@owasp-aghast/aghast 0.8.0-beta.0

package/dist/diff-parser.js

@@ -0,0 +1,112 @@
+/**
+ * Git diff parsing utility.
+ *
+ * Parses unified diff format (output of `git diff`) into a structured
+ * map of changed regions per file. Used by the diff filter to
+ * determine which code was changed.
+ */
+import { execFile } from 'node:child_process';
+import { readFile } from 'node:fs/promises';
+// --- Parsing ---
+/**
+ * Parse a unified diff string into a DiffMap.
+ *
+ * Extracts file paths and hunk headers, using the new-file line numbers
+ * (the `+` side) since we analyze the current state of the code.
+ *
+ * Handles:
+ * - Regular file modifications
+ * - Renames (maps to new path)
+ * - New files (entire file is changed)
+ * - Deleted files (excluded — no code to analyze)
+ * - Binary files (skipped)
+ */
+export function parseDiff(diffText) {
+    const result = new Map();
+    if (!diffText.trim())
+        return result;
+    const lines = diffText.split('\n').map(l => l.replace(/\r$/, ''));
+    let currentFile = null;
+    let isDeletedFile = false;
+    let isBinaryFile = false;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // New file diff header: "diff --git a/... b/..."
+        if (line.startsWith('diff --git ')) {
+            currentFile = null;
+            isDeletedFile = false;
+            isBinaryFile = false;
+            continue;
+        }
+        // Binary file marker
+        if (line.startsWith('Binary files ') || line === 'GIT binary patch') {
+            isBinaryFile = true;
+            continue;
+        }
+        // Deleted file marker
+        if (line === 'deleted file mode 100644' || line === 'deleted file mode 100755' || line.startsWith('deleted file mode ')) {
+            isDeletedFile = true;
+            continue;
+        }
+        // New file path: "+++ b/path" (the destination side of the diff)
+        if (line.startsWith('+++ b/')) {
+            if (isDeletedFile || isBinaryFile)
+                continue;
+            currentFile = line.slice(6); // Remove "+++ b/"
+            continue;
+        }
+        // Deleted file: "+++ /dev/null"
+        if (line === '+++ /dev/null') {
+            isDeletedFile = true;
+            currentFile = null;
+            continue;
+        }
+        // Hunk header: "@@ -old,len +new,len @@"
+        if (line.startsWith('@@ ') && currentFile && !isDeletedFile && !isBinaryFile) {
+            const match = line.match(/@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/);
+            if (match) {
+                const startLine = parseInt(match[1], 10);
+                const lineCount = match[2] !== undefined ? parseInt(match[2], 10) : 1;
+                // A hunk with 0 new lines means pure deletion in this region — skip
+                if (lineCount === 0)
+                    continue;
+                const endLine = startLine + lineCount - 1;
+                const hunk = { file: currentFile, startLine, endLine };
+                if (!result.has(currentFile)) {
+                    result.set(currentFile, []);
+                }
+                result.get(currentFile).push(hunk);
+            }
+            continue;
+        }
+    }
+    return result;
+}
+// --- Git integration ---
+/**
+ * Run `git diff <ref>` against a repository and return the raw unified diff.
+ */
+export async function getDiff(repoPath, ref) {
+    return new Promise((resolve, reject) => {
+        execFile('git', ['diff', ref], { cwd: repoPath, maxBuffer: 50 * 1024 * 1024 }, // 50MB buffer
+        (error, stdout, stderr) => {
+            if (error) {
+                reject(new Error(`git diff failed: ${stderr?.trim() || error.message}`));
+                return;
+            }
+            resolve(stdout);
+        });
+    });
+}
+/**
+ * Load a diff from a file path.
+ */
+export async function loadDiffFromFile(filePath) {
+    try {
+        return await readFile(filePath, 'utf-8');
+    }
+    catch (err) {
+        throw new Error(`Failed to read diff file: ${filePath}`, { cause: err });
+    }
+}
+//# sourceMappingURL=diff-parser.js.map

package/dist/diff-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-parser.js","sourceRoot":"","sources":["../src/diff-parser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAgB5C,kBAAkB;AAElB;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,MAAM,MAAM,GAAY,IAAI,GAAG,EAAE,CAAC;IAElC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC;IAEpC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAClE,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,iDAAiD;QACjD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,WAAW,GAAG,IAAI,CAAC;YACnB,aAAa,GAAG,KAAK,CAAC;YACtB,YAAY,GAAG,KAAK,CAAC;YACrB,SAAS;QACX,CAAC;QAED,qBAAqB;QACrB,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACpE,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QAED,sBAAsB;QACtB,IAAI,IAAI,KAAK,0BAA0B,IAAI,IAAI,KAAK,0BAA0B,IAAI,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACxH,aAAa,GAAG,IAAI,CAAC;YACrB,SAAS;QACX,CAAC;QAED,iEAAiE;QACjE,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,IAAI,aAAa,IAAI,YAAY;gBAAE,SAAS;YAC5C,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB;YAC/C,SAAS;QACX,CAAC;QAED,gCAAgC;QAChC,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC7B,aAAa,GAAG,IAAI,CAAC;YACrB,WAAW,GAAG,IAAI,CAAC;YACnB,SAAS;QACX,CAAC;QAED,yCAAyC;QACzC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,WAAW,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACnE,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAEtE,oEAAoE;gBACpE,IAAI,SAAS,KAAK,CAAC;oBAAE,SAAS;gBAE9B,MAAM,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC;gBAE1C,MAAM,IAAI,GAAa,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;gBAEjE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC7B,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;gBAC9B,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,CAAC;YACD,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,0BAA0B;AAE1B;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,QAAgB,EAAE,GAAW;IACzD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CACN,KAAK,EACL,CAAC,MAAM,EAAE,GAAG,CAAC,EACb,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,cAAc;QAC9D,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACxB,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,MAAM,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBACzE,OAAO;YACT,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC"}

package/dist/diff-unit-matcher.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Unit-to-diff matching with call graph traversal.
+ *
+ * Determines which OpenAnt code units are "touched" by a git diff:
+ * - Tier 1 (direct): unit's code region overlaps with a changed region
+ * - Tier 2 (flow): unit is a caller or callee of a directly-touched unit
+ *
+ * Also filters Semgrep findings to only those within touched units
+ * (or in files without OpenAnt coverage that have diff changes).
+ */
+import type { OpenAntUnit } from './openant-loader.js';
+import type { DiffMap, DiffHunk } from './diff-parser.js';
+/**
+ * Normalize file path to forward slashes for cross-platform comparison.
+ * Diffs always use forward slashes; OpenAnt uses backslashes on Windows.
+ */
+export declare function normalizePath(filePath: string): string;
+/**
+ * Look up a file in the DiffMap, normalising the key for cross-platform matching.
+ */
+export declare function diffMapGet(diffMap: DiffMap, filePath: string): DiffHunk[] | undefined;
+/**
+ * Check whether two line ranges overlap.
+ */
+export declare function rangesOverlap(aStart: number, aEnd: number, bStart: number, bEnd: number): boolean;
+/**
+ * Find all OpenAnt units that are "touched" by the diff.
+ *
+ * A unit is touched if:
+ * 1. Its code region directly overlaps with a changed region (Tier 1)
+ * 2. It is within `depth` hops in the call graph of a directly-touched unit (Tier 2)
+ *
+ * @param units All OpenAnt units (after any configured filtering)
+ * @param diffMap Changed regions from the parsed diff
+ * @param depth Call graph hops to follow (default: 1). 0 = direct only.
+ */
+export declare function findTouchedUnits(units: OpenAntUnit[], diffMap: DiffMap, depth?: number): OpenAntUnit[];
+/**
+ * Filter discovered findings to only those within the scope of touched units.
+ *
+ * Two-path logic:
+ * - Path A: Files with OpenAnt coverage — finding must be inside a touched unit
+ * - Path B: Files without OpenAnt coverage — include all findings if the file has diff changes
+ *
+ * Generic over T so any object carrying file/startLine/endLine (DiscoveredTarget,
+ * CheckTarget, etc.) can be filtered without conversion.
+ */
+export declare function filterFindingsByScope<T extends {
+    file: string;
+    startLine: number;
+    endLine: number;
+}>(findings: T[], touchedUnits: OpenAntUnit[], allUnits: OpenAntUnit[], diffMap: DiffMap): T[];
+//# sourceMappingURL=diff-unit-matcher.d.ts.map

package/dist/diff-unit-matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-unit-matcher.d.ts","sourceRoot":"","sources":["../src/diff-unit-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE1D;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,QAAQ,EAAE,GAAG,SAAS,CAUrF;AASD;;GAEG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAC5B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAC3B,OAAO,CAET;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,WAAW,EAAE,EACpB,OAAO,EAAE,OAAO,EAChB,KAAK,GAAE,MAAU,GAChB,WAAW,EAAE,CAkEf;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAClG,QAAQ,EAAE,CAAC,EAAE,EACb,YAAY,EAAE,WAAW,EAAE,EAC3B,QAAQ,EAAE,WAAW,EAAE,EACvB,OAAO,EAAE,OAAO,GACf,CAAC,EAAE,CAyBL"}

package/dist/diff-unit-matcher.js

@@ -0,0 +1,156 @@
+/**
+ * Unit-to-diff matching with call graph traversal.
+ *
+ * Determines which OpenAnt code units are "touched" by a git diff:
+ * - Tier 1 (direct): unit's code region overlaps with a changed region
+ * - Tier 2 (flow): unit is a caller or callee of a directly-touched unit
+ *
+ * Also filters Semgrep findings to only those within touched units
+ * (or in files without OpenAnt coverage that have diff changes).
+ */
+/**
+ * Normalize file path to forward slashes for cross-platform comparison.
+ * Diffs always use forward slashes; OpenAnt uses backslashes on Windows.
+ */
+export function normalizePath(filePath) {
+    return filePath.replace(/\\/g, '/');
+}
+/**
+ * Look up a file in the DiffMap, normalising the key for cross-platform matching.
+ */
+export function diffMapGet(diffMap, filePath) {
+    // Try exact match first (fast path)
+    const exact = diffMap.get(filePath);
+    if (exact)
+        return exact;
+    // Fall back to normalised comparison
+    const normalized = normalizePath(filePath);
+    for (const [key, value] of diffMap) {
+        if (normalizePath(key) === normalized)
+            return value;
+    }
+    return undefined;
+}
+/**
+ * Check whether a file exists in the DiffMap, normalising for cross-platform matching.
+ */
+function diffMapHas(diffMap, filePath) {
+    return diffMapGet(diffMap, filePath) !== undefined;
+}
+/**
+ * Check whether two line ranges overlap.
+ */
+export function rangesOverlap(aStart, aEnd, bStart, bEnd) {
+    return aStart <= bEnd && aEnd >= bStart;
+}
+/**
+ * Find all OpenAnt units that are "touched" by the diff.
+ *
+ * A unit is touched if:
+ * 1. Its code region directly overlaps with a changed region (Tier 1)
+ * 2. It is within `depth` hops in the call graph of a directly-touched unit (Tier 2)
+ *
+ * @param units All OpenAnt units (after any configured filtering)
+ * @param diffMap Changed regions from the parsed diff
+ * @param depth Call graph hops to follow (default: 1). 0 = direct only.
+ */
+export function findTouchedUnits(units, diffMap, depth = 1) {
+    const touchedIds = new Set();
+    // Tier 1: direct overlap with diff
+    for (const unit of units) {
+        const origin = unit.code.primary_origin;
+        const regions = diffMapGet(diffMap, origin.file_path);
+        if (regions && regions.some(r => rangesOverlap(origin.start_line, origin.end_line, r.startLine, r.endLine))) {
+            touchedIds.add(unit.id);
+        }
+    }
+    // Tier 2: call graph adjacency (N hops)
+    //
+    // Build a lookup of all identifiers that can refer to a unit: its id,
+    // its function_name, and its file_path:function_name. OpenAnt uses
+    // different formats across versions (qualified "file:func" in direct_calls
+    // vs unqualified "func" in function_name), so we match against all.
+    const unitIdsByName = new Map();
+    for (const unit of units) {
+        const origin = unit.code.primary_origin;
+        const names = [
+            unit.id,
+            origin.function_name,
+            `${normalizePath(origin.file_path)}:${origin.function_name}`,
+        ];
+        for (const name of names) {
+            if (!unitIdsByName.has(name))
+                unitIdsByName.set(name, new Set());
+            unitIdsByName.get(name).add(unit.id);
+        }
+    }
+    for (let hop = 0; hop < depth; hop++) {
+        const newlyTouched = new Set();
+        // For each currently touched unit, find its direct callees and callers
+        for (const unit of units) {
+            if (!touchedIds.has(unit.id))
+                continue;
+            const meta = unit.metadata;
+            // Units that this touched unit calls (callees)
+            for (const calleeName of (meta.direct_calls ?? [])) {
+                const calleeIds = unitIdsByName.get(calleeName) ?? unitIdsByName.get(normalizePath(calleeName));
+                if (calleeIds) {
+                    for (const id of calleeIds) {
+                        if (!touchedIds.has(id))
+                            newlyTouched.add(id);
+                    }
+                }
+            }
+            // Units that call this touched unit (callers)
+            for (const callerName of (meta.direct_callers ?? [])) {
+                const callerIds = unitIdsByName.get(callerName) ?? unitIdsByName.get(normalizePath(callerName));
+                if (callerIds) {
+                    for (const id of callerIds) {
+                        if (!touchedIds.has(id))
+                            newlyTouched.add(id);
+                    }
+                }
+            }
+        }
+        if (newlyTouched.size === 0)
+            break;
+        for (const id of newlyTouched)
+            touchedIds.add(id);
+    }
+    return units.filter(u => touchedIds.has(u.id));
+}
+/**
+ * Filter discovered findings to only those within the scope of touched units.
+ *
+ * Two-path logic:
+ * - Path A: Files with OpenAnt coverage — finding must be inside a touched unit
+ * - Path B: Files without OpenAnt coverage — include all findings if the file has diff changes
+ *
+ * Generic over T so any object carrying file/startLine/endLine (DiscoveredTarget,
+ * CheckTarget, etc.) can be filtered without conversion.
+ */
+export function filterFindingsByScope(findings, touchedUnits, allUnits, diffMap) {
+    // Determine which files have OpenAnt coverage (normalised for cross-platform)
+    const coveredFiles = new Set();
+    for (const unit of allUnits) {
+        coveredFiles.add(normalizePath(unit.code.primary_origin.file_path));
+    }
+    return findings.filter(finding => {
+        const normalizedFindingFile = normalizePath(finding.file);
+        if (coveredFiles.has(normalizedFindingFile)) {
+            // Path A: file has OpenAnt units — finding must overlap with a touched unit
+            // Uses overlap rather than strict containment because discovery tools may
+            // include context lines (e.g. Semgrep includes decorators above a function)
+            return touchedUnits.some(unit => {
+                const origin = unit.code.primary_origin;
+                return (normalizedFindingFile === normalizePath(origin.file_path) &&
+                    rangesOverlap(finding.startLine, finding.endLine, origin.start_line, origin.end_line));
+            });
+        }
+        else {
+            // Path B: file has NO OpenAnt units — include if file has diff changes
+            return diffMapHas(diffMap, finding.file);
+        }
+    });
+}
+//# sourceMappingURL=diff-unit-matcher.js.map

package/dist/diff-unit-matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-unit-matcher.js","sourceRoot":"","sources":["../src/diff-unit-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,OAAgB,EAAE,QAAgB;IAC3D,oCAAoC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,qCAAqC;IACrC,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,OAAgB,EAAE,QAAgB;IACpD,OAAO,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,SAAS,CAAC;AACrD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EAAE,IAAY,EAC5B,MAAc,EAAE,IAAY;IAE5B,OAAO,MAAM,IAAI,IAAI,IAAI,IAAI,IAAI,MAAM,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAoB,EACpB,OAAgB,EAChB,QAAgB,CAAC;IAEjB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,mCAAmC;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC5G,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,EAAE;IACF,sEAAsE;IACtE,mEAAmE;IACnE,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;QACxC,MAAM,KAAK,GAAG;YACZ,IAAI,CAAC,EAAE;YACP,MAAM,CAAC,aAAa;YACpB,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,aAAa,EAAE;SAC7D,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;YACjE,aAAa,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;QACrC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QAEvC,uEAAuE;QACvE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,SAAS;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;YAE3B,+CAA+C;YAC/C,KAAK,MAAM,UAAU,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;gBACnD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;gBAChG,IAAI,SAAS,EAAE,CAAC;oBACd,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;wBAC3B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;4BAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAChD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,8CAA8C;YAC9C,KAAK,MAAM,UAAU,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,CAAC;gBACrD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;gBAChG,IAAI,SAAS,EAAE,CAAC;oBACd,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;wBAC3B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;4BAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAChD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM;QACnC,KAAK,MAAM,EAAE,IAAI,YAAY;YAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAa,EACb,YAA2B,EAC3B,QAAuB,EACvB,OAAgB;IAEhB,8EAA8E;IAC9E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QAC/B,MAAM,qBAAqB,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,YAAY,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC5C,4EAA4E;YAC5E,0EAA0E;YAC1E,4EAA4E;YAC5E,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;gBACxC,OAAO,CACL,qBAAqB,KAAK,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;oBACzD,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CACtF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,uEAAuE;YACvE,OAAO,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/discoveries/openant-discovery.d.ts

@@ -0,0 +1,10 @@
+/**
+ * OpenAnt-based target discovery.
+ *
+ * Runs `openant parse` against the repository (or uses a mock dataset),
+ * filters the resulting code units, and returns them as targets with
+ * rich prompt enrichment (call graph, entry points, metadata).
+ */
+import type { TargetDiscovery } from '../discovery.js';
+export declare const openantDiscovery: TargetDiscovery;
+//# sourceMappingURL=openant-discovery.d.ts.map

package/dist/discoveries/openant-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openant-discovery.d.ts","sourceRoot":"","sources":["../../src/discoveries/openant-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAsC,MAAM,iBAAiB,CAAC;AAK3F,eAAO,MAAM,gBAAgB,EAAE,eAiD9B,CAAC"}

package/dist/discoveries/openant-discovery.js

@@ -0,0 +1,56 @@
+/**
+ * OpenAnt-based target discovery.
+ *
+ * Runs `openant parse` against the repository (or uses a mock dataset),
+ * filters the resulting code units, and returns them as targets with
+ * rich prompt enrichment (call graph, entry points, metadata).
+ */
+import { runOpenAnt } from '../openant-runner.js';
+import { loadDatasetFromFile, filterUnits, formatUnitPromptSection } from '../openant-loader.js';
+import { logProgress, logDebug } from '../logging.js';
+import { DEFAULT_GENERIC_PROMPT } from '../defaults.js';
+const TAG = 'openant-discovery';
+export const openantDiscovery = {
+    name: 'openant',
+    defaultGenericPrompt: DEFAULT_GENERIC_PROMPT,
+    needsInstructions: true,
+    supportsDiffFilter: true,
+    async discover(check, repoPath, options) {
+        const checkTarget = check.checkTarget;
+        // Reuse the scan runner's dataset when provided, otherwise run OpenAnt ourselves.
+        let datasetPath;
+        let cleanup;
+        if (options?.openantDatasetPath) {
+            logDebug(TAG, `Reusing preloaded OpenAnt dataset: ${options.openantDatasetPath}`);
+            datasetPath = options.openantDatasetPath;
+        }
+        else {
+            ({ datasetPath, cleanup } = await runOpenAnt(repoPath));
+        }
+        try {
+            // Load and filter units
+            const dataset = await loadDatasetFromFile(datasetPath);
+            const totalUnits = dataset.units.length;
+            const units = filterUnits(dataset.units, checkTarget.openant);
+            logProgress(TAG, `Loaded ${totalUnits} units (${units.length} after filtering)`);
+            return units.map((unit, idx) => {
+                const origin = unit.code.primary_origin;
+                return {
+                    file: origin.file_path,
+                    startLine: origin.start_line,
+                    endLine: origin.end_line,
+                    label: `[unit ${idx + 1}/${units.length}]`,
+                    promptEnrichment: formatUnitPromptSection(unit),
+                    agentOptions: { maxTurns: 20 },
+                };
+            });
+        }
+        finally {
+            if (cleanup) {
+                await cleanup();
+                logDebug(TAG, 'Cleaned up temporary OpenAnt output');
+            }
+        }
+    },
+};
+//# sourceMappingURL=openant-discovery.js.map

package/dist/discoveries/openant-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openant-discovery.js","sourceRoot":"","sources":["../../src/discoveries/openant-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,MAAM,GAAG,GAAG,mBAAmB,CAAC;AAEhC,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,IAAI,EAAE,SAAS;IACf,oBAAoB,EAAE,sBAAsB;IAC5C,iBAAiB,EAAE,IAAI;IACvB,kBAAkB,EAAE,IAAI;IAExB,KAAK,CAAC,QAAQ,CACZ,KAAoB,EACpB,QAAgB,EAChB,OAA0B;QAE1B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAY,CAAC;QAEvC,kFAAkF;QAClF,IAAI,WAAmB,CAAC;QACxB,IAAI,OAA0C,CAAC;QAC/C,IAAI,OAAO,EAAE,kBAAkB,EAAE,CAAC;YAChC,QAAQ,CAAC,GAAG,EAAE,sCAAsC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;YAClF,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC;YACH,wBAAwB;YACxB,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;YACvD,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YACxC,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;YAE9D,WAAW,CAAC,GAAG,EAAE,UAAU,UAAU,WAAW,KAAK,CAAC,MAAM,mBAAmB,CAAC,CAAC;YAEjF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;gBAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;gBACxC,OAAO;oBACL,IAAI,EAAE,MAAM,CAAC,SAAS;oBACtB,SAAS,EAAE,MAAM,CAAC,UAAU;oBAC5B,OAAO,EAAE,MAAM,CAAC,QAAQ;oBACxB,KAAK,EAAE,SAAS,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG;oBAC1C,gBAAgB,EAAE,uBAAuB,CAAC,IAAI,CAAC;oBAC/C,YAAY,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;iBAC/B,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,OAAO,EAAE,CAAC;gBAChB,QAAQ,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/discoveries/sarif-discovery.d.ts

@@ -0,0 +1,9 @@
+/**
+ * SARIF-based target discovery.
+ *
+ * Reads an external SARIF file (e.g. from another SAST tool) and
+ * returns findings as targets for AI analysis.
+ */
+import type { TargetDiscovery } from '../discovery.js';
+export declare const sarifDiscovery: TargetDiscovery;
+//# sourceMappingURL=sarif-discovery.d.ts.map

package/dist/discoveries/sarif-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif-discovery.d.ts","sourceRoot":"","sources":["../../src/discoveries/sarif-discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,KAAK,EAAE,eAAe,EAAsC,MAAM,iBAAiB,CAAC;AA0B3F,eAAO,MAAM,cAAc,EAAE,eA8C5B,CAAC"}

package/dist/discoveries/sarif-discovery.js

@@ -0,0 +1,56 @@
+/**
+ * SARIF-based target discovery.
+ *
+ * Reads an external SARIF file (e.g. from another SAST tool) and
+ * returns findings as targets for AI analysis.
+ */
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { parseSARIF, deduplicateTargets } from '../sarif-parser.js';
+import { logDebug } from '../logging.js';
+import { ERROR_CODES, formatError } from '../error-codes.js';
+import { DEFAULT_GENERIC_PROMPT } from '../defaults.js';
+const TAG = 'sarif-discovery';
+function buildFindingPromptEnrichment(file, startLine, endLine, message, snippet) {
+    const snippetSection = snippet ? `\n- Code snippet from tool: ${snippet}` : '';
+    return `\n\nFINDING DETAILS:
+
+- File: ${file}
+- Lines: ${startLine}-${endLine}
+- Tool's finding description: ${message}${snippetSection}
+
+You MUST:
+- Analyze ONLY this specific finding — do not search for or report issues at other locations
+- You may read other files to understand context (e.g., imports, type definitions, data flow), but only report issues for this finding
+- Do NOT scan the broader repository for other vulnerability patterns
+`;
+}
+export const sarifDiscovery = {
+    name: 'sarif',
+    defaultGenericPrompt: DEFAULT_GENERIC_PROMPT,
+    needsInstructions: true,
+    supportsDiffFilter: true,
+    async discover(check, repoPath, _options) {
+        const checkTarget = check.checkTarget;
+        if (!checkTarget.sarifFile) {
+            throw new Error(formatError(ERROR_CODES.E2004, `Check "${check.id}" uses sarif discovery but has no "sarifFile" in its check definition`));
+        }
+        // Resolve sarifFile relative to the target repo
+        const sarifFilePath = resolve(repoPath, checkTarget.sarifFile);
+        logDebug(TAG, `Reading SARIF file: ${sarifFilePath}`);
+        const sarifContent = await readFile(sarifFilePath, 'utf-8');
+        let targets = parseSARIF(sarifContent);
+        targets = deduplicateTargets(targets);
+        logDebug(TAG, `Discovered ${targets.length} findings`);
+        return targets.map((target, idx) => ({
+            file: target.file,
+            startLine: target.startLine,
+            endLine: target.endLine,
+            label: `[finding ${idx + 1}/${targets.length}]`,
+            message: target.message,
+            snippet: target.snippet,
+            promptEnrichment: buildFindingPromptEnrichment(target.file, target.startLine, target.endLine, target.message, target.snippet),
+        }));
+    },
+};
+//# sourceMappingURL=sarif-discovery.js.map

package/dist/discoveries/sarif-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif-discovery.js","sourceRoot":"","sources":["../../src/discoveries/sarif-discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,MAAM,GAAG,GAAG,iBAAiB,CAAC;AAE9B,SAAS,4BAA4B,CACnC,IAAY,EACZ,SAAiB,EACjB,OAAe,EACf,OAAe,EACf,OAAgB;IAEhB,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,OAAO;;UAEC,IAAI;WACH,SAAS,IAAI,OAAO;gCACC,OAAO,GAAG,cAAc;;;;;;CAMvD,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,IAAI,EAAE,OAAO;IACb,oBAAoB,EAAE,sBAAsB;IAC5C,iBAAiB,EAAE,IAAI;IACvB,kBAAkB,EAAE,IAAI;IAExB,KAAK,CAAC,QAAQ,CACZ,KAAoB,EACpB,QAAgB,EAChB,QAA2B;QAE3B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAY,CAAC;QAEvC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,KAAK,CAAC,EAAE,uEAAuE,CAAC,CAC1H,CAAC;QACJ,CAAC;QAED,gDAAgD;QAChD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;QAE/D,QAAQ,CAAC,GAAG,EAAE,uBAAuB,aAAa,EAAE,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAE5D,IAAI,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACvC,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEtC,QAAQ,CAAC,GAAG,EAAE,cAAc,OAAO,CAAC,MAAM,WAAW,CAAC,CAAC;QAEvD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,YAAY,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG;YAC/C,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,gBAAgB,EAAE,4BAA4B,CAC5C,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,OAAO,CACf;SACF,CAAC,CAAC,CAAC;IACN,CAAC;CACF,CAAC"}

package/dist/discoveries/semgrep-discovery.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Semgrep-based target discovery.
+ *
+ * Runs Semgrep rules against the repository, parses SARIF output,
+ * and returns discovered targets with inline prompt enrichment.
+ */
+import type { TargetDiscovery } from '../discovery.js';
+export declare const semgrepDiscovery: TargetDiscovery;
+//# sourceMappingURL=semgrep-discovery.d.ts.map

package/dist/discoveries/semgrep-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep-discovery.d.ts","sourceRoot":"","sources":["../../src/discoveries/semgrep-discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAsC,MAAM,iBAAiB,CAAC;AA4B3F,eAAO,MAAM,gBAAgB,EAAE,eAoC9B,CAAC"}

package/dist/discoveries/semgrep-discovery.js

@@ -0,0 +1,61 @@
+/**
+ * Semgrep-based target discovery.
+ *
+ * Runs Semgrep rules against the repository, parses SARIF output,
+ * and returns discovered targets with inline prompt enrichment.
+ */
+import { runSemgrep } from '../semgrep-runner.js';
+import { parseSARIF, deduplicateTargets } from '../sarif-parser.js';
+import { logDebug } from '../logging.js';
+import { DEFAULT_GENERIC_PROMPT } from '../defaults.js';
+const TAG = 'semgrep-discovery';
+function buildTargetPromptEnrichment(file, startLine, endLine) {
+    return `\n\nTARGET LOCATION:
+
+You are analyzing a specific code location:
+- File: ${file}
+- Lines: ${startLine}-${endLine}
+
+You MUST:
+- Analyze ONLY this specific target location — do not search for or report issues at other locations
+- You may read other files to understand context (e.g., imports, type definitions, data flow), but only report issues for this target
+- If the code at this location is not vulnerable, return {"issues": []} — do not "spend" the target by reporting an issue you noticed somewhere else in the file
+- Do NOT scan the broader repository for other instances of this vulnerability pattern
+
+REPORTING RULES (strict — these prevent cross-target hallucinations):
+- Each reported issue's "file"/"startLine"/"endLine" MUST point at this target's range above, OR at a line inside a function this target directly/transitively calls. They must NOT point at a sibling location (e.g. another function, another route handler, another class) that simply happens to live in the same file. If that sibling is genuinely vulnerable, it has its own target run — leave it alone here.
+
+DESCRIPTION OPENING (mandatory output contract):
+- Your description's first heading MUST identify the entry point this target represents — its function name, route path+verb, class method, or equivalent — exactly as it appears in the source. For example: a route handler → "## Missing X in DELETE /:id"; a function → "## Missing X in processPayment".
+- The rest of the description must then describe THAT specific symbol's vulnerability — not a sibling's. If, while writing, you find yourself describing a different route/function than the one you opened with, stop: you are hallucinating across targets. Discard the issue and return {"issues": []}.
+- If you noticed a real vulnerability while reading the file but it is in a sibling location, do NOT smuggle it into this target's report. That sibling has its own target run.
+`;
+}
+export const semgrepDiscovery = {
+    name: 'semgrep',
+    defaultGenericPrompt: DEFAULT_GENERIC_PROMPT,
+    needsInstructions: true,
+    supportsDiffFilter: true,
+    async discover(check, repoPath, _options) {
+        const checkTarget = check.checkTarget;
+        logDebug(TAG, `Running Semgrep for check: ${check.id}`);
+        const sarifContent = await runSemgrep({
+            repositoryPath: repoPath,
+            rules: checkTarget.rules,
+            config: checkTarget.config,
+        });
+        let targets = parseSARIF(sarifContent);
+        targets = deduplicateTargets(targets);
+        logDebug(TAG, `Discovered ${targets.length} targets`);
+        return targets.map((target, idx) => ({
+            file: target.file,
+            startLine: target.startLine,
+            endLine: target.endLine,
+            label: `[target ${idx + 1}/${targets.length}]`,
+            message: target.message,
+            snippet: target.snippet,
+            promptEnrichment: buildTargetPromptEnrichment(target.file, target.startLine, target.endLine),
+        }));
+    },
+};
+//# sourceMappingURL=semgrep-discovery.js.map

package/dist/discoveries/semgrep-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep-discovery.js","sourceRoot":"","sources":["../../src/discoveries/semgrep-discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,MAAM,GAAG,GAAG,mBAAmB,CAAC;AAEhC,SAAS,2BAA2B,CAAC,IAAY,EAAE,SAAiB,EAAE,OAAe;IACnF,OAAO;;;UAGC,IAAI;WACH,SAAS,IAAI,OAAO;;;;;;;;;;;;;;;CAe9B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,IAAI,EAAE,SAAS;IACf,oBAAoB,EAAE,sBAAsB;IAC5C,iBAAiB,EAAE,IAAI;IACvB,kBAAkB,EAAE,IAAI;IAExB,KAAK,CAAC,QAAQ,CACZ,KAAoB,EACpB,QAAgB,EAChB,QAA2B;QAE3B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAY,CAAC;QAEvC,QAAQ,CAAC,GAAG,EAAE,8BAA8B,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAExD,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC;YACpC,cAAc,EAAE,QAAQ;YACxB,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,MAAM,EAAE,WAAW,CAAC,MAAM;SAC3B,CAAC,CAAC;QAEH,IAAI,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACvC,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEtC,QAAQ,CAAC,GAAG,EAAE,cAAc,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;QAEtD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,WAAW,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG;YAC9C,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,gBAAgB,EAAE,2BAA2B,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;SAC7F,CAAC,CAAC,CAAC;IACN,CAAC;CACF,CAAC"}