@owasp-aghast/aghast 0.8.3 → 0.9.0-rc.1

package/dist/error-codes.d.ts

@@ -8,7 +8,10 @@
  *   E4xxx — Repository/target validation
  *   E5xxx — Semgrep / Opengrep
  *   E6xxx — OpenAnt
- *   E7xxx — Budget / cost controls
+ *   E70xx — Budget / cost controls
+ *   E71xx — Script discovery
+ *   E72xx — Result handlers (PR comments, issue trackers, notifications)
+ *   E8xxx — Judge stage
  *   E9xxx — Internal/fatal
  */
 export interface ErrorCode {
@@ -34,6 +37,14 @@ export declare const ERROR_CODES: {
     readonly E6001: ErrorCode;
     readonly E6002: ErrorCode;
     readonly E7001: ErrorCode;
+    readonly E7101: ErrorCode;
+    readonly E7102: ErrorCode;
+    readonly E7103: ErrorCode;
+    readonly E7104: ErrorCode;
+    readonly E7105: ErrorCode;
+    readonly E7106: ErrorCode;
+    readonly E7201: ErrorCode;
+    readonly E8001: ErrorCode;
     readonly E9001: ErrorCode;
 };
 /**

package/dist/error-codes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAMD,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;CAuCd,CAAC;AAEX;;;GAGG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAWzE"}
+{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAMD,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoDd,CAAC;AAEX;;;GAGG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAWzE"}

package/dist/error-codes.js

@@ -8,7 +8,10 @@
  *   E4xxx — Repository/target validation
  *   E5xxx — Semgrep / Opengrep
  *   E6xxx — OpenAnt
- *   E7xxx — Budget / cost controls
+ *   E70xx — Budget / cost controls
+ *   E71xx — Script discovery
+ *   E72xx — Result handlers (PR comments, issue trackers, notifications)
+ *   E8xxx — Judge stage
  *   E9xxx — Internal/fatal
  */
 function ec(code, label) {
@@ -42,8 +45,19 @@ export const ERROR_CODES = {
     // E6xxx — OpenAnt
     E6001: ec('E6001', 'OpenAnt not installed'),
     E6002: ec('E6002', 'OpenAnt execution failed'),
-    // E7xxx — Budget / cost controls
+    // E70xx — Budget / cost controls
     E7001: ec('E7001', 'Budget limit exceeded'),
+    // E71xx — Script discovery
+    E7101: ec('E7101', 'Script discovery timeout'),
+    E7102: ec('E7102', 'Script discovery non-zero exit'),
+    E7103: ec('E7103', 'Script discovery stdout overflow'),
+    E7104: ec('E7104', 'Script discovery spawn/IO failure'),
+    E7105: ec('E7105', 'Script discovery output parse failure'),
+    E7106: ec('E7106', 'Script discovery unsupported scriptType for platform'),
+    // E72xx — Result handlers
+    E7201: ec('E7201', 'PR comment posting failed'),
+    // E8xxx — Judge stage
+    E8001: ec('E8001', 'Judge mock response file not found'),
     // E9xxx — Internal
     E9001: ec('E9001', 'Fatal internal error'),
 };

package/dist/error-codes.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-codes.js","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,SAAS,EAAE,CAAC,IAAY,EAAE,KAAa;IACrC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,sBAAsB;IACtB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,gCAAgC,CAAC;IACpD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAE5C,wBAAwB;IACxB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,gCAAgC,CAAC;IACpD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,oCAAoC,CAAC;IACxD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAC9C,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,yBAAyB;IACzB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC5C,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,iCAAiC,CAAC;IACrD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAE5C,uCAAuC;IACvC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,2BAA2B,CAAC;IAE/C,6BAA6B;IAC7B,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC3C,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAE5C,kBAAkB;IAClB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC3C,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,iCAAiC;IACjC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAE3C,mBAAmB;IACnB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,sBAAsB,CAAC;CAClC,CAAC;AAEX;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,SAAoB,EAAE,OAAe;IAC/D,OAAO,UAAU,SAAS,CAAC,IAAI,MAAM,OAAO,EAAE,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,OAAe;IAC/D,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,kBAAkB,CAAC,gBAAgB,OAAO,mBAAmB,OAAO,EAAE,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,2DAA2D,KAAK,SAAS,IAAI,aAAa,CAAC;IACvG,OAAO;QACL,uBAAuB,WAAW,CAAC,KAAK,CAAC,IAAI,MAAM,OAAO,EAAE;QAC5D,YAAY,OAAO,EAAE;QACrB,EAAE;QACF,0CAA0C;QAC1C,KAAK,GAAG,EAAE;KACX,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"error-codes.js","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH,SAAS,EAAE,CAAC,IAAY,EAAE,KAAa;IACrC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,sBAAsB;IACtB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,gCAAgC,CAAC;IACpD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAE5C,wBAAwB;IACxB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,gCAAgC,CAAC;IACpD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,oCAAoC,CAAC;IACxD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAC9C,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,yBAAyB;IACzB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC5C,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,iCAAiC,CAAC;IACrD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAE5C,uCAAuC;IACvC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,2BAA2B,CAAC;IAE/C,6BAA6B;IAC7B,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC3C,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAE5C,kBAAkB;IAClB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC3C,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,iCAAiC;IACjC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAE3C,2BAA2B;IAC3B,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAC9C,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,gCAAgC,CAAC;IACpD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,kCAAkC,CAAC;IACtD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,mCAAmC,CAAC;IACvD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,uCAAuC,CAAC;IAC3D,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,sDAAsD,CAAC;IAE1E,0BAA0B;IAC1B,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,2BAA2B,CAAC;IAC/C,sBAAsB;IACtB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,oCAAoC,CAAC;IAExD,mBAAmB;IACnB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,sBAAsB,CAAC;CAClC,CAAC;AAEX;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,SAAoB,EAAE,OAAe;IAC/D,OAAO,UAAU,SAAS,CAAC,IAAI,MAAM,OAAO,EAAE,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,OAAe;IAC/D,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,kBAAkB,CAAC,gBAAgB,OAAO,mBAAmB,OAAO,EAAE,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,2DAA2D,KAAK,SAAS,IAAI,aAAa,CAAC;IACvG,OAAO;QACL,uBAAuB,WAAW,CAAC,KAAK,CAAC,IAAI,MAAM,OAAO,EAAE;QAC5D,YAAY,OAAO,EAAE;QACrB,EAAE;QACF,0CAA0C;QAC1C,KAAK,GAAG,EAAE;KACX,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/formatters/csv-formatter.d.ts

@@ -0,0 +1,45 @@
+/**
+ * CSV output formatter — one row per SecurityIssue (plus a row per ERROR check)
+ * for spreadsheet analysis (Excel, Google Sheets, etc.).
+ *
+ * Output contract:
+ *   - Encoding: UTF-8, no BOM. Excel-on-Windows may render non-ASCII bytes as
+ *     mojibake when a CSV is opened directly without an encoding hint; consumers
+ *     that need Excel auto-detection should use the JSON or SARIF output instead,
+ *     or import the CSV via Excel's "From Text/CSV" wizard which lets you pick
+ *     UTF-8 explicitly.
+ *   - Line terminator: CRLF (RFC 4180). Final row is also CRLF-terminated.
+ *   - Quoting: RFC 4180 — fields containing `,`, `"`, CR, or LF are wrapped in
+ *     double quotes; embedded `"` is doubled.
+ *   - Description: flattened to a single line (CR/LF/CRLF → single space) and
+ *     truncated to {@link DESCRIPTION_MAX_LENGTH} chars with a U+2026 ellipsis.
+ *   - The structured `dataFlow` taint trace on `SecurityIssue` is intentionally
+ *     omitted — flat per-issue rows can't represent a list well; SARIF/JSON
+ *     output keeps the full trace.
+ */
+import type { ScanResults } from '../types.js';
+import type { OutputFormatter } from './types.js';
+/**
+ * Escapes a single CSV field. Two independent defences:
+ *   1. Spreadsheet formula injection — {@link neutralizeFormula} (see OWASP).
+ *      Only applied to `string` values: the formula-trigger set includes `-`,
+ *      and genuinely numeric columns (`startLine`, `endLine`,
+ *      `judge.confidence`) can legitimately start with `-` (or, in principle,
+ *      be produced with other trigger prefixes) — those are never
+ *      attacker-controlled free text, so quoting them as text would corrupt
+ *      the number for no security benefit.
+ *   2. CSV structure — RFC 4180 quoting: fields containing `,`, `"`, CR or LF
+ *      are wrapped in double quotes with embedded `"` doubled.
+ */
+export declare function escapeCsvField(value: string | number | undefined): string;
+/**
+ * Truncates a description to fit within the CSV column and replaces newlines
+ * with spaces so each issue stays on a single row.
+ */
+export declare function normalizeDescription(description: string): string;
+export declare class CsvFormatter implements OutputFormatter {
+    readonly id = "csv";
+    readonly fileExtension = ".csv";
+    format(results: ScanResults): string;
+}
+//# sourceMappingURL=csv-formatter.d.ts.map

package/dist/formatters/csv-formatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csv-formatter.d.ts","sourceRoot":"","sources":["../../src/formatters/csv-formatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAwC,MAAM,aAAa,CAAC;AACrF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AA6DlD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAQzE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAMhE;AAmDD,qBAAa,YAAa,YAAW,eAAe;IAClD,QAAQ,CAAC,EAAE,SAAS;IACpB,QAAQ,CAAC,aAAa,UAAU;IAEhC,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM;CAqBrC"}

package/dist/formatters/csv-formatter.js

@@ -0,0 +1,176 @@
+/**
+ * CSV output formatter — one row per SecurityIssue (plus a row per ERROR check)
+ * for spreadsheet analysis (Excel, Google Sheets, etc.).
+ *
+ * Output contract:
+ *   - Encoding: UTF-8, no BOM. Excel-on-Windows may render non-ASCII bytes as
+ *     mojibake when a CSV is opened directly without an encoding hint; consumers
+ *     that need Excel auto-detection should use the JSON or SARIF output instead,
+ *     or import the CSV via Excel's "From Text/CSV" wizard which lets you pick
+ *     UTF-8 explicitly.
+ *   - Line terminator: CRLF (RFC 4180). Final row is also CRLF-terminated.
+ *   - Quoting: RFC 4180 — fields containing `,`, `"`, CR, or LF are wrapped in
+ *     double quotes; embedded `"` is doubled.
+ *   - Description: flattened to a single line (CR/LF/CRLF → single space) and
+ *     truncated to {@link DESCRIPTION_MAX_LENGTH} chars with a U+2026 ellipsis.
+ *   - The structured `dataFlow` taint trace on `SecurityIssue` is intentionally
+ *     omitted — flat per-issue rows can't represent a list well; SARIF/JSON
+ *     output keeps the full trace.
+ */
+/** Maximum length of the description field in CSV output (longer values are truncated with an ellipsis). */
+const DESCRIPTION_MAX_LENGTH = 500;
+/**
+ * Judge columns are appended at the end and are ALWAYS present, even when the
+ * judge did not run (in which case they are empty).
+ *
+ * Two deliberate choices, both different from the HTML formatter:
+ *
+ *   - Appended, not inserted: a consumer reading by column index keeps working
+ *     for every column it already knew about.
+ *   - Unconditional, not "only when the judge ran": CSV is the format most
+ *     likely to be machine-parsed, and a header row that changes shape
+ *     depending on runtime configuration is far more hostile to a script than
+ *     a couple of empty columns. HTML can afford to hide an empty column
+ *     because a human reads it; a parser cannot.
+ *
+ * Scan-level cost is deliberately NOT a column. It is a single value for the
+ * whole run, so repeating it on every row would invite summing it — yielding
+ * cost × issue-count, silently and wrongly. It stays in the JSON, Markdown and
+ * HTML reports, where it can be shown once.
+ */
+const CSV_HEADERS = [
+    'checkId',
+    'checkName',
+    'status',
+    'file',
+    'startLine',
+    'endLine',
+    'severity',
+    'confidence',
+    'description',
+    'recommendation',
+    'judgeVerdict',
+    'judgeConfidence',
+    'judgeRationale',
+];
+/**
+ * Leading characters that make Excel / Google Sheets / LibreOffice interpret a
+ * cell as a formula rather than text. A field beginning with one of these — in
+ * AI-authored free text (`description`, `recommendation`, judge `rationale`), it
+ * is attacker-influenceable via crafted repo content — could execute a formula
+ * (e.g. `=HYPERLINK`, `=cmd|...`, `+`/`-`/`@` variants, or DDE) when the CSV is
+ * opened. See OWASP "CSV Injection".
+ */
+const FORMULA_TRIGGERS = new Set(['=', '+', '-', '@', '\t', '\r', '\n']);
+/**
+ * Neutralises spreadsheet formula injection by prefixing a single quote when the
+ * value starts with a formula trigger. The `'` is the conventional OWASP
+ * mitigation: spreadsheets treat a leading apostrophe as "this cell is text" and
+ * do not display it, so the value reads unchanged while never being evaluated.
+ * Applied to the raw value *before* RFC-4180 quoting so both defences compose.
+ */
+function neutralizeFormula(str) {
+    return str.length > 0 && FORMULA_TRIGGERS.has(str[0]) ? `'${str}` : str;
+}
+/**
+ * Escapes a single CSV field. Two independent defences:
+ *   1. Spreadsheet formula injection — {@link neutralizeFormula} (see OWASP).
+ *      Only applied to `string` values: the formula-trigger set includes `-`,
+ *      and genuinely numeric columns (`startLine`, `endLine`,
+ *      `judge.confidence`) can legitimately start with `-` (or, in principle,
+ *      be produced with other trigger prefixes) — those are never
+ *      attacker-controlled free text, so quoting them as text would corrupt
+ *      the number for no security benefit.
+ *   2. CSV structure — RFC 4180 quoting: fields containing `,`, `"`, CR or LF
+ *      are wrapped in double quotes with embedded `"` doubled.
+ */
+export function escapeCsvField(value) {
+    if (value === undefined || value === null)
+        return '';
+    const str = typeof value === 'string' ? neutralizeFormula(value) : String(value);
+    // Wrap in quotes if it contains a comma, quote, CR, or LF.
+    if (/[",\r\n]/.test(str)) {
+        return `"${str.replace(/"/g, '""')}"`;
+    }
+    return str;
+}
+/**
+ * Truncates a description to fit within the CSV column and replaces newlines
+ * with spaces so each issue stays on a single row.
+ */
+export function normalizeDescription(description) {
+    // Replace any sequence of CR/LF with a single space so the cell stays on one line
+    // (CSV viewers do support multi-line cells via quoting, but flattening keeps spreadsheets readable).
+    const flattened = description.replace(/\r\n|\r|\n/g, ' ').replace(/\s+/g, ' ').trim();
+    if (flattened.length <= DESCRIPTION_MAX_LENGTH)
+        return flattened;
+    return flattened.slice(0, DESCRIPTION_MAX_LENGTH - 1) + '…'; // ellipsis
+}
+function statusForIssue(issue, checkStatusByCheckId) {
+    // Fall back to 'UNKNOWN' (not 'FAIL') for orphaned issues so a row in the
+    // spreadsheet doesn't claim a check status that wasn't actually reported.
+    return checkStatusByCheckId.get(issue.checkId) ?? 'UNKNOWN';
+}
+function issueRow(issue, checkStatus) {
+    return [
+        escapeCsvField(issue.checkId),
+        escapeCsvField(issue.checkName),
+        escapeCsvField(checkStatus),
+        escapeCsvField(issue.file),
+        escapeCsvField(issue.startLine),
+        escapeCsvField(issue.endLine),
+        escapeCsvField(issue.severity),
+        escapeCsvField(issue.confidence),
+        escapeCsvField(normalizeDescription(issue.description)),
+        escapeCsvField(issue.recommendation),
+        escapeCsvField(issue.judge?.verdict),
+        // Confidence as a plain 0–1 number: spreadsheets can format or threshold it,
+        // which a "85%" string would prevent.
+        escapeCsvField(issue.judge?.confidence),
+        // Model-authored free text — flattened and truncated like description, so a
+        // multi-paragraph rationale cannot blow up the row.
+        escapeCsvField(issue.judge?.rationale ? normalizeDescription(issue.judge.rationale) : undefined),
+    ].join(',');
+}
+function errorCheckRow(check) {
+    // Surface execution errors so they show up alongside issues in spreadsheets.
+    // No file/line/severity/confidence/recommendation — just the error in the description column.
+    const description = normalizeDescription(check.error ? `Check execution error: ${check.error}` : 'Check execution error');
+    return [
+        escapeCsvField(check.checkId),
+        escapeCsvField(check.checkName),
+        escapeCsvField(check.status),
+        '', // file
+        '', // startLine
+        '', // endLine
+        '', // severity
+        '', // confidence
+        escapeCsvField(description),
+        '', // recommendation
+        '', // judgeVerdict — an ERROR check produced no issue to judge
+        '', // judgeConfidence
+        '', // judgeRationale
+    ].join(',');
+}
+export class CsvFormatter {
+    id = 'csv';
+    fileExtension = '.csv';
+    format(results) {
+        const checkStatusByCheckId = new Map();
+        for (const check of results.checks) {
+            checkStatusByCheckId.set(check.checkId, check.status);
+        }
+        const lines = [CSV_HEADERS.join(',')];
+        for (const issue of results.issues) {
+            lines.push(issueRow(issue, statusForIssue(issue, checkStatusByCheckId)));
+        }
+        for (const check of results.checks) {
+            if (check.status === 'ERROR') {
+                lines.push(errorCheckRow(check));
+            }
+        }
+        // RFC 4180 specifies CRLF line endings.
+        return lines.join('\r\n') + '\r\n';
+    }
+}
+//# sourceMappingURL=csv-formatter.js.map

package/dist/formatters/csv-formatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csv-formatter.js","sourceRoot":"","sources":["../../src/formatters/csv-formatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,4GAA4G;AAC5G,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,GAAG;IAClB,SAAS;IACT,WAAW;IACX,QAAQ;IACR,MAAM;IACN,WAAW;IACX,SAAS;IACT,UAAU;IACV,YAAY;IACZ,aAAa;IACb,gBAAgB;IAChB,cAAc;IACd,iBAAiB;IACjB,gBAAgB;CACR,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEzE;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,KAAkC;IAC/D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjF,2DAA2D;IAC3D,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,kFAAkF;IAClF,qGAAqG;IACrG,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACtF,IAAI,SAAS,CAAC,MAAM,IAAI,sBAAsB;QAAE,OAAO,SAAS,CAAC;IACjE,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW;AAC1E,CAAC;AAED,SAAS,cAAc,CAAC,KAAoB,EAAE,oBAAyC;IACrF,0EAA0E;IAC1E,0EAA0E;IAC1E,OAAO,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;AAC9D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAoB,EAAE,WAAmB;IACzD,OAAO;QACL,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7B,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC;QAC/B,cAAc,CAAC,WAAW,CAAC;QAC3B,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;QAC1B,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC;QAC/B,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7B,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC9B,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC;QAChC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvD,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC;QACpC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC;QACpC,6EAA6E;QAC7E,sCAAsC;QACtC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC;QACvC,4EAA4E;QAC5E,oDAAoD;QACpD,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;KACjG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAA4B;IACjD,6EAA6E;IAC7E,8FAA8F;IAC9F,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,0BAA0B,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;IAC1H,OAAO;QACL,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7B,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC;QAC/B,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC;QAC5B,EAAE,EAAE,OAAO;QACX,EAAE,EAAE,YAAY;QAChB,EAAE,EAAE,UAAU;QACd,EAAE,EAAE,WAAW;QACf,EAAE,EAAE,aAAa;QACjB,cAAc,CAAC,WAAW,CAAC;QAC3B,EAAE,EAAE,iBAAiB;QACrB,EAAE,EAAE,2DAA2D;QAC/D,EAAE,EAAE,kBAAkB;QACtB,EAAE,EAAE,iBAAiB;KACtB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,MAAM,OAAO,YAAY;IACd,EAAE,GAAG,KAAK,CAAC;IACX,aAAa,GAAG,MAAM,CAAC;IAEhC,MAAM,CAAC,OAAoB;QACzB,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAkB,CAAC;QACvD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,KAAK,GAAa,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAEhD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC7B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IACrC,CAAC;CACF"}

package/dist/formatters/html-formatter.d.ts

@@ -0,0 +1,39 @@
+/**
+ * HTML output formatter — self-contained interactive report.
+ *
+ * Emits a single .html file with inline CSS + JS. Includes:
+ *   - Header with title, scan timestamp, repository info
+ *   - Summary statistics (totals + per-status counters)
+ *   - Filterable, severity-badged issues table
+ *   - Expandable per-check sections with optional code snippets
+ *   - The full `ScanResults` embedded as a JSON island for client-side filtering
+ *
+ * All user-controlled strings are HTML-escaped via `escapeHtml`. The embedded
+ * JSON has `</` sequences neutralised so an attacker-controlled string cannot
+ * break out of the `<script type="application/json">` tag.
+ */
+import type { ScanResults } from '../types.js';
+import type { OutputFormatter } from './types.js';
+/** Escapes the five HTML special characters. */
+export declare function escapeHtml(value: unknown): string;
+/**
+ * Embeds JSON inside a `<script type="application/json">` block safely.
+ *
+ * Two patterns matter for HTML's script-data tokenizer:
+ *   1. `</` — replaced with `<\/` so a stray `</script>` cannot terminate the
+ *      script element early. `\/` is valid JSON for `/`, so JSON.parse
+ *      round-trips faithfully.
+ *   2. `<!--` — the script-data tokenizer enters a "script data escaped"
+ *      state on `<!--`, in which a nested `<script>...</script>` pair can
+ *      terminate the outer element ahead of the literal closing tag we control.
+ *      Encoding `<` as the Unicode escape `<` is unambiguous JSON
+ *      (parses back to `<`) and prevents the tokenizer from ever entering the
+ *      escaped state.
+ */
+export declare function escapeJsonForScriptTag(json: string): string;
+export declare class HtmlFormatter implements OutputFormatter {
+    readonly id = "html";
+    readonly fileExtension = ".html";
+    format(results: ScanResults): string;
+}
+//# sourceMappingURL=html-formatter.d.ts.map

package/dist/formatters/html-formatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html-formatter.d.ts","sourceRoot":"","sources":["../../src/formatters/html-formatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACV,WAAW,EAIZ,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,gDAAgD;AAChD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CASjD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI3D;AA8WD,qBAAa,aAAc,YAAW,eAAe;IACnD,QAAQ,CAAC,EAAE,UAAU;IACrB,QAAQ,CAAC,aAAa,WAAW;IAEjC,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM;CAsCrC"}