@owasp-aghast/aghast 0.8.3 → 0.9.0-rc.1

package/dist/formatters/html-formatter.js

@@ -0,0 +1,432 @@
+/**
+ * HTML output formatter — self-contained interactive report.
+ *
+ * Emits a single .html file with inline CSS + JS. Includes:
+ *   - Header with title, scan timestamp, repository info
+ *   - Summary statistics (totals + per-status counters)
+ *   - Filterable, severity-badged issues table
+ *   - Expandable per-check sections with optional code snippets
+ *   - The full `ScanResults` embedded as a JSON island for client-side filtering
+ *
+ * All user-controlled strings are HTML-escaped via `escapeHtml`. The embedded
+ * JSON has `</` sequences neutralised so an attacker-controlled string cannot
+ * break out of the `<script type="application/json">` tag.
+ */
+/** Escapes the five HTML special characters. */
+export function escapeHtml(value) {
+    if (value === undefined || value === null)
+        return '';
+    const str = String(value);
+    return str
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+/**
+ * Embeds JSON inside a `<script type="application/json">` block safely.
+ *
+ * Two patterns matter for HTML's script-data tokenizer:
+ *   1. `</` — replaced with `<\/` so a stray `</script>` cannot terminate the
+ *      script element early. `\/` is valid JSON for `/`, so JSON.parse
+ *      round-trips faithfully.
+ *   2. `<!--` — the script-data tokenizer enters a "script data escaped"
+ *      state on `<!--`, in which a nested `<script>...</script>` pair can
+ *      terminate the outer element ahead of the literal closing tag we control.
+ *      Encoding `<` as the Unicode escape `<` is unambiguous JSON
+ *      (parses back to `<`) and prevents the tokenizer from ever entering the
+ *      escaped state.
+ */
+export function escapeJsonForScriptTag(json) {
+    return json
+        .replace(/<\//g, '<\\/')
+        .replace(/<!--/g, '\\u003c!--');
+}
+function severityClass(severity) {
+    switch (severity) {
+        case 'critical':
+        case 'high':
+            return 'sev-high';
+        case 'medium':
+            return 'sev-medium';
+        case 'low':
+        case 'informational':
+            return 'sev-low';
+        default:
+            return 'sev-unknown';
+    }
+}
+function statusClass(status) {
+    switch (status) {
+        case 'PASS':
+            return 'status-pass';
+        case 'FAIL':
+            return 'status-fail';
+        case 'FLAG':
+            return 'status-flag';
+        case 'ERROR':
+            return 'status-error';
+        default:
+            return 'status-unknown';
+    }
+}
+const CSS = `
+:root {
+  color-scheme: light dark;
+  --bg: #f6f7f9;
+  --fg: #1f2329;
+  --muted: #6a7280;
+  --card: #ffffff;
+  --border: #e2e5ea;
+  --pass: #15803d;
+  --fail: #b91c1c;
+  --flag: #b45309;
+  --error: #6b21a8;
+  --sev-high: #b91c1c;
+  --sev-medium: #b45309;
+  --sev-low: #2563eb;
+  --sev-unknown: #6a7280;
+}
+@media (prefers-color-scheme: dark) {
+  :root {
+    --bg: #14171c;
+    --fg: #e6e8eb;
+    --muted: #9ba1aa;
+    --card: #1c2026;
+    --border: #2a2f37;
+  }
+}
+* { box-sizing: border-box; }
+body {
+  margin: 0;
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+  background: var(--bg);
+  color: var(--fg);
+  line-height: 1.5;
+}
+.container { max-width: 1200px; margin: 0 auto; padding: 24px; }
+header { margin-bottom: 24px; }
+header h1 { margin: 0 0 4px; font-size: 1.6rem; }
+header .meta { color: var(--muted); font-size: 0.9rem; }
+.muted { color: var(--muted); }
+.card {
+  background: var(--card);
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  padding: 16px;
+  margin-bottom: 16px;
+}
+.summary-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(140px, 1fr));
+  gap: 12px;
+}
+.stat {
+  background: var(--card);
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  padding: 12px;
+  text-align: center;
+}
+.stat .num { font-size: 1.6rem; font-weight: 600; }
+.stat .label { color: var(--muted); font-size: 0.8rem; text-transform: uppercase; letter-spacing: 0.04em; }
+.badge {
+  display: inline-block;
+  padding: 2px 8px;
+  border-radius: 999px;
+  font-size: 0.75rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: #fff;
+}
+.badge.sev-high { background: var(--sev-high); }
+.badge.sev-medium { background: var(--sev-medium); }
+.badge.sev-low { background: var(--sev-low); }
+.badge.sev-unknown { background: var(--sev-unknown); }
+.badge.status-pass { background: var(--pass); }
+.badge.status-fail { background: var(--fail); }
+.badge.status-flag { background: var(--flag); }
+.badge.status-error { background: var(--error); }
+.badge.status-unknown { background: var(--sev-unknown); }
+.controls { display: flex; flex-wrap: wrap; gap: 8px; margin-bottom: 12px; }
+.controls input, .controls select {
+  background: var(--card);
+  color: var(--fg);
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  padding: 6px 10px;
+  font: inherit;
+}
+table { width: 100%; border-collapse: collapse; font-size: 0.9rem; }
+th, td {
+  text-align: left;
+  padding: 8px 10px;
+  border-bottom: 1px solid var(--border);
+  vertical-align: top;
+}
+th { background: var(--card); font-weight: 600; }
+tr.hidden { display: none; }
+details { margin-top: 8px; }
+details summary { cursor: pointer; font-weight: 600; }
+pre.snippet {
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  padding: 8px;
+  overflow-x: auto;
+  font-size: 0.8rem;
+  margin: 8px 0 0;
+}
+.empty { color: var(--muted); font-style: italic; }
+footer { color: var(--muted); font-size: 0.8rem; text-align: center; margin: 32px 0 16px; }
+`;
+const CLIENT_JS = `
+(function () {
+  var data;
+  try {
+    data = JSON.parse(document.getElementById('aghast-results').textContent);
+  } catch (e) {
+    return;
+  }
+  var search = document.getElementById('filter-search');
+  var severity = document.getElementById('filter-severity');
+  var status = document.getElementById('filter-status');
+  var rows = Array.prototype.slice.call(document.querySelectorAll('#issues-table tbody tr'));
+
+  function applyFilters() {
+    var q = (search.value || '').toLowerCase();
+    var sev = severity.value;
+    var st = status.value;
+    rows.forEach(function (row) {
+      var text = row.getAttribute('data-search') || '';
+      var rowSev = row.getAttribute('data-severity') || '';
+      var rowStatus = row.getAttribute('data-status') || '';
+      var matches = (!q || text.indexOf(q) !== -1)
+        && (!sev || rowSev === sev)
+        && (!st || rowStatus === st);
+      row.classList.toggle('hidden', !matches);
+    });
+  }
+
+  if (search) search.addEventListener('input', applyFilters);
+  if (severity) severity.addEventListener('change', applyFilters);
+  if (status) status.addEventListener('change', applyFilters);
+
+  // Expose data for debugging / extensibility.
+  window.aghastResults = data;
+})();
+`;
+function renderHeader(results) {
+    const repo = results.repository;
+    const repoLabel = repo.remoteUrl
+        ? `${escapeHtml(repo.remoteUrl)}`
+        : escapeHtml(repo.path);
+    const branch = repo.branch ? ` <span class="muted">on ${escapeHtml(repo.branch)}</span>` : '';
+    const commit = repo.commit ? ` <span class="muted">@ ${escapeHtml(repo.commit.slice(0, 12))}</span>` : '';
+    return `
+    <header>
+      <h1>aghast Security Scan Report</h1>
+      <div class="meta">
+        Scan ID: <code>${escapeHtml(results.scanId)}</code> &middot;
+        Generated: ${escapeHtml(results.timestamp)} &middot;
+        Provider: ${escapeHtml(results.agentProvider.name)}
+      </div>
+      <div class="meta">
+        Repository: ${repoLabel}${branch}${commit}
+      </div>
+    </header>
+  `;
+}
+/**
+ * Format a cost for display. Sub-cent runs are common with cheap models, and
+ * rounding them to "$0.00" reads as "free" rather than "very small".
+ */
+function formatCost(amount, currency) {
+    const decimals = amount > 0 && amount < 0.01 ? 4 : 2;
+    const value = amount.toFixed(decimals);
+    return currency === 'USD' ? `$${value}` : `${value} ${escapeHtml(currency)}`;
+}
+function renderSummary(results, _repo) {
+    const { summary } = results;
+    const extra = [];
+    // Judge tiles appear only when the stage ran. `judgedIssues` is the marker:
+    // every other counter is legitimately zero on a clean scan and cannot
+    // distinguish "judge ran and found nothing" from "judge never ran".
+    if (summary.judgedIssues !== undefined) {
+        extra.push(`<div class="stat"><div class="num">${summary.judgedIssues}</div><div class="label">Judged</div></div>`);
+        if (summary.falsePositives !== undefined) {
+            extra.push(`<div class="stat"><div class="num">${summary.falsePositives}</div><div class="label">False positives</div></div>`);
+        }
+        if (summary.uncertainJudgements !== undefined) {
+            extra.push(`<div class="stat"><div class="num">${summary.uncertainJudgements}</div><div class="label">Uncertain</div></div>`);
+        }
+    }
+    const cost = results.metadata?.cost;
+    if (cost) {
+        extra.push(`<div class="stat"><div class="num">${escapeHtml(formatCost(cost.totalCostUsd, cost.currency))}</div>`
+            + `<div class="label">Est. cost</div></div>`);
+    }
+    return `
+    <section class="summary-grid">
+      <div class="stat"><div class="num">${summary.totalChecks}</div><div class="label">Checks</div></div>
+      <div class="stat"><div class="num">${summary.passedChecks}</div><div class="label">Passed</div></div>
+      <div class="stat"><div class="num">${summary.failedChecks}</div><div class="label">Failed</div></div>
+      <div class="stat"><div class="num">${summary.flaggedChecks}</div><div class="label">Flagged</div></div>
+      <div class="stat"><div class="num">${summary.errorChecks}</div><div class="label">Errors</div></div>
+      <div class="stat"><div class="num">${summary.totalIssues}</div><div class="label">Issues</div></div>
+      ${extra.join('\n      ')}
+    </section>
+  `;
+}
+function renderIssuesTable(issues, statusByCheck) {
+    if (issues.length === 0) {
+        return `<section class="card"><h2>Issues</h2><p class="empty">No issues detected.</p></section>`;
+    }
+    // Only carry a Verdict column when the judge actually annotated something.
+    // A permanently empty column on every non-judged scan is worse than none.
+    const hasVerdicts = issues.some((i) => i.judge);
+    const rows = issues.map((issue) => {
+        const sev = issue.severity ?? '';
+        const sevCls = severityClass(issue.severity);
+        const sevBadge = `<span class="badge ${sevCls}">${escapeHtml(sev || 'unknown')}</span>`;
+        const verdictCell = hasVerdicts
+            ? `<td>${issue.judge
+                ? `<span class="badge">${escapeHtml(issue.judge.verdict)}</span> `
+                    + `<span title="${escapeHtml(issue.judge.rationale ?? '')}">`
+                    + `${Math.round(issue.judge.confidence * 100)}%</span>`
+                : ''}</td>`
+            : '';
+        // Fall back to 'UNKNOWN' (not 'FAIL') for orphaned issues so the row's
+        // status badge and the data-status filter don't lie when an issue
+        // references a checkId that isn't in the checks list.
+        const status = statusByCheck.get(issue.checkId) ?? 'UNKNOWN';
+        const statusCls = statusClass(status);
+        const statusBadge = `<span class="badge ${statusCls}">${escapeHtml(status)}</span>`;
+        const searchBlob = `${issue.checkId} ${issue.checkName} ${issue.file} ${issue.description}`.toLowerCase();
+        return `
+      <tr data-severity="${escapeHtml(sev)}" data-status="${escapeHtml(status)}" data-search="${escapeHtml(searchBlob)}">
+        <td>${escapeHtml(issue.checkId)}</td>
+        <td>${escapeHtml(issue.checkName)}</td>
+        <td>${statusBadge}</td>
+        <td>${sevBadge}</td>
+        <td><code>${escapeHtml(issue.file)}</code>:${escapeHtml(issue.startLine)}-${escapeHtml(issue.endLine)}</td>
+        <td>${escapeHtml(issue.description)}</td>
+        ${verdictCell}
+      </tr>
+    `;
+    }).join('');
+    return `
+    <section class="card">
+      <h2>Issues</h2>
+      <div class="controls">
+        <input id="filter-search" type="search" placeholder="Filter by text..." />
+        <select id="filter-severity">
+          <option value="">All severities</option>
+          <option value="critical">Critical</option>
+          <option value="high">High</option>
+          <option value="medium">Medium</option>
+          <option value="low">Low</option>
+          <option value="informational">Informational</option>
+        </select>
+        <select id="filter-status">
+          <option value="">All statuses</option>
+          <option value="PASS">Pass</option>
+          <option value="FAIL">Fail</option>
+          <option value="FLAG">Flag</option>
+          <option value="ERROR">Error</option>
+        </select>
+      </div>
+      <table id="issues-table" aria-label="Security issues">
+        <thead>
+          <tr><th>Check ID</th><th>Check</th><th>Status</th><th>Severity</th><th>Location</th><th>Description</th>${hasVerdicts ? '<th>Verdict</th>' : ''}</tr>
+        </thead>
+        <tbody>${rows}</tbody>
+      </table>
+    </section>
+  `;
+}
+function renderCheckDetails(checks, issuesByCheck) {
+    if (checks.length === 0) {
+        return '';
+    }
+    const sections = checks.map((check) => {
+        const checkIssues = issuesByCheck.get(check.checkId) ?? [];
+        const statusBadge = `<span class="badge ${statusClass(check.status)}">${escapeHtml(check.status)}</span>`;
+        const errorBlock = check.error
+            ? `<p><strong>Error:</strong> ${escapeHtml(check.error)}</p>`
+            : '';
+        const issuesBlock = checkIssues.length === 0
+            ? '<p class="empty">No issues for this check.</p>'
+            : checkIssues.map((issue) => {
+                const snippet = issue.codeSnippet
+                    ? `<pre class="snippet">${escapeHtml(issue.codeSnippet)}</pre>`
+                    : '';
+                const recommendation = issue.recommendation
+                    ? `<p><strong>Recommendation:</strong> ${escapeHtml(issue.recommendation)}</p>`
+                    : '';
+                return `
+          <div class="card">
+            <div><strong><code>${escapeHtml(issue.file)}</code>:${escapeHtml(issue.startLine)}-${escapeHtml(issue.endLine)}</strong>
+              ${issue.severity ? `<span class="badge ${severityClass(issue.severity)}">${escapeHtml(issue.severity)}</span>` : ''}
+            </div>
+            <p>${escapeHtml(issue.description)}</p>
+            ${recommendation}
+            ${snippet}
+          </div>
+        `;
+            }).join('');
+        return `
+      <details>
+        <summary>${escapeHtml(check.checkName)} (${escapeHtml(check.checkId)}) ${statusBadge} &middot; ${check.issuesFound} issue(s)</summary>
+        ${errorBlock}
+        ${issuesBlock}
+      </details>
+    `;
+    }).join('');
+    return `<section class="card"><h2>Checks</h2>${sections}</section>`;
+}
+export class HtmlFormatter {
+    id = 'html';
+    fileExtension = '.html';
+    format(results) {
+        const statusByCheck = new Map();
+        const issuesByCheck = new Map();
+        for (const check of results.checks) {
+            statusByCheck.set(check.checkId, check.status);
+            issuesByCheck.set(check.checkId, []);
+        }
+        for (const issue of results.issues) {
+            const arr = issuesByCheck.get(issue.checkId);
+            if (arr)
+                arr.push(issue);
+            else
+                issuesByCheck.set(issue.checkId, [issue]);
+        }
+        const embeddedJson = escapeJsonForScriptTag(JSON.stringify(results));
+        const title = `aghast scan ${escapeHtml(results.scanId)}`;
+        return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>${title}</title>
+  <style>${CSS}</style>
+</head>
+<body>
+  <div class="container">
+    ${renderHeader(results)}
+    ${renderSummary(results, results.repository)}
+    ${renderIssuesTable(results.issues, statusByCheck)}
+    ${renderCheckDetails(results.checks, issuesByCheck)}
+    <footer>Generated by aghast v${escapeHtml(results.version)}</footer>
+  </div>
+  <script id="aghast-results" type="application/json">${embeddedJson}</script>
+  <script>${CLIENT_JS}</script>
+</body>
+</html>
+`;
+    }
+}
+//# sourceMappingURL=html-formatter.js.map

package/dist/formatters/html-formatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html-formatter.js","sourceRoot":"","sources":["../../src/formatters/html-formatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAUH,gDAAgD;AAChD,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,OAAO,GAAG;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,IAAI;SACR,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC;SACvB,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,aAAa,CAAC,QAA4B;IACjD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,UAAU,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC;QACtB,KAAK,KAAK,CAAC;QACX,KAAK,eAAe;YAClB,OAAO,SAAS,CAAC;QACnB;YACE,OAAO,aAAa,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,OAAO;YACV,OAAO,cAAc,CAAC;QACxB;YACE,OAAO,gBAAgB,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,MAAM,GAAG,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8GX,CAAC;AAEF,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCjB,CAAC;AAEF,SAAS,YAAY,CAAC,OAAoB;IACxC,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS;QAC9B,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QACjC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,2BAA2B,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,0BAA0B,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1G,OAAO;;;;yBAIgB,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC;qBAC9B,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC;oBAC9B,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC;;;sBAGpC,SAAS,GAAG,MAAM,GAAG,MAAM;;;GAG9C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,MAAc,EAAE,QAAgB;IAClD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,aAAa,CAAC,OAAoB,EAAE,KAAqB;IAChE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,4EAA4E;IAC5E,sEAAsE;IACtE,oEAAoE;IACpE,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CACR,sCAAsC,OAAO,CAAC,YAAY,6CAA6C,CACxG,CAAC;QACF,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CACR,sCAAsC,OAAO,CAAC,cAAc,sDAAsD,CACnH,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;YAC9C,KAAK,CAAC,IAAI,CACR,sCAAsC,OAAO,CAAC,mBAAmB,gDAAgD,CAClH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;IACpC,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CACR,sCAAsC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ;cACpG,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IAED,OAAO;;2CAEkC,OAAO,CAAC,WAAW;2CACnB,OAAO,CAAC,YAAY;2CACpB,OAAO,CAAC,YAAY;2CACpB,OAAO,CAAC,aAAa;2CACrB,OAAO,CAAC,WAAW;2CACnB,OAAO,CAAC,WAAW;QACtD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;;GAE3B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAuB,EAAE,aAAkC;IACpF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,yFAAyF,CAAC;IACnG,CAAC;IACD,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,sBAAsB,MAAM,KAAK,UAAU,CAAC,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC;QACxF,MAAM,WAAW,GAAG,WAAW;YAC7B,CAAC,CAAC,OAAO,KAAK,CAAC,KAAK;gBAChB,CAAC,CAAC,uBAAuB,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU;sBAC9D,gBAAgB,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI;sBAC3D,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU;gBACzD,CAAC,CAAC,EAAE,OAAO;YACf,CAAC,CAAC,EAAE,CAAC;QACP,uEAAuE;QACvE,kEAAkE;QAClE,sDAAsD;QACtD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;QAC7D,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,WAAW,GAAG,sBAAsB,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;QACpF,MAAM,UAAU,GAAG,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1G,OAAO;2BACgB,UAAU,CAAC,GAAG,CAAC,kBAAkB,UAAU,CAAC,MAAM,CAAC,kBAAkB,UAAU,CAAC,UAAU,CAAC;cACxG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;cACzB,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;cAC3B,WAAW;cACX,QAAQ;oBACF,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;cAC/F,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;UACjC,WAAW;;KAEhB,CAAC;IACJ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO;;;;;;;;;;;;;;;;;;;;;;;oHAuB2G,WAAW,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE;;iBAExI,IAAI;;;GAGlB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAA+B,EAAE,aAA2C;IACtG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACpC,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC3D,MAAM,WAAW,GAAG,sBAAsB,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;QAC1G,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK;YAC5B,CAAC,CAAC,8BAA8B,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM;YAC7D,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,KAAK,CAAC;YAC1C,CAAC,CAAC,gDAAgD;YAClD,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW;oBAC/B,CAAC,CAAC,wBAAwB,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ;oBAC/D,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc;oBACzC,CAAC,CAAC,uCAAuC,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM;oBAC/E,CAAC,CAAC,EAAE,CAAC;gBACP,OAAO;;iCAEkB,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC1G,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;;iBAEhH,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;cAChC,cAAc;cACd,OAAO;;SAEZ,CAAC;YACJ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACd,OAAO;;mBAEQ,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,WAAW,aAAa,KAAK,CAAC,WAAW;UAChH,UAAU;UACV,WAAW;;KAEhB,CAAC;IACJ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,wCAAwC,QAAQ,YAAY,CAAC;AACtE,CAAC;AAED,MAAM,OAAO,aAAa;IACf,EAAE,GAAG,MAAM,CAAC;IACZ,aAAa,GAAG,OAAO,CAAC;IAEjC,MAAM,CAAC,OAAoB;QACzB,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;QAChD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA2B,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/C,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,GAAG;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;gBACpB,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,YAAY,GAAG,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,eAAe,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAE1D,OAAO;;;;;WAKA,KAAK;WACL,GAAG;;;;MAIR,YAAY,CAAC,OAAO,CAAC;MACrB,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC;MAC1C,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC;MAChD,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC;mCACpB,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC;;wDAEN,YAAY;YACxD,SAAS;;;CAGpB,CAAC;IACA,CAAC;CACF"}

package/dist/formatters/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/formatters/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlD,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAOlD,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,CAOxD;AAED,yCAAyC;AACzC,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/formatters/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAOlD,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAUlD,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,CAOxD;AAED,yCAAyC;AACzC,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C"}

package/dist/formatters/index.js

@@ -3,9 +3,15 @@
  */
 import { JsonFormatter } from './json-formatter.js';
 import { SarifFormatter } from './sarif-formatter.js';
+import { CsvFormatter } from './csv-formatter.js';
+import { HtmlFormatter } from './html-formatter.js';
+import { MarkdownFormatter } from './markdown-formatter.js';
 const formatters = new Map([
     ['json', new JsonFormatter()],
     ['sarif', new SarifFormatter()],
+    ['csv', new CsvFormatter()],
+    ['html', new HtmlFormatter()],
+    ['markdown', new MarkdownFormatter()],
 ]);
 /** Returns the formatter for the given ID, or throws listing available formats. */
 export function getFormatter(id) {

package/dist/formatters/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/formatters/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAItD,MAAM,UAAU,GAAG,IAAI,GAAG,CAA0B;IAClD,CAAC,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;IAC7B,CAAC,OAAO,EAAE,IAAI,cAAc,EAAE,CAAC;CAChC,CAAC,CAAC;AAEH,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,SAAS,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,mBAAmB;IACjC,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/formatters/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAI5D,MAAM,UAAU,GAAG,IAAI,GAAG,CAA0B;IAClD,CAAC,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;IAC7B,CAAC,OAAO,EAAE,IAAI,cAAc,EAAE,CAAC;IAC/B,CAAC,KAAK,EAAE,IAAI,YAAY,EAAE,CAAC;IAC3B,CAAC,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;IAC7B,CAAC,UAAU,EAAE,IAAI,iBAAiB,EAAE,CAAC;CACtC,CAAC,CAAC;AAEH,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,SAAS,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,mBAAmB;IACjC,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;AACvC,CAAC"}

package/dist/formatters/markdown-formatter.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Markdown output formatter — produces a human-readable security report.
+ * See SPECIFICATION.md Appendix E.3.1.
+ *
+ * Sections (in order):
+ *   1. Header                — Title, date, AI provider/model, repository info
+ *   2. Executive Summary     — One-paragraph overview of the scan outcome
+ *   3. Summary Table         — All checks with PASS/FAIL/FLAG/ERROR status
+ *   4. Detailed Findings     — Failed checks with descriptions, snippets, recs
+ *   5. Flagged Items         — Checks needing human review (only when present)
+ *   6. Errors                — Checks with ERROR status (only when present)
+ *   7. Statistics            — Totals for the scan
+ *   8. CI Metadata           — Job URL / branch / pipeline info (only when set)
+ */
+import type { ScanResults } from '../types.js';
+import type { OutputFormatter } from './types.js';
+/** Resolves the fenced-code-block language tag from a file path. */
+export declare function languageForFile(filePath: string): string;
+/** Wraps code in a fenced block with a language tag, escaping nested fences safely. */
+export declare function fencedCode(code: string, language: string): string;
+/**
+ * Wraps `value` in a backtick fence long enough to survive any backticks
+ * already inside `value`. Per CommonMark, an inline-code span uses a backtick
+ * run of length N around a body that contains no run of length N — minimum
+ * length 1 (unlike fenced code blocks, which require minimum 3). Pad with a
+ * leading/trailing space if the body itself starts or ends with a backtick.
+ * Newlines are collapsed to spaces because inline-code spans must be
+ * single-line (and table cells must not contain raw newlines).
+ */
+export declare function inlineCode(value: string): string;
+/**
+ * Escapes AI-authored free text (issue `description` / `recommendation`) for
+ * safe rendering as a Markdown *block*.
+ *
+ * Threat model: these fields come from the LLM's analysis of the scanned
+ * repository, whose source can contain attacker-crafted strings. Rendered raw
+ * they can inject active HTML that executes when the report is viewed on GitHub,
+ * a wiki, or any Markdown viewer permitting inline HTML (`<script>`,
+ * `<img onerror=...>`), and can break the report's own structure (table cells,
+ * headings, code fences, lists, blockquotes). The HTML formatter already defends
+ * the same fields via `escapeHtml`; this is the Markdown-side equivalent.
+ *
+ * Unlike {@link escapeInlineText}, newlines are *preserved* — these are prose
+ * paragraphs, not single-line bullets — so the escaping is applied per line:
+ *   1. Inline pass: backslash-escape every character that can open inline
+ *      formatting or a raw HTML tag (`\` first so we don't re-escape our own
+ *      escapes). Escaping `<` is what neutralises the inline-HTML vector — per
+ *      CommonMark/GFM, `\<script>` renders as literal text.
+ *   2. Block pass: backslash-escape a leading marker (after optional
+ *      indentation) that would open a block construct — ATX heading (`#`),
+ *      list/thematic-break (`-`/`+`), setext underline (`=`), or an ordered-list
+ *      marker (`1.` / `1)`). Blockquote (`>`) and fences (`` ` ``/`~`) are
+ *      already handled by the inline pass.
+ */
+export declare function escapeMarkdownText(value: string): string;
+export declare class MarkdownFormatter implements OutputFormatter {
+    readonly id = "markdown";
+    readonly fileExtension = ".md";
+    format(results: ScanResults): string;
+}
+//# sourceMappingURL=markdown-formatter.d.ts.map

package/dist/formatters/markdown-formatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown-formatter.d.ts","sourceRoot":"","sources":["../../src/formatters/markdown-formatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACV,WAAW,EAKZ,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AA0ClD,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAKxD;AAeD,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOjE;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAoBhD;AA0BD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAiBxD;AAsWD,qBAAa,iBAAkB,YAAW,eAAe;IACvD,QAAQ,CAAC,EAAE,cAAc;IACzB,QAAQ,CAAC,aAAa,SAAS;IAE/B,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM;CAkBrC"}