@oculum/scanner 1.0.14 → 1.0.15

package/src/pipeline/modes/incremental.ts

@@ -14,6 +14,7 @@ import {
   type FileDiff,
 } from '../../shared/diff-parser'
 import { detectGlobalAuthMiddleware } from '../../model/middleware-detector'
+import { escapeRegex } from '../../shared/regex-utils'
 
 /**
  * Options for incremental scanning
@@ -233,13 +234,6 @@ function findImporters(allFiles: ScanFile[], changedPaths: string[]): Set<string
   return importers
 }
 
-/**
- * Escape special regex characters
- */
-function escapeRegex(str: string): string {
-  return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
-}
-
 /**
  * Create a PR-optimized scan config
  */

package/src/postprocess/dedup.ts

@@ -1,50 +1,78 @@
 /**
  * Deduplication — Remove duplicate vulnerabilities.
  *
- * Handles standard dedup (same file, line, category) and cross-layer URL dedup
- * (e.g., Layer 1 sensitive_url + Layer 2 ai_pattern on same line).
+ * Handles:
+ * 1. Standard dedup (same file, line, category)
+ * 2. Cross-layer URL dedup (sensitive_url + ai_pattern on same line)
+ * 3. Secret-family dedup (hardcoded_secret + sensitive_variable + insecure_config on same line)
  */
 
 import type { Vulnerability } from '../shared/types'
 import { severityRank, confidenceRank } from '../shared/parsed-file'
 
+// Categories that all flag the same fundamental issue: a hardcoded secret/credential.
+// When multiple fire on the same line, keep only the best finding.
+const SECRET_FAMILY = new Set([
+  'hardcoded_secret',
+  'high_entropy_string',
+  'sensitive_variable',
+  'insecure_config',
+])
+
+/**
+ * Pick the best vulnerability from a group of same-line findings.
+ * Prefers: higher severity > lower layer (more specific) > higher confidence.
+ */
+function pickBest(a: Vulnerability, b: Vulnerability): Vulnerability {
+  const sevDiff = severityRank(b.severity) - severityRank(a.severity)
+  if (sevDiff !== 0) return sevDiff > 0 ? b : a
+  // Same severity — prefer lower layer (Layer 1 pattern is more specific than Layer 2 heuristic)
+  if (a.layer !== b.layer) return a.layer < b.layer ? a : b
+  // Same layer — prefer higher confidence
+  return confidenceRank(b.confidence) > confidenceRank(a.confidence) ? b : a
+}
+
 /**
  * Remove duplicate vulnerabilities (same file, line, category)
  * Also handles cross-layer URL duplicates (sensitive_url + ai_pattern)
+ * and secret-family duplicates (hardcoded_secret + sensitive_variable + insecure_config)
  */
 export function deduplicateVulnerabilities(vulnerabilities: Vulnerability[]): Vulnerability[] {
   const seen = new Map<string, Vulnerability>()
   const urlDedupMap = new Map<string, Vulnerability>()
+  const secretDedupMap = new Map<string, Vulnerability>()
 
   for (const vuln of vulnerabilities) {
     // Special handling for URL duplicates across layers
-    // (e.g., Layer 1 detects as sensitive_url, Layer 2 detects as ai_pattern on same line)
-    // Route based on category, not lineContent regex — a sensitive_url finding is a URL
-    // finding regardless of what scheme appears in the line content.
     if (vuln.category === 'sensitive_url' || vuln.category === 'ai_pattern') {
-
-      // Create compound key that ignores category differences for URLs
       const urlKey = `${vuln.filePath}:${vuln.lineNumber}:url_finding`
       const existing = urlDedupMap.get(urlKey)
 
       if (!existing) {
         urlDedupMap.set(urlKey, vuln)
       } else {
-        // Keep Layer 1 (more specific) over Layer 2 AI pattern
-        // Or keep higher severity
-        if (vuln.layer < existing.layer ||
-            severityRank(vuln.severity) > severityRank(existing.severity)) {
-          urlDedupMap.set(urlKey, vuln)
-        }
+        urlDedupMap.set(urlKey, pickBest(existing, vuln))
+      }
+      continue
+    }
+
+    // Secret-family dedup: multiple detectors flagging the same hardcoded secret
+    if (SECRET_FAMILY.has(vuln.category)) {
+      const secretKey = `${vuln.filePath}:${vuln.lineNumber}:secret_finding`
+      const existing = secretDedupMap.get(secretKey)
+
+      if (!existing) {
+        secretDedupMap.set(secretKey, vuln)
+      } else {
+        secretDedupMap.set(secretKey, pickBest(existing, vuln))
       }
       continue
     }
 
-    // Standard deduplication for non-URL findings
+    // Standard deduplication for other findings
     const key = `${vuln.filePath}:${vuln.lineNumber}:${vuln.category}`
     const existing = seen.get(key)
 
-    // Keep the higher severity or higher confidence finding
     if (!existing) {
       seen.set(key, vuln)
     } else if (severityRank(vuln.severity) > severityRank(existing.severity)) {
@@ -57,6 +85,9 @@ export function deduplicateVulnerabilities(vulnerabilities: Vulnerability[]): Vu
     }
   }
 
-  // Combine URL and non-URL findings
-  return [...Array.from(seen.values()), ...Array.from(urlDedupMap.values())]
+  return [
+    ...Array.from(seen.values()),
+    ...Array.from(urlDedupMap.values()),
+    ...Array.from(secretDedupMap.values()),
+  ]
 }

package/src/report/build-result.ts

@@ -9,23 +9,32 @@ import type {
   ScanResult,
   Vulnerability,
   SuppressedVulnerabilitySummary,
-} from '../shared/types'
-import type { ValidationStats } from '../validate'
-import type { SuppressionResult } from '../postprocess/suppression/types'
-import type { FilterPipeline } from '../postprocess/filtering/pipeline'
-import { sortBySeverity, computeSeverityCounts, computeCategoryCounts } from './summary'
+} from "../shared/types";
+import type { ScoredFinding } from "../score";
+import type { ProjectContext } from "../model/project-context";
+import type { ValidationStats } from "../validate";
+import type { SuppressionResult } from "../postprocess/suppression/types";
+import type { FilterPipeline } from "../postprocess/filtering/pipeline";
+import {
+  sortBySeverity,
+  computeSeverityCounts,
+  computeCategoryCounts,
+} from "./summary";
 
 export interface BuildScanResultInput {
-  repoInfo: { name: string; url: string; branch: string }
-  files: { length: number }
-  findings: Vulnerability[]
-  suppressionResult: SuppressionResult
-  startTime: number
-  validationStats?: ValidationStats
-  showSuppressed?: boolean
-  filterPipeline?: FilterPipeline
-  cancelled?: boolean
-  cancelReason?: string
+  repoInfo: { name: string; url: string; branch: string };
+  files: { length: number };
+  findings: Vulnerability[];
+  suppressionResult: SuppressionResult;
+  startTime: number;
+  validationStats?: ValidationStats;
+  showSuppressed?: boolean;
+  filterPipeline?: FilterPipeline;
+  cancelled?: boolean;
+  cancelReason?: string;
+  projectContext?: ProjectContext;
+  forReviewFindings?: ScoredFinding[];
+  languageStats?: Record<string, number>;
 }
 
 /**
@@ -43,22 +52,28 @@ export function buildScanResult(input: BuildScanResultInput): ScanResult {
     filterPipeline,
     cancelled,
     cancelReason,
-  } = input
+    projectContext,
+    forReviewFindings,
+    languageStats,
+  } = input;
 
   // Use the filtered findings (after suppression)
-  const afterSuppression = suppressionResult.findings
+  const afterSuppression = suppressionResult.findings;
 
   // Sort by severity
-  const sortedVulnerabilities = sortBySeverity(afterSuppression)
+  const sortedVulnerabilities = sortBySeverity(afterSuppression);
 
   // Compute issue-mix counts (based on unsuppressed findings)
-  const severityCounts = computeSeverityCounts(sortedVulnerabilities)
-  const categoryCounts = computeCategoryCounts(sortedVulnerabilities)
-  const hasBlockingIssues = severityCounts.critical > 0 || severityCounts.high > 0
+  const severityCounts = computeSeverityCounts(sortedVulnerabilities);
+  const categoryCounts = computeCategoryCounts(sortedVulnerabilities);
+  const hasBlockingIssues =
+    severityCounts.critical > 0 || severityCounts.high > 0;
 
   // Build suppressed vulnerabilities summary (for --show-suppressed)
-  const suppressedVulnerabilities: SuppressedVulnerabilitySummary[] | undefined = showSuppressed
-    ? suppressionResult.suppressed.map(s => ({
+  const suppressedVulnerabilities:
+    | SuppressedVulnerabilitySummary[]
+    | undefined = showSuppressed
+    ? suppressionResult.suppressed.map((s) => ({
         hash: s.suppression.hash,
         filePath: s.vulnerability.filePath,
         lineNumber: s.vulnerability.lineNumber,
@@ -69,7 +84,7 @@ export function buildScanResult(input: BuildScanResultInput): ScanResult {
         suppressionReason: s.suppression.reason,
         expires: s.suppression.expires,
       }))
-    : undefined
+    : undefined;
 
   return {
     repoName: repoInfo.name,
@@ -84,11 +99,24 @@ export function buildScanResult(input: BuildScanResultInput): ScanResult {
     scanDuration: Date.now() - startTime,
     timestamp: new Date().toISOString(),
     validationStats,
-    suppressionStats: suppressionResult.suppressed.length > 0 || suppressionResult.expiredSuppressions > 0
-      ? suppressionResult.stats
-      : undefined,
+    suppressionStats:
+      suppressionResult.suppressed.length > 0 ||
+      suppressionResult.expiredSuppressions > 0
+        ? suppressionResult.stats
+        : undefined,
     suppressedVulnerabilities,
-    filterAuditTrail: filterPipeline?.isEnabled ? filterPipeline.getAuditTrail() : undefined,
+    forReviewFindings:
+      forReviewFindings && forReviewFindings.length > 0
+        ? forReviewFindings.map((f) => ({
+            ...f,
+            confidenceScore: f.confidence_score.score,
+          }))
+        : undefined,
+    filterAuditTrail: filterPipeline?.isEnabled
+      ? filterPipeline.getAuditTrail()
+      : undefined,
+    projectContext,
+    languageStats,
     ...(cancelled ? { cancelled: true, cancelReason } : {}),
-  }
+  };
 }