@oculum/scanner 1.0.14 → 1.0.15

package/src/__tests__/score/evidence.test.ts

@@ -0,0 +1,144 @@
+/**
+ * Tests for evidence level classification (score/evidence.ts)
+ */
+
+import { classifyEvidence, EVIDENCE_BASE } from '../../score/evidence'
+import type { Vulnerability, TaintPathOutput } from '../../shared/types'
+
+function makeFinding(overrides: Partial<Vulnerability> = {}): Vulnerability {
+  return {
+    id: 'test-1',
+    filePath: 'src/app.ts',
+    lineNumber: 10,
+    lineContent: 'db.query(userInput)',
+    severity: 'medium',
+    category: 'sql_injection',
+    title: 'Test finding',
+    description: 'Test',
+    confidence: 'medium',
+    layer: 2,
+    ...overrides,
+  }
+}
+
+function makeTaintPath(overrides: Partial<TaintPathOutput> = {}): TaintPathOutput {
+  return {
+    sourceType: 'http_body',
+    sourceLine: 5,
+    sinkType: 'sql_query',
+    sinkLine: 15,
+    taintKinds: ['sql'],
+    sanitized: false,
+    steps: [
+      {
+        line: 5,
+        variable: 'req.body',
+        taintKinds: ['sql'],
+        description: 'User input from HTTP body',
+        stepType: 'source',
+      },
+      {
+        line: 10,
+        variable: 'input',
+        taintKinds: ['sql'],
+        description: 'Assigned to input',
+        stepType: 'propagation',
+      },
+      {
+        line: 15,
+        variable: 'query',
+        taintKinds: ['sql'],
+        description: 'Flows to SQL query',
+        stepType: 'sink',
+      },
+    ],
+    ...overrides,
+  }
+}
+
+describe('classifyEvidence', () => {
+  describe('EVIDENCE_BASE constants', () => {
+    it('has correct base scores for each level', () => {
+      expect(EVIDENCE_BASE.proven).toBe(0.90)
+      expect(EVIDENCE_BASE.partial).toBe(0.60)
+      expect(EVIDENCE_BASE.contextual).toBe(0.45)
+      expect(EVIDENCE_BASE.pattern_only).toBe(0.30)
+    })
+  })
+
+  describe('proven classification', () => {
+    it('returns proven when finding has taintPath with steps', () => {
+      const finding = makeFinding({ taintPath: makeTaintPath() })
+      expect(classifyEvidence(finding)).toBe('proven')
+    })
+
+    it('respects pre-set evidenceLevel', () => {
+      const finding = makeFinding({ evidenceLevel: 'proven' })
+      expect(classifyEvidence(finding)).toBe('proven')
+    })
+  })
+
+  describe('partial classification', () => {
+    it('returns partial for structural source', () => {
+      const finding = makeFinding({ source: 'structural' })
+      expect(classifyEvidence(finding)).toBe('partial')
+    })
+
+    it('returns partial for ai_code source', () => {
+      const finding = makeFinding({ source: 'ai_code' })
+      expect(classifyEvidence(finding)).toBe('partial')
+    })
+  })
+
+  describe('contextual classification', () => {
+    it('returns contextual for secrets source', () => {
+      const finding = makeFinding({ source: 'secrets' })
+      expect(classifyEvidence(finding)).toBe('contextual')
+    })
+
+    it('returns contextual for config source', () => {
+      const finding = makeFinding({ source: 'config' })
+      expect(classifyEvidence(finding)).toBe('contextual')
+    })
+  })
+
+  describe('pattern_only classification', () => {
+    it('returns pattern_only when no source is set', () => {
+      const finding = makeFinding({ source: undefined })
+      expect(classifyEvidence(finding)).toBe('pattern_only')
+    })
+
+    it('returns pattern_only for validation source', () => {
+      const finding = makeFinding({ source: 'validation' })
+      expect(classifyEvidence(finding)).toBe('pattern_only')
+    })
+  })
+
+  describe('edge cases', () => {
+    it('does not classify as proven when taintPath has empty steps', () => {
+      const finding = makeFinding({
+        source: 'structural',
+        taintPath: makeTaintPath({ steps: [] }),
+      })
+      // Empty steps means no real path — falls back to source-based classification
+      expect(classifyEvidence(finding)).toBe('partial')
+    })
+
+    it('respects pre-set evidenceLevel over taintPath', () => {
+      const finding = makeFinding({
+        evidenceLevel: 'contextual',
+        taintPath: makeTaintPath(),
+      })
+      // Pre-set takes priority
+      expect(classifyEvidence(finding)).toBe('contextual')
+    })
+
+    it('respects pre-set evidenceLevel over source', () => {
+      const finding = makeFinding({
+        source: 'structural',
+        evidenceLevel: 'pattern_only',
+      })
+      expect(classifyEvidence(finding)).toBe('pattern_only')
+    })
+  })
+})

package/src/__tests__/score/scoring-integration.test.ts

@@ -1,5 +1,8 @@
 /**
  * Integration tests for the scoring system
+ *
+ * After Phase 7, base scores come from evidence level classification,
+ * not from baseConfidence. Tests use evidenceLevel to control base scores.
  */
 
 import { scoreFindings, DEPTH_CONFIGS } from '../../score'
@@ -44,23 +47,22 @@ function makeFinding(overrides: Partial<Vulnerability> = {}): Vulnerability {
     description: 'Test',
     confidence: 'medium',
     layer: 1,
-    baseConfidence: 0.50,
+    source: 'secrets',
     ...overrides,
   }
 }
 
 describe('scoreFindings', () => {
-  it('scores a batch of findings', () => {
+  it('scores a batch of findings with different evidence levels', () => {
     const findings: Vulnerability[] = [
-      makeFinding({ id: 'f1', baseConfidence: 0.70, category: 'hardcoded_secret' }),
-      makeFinding({ id: 'f2', baseConfidence: 0.30, category: 'high_entropy_string' }),
-      makeFinding({ id: 'f3', baseConfidence: 0.15, category: 'ai_pattern' }),
+      makeFinding({ id: 'f1', evidenceLevel: 'proven', category: 'sql_injection' }),
+      makeFinding({ id: 'f2', evidenceLevel: 'partial', category: 'xss' }),
+      makeFinding({ id: 'f3', evidenceLevel: 'pattern_only', category: 'ai_pattern' }),
     ]
 
     const { scored } = scoreFindings(findings, 'verified', PROJECT_CONTEXT)
 
     expect(scored).toHaveLength(3)
-    // Each finding has a confidence_score
     for (const s of scored) {
       expect(s.confidence_score).toBeDefined()
       expect(s.confidence_score.score).toBeGreaterThanOrEqual(0)
@@ -69,23 +71,35 @@ describe('scoreFindings', () => {
     }
   })
 
-  it('all findings get valid confidence_score', () => {
+  it('all findings get evidence-based confidence scores', () => {
     const findings: Vulnerability[] = [
-      makeFinding({ id: 'f1' }),
-      makeFinding({ id: 'f2', baseConfidence: undefined }),
+      makeFinding({ id: 'f1', evidenceLevel: 'contextual' }),
+      makeFinding({ id: 'f2', source: 'structural', evidenceLevel: undefined }),
     ]
 
     const { scored } = scoreFindings(findings, 'verified', PROJECT_CONTEXT)
 
-    expect(scored[0].confidence_score.base).toBe(0.50)
-    expect(scored[1].confidence_score.base).toBe(0.35) // default
+    expect(scored[0].confidence_score.base).toBe(0.45) // contextual
+    expect(scored[1].confidence_score.base).toBe(0.60) // structural → partial
+  })
+
+  it('stamps evidenceLevel on all output findings', () => {
+    const findings: Vulnerability[] = [
+      makeFinding({ id: 'f1', evidenceLevel: 'proven' }),
+      makeFinding({ id: 'f2', source: 'config', evidenceLevel: undefined }),
+    ]
+
+    const { scored } = scoreFindings(findings, 'verified', PROJECT_CONTEXT)
+
+    expect(scored[0].evidenceLevel).toBe('proven')
+    expect(scored[1].evidenceLevel).toBe('contextual') // config → contextual
   })
 
   it('test file findings get negative adjustments', () => {
     const findings: Vulnerability[] = [
       makeFinding({
         id: 'f1',
-        baseConfidence: 0.50,
+        evidenceLevel: 'partial',
         filePath: 'src/__tests__/auth.test.ts',
       }),
     ]
@@ -93,57 +107,63 @@ describe('scoreFindings', () => {
     const { scored } = scoreFindings(findings, 'verified', PROJECT_CONTEXT)
 
     expect(scored[0].confidence_score.adjustments.length).toBeGreaterThan(0)
-    expect(scored[0].confidence_score.score).toBeLessThan(0.50)
-    // test_file rule gives -0.35, so 0.50 - 0.35 = 0.15 (may also get scanner_code)
+    // partial base 0.60, test_file gives -0.35 → 0.25
+    expect(scored[0].confidence_score.score).toBeLessThan(0.60)
     const testFileAdj = scored[0].confidence_score.adjustments.find(a => a.factor === 'test_file')
     expect(testFileAdj).toBeDefined()
     expect(testFileAdj!.delta).toBe(-0.35)
   })
 
-  it('experimental-equivalent detectors route to suppress', () => {
+  it('pattern_only findings with penalties route to suppress', () => {
     const findings: Vulnerability[] = [
-      makeFinding({ id: 'f1', baseConfidence: 0.15, category: 'ai_pattern' }),
-      makeFinding({ id: 'f2', baseConfidence: 0.10, category: 'security_bypass' }),
+      makeFinding({
+        id: 'f1',
+        evidenceLevel: 'pattern_only',
+        category: 'ai_pattern',
+        severity: 'info',
+      }),
     ]
 
     const { scored } = scoreFindings(findings, 'verified', PROJECT_CONTEXT)
 
-    // 0.15 < validateThreshold(0.20) → suppress
-    expect(scored[0].confidence_score.routing).toBe('suppress')
-    // 0.10 < validateThreshold(0.20) → suppress
-    expect(scored[1].confidence_score.routing).toBe('suppress')
+    // pattern_only base 0.30, info_severity_low_priority or low_severity_ai_pattern may apply
+    // Even without penalties, 0.30 >= 0.20 → validate
+    // With penalties it should go lower
+    expect(scored[0].confidence_score.score).toBeLessThanOrEqual(0.30)
   })
 
-  it('high-confidence findings route to surface', () => {
+  it('proven findings route to surface at verified depth', () => {
     const findings: Vulnerability[] = [
-      makeFinding({ id: 'f1', baseConfidence: 0.70, category: 'hardcoded_secret' }),
+      makeFinding({ id: 'f1', evidenceLevel: 'proven', category: 'sql_injection' }),
     ]
 
     const { scored } = scoreFindings(findings, 'verified', PROJECT_CONTEXT)
+    // proven base 0.90 >= surfaceThreshold(0.80) → surface
     expect(scored[0].confidence_score.routing).toBe('surface')
   })
 
-  it('medium-confidence findings route to validate in verified depth', () => {
+  it('partial findings route to validate in verified depth', () => {
     const findings: Vulnerability[] = [
-      makeFinding({ id: 'f1', baseConfidence: 0.50, category: 'config_audit' }),
+      makeFinding({ id: 'f1', evidenceLevel: 'partial', category: 'xss' }),
     ]
 
     const { scored } = scoreFindings(findings, 'verified', PROJECT_CONTEXT)
+    // partial base 0.60 < surfaceThreshold(0.80) and 0.60 >= validateThreshold(0.35) → validate
     expect(scored[0].confidence_score.routing).toBe('validate')
   })
 
-  it('local depth only surfaces high-confidence findings', () => {
+  it('local depth surfaces proven, suppresses others', () => {
     const findings: Vulnerability[] = [
-      makeFinding({ id: 'f1', baseConfidence: 0.70 }),
-      makeFinding({ id: 'f2', baseConfidence: 0.50 }),
-      makeFinding({ id: 'f3', baseConfidence: 0.20 }),
+      makeFinding({ id: 'f1', evidenceLevel: 'proven' }),
+      makeFinding({ id: 'f2', evidenceLevel: 'partial' }),
+      makeFinding({ id: 'f3', evidenceLevel: 'pattern_only' }),
     ]
 
     const { scored } = scoreFindings(findings, 'local', PROJECT_CONTEXT)
 
-    expect(scored[0].confidence_score.routing).toBe('surface')
-    expect(scored[1].confidence_score.routing).toBe('suppress') // No AI in local
-    expect(scored[2].confidence_score.routing).toBe('suppress')
+    expect(scored[0].confidence_score.routing).toBe('surface')  // 0.90 >= 0.70
+    expect(scored[1].confidence_score.routing).toBe('suppress') // No AI in local, 0.60 < 0.70
+    expect(scored[2].confidence_score.routing).toBe('suppress') // 0.30 < 0.70
   })
 })
 
@@ -153,13 +173,15 @@ describe('DEPTH_CONFIGS', () => {
     expect(DEPTH_CONFIGS.local.surfaceThreshold).toBe(0.70)
   })
 
-  it('verified has AI enabled', () => {
+  it('verified has AI enabled with raised surface threshold', () => {
     expect(DEPTH_CONFIGS.verified.aiEnabled).toBe(true)
-    expect(DEPTH_CONFIGS.verified.validateThreshold).toBe(0.20)
+    expect(DEPTH_CONFIGS.verified.surfaceThreshold).toBe(0.80)
+    expect(DEPTH_CONFIGS.verified.validateThreshold).toBe(0.35)
   })
 
   it('deep has lowest validate threshold', () => {
     expect(DEPTH_CONFIGS.deep.aiEnabled).toBe(true)
+    expect(DEPTH_CONFIGS.deep.surfaceThreshold).toBe(0.80)
     expect(DEPTH_CONFIGS.deep.validateThreshold).toBe(0.10)
   })
 })

package/src/__tests__/score/taint-adjustments.test.ts

@@ -1,244 +1,30 @@
 /**
  * Tests for taint adjustment rules in the confidence scoring system.
+ *
+ * Phase 7: The 4 taint adjustment rules were absorbed into evidence-based scoring.
+ * TAINT_RULES is now empty — these tests verify the removal.
  */
 
 import { TAINT_RULES } from '../../score/adjustments'
-import type { AdjustmentContext } from '../../score/types'
-import type { Vulnerability } from '../../shared/types'
 
-function makeFinding(overrides: Partial<Vulnerability> = {}): Vulnerability {
-  return {
-    id: 'test-1',
-    filePath: 'src/app.ts',
-    lineNumber: 10,
-    lineContent: 'db.query(userInput)',
-    severity: 'medium',
-    category: 'dangerous_function',
-    title: 'Test finding',
-    description: 'Test',
-    confidence: 'medium',
-    layer: 2,
-    baseConfidence: 0.50,
-    ...overrides,
-  }
-}
-
-function makeContext(overrides: Partial<AdjustmentContext> = {}): AdjustmentContext {
-  return {
-    file: {
-      isTestFile: false,
-      isExampleFile: false,
-      isDocFile: false,
-      isScannerCode: false,
-      isToolingDir: false,
-      isServerOnly: false,
-      isClientBundled: false,
-    },
-    project: {
-      hasAuthMiddleware: false,
-      hasTypeScript: true,
-      orm: null,
-      validationLib: null,
-    },
-    lineContent: 'db.query(userInput)',
-    filePath: 'src/app.ts',
-    ...overrides,
-  }
-}
-
-function findRule(name: string) {
-  return TAINT_RULES.find(r => r.name === name)
-}
-
-describe('Taint Adjustment Rules', () => {
-  it('has exactly 4 rules', () => {
-    expect(TAINT_RULES).toHaveLength(4)
-  })
-
-  describe('confirmed_taint_unsanitised', () => {
-    const rule = findRule('confirmed_taint_unsanitised')!
-
-    it('exists with correct delta', () => {
-      expect(rule).toBeDefined()
-      expect(rule.delta).toBe(0.35)
-      expect(rule.source).toBe('taint')
-    })
-
-    it('applies when taint is confirmed, unsanitised, and not low confidence', () => {
-      const finding = makeFinding()
-      const ctx = makeContext({
-        taint: { confirmed: true, sources: ['http_body'], sinkType: 'sql_query', sanitised: false, confidence: 'high' },
-      })
-      expect(rule.applies(finding, ctx)).toBe(true)
-    })
-
-    it('applies with medium confidence', () => {
-      const finding = makeFinding()
-      const ctx = makeContext({
-        taint: { confirmed: true, sources: ['http_body'], sinkType: 'sql_query', sanitised: false, confidence: 'medium' },
-      })
-      expect(rule.applies(finding, ctx)).toBe(true)
-    })
-
-    it('does not apply when sanitised', () => {
-      const finding = makeFinding()
-      const ctx = makeContext({
-        taint: { confirmed: true, sources: ['http_body'], sinkType: 'sql_query', sanitised: true, confidence: 'high' },
-      })
-      expect(rule.applies(finding, ctx)).toBe(false)
-    })
-
-    it('does not apply with low confidence', () => {
-      const finding = makeFinding()
-      const ctx = makeContext({
-        taint: { confirmed: true, sources: ['cli_args'], sinkType: 'sql_query', sanitised: false, confidence: 'low' },
-      })
-      expect(rule.applies(finding, ctx)).toBe(false)
-    })
-
-    it('does not apply when taint is undefined', () => {
-      const finding = makeFinding()
-      const ctx = makeContext()
-      expect(rule.applies(finding, ctx)).toBe(false)
-    })
+describe('Taint Adjustment Rules (Phase 7: Absorbed into Evidence Levels)', () => {
+  it('TAINT_RULES is empty (4 rules absorbed into evidence-based scoring)', () => {
+    expect(TAINT_RULES).toHaveLength(0)
   })
 
-  describe('confirmed_taint_sanitised', () => {
-    const rule = findRule('confirmed_taint_sanitised')!
-
-    it('exists with correct delta', () => {
-      expect(rule).toBeDefined()
-      expect(rule.delta).toBe(0.15)
-    })
-
-    it('applies when taint is confirmed and sanitised', () => {
-      const finding = makeFinding()
-      const ctx = makeContext({
-        taint: { confirmed: true, sources: ['http_body'], sinkType: 'sql_query', sanitised: true, confidence: 'high' },
-      })
-      expect(rule.applies(finding, ctx)).toBe(true)
-    })
-
-    it('does not apply when not sanitised', () => {
-      const finding = makeFinding()
-      const ctx = makeContext({
-        taint: { confirmed: true, sources: ['http_body'], sinkType: 'sql_query', sanitised: false, confidence: 'high' },
-      })
-      expect(rule.applies(finding, ctx)).toBe(false)
-    })
+  it('no longer contains confirmed_taint_unsanitised', () => {
+    expect(TAINT_RULES.find(r => r.name === 'confirmed_taint_unsanitised')).toBeUndefined()
   })
 
-  describe('no_taint_path', () => {
-    const rule = findRule('no_taint_path')!
-
-    it('exists with correct delta', () => {
-      expect(rule).toBeDefined()
-      expect(rule.delta).toBe(-0.10)
-    })
-
-    it('applies for sink-relevant categories when taint is not confirmed', () => {
-      const finding = makeFinding({ category: 'dangerous_function' })
-      const ctx = makeContext({
-        taint: { confirmed: false, sources: [], sinkType: null, sanitised: false, confidence: null },
-      })
-      expect(rule.applies(finding, ctx)).toBe(true)
-    })
-
-    it('applies for sql_injection category', () => {
-      const finding = makeFinding({ category: 'sql_injection' })
-      const ctx = makeContext({
-        taint: { confirmed: false, sources: [], sinkType: null, sanitised: false, confidence: null },
-      })
-      expect(rule.applies(finding, ctx)).toBe(true)
-    })
-
-    it('applies for xss category', () => {
-      const finding = makeFinding({ category: 'xss' })
-      const ctx = makeContext({
-        taint: { confirmed: false, sources: [], sinkType: null, sanitised: false, confidence: null },
-      })
-      expect(rule.applies(finding, ctx)).toBe(true)
-    })
-
-    it('does not apply for non-sink categories', () => {
-      const finding = makeFinding({ category: 'hardcoded_secret' })
-      const ctx = makeContext({
-        taint: { confirmed: false, sources: [], sinkType: null, sanitised: false, confidence: null },
-      })
-      expect(rule.applies(finding, ctx)).toBe(false)
-    })
-
-    it('does not apply when taint is confirmed', () => {
-      const finding = makeFinding({ category: 'dangerous_function' })
-      const ctx = makeContext({
-        taint: { confirmed: true, sources: ['http_body'], sinkType: 'sql_query', sanitised: false, confidence: 'high' },
-      })
-      expect(rule.applies(finding, ctx)).toBe(false)
-    })
-
-    it('does not apply when taint is undefined (unanalyzed file)', () => {
-      const finding = makeFinding({ category: 'dangerous_function' })
-      const ctx = makeContext()
-      expect(rule.applies(finding, ctx)).toBe(false)
-    })
+  it('no longer contains confirmed_taint_sanitised', () => {
+    expect(TAINT_RULES.find(r => r.name === 'confirmed_taint_sanitised')).toBeUndefined()
   })
 
-  describe('low_confidence_taint', () => {
-    const rule = findRule('low_confidence_taint')!
-
-    it('exists with correct delta', () => {
-      expect(rule).toBeDefined()
-      expect(rule.delta).toBe(0.10)
-    })
-
-    it('applies for confirmed, unsanitised, low-confidence taint', () => {
-      const finding = makeFinding()
-      const ctx = makeContext({
-        taint: { confirmed: true, sources: ['cli_args'], sinkType: 'sql_query', sanitised: false, confidence: 'low' },
-      })
-      expect(rule.applies(finding, ctx)).toBe(true)
-    })
-
-    it('does not apply for high confidence', () => {
-      const finding = makeFinding()
-      const ctx = makeContext({
-        taint: { confirmed: true, sources: ['http_body'], sinkType: 'sql_query', sanitised: false, confidence: 'high' },
-      })
-      expect(rule.applies(finding, ctx)).toBe(false)
-    })
-
-    it('does not apply when sanitised', () => {
-      const finding = makeFinding()
-      const ctx = makeContext({
-        taint: { confirmed: true, sources: ['cli_args'], sinkType: 'sql_query', sanitised: true, confidence: 'low' },
-      })
-      expect(rule.applies(finding, ctx)).toBe(false)
-    })
+  it('no longer contains no_taint_path', () => {
+    expect(TAINT_RULES.find(r => r.name === 'no_taint_path')).toBeUndefined()
   })
 
-  describe('Rule mutual exclusivity', () => {
-    it('confirmed_taint_unsanitised and low_confidence_taint do not both apply for high confidence', () => {
-      const finding = makeFinding()
-      const ctx = makeContext({
-        taint: { confirmed: true, sources: ['http_body'], sinkType: 'sql_query', sanitised: false, confidence: 'high' },
-      })
-      const unsanitised = findRule('confirmed_taint_unsanitised')!
-      const lowConf = findRule('low_confidence_taint')!
-
-      expect(unsanitised.applies(finding, ctx)).toBe(true)
-      expect(lowConf.applies(finding, ctx)).toBe(false)
-    })
-
-    it('only low_confidence_taint applies for low confidence unsanitised', () => {
-      const finding = makeFinding()
-      const ctx = makeContext({
-        taint: { confirmed: true, sources: ['cli_args'], sinkType: 'sql_query', sanitised: false, confidence: 'low' },
-      })
-      const unsanitised = findRule('confirmed_taint_unsanitised')!
-      const lowConf = findRule('low_confidence_taint')!
-
-      expect(unsanitised.applies(finding, ctx)).toBe(false)
-      expect(lowConf.applies(finding, ctx)).toBe(true)
-    })
+  it('no longer contains low_confidence_taint', () => {
+    expect(TAINT_RULES.find(r => r.name === 'low_confidence_taint')).toBeUndefined()
   })
 })