3. Category importance (secrets/URLs/auth before cosmetic patterns)
+ */
+export function capValidationCandidatesPerFile(
+  vulnerabilities: Vulnerability[],
+  maxPerFile: number = MAX_VALIDATION_CANDIDATES_PER_FILE
+): Vulnerability[] {
+  // Group by file
+  const byFile = new Map<string, Vulnerability[]>()
+  for (const vuln of vulnerabilities) {
+    const existing = byFile.get(vuln.filePath) || []
+    existing.push(vuln)
+    byFile.set(vuln.filePath, existing)
+  }
+
+  const result: Vulnerability[] = []
+
+  for (const [, fileVulns] of byFile) {
+    // Sort by priority: confidence score descending, then severity, then category
+    const sorted = [...fileVulns].sort((a, b) => {
+      // Confidence score comparison (higher = higher priority for validation)
+      const aScore = (a as ScoredFinding).confidence_score?.score ?? (a.baseConfidence ?? 0.35)
+      const bScore = (b as ScoredFinding).confidence_score?.score ?? (b.baseConfidence ?? 0.35)
+      const scoreDiff = bScore - aScore
+      if (Math.abs(scoreDiff) > 0.01) return scoreDiff
+
+      // Severity comparison (higher severity = higher priority)
+      const severityDiff = severityRank(b.severity) - severityRank(a.severity)
+      if (severityDiff !== 0) return severityDiff
+
+      // Category importance (secrets/URLs/auth before AI patterns)
+      const categoryPriority = (v: Vulnerability): number => {
+        if (v.category === 'hardcoded_secret') return 10
+        if (v.category === 'high_entropy_string') return 9
+        if (v.category === 'sensitive_url') return 8
+        if (v.category === 'missing_auth') return 7
+        if (v.category === 'ai_pattern') return 3
+        return 5
+      }
+      return categoryPriority(b) - categoryPriority(a)
+    })
+
+    // Take top N per file
+    const capped = sorted.slice(0, maxPerFile)
+    result.push(...capped)
+  }
+
+  return result
+}

package/src/report/build-result.ts

@@ -0,0 +1,94 @@
+/**
+ * Report Builder — Composes the final ScanResult from processed findings.
+ *
+ * Encapsulates sorting, counting, suppressed-summary building, and result
+ * object construction.
+ */
+
+import type {
+  ScanResult,
+  Vulnerability,
+  SuppressedVulnerabilitySummary,
+} from '../shared/types'
+import type { ValidationStats } from '../validate'
+import type { SuppressionResult } from '../postprocess/suppression/types'
+import type { FilterPipeline } from '../postprocess/filtering/pipeline'
+import { sortBySeverity, computeSeverityCounts, computeCategoryCounts } from './summary'
+
+export interface BuildScanResultInput {
+  repoInfo: { name: string; url: string; branch: string }
+  files: { length: number }
+  findings: Vulnerability[]
+  suppressionResult: SuppressionResult
+  startTime: number
+  validationStats?: ValidationStats
+  showSuppressed?: boolean
+  filterPipeline?: FilterPipeline
+  cancelled?: boolean
+  cancelReason?: string
+}
+
+/**
+ * Build the final ScanResult from postprocessed findings.
+ */
+export function buildScanResult(input: BuildScanResultInput): ScanResult {
+  const {
+    repoInfo,
+    files,
+    findings,
+    suppressionResult,
+    startTime,
+    validationStats,
+    showSuppressed,
+    filterPipeline,
+    cancelled,
+    cancelReason,
+  } = input
+
+  // Use the filtered findings (after suppression)
+  const afterSuppression = suppressionResult.findings
+
+  // Sort by severity
+  const sortedVulnerabilities = sortBySeverity(afterSuppression)
+
+  // Compute issue-mix counts (based on unsuppressed findings)
+  const severityCounts = computeSeverityCounts(sortedVulnerabilities)
+  const categoryCounts = computeCategoryCounts(sortedVulnerabilities)
+  const hasBlockingIssues = severityCounts.critical > 0 || severityCounts.high > 0
+
+  // Build suppressed vulnerabilities summary (for --show-suppressed)
+  const suppressedVulnerabilities: SuppressedVulnerabilitySummary[] | undefined = showSuppressed
+    ? suppressionResult.suppressed.map(s => ({
+        hash: s.suppression.hash,
+        filePath: s.vulnerability.filePath,
+        lineNumber: s.vulnerability.lineNumber,
+        category: s.vulnerability.category,
+        severity: s.vulnerability.severity,
+        title: s.vulnerability.title,
+        suppressionType: s.suppression.type,
+        suppressionReason: s.suppression.reason,
+        expires: s.suppression.expires,
+      }))
+    : undefined
+
+  return {
+    repoName: repoInfo.name,
+    repoUrl: repoInfo.url,
+    branch: repoInfo.branch,
+    filesScanned: files.length,
+    filesSkipped: 0, // TODO: track skipped files
+    vulnerabilities: sortedVulnerabilities,
+    severityCounts,
+    categoryCounts,
+    hasBlockingIssues: cancelled ? false : hasBlockingIssues,
+    scanDuration: Date.now() - startTime,
+    timestamp: new Date().toISOString(),
+    validationStats,
+    suppressionStats: suppressionResult.suppressed.length > 0 || suppressionResult.expiredSuppressions > 0
+      ? suppressionResult.stats
+      : undefined,
+    suppressedVulnerabilities,
+    filterAuditTrail: filterPipeline?.isEnabled ? filterPipeline.getAuditTrail() : undefined,
+    ...(cancelled ? { cancelled: true, cancelReason } : {}),
+  }
+}

package/src/report/enrichment.ts

@@ -0,0 +1,52 @@
+/**
+ * Report Enrichment — Adds rule registry metadata and framework-specific fixes to findings.
+ *
+ * Extracted from the orchestrator. Runs after detection + aggregation, before scoring.
+ */
+
+import type { Vulnerability } from '../shared/types'
+import type { ProjectContext } from '../model/project-context'
+import { getRuleMetadata } from '../shared/rules'
+import { getFrameworkFix } from '../shared/rules/framework-fixes'
+
+/**
+ * Enrich findings with metadata from the rule registry (PRO-82)
+ * Sets default impact, evidence, fixSteps, and references from registry
+ *
+ * PRO-83: When projectContext is provided, uses framework-aware fix suggestions
+ * that are tailored to the user's detected tech stack (e.g., Prisma-specific
+ * SQL injection fixes instead of generic advice).
+ *
+ * These can be overridden later by AI-generated content
+ */
+export function enrichWithMetadata(
+  findings: Vulnerability[],
+  projectContext?: ProjectContext
+): Vulnerability[] {
+  return findings.map(f => {
+    const metadata = getRuleMetadata(f.category)
+    if (!metadata) return f
+
+    // PRO-83: Check for framework-specific fix suggestions
+    let fixSteps = metadata.fixSteps
+    if (projectContext) {
+      const frameworkFix = getFrameworkFix(
+        f.category,
+        projectContext.frameworks,
+        projectContext.dataAccess
+      )
+      if (frameworkFix) {
+        fixSteps = frameworkFix.fixSteps
+      }
+    }
+
+    return {
+      ...f,
+      // Set defaults from registry (AI can override later)
+      impact: f.impact || metadata.whyItMatters,
+      evidence: f.evidence || metadata.evidence,
+      fixSteps: f.fixSteps || fixSteps,
+      references: f.references || metadata.references,
+    }
+  })
+}

package/src/{formatters → report/formatters}/ai-context.ts

@@ -3,7 +3,7 @@
  * Generates structured markdown for AI coding assistants to consume and fix security findings
  */
 
-import type { ScanResult, Vulnerability, VulnerabilitySeverity } from '../types'
+import type { ScanResult, Vulnerability, VulnerabilitySeverity } from '../../shared/types'
 import { sortBySeverity } from './grouping'
 
 /**

package/src/{formatters → report/formatters}/cli-terminal.ts

@@ -3,9 +3,9 @@
  * Formats scan results with ANSI colors for terminal output
  */
 
-import type { ScanResult, Vulnerability, VulnerabilitySeverity } from '../types'
+import type { ScanResult, Vulnerability, VulnerabilitySeverity } from '../../shared/types'
 import { groupByTheme, getBlockingIssues, GroupedFindings, THEME_CONFIG } from './grouping'
-import { computeFindingHash } from '../suppression/hash'
+import { computeFindingHash } from '../../postprocess/suppression/hash'
 
 /**
  * ANSI color codes
@@ -110,7 +110,7 @@ function formatFinding(finding: Vulnerability, options: FormatFindingOptions = {
     output += '\n'
   } else if (finding.suggestedFix) {
     // Fallback to legacy suggestedFix field
-    output += `${indent}   ${c(colors.green, '💡 ' + finding.suggestedFix)}\n`
+    output += `${indent}   ${c(colors.green, finding.suggestedFix)}\n`
     output += '\n'
   }
 
@@ -134,7 +134,7 @@ function formatFinding(finding: Vulnerability, options: FormatFindingOptions = {
 
     // AI enhanced indicator
     if (finding.aiEnhanced) {
-      output += `${indent}   ${c(colors.magenta, '✨ AI-enhanced fix suggestion')}\n`
+      output += `${indent}   ${c(colors.magenta, '[AI] Enhanced fix suggestion')}\n`
     }
   }
 
@@ -189,9 +189,9 @@ function formatDiffSummary(baselineDiff: NonNullable<ScanResult['baselineDiff']>
 
   output += c(colors.bold, 'Baseline Comparison') + '\n'
   output += c(colors.dim, '─'.repeat(40)) + '\n'
-  output += `  🆕 ${c(colors.yellow, `${baselineDiff.newCount} new`)} findings\n`
-  output += `  ✅ ${c(colors.green, `${baselineDiff.fixedCount} fixed`)} since baseline\n`
-  output += `  📋 ${c(colors.dim, `${baselineDiff.existingCount} existing`)} (in baseline)\n`
+  output += `  + ${c(colors.yellow, `${baselineDiff.newCount} new`)} findings\n`
+  output += `  - ${c(colors.green, `${baselineDiff.fixedCount} fixed`)} since baseline\n`
+  output += `  = ${c(colors.dim, `${baselineDiff.existingCount} existing`)} (in baseline)\n`
   output += '\n'
 
   // Format baseline date
@@ -241,11 +241,11 @@ export function formatTerminalOutput(result: ScanResult, options: {
   // Status
   if (hasBlockingIssues) {
     const blocking = severityCounts.critical + severityCounts.high
-    output += c(colors.bgRed + colors.white + colors.bold, ` 🚨 ${blocking} BLOCKING ISSUES FOUND `) + '\n\n'
+    output += c(colors.bgRed + colors.white + colors.bold, ` ! ${blocking} BLOCKING ISSUES FOUND `) + '\n\n'
   } else if (vulnerabilities.length > 0) {
-    output += c(colors.yellow, `⚠️  ${vulnerabilities.length} issues found (no blocking issues)`) + '\n\n'
+    output += c(colors.yellow, `${vulnerabilities.length} issues found (no blocking issues)`) + '\n\n'
   } else {
-    output += c(colors.green, '✅ No security issues found!') + '\n\n'
+    output += c(colors.green, 'No security issues found!') + '\n\n'
     output += c(colors.dim, `Scanned ${filesScanned} files in ${(scanDuration / 1000).toFixed(1)}s`) + '\n'
     return output
   }
@@ -376,7 +376,7 @@ export function formatCompactSummary(
   if (vulnerabilities.length === 0) {
     return noColor
       ? 'No security issues found.'
-      : c(colors.green, '✓ No security issues found.')
+      : c(colors.green, 'No security issues found.')
   }
 
   // Group by severity

package/src/{formatters → report/formatters}/github-comment.ts

@@ -3,7 +3,7 @@
  * Formats scan results as markdown for GitHub PR comments
  */
 
-import type { ScanResult, Vulnerability, VulnerabilitySeverity, VulnerabilityCategory } from '../types'
+import type { ScanResult, Vulnerability, VulnerabilitySeverity, VulnerabilityCategory } from '../../shared/types'
 import { groupByTheme, limitPerGroup, getBlockingIssues, GroupedFindings } from './grouping'
 
 /**

package/src/{formatters → report/formatters}/grouping.ts

@@ -3,7 +3,7 @@
  * Groups and sorts vulnerabilities for workflow-friendly output
  */
 
-import type { Vulnerability, VulnerabilitySeverity, VulnerabilityCategory } from '../types'
+import type { Vulnerability, VulnerabilitySeverity, VulnerabilityCategory } from '../../shared/types'
 
 /**
  * Risk themes for grouping findings
@@ -63,13 +63,13 @@ export function getRiskTheme(category: VulnerabilityCategory): RiskTheme {
  * Theme display names and icons
  */
 export const THEME_CONFIG: Record<RiskTheme, { name: string; icon: string; priority: number }> = {
-  secrets: { name: 'Secrets & Credentials', icon: '🔑', priority: 1 },
-  injection: { name: 'Injection Vulnerabilities', icon: '💉', priority: 2 },
-  auth: { name: 'Authentication Issues', icon: '🔒', priority: 3 },
-  ai: { name: 'AI Security', icon: '🤖', priority: 4 },
-  config: { name: 'Configuration Issues', icon: '⚙️', priority: 5 },
-  data: { name: 'Data Exposure', icon: '📊', priority: 6 },
-  other: { name: 'Other Issues', icon: '⚠️', priority: 7 },
+  secrets: { name: 'Secrets & Credentials', icon: '*', priority: 1 },
+  injection: { name: 'Injection Vulnerabilities', icon: '*', priority: 2 },
+  auth: { name: 'Authentication Issues', icon: '*', priority: 3 },
+  ai: { name: 'AI Security', icon: '*', priority: 4 },
+  config: { name: 'Configuration Issues', icon: '*', priority: 5 },
+  data: { name: 'Data Exposure', icon: '*', priority: 6 },
+  other: { name: 'Other Issues', icon: '*', priority: 7 },
 }
 
 /**

package/src/{formatters → report/formatters}/ide/claude-code.ts

@@ -3,7 +3,7 @@
  * Generates CLAUDE.md section format
  */
 
-import type { ScanResult, Vulnerability, VulnerabilityCategory } from '../../types'
+import type { ScanResult, Vulnerability, VulnerabilityCategory } from '../../../shared/types'
 import { sortBySeverity } from '../grouping'
 
 /** Start marker for Oculum section in CLAUDE.md */

package/src/{formatters → report/formatters}/ide/cursor.ts

@@ -3,7 +3,7 @@
  * Generates .cursor/rules/security.mdc format
  */
 
-import type { ScanResult, Vulnerability } from '../../types'
+import type { ScanResult, Vulnerability } from '../../../shared/types'
 import { sortBySeverity } from '../grouping'
 
 /**

package/src/{formatters → report/formatters}/ide/windsurf.ts

@@ -3,7 +3,7 @@
  * Generates .windsurfrules format
  */
 
-import type { ScanResult, Vulnerability, VulnerabilityCategory } from '../../types'
+import type { ScanResult, Vulnerability, VulnerabilityCategory } from '../../../shared/types'
 import { sortBySeverity } from '../grouping'
 
 /**

package/src/{formatters → report/formatters}/vscode-diagnostic.ts

@@ -3,7 +3,7 @@
  * Formats scan results as LSP diagnostic format for VS Code integration
  */
 
-import type { Vulnerability, VulnerabilitySeverity } from '../types'
+import type { Vulnerability, VulnerabilitySeverity } from '../../shared/types'
 
 /**
  * LSP Diagnostic Severity