@orkastery/cli 0.5.6 → 0.6.1

package/dist/security-scan/normalize/actionlint.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.actionlint = actionlint;
+const util_1 = require("./util");
+/** actionlint JSON: paths are relative to the repository root (it runs from there). The snippet is its first source line (the rest is the caret ruler, which moves with the column). */
+function actionlint(output, ctx) {
+    const list = (0, util_1.parseReport)('actionlint', output);
+    return list.map(e => ({
+        tool: 'actionlint', rule: `actionlint/${e.kind ?? 'error'}`, category: 'workflow', severity: (0, util_1.mapSeverity)('actionlint', 'any'),
+        file: (0, util_1.repoPath)(e.filepath, ctx), line: e.line, message: e.message ?? '', snippet: (e.snippet ?? e.message ?? '').split('\n')[0],
+    }));
+}

package/dist/security-scan/normalize/eslint.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.eslint = eslint;
+const util_1 = require("./util");
+/** ESLint JSON: `filePath` is absolute inside the container. A message without a rule is a parse error. */
+function eslint(output, ctx) {
+    const files = (0, util_1.parseReport)('eslint', output);
+    return files.flatMap(f => (0, util_1.asArray)(f.messages).map(m => ({
+        tool: 'eslint', rule: m.ruleId ?? 'parse-error', category: 'quality', severity: (0, util_1.mapSeverity)('eslint', m.severity), stack: 'js',
+        file: (0, util_1.repoPath)(f.filePath, ctx), line: m.line, message: m.message ?? '', snippet: m.message ?? '',
+    })));
+}

package/dist/security-scan/normalize/gitleaks.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gitleaks = gitleaks;
+const util_1 = require("./util");
+/** The secret value never leaves this function: the snippet is its sha256, and Match/Secret/commit data are dropped. */
+function gitleaks(output, ctx) {
+    const leaks = (0, util_1.parseReport)('gitleaks', output);
+    return leaks.map(l => ({
+        tool: 'gitleaks', rule: l.RuleID ?? 'unknown', category: 'secret', severity: (0, util_1.mapSeverity)('gitleaks', 'any'),
+        file: (0, util_1.repoPath)(l.File ?? '', ctx), line: l.StartLine, message: l.Description ?? l.RuleID ?? 'secret',
+        snippet: (0, util_1.sha256)(l.Secret ?? l.Match ?? ''),
+    }));
+}

package/dist/security-scan/normalize/golangci-lint.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.golangciLint = golangciLint;
+const util_1 = require("./util");
+/** golangci-lint JSON: runs inside the stack directory, so `Pos.Filename` is relative to it (or `../src/..` from the root mount). */
+function golangciLint(output, ctx) {
+    const report = (0, util_1.parseReport)('golangci-lint', output);
+    return (0, util_1.asArray)(report.Issues).map(i => ({
+        tool: 'golangci-lint', rule: i.FromLinter ?? 'unknown', category: 'quality', severity: (0, util_1.mapSeverity)('golangci-lint', i.FromLinter), stack: 'go',
+        file: (0, util_1.repoPath)(i.Pos?.Filename ?? '', ctx, 'stack'), line: i.Pos?.Line, message: i.Text ?? '',
+        snippet: (0, util_1.asArray)(i.SourceLines).join('\n') || (i.Text ?? ''),
+    }));
+}

package/dist/security-scan/normalize/govulncheck.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.govulncheck = govulncheck;
+const util_1 = require("./util");
+/**
+ * govulncheck `-format json` is a stream. One finding per advisory and vulnerable module; `reachable` is true when
+ * some trace of it has a function frame in the user's own module (the first SBOM module, the one without version).
+ */
+function govulncheck(output, ctx) {
+    const messages = (0, util_1.parseReport)('govulncheck', output);
+    const main = messages.find(m => m.SBOM)?.SBOM?.modules?.[0]?.path;
+    const summaries = new Map();
+    for (const m of messages)
+        if (m.osv)
+            summaries.set(m.osv.id, m.osv.summary ?? m.osv.id);
+    const byKey = new Map();
+    for (const m of messages) {
+        if (!m.finding)
+            continue;
+        const trace = (0, util_1.asArray)(m.finding.trace);
+        const module = trace[0]?.module ?? 'unknown';
+        const calledFromMain = main !== undefined && trace.some(fr => fr.module === main && fr.function !== undefined);
+        const key = `${m.finding.osv}|${module}`;
+        const known = byKey.get(key);
+        if (known) {
+            if (calledFromMain)
+                known.reachable = true;
+            continue;
+        }
+        byKey.set(key, {
+            tool: 'govulncheck', rule: m.finding.osv, category: 'dependency', severity: (0, util_1.mapSeverity)('govulncheck', 'any'), stack: 'go',
+            file: (0, util_1.stackFile)('go.mod', ctx), message: summaries.get(m.finding.osv) ?? m.finding.osv, snippet: module, reachable: calledFromMain,
+        });
+    }
+    return [...byKey.values()];
+}

package/dist/security-scan/normalize/index.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NORMALIZERS = exports.partialOf = void 0;
+const actionlint_1 = require("./actionlint");
+const eslint_1 = require("./eslint");
+const gitleaks_1 = require("./gitleaks");
+const golangci_lint_1 = require("./golangci-lint");
+const govulncheck_1 = require("./govulncheck");
+const npm_audit_1 = require("./npm-audit");
+const osv_scanner_1 = require("./osv-scanner");
+const oxlint_1 = require("./oxlint");
+const pip_audit_1 = require("./pip-audit");
+const ruff_1 = require("./ruff");
+const semgrep_1 = require("./semgrep");
+const trivy_1 = require("./trivy");
+const zizmor_1 = require("./zizmor");
+var util_1 = require("./util");
+Object.defineProperty(exports, "partialOf", { enumerable: true, get: function () { return util_1.partialOf; } });
+/** One normalizer per catalog tool (key = catalog name). Output that breaks the tool's `expect` contract throws `security-scan.parse`. */
+exports.NORMALIZERS = {
+    gitleaks: gitleaks_1.gitleaks, semgrep: semgrep_1.semgrep, 'trivy-vuln': trivy_1.trivyVuln, 'trivy-config': trivy_1.trivyConfig, 'trivy-license': trivy_1.trivyLicense,
+    'npm-audit': npm_audit_1.npmAudit, 'pip-audit': pip_audit_1.pipAudit, govulncheck: govulncheck_1.govulncheck, zizmor: zizmor_1.zizmor, actionlint: actionlint_1.actionlint, eslint: eslint_1.eslint, ruff: ruff_1.ruff, 'golangci-lint': golangci_lint_1.golangciLint,
+    // RM-072 (D13): as ferramentas do catalogo so do Agile (tools-agil.json), atras de flag.
+    'osv-scanner': osv_scanner_1.osvScanner, oxlint: oxlint_1.oxlint,
+};

package/dist/security-scan/normalize/npm-audit.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.npmAudit = npmAudit;
+const util_1 = require("./util");
+/**
+ * npm audit v2: one finding per advisory (the `via` objects), deduplicated per package. A `via` that is a string only
+ * says the package is affected through another one, whose own entry carries the advisory. The report names no file,
+ * so the finding is on the stack's `package-lock.json` (the audit runs with `--package-lock-only`).
+ */
+function npmAudit(output, ctx) {
+    const report = (0, util_1.parseReport)('npm-audit', output);
+    const seen = new Set();
+    const out = [];
+    for (const [pkg, v] of Object.entries(report.vulnerabilities)) {
+        for (const via of v.via ?? []) {
+            if (typeof via === 'string')
+                continue;
+            const rule = /GHSA-[0-9a-z-]+/i.exec(via.url ?? '')?.[0] ?? `npm:${via.source ?? via.title ?? 'unknown'}`;
+            const key = `${pkg}|${rule}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            out.push({
+                tool: 'npm-audit', rule, category: 'dependency', severity: (0, util_1.mapSeverity)('npm-audit', via.severity), stack: 'js',
+                file: (0, util_1.stackFile)('package-lock.json', ctx), message: via.title ?? rule, snippet: via.name ?? pkg,
+            });
+        }
+    }
+    return out;
+}

package/dist/security-scan/normalize/osv-scanner.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.osvScanner = osvScanner;
+const util_1 = require("./util");
+/** A pontuacao CVSS do grupo em severidade (as faixas do CVSS 3); sem ela, a do advisory; sem nada, o padrao. */
+function severidade(grupo, vulns) {
+    const nota = Number(grupo.max_severity);
+    if (grupo.max_severity && Number.isFinite(nota) && nota > 0)
+        return nota >= 9 ? 'critical' : nota >= 7 ? 'high' : nota >= 4 ? 'medium' : 'low';
+    return (0, util_1.mapSeverity)('osv-scanner', vulns.map(v => v.database_specific?.severity).find(Boolean));
+}
+/**
+ * RM-072 (D13): osv-scanner v2 (`scan source --format json`), so no Agile Check e atras de `check.agile.osv_scanner`. Um
+ * achado por grupo de aliases (o mesmo problema com id do GHSA, do PYSEC ou do Go vira um so), com o primeiro id do
+ * grupo como regra e o pacote como trecho, no lockfile que o resultado nomeia.
+ */
+function osvScanner(output, ctx) {
+    const report = (0, util_1.parseReport)('osv-scanner', output);
+    const out = [];
+    for (const r of (0, util_1.asArray)(report.results)) {
+        for (const p of (0, util_1.asArray)(r.packages)) {
+            const porId = new Map((0, util_1.asArray)(p.vulnerabilities).map(v => [v.id, v]));
+            const grupos = (0, util_1.asArray)(p.groups).length ? (0, util_1.asArray)(p.groups) : (0, util_1.asArray)(p.vulnerabilities).map(v => ({ ids: [v.id] }));
+            for (const g of grupos) {
+                const vulns = g.ids.map(id => porId.get(id)).filter((v) => !!v);
+                out.push({ tool: 'osv-scanner', rule: g.ids[0], category: 'dependency', severity: severidade(g, vulns),
+                    file: (0, util_1.repoPath)(r.source.path, ctx), message: vulns.find(v => v.summary)?.summary ?? g.ids[0], snippet: p.package.name });
+            }
+        }
+    }
+    return out;
+}

package/dist/security-scan/normalize/oxlint.js

@@ -0,0 +1,51 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oxlint = oxlint;
+const path = __importStar(require("node:path"));
+const util_1 = require("./util");
+/**
+ * RM-072 (D13): oxlint `--format json`, so no Agile Check e atras de `check.agile.oxlint`, como primeiro passe antes do
+ * `eslint` (nao tira regra dele). O `filename` e relativo ao diretorio da stack, onde o wrapper roda; a regra e o
+ * `code` (`eslint(no-eval)`, `unicorn(...)`), e o trecho e a mensagem, como no `eslint`.
+ */
+function oxlint(output, ctx) {
+    const report = (0, util_1.parseReport)('oxlint', output);
+    return (0, util_1.asArray)(report.diagnostics).map(d => ({
+        tool: 'oxlint', rule: d.code ?? 'oxlint', category: 'quality', severity: (0, util_1.mapSeverity)('oxlint', d.severity), stack: 'js',
+        file: path.posix.normalize(path.posix.join(ctx.stackDir, d.filename ?? '')), line: (0, util_1.asArray)(d.labels)[0]?.span?.line,
+        message: d.message ?? '', snippet: d.message ?? '',
+    }));
+}

package/dist/security-scan/normalize/pip-audit.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pipAudit = pipAudit;
+const util_1 = require("./util");
+/**
+ * pip-audit gives no severity and no file. The catalog severityMap is `{"*": "high"}` (as govulncheck's): the safe side
+ * is to let a known vulnerable dependency reach the loop, never to hide it as medium.
+ * The file is the stack's `requirements.txt`, the only manifest the catalog command audits.
+ */
+function pipAudit(output, ctx) {
+    const report = (0, util_1.parseReport)('pip-audit', output);
+    return (0, util_1.asArray)(report.dependencies).flatMap(d => (0, util_1.asArray)(d.vulns).map(v => ({
+        tool: 'pip-audit', rule: v.id, category: 'dependency', severity: (0, util_1.mapSeverity)('pip-audit', 'any'), stack: 'python',
+        file: (0, util_1.stackFile)('requirements.txt', ctx), message: v.description?.split('\n')[0] ?? v.id, snippet: d.name,
+    })));
+}

package/dist/security-scan/normalize/ruff.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ruff = ruff;
+const util_1 = require("./util");
+/** Ruff JSON: `filename` is absolute inside the container. */
+function ruff(output, ctx) {
+    const list = (0, util_1.parseReport)('ruff', output);
+    return list.map(d => ({
+        tool: 'ruff', rule: d.code ?? 'syntax-error', category: 'quality', severity: (0, util_1.mapSeverity)('ruff', 'any'), stack: 'python',
+        file: (0, util_1.repoPath)(d.filename, ctx), line: d.location?.row, message: d.message ?? '', snippet: d.message ?? '',
+    }));
+}

package/dist/security-scan/normalize/semgrep.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.semgrep = semgrep;
+const util_1 = require("./util");
+/**
+ * Semgrep JSON. `extra.lines` needs a login in the OSS CLI, so the snippet is the text bound to the rule's
+ * metavariables when there are any, else the rule message: both survive a line shift. Paths are relative to the
+ * directory Semgrep ran from, the repository root.
+ */
+function semgrep(output, ctx) {
+    const report = (0, util_1.parseReport)('semgrep', output);
+    return (0, util_1.asArray)(report.results).map(r => {
+        const bound = Object.values(r.extra.metavars ?? {}).map(m => m.abstract_content ?? '').join(' ').trim();
+        const message = r.extra.message ?? r.check_id;
+        return {
+            tool: 'semgrep', rule: r.check_id, category: 'sast', severity: (0, util_1.mapSeverity)('semgrep', r.extra.severity),
+            file: (0, util_1.repoPath)(r.path, ctx), line: r.start?.line, message, snippet: bound || message,
+        };
+    });
+}

package/dist/security-scan/normalize/trivy.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.trivyVuln = trivyVuln;
+exports.trivyConfig = trivyConfig;
+exports.trivyLicense = trivyLicense;
+const util_1 = require("./util");
+const results = (tool, output) => (0, util_1.asArray)((0, util_1.parseReport)(tool, output).Results);
+/** Trivy fs `--scanners vuln`: one finding per advisory and package; the snippet is the package name (no version, so a bump that keeps the CVE stays `existing`). */
+function trivyVuln(output, ctx) {
+    return results('trivy-vuln', output).flatMap(r => (0, util_1.asArray)(r.Vulnerabilities).map(v => ({
+        tool: 'trivy-vuln', rule: v.VulnerabilityID, category: 'dependency', severity: (0, util_1.mapSeverity)('trivy-vuln', v.Severity),
+        file: (0, util_1.repoPath)(r.Target, ctx), message: v.Title ?? v.Description ?? v.VulnerabilityID, snippet: v.PkgName ?? '',
+    })));
+}
+/** Trivy config: failed checks only; the snippet is the offending source line, else the check message. */
+function trivyConfig(output, ctx) {
+    return results('trivy-config', output).flatMap(r => (0, util_1.asArray)(r.Misconfigurations).filter(m => m.Status === undefined || m.Status === 'FAIL').map(m => {
+        const cause = (0, util_1.asArray)(m.CauseMetadata?.Code?.Lines).filter(l => l.IsCause).map(l => l.Content ?? '').join('\n').trim();
+        return {
+            tool: 'trivy-config', rule: m.ID, category: 'iac', severity: (0, util_1.mapSeverity)('trivy-config', m.Severity),
+            file: (0, util_1.repoPath)(r.Target, ctx), line: m.CauseMetadata?.StartLine, message: m.Message ?? m.Title ?? m.ID,
+            snippet: cause || (m.Message ?? m.ID),
+        };
+    }));
+}
+/** Trivy license: one finding per package and license name. */
+function trivyLicense(output, ctx) {
+    return results('trivy-license', output).flatMap(r => (0, util_1.asArray)(r.Licenses).map(l => ({
+        tool: 'trivy-license', rule: l.Name ?? 'unknown', category: 'license', severity: (0, util_1.mapSeverity)('trivy-license', l.Severity),
+        file: (0, util_1.repoPath)(l.FilePath || r.Target, ctx), message: `${l.PkgName ?? ''} ${l.Name ?? ''} (${l.Category ?? 'license'})`.trim(),
+        snippet: l.PkgName ?? '',
+    })));
+}

package/dist/security-scan/normalize/util.js

@@ -0,0 +1,204 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.asArray = void 0;
+exports.sha256 = sha256;
+exports.parseError = parseError;
+exports.partialOf = partialOf;
+exports.parseReport = parseReport;
+exports.mapSeverity = mapSeverity;
+exports.repoPath = repoPath;
+exports.stackFile = stackFile;
+const crypto = __importStar(require("node:crypto"));
+const path = __importStar(require("node:path"));
+const tools_1 = require("../tools");
+let catalog;
+/** The catalog is read once per process: normalizers look a tool up for every finding. */
+// RM-072 (D13): as entradas do catalogo do Agile entram so pelo nome delas, que o Classic nao usa.
+const loadTools = () => (catalog ??= [...(0, tools_1.loadTools)(), ...(0, tools_1.loadAgileTools)()]);
+const DEFAULT_SEVERITY = 'medium';
+function sha256(text) {
+    return crypto.createHash('sha256').update(text).digest('hex');
+}
+function parseError(tool, reason) {
+    const first = (reason.split('\n').find(l => l.trim()) ?? '').trim().slice(0, 200);
+    return new Error(`security-scan.parse: ${tool}: ${first}`);
+}
+function parseJsonStream(text) {
+    const values = [];
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    let start = -1;
+    for (let i = 0; i < text.length; i++) {
+        const c = text[i];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (c === '\\')
+                escaped = true;
+            else if (c === '"')
+                inString = false;
+            continue;
+        }
+        if (c === '"')
+            inString = true;
+        else if (c === '{' || c === '[') {
+            if (depth++ === 0)
+                start = i;
+        }
+        else if (c === '}' || c === ']') {
+            if (--depth === 0)
+                values.push(JSON.parse(text.slice(start, i + 1)));
+            if (depth < 0)
+                throw Error('unbalanced JSON');
+        }
+        else if (depth === 0 && !/\s/.test(c))
+            throw Error(`unexpected "${c}" outside a JSON value`);
+    }
+    if (depth !== 0)
+        throw Error('truncated JSON');
+    return values;
+}
+const nonEmpty = (v) => Array.isArray(v) ? v.length > 0 : v !== undefined && v !== null && v !== '' && v !== false;
+/** The type of an error entry: Semgrep writes `"Timeout"` or `["PartialParsing", [locations]]`. */
+const typeOf = (e) => {
+    const t = e?.type;
+    return String(Array.isArray(t) ? t[0] : t ?? '');
+};
+const isTolerated = (e, tol) => e?.level === tol.level && tol.types.includes(typeOf(e));
+/**
+ * The non-fatal part of a tool report under the catalog `expect.tolerate` (Semgrep warn-level `Timeout` and
+ * `PartialParsing`): `partial-timeout: 2, partial-parsing: 1`, in the catalog order of the types; undefined when the
+ * tool has no `tolerate`, the output does not parse, or nothing was tolerated. `parseReport` already refused any entry
+ * outside the tolerance.
+ */
+function partialOf(catalogName, output) {
+    const tol = loadTools().find(t => t.name === catalogName)?.expect.tolerate;
+    if (!tol)
+        return undefined;
+    let list;
+    try {
+        list = JSON.parse(output)?.[tol.key];
+    }
+    catch {
+        return undefined;
+    }
+    if (!Array.isArray(list))
+        return undefined;
+    const kebab = (t) => t.replace(/^Partial/, '').replace(/([a-z0-9])([A-Z])/g, '$1-$2').toLowerCase();
+    const parts = tol.types.map(t => [t, list.filter(e => isTolerated(e, tol) && typeOf(e) === t).length])
+        .filter(([, n]) => n > 0).map(([t, n]) => `partial-${kebab(t)}: ${n}`);
+    return parts.length ? parts.join(', ') : undefined;
+}
+/** Parses a tool report and enforces the catalog `expect` contract (shape, requireKey, failIfKey); throws security-scan.parse. */
+function parseReport(tool, output, catalogName = tool) {
+    const spec = loadTools().find(t => t.name === catalogName);
+    if (!spec)
+        throw parseError(tool, 'not in the catalog');
+    const { shape, requireKey = [], failIfKey = [], tolerate } = spec.expect;
+    let value;
+    try {
+        if (shape === 'stream') {
+            const values = parseJsonStream(output);
+            if (values.length === 0)
+                throw Error('empty stream');
+            return values;
+        }
+        value = JSON.parse(output);
+    }
+    catch (e) {
+        // A secret scanner's output may hold the secret: its parse error carries a fixed reason, never output content.
+        if (spec.category === 'secret')
+            throw parseError(tool, 'invalid JSON');
+        throw parseError(tool, output.trim() ? output : e.message);
+    }
+    if (shape === 'array') {
+        if (!Array.isArray(value))
+            throw parseError(tool, 'expected a JSON array');
+        return value;
+    }
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        throw parseError(tool, 'expected a JSON object');
+    const obj = value;
+    for (const k of requireKey)
+        if (!(k in obj))
+            throw parseError(tool, `missing key "${k}"`);
+    for (const k of failIfKey) {
+        // Entries the catalog tolerates (non-fatal, see partialOf) do not fail the tool; any other entry does.
+        const v = tolerate?.key === k && Array.isArray(obj[k]) ? obj[k].filter(e => !isTolerated(e, tolerate)) : obj[k];
+        if (nonEmpty(v))
+            throw parseError(tool, `tool reported "${k}": ${JSON.stringify(v).slice(0, 160)}`);
+    }
+    return obj;
+}
+/**
+ * Severity through the catalog `severityMap`, case-insensitive, with '*' as the catch-all. A value the map does not
+ * know (or a tool without a map) is `medium`, never an exception.
+ */
+function mapSeverity(tool, raw, fallback = DEFAULT_SEVERITY) {
+    const map = loadTools().find(t => t.name === tool)?.severityMap;
+    if (!map)
+        return fallback;
+    const key = String(raw ?? '').toLowerCase();
+    for (const [k, v] of Object.entries(map))
+        if (k.toLowerCase() === key)
+            return v;
+    return map['*'] ?? fallback;
+}
+/**
+ * A file path as printed by a tool, made relative to the repository root with posix separators. An absolute path is
+ * taken under `ctx.root` (the container mount); a relative one is relative to the repository root, or to the stack
+ * directory when `from` is 'stack' (tools that run inside it). A path that leaves the mount is returned normalized.
+ */
+function repoPath(file, ctx, from = 'root') {
+    const mount = path.posix.resolve('/', (ctx.root || '/src').replaceAll('\\', '/'));
+    let f = file.replaceAll('\\', '/');
+    // golangci-lint run at the mount root prints `../src/x.go`: relative to a sibling of the mount, so root-relative.
+    const sibling = `../${path.posix.basename(mount)}/`;
+    if (f.startsWith(sibling))
+        f = path.posix.join(mount, f.slice(sibling.length));
+    const abs = path.posix.resolve(mount, from === 'stack' ? ctx.stackDir : '.', f);
+    const rel = path.posix.relative(mount, abs);
+    if (rel === '' || rel.startsWith('..'))
+        return path.posix.normalize(f);
+    return rel;
+}
+/** A file the stack owns (lockfile, requirements.txt, go.mod), inside the stack directory. */
+function stackFile(name, ctx) {
+    return path.posix.normalize(path.posix.join(ctx.stackDir.replaceAll('\\', '/'), name));
+}
+const asArray = (v) => Array.isArray(v) ? v : [];
+exports.asArray = asArray;

package/dist/security-scan/normalize/zizmor.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.zizmor = zizmor;
+const util_1 = require("./util");
+/** zizmor JSON (`--format json`). Rows are 0-based in the report, lines are 1-based here; the primary location wins. */
+function zizmor(output, ctx) {
+    const list = (0, util_1.parseReport)('zizmor', output);
+    return list.filter(z => !z.ignored).map(z => {
+        const loc = (0, util_1.asArray)(z.locations).find(l => l.symbolic?.kind === 'Primary') ?? (0, util_1.asArray)(z.locations)[0];
+        const local = loc?.symbolic?.key?.Local;
+        const row = loc?.concrete?.location?.start_point?.row;
+        return {
+            tool: 'zizmor', rule: z.ident, category: 'workflow', severity: (0, util_1.mapSeverity)('zizmor', z.determinations?.severity),
+            file: (0, util_1.repoPath)(local?.verbatim_path ?? local?.given_path ?? '', ctx), line: row === undefined ? undefined : row + 1,
+            message: [z.desc, loc?.symbolic?.annotation].filter(Boolean).join(': ') || z.ident,
+            snippet: loc?.concrete?.feature ?? z.desc ?? z.ident,
+        };
+    });
+}