@owasp-aghast/aghast 0.8.4 → 0.9.0-rc.1

package/dist/formatters/sarif-formatter.js

@@ -17,6 +17,26 @@ export function mapSeverityToLevel(severity) {
             return 'note';
     }
 }
+/**
+ * Maps a judge verdict to a SARIF result kind.
+ *
+ * `false_positive` maps to `pass` rather than the more obvious `false`, because
+ * `false` is not a member of the SARIF 2.1.0 `kind` enum — the spec allows only
+ * `notApplicable`, `pass`, `fail`, `review`, `open` and `informational`, and a
+ * validating consumer rejects the whole document otherwise.
+ *
+ * `pass` is also what this formatter already emits for false positives found by
+ * false-positive-validation checks (see `buildValidationResults`), so both paths
+ * now describe a dismissed finding the same way: `kind: "pass"` plus a
+ * suppression carrying the rationale.
+ */
+function mapVerdictToKind(verdict) {
+    switch (verdict) {
+        case 'true_positive': return 'open';
+        case 'false_positive': return 'pass';
+        case 'uncertain': return 'review';
+    }
+}
 export class SarifFormatter {
     id = 'sarif';
     fileExtension = '.sarif';
@@ -29,6 +49,7 @@ export class SarifFormatter {
         if (results.validations) {
             sarifResults.push(...this.buildValidationResults(results.validations));
         }
+        const invocations = this.buildInvocations(results);
         const sarif = {
             $schema: 'https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json',
             version: '2.1.0',
@@ -41,12 +62,36 @@ export class SarifFormatter {
                             rules,
                         },
                     },
+                    ...(invocations ? { invocations } : {}),
                     results: sarifResults,
                 },
             ],
         };
         return JSON.stringify(sarif, null, 2);
     }
+    /**
+     * Map CI/CD metadata (spec E.4) to a single SARIF invocation entry. The
+     * `properties` bag is the conventional location for non-standard run
+     * context in SARIF; we use stable, namespaced keys (`aghast.<field>`) so
+     * downstream consumers can rely on the shape.
+     */
+    buildInvocations(results) {
+        const ci = results.metadata?.ciMetadata;
+        if (!ci)
+            return undefined;
+        const properties = {};
+        if (ci.jobUrl)
+            properties['aghast.ciJobUrl'] = ci.jobUrl;
+        if (ci.branch)
+            properties['aghast.ciBranch'] = ci.branch;
+        if (ci.pipelineSource)
+            properties['aghast.ciPipelineSource'] = ci.pipelineSource;
+        if (ci.jobStartedAt)
+            properties['aghast.ciJobStartedAt'] = ci.jobStartedAt;
+        if (Object.keys(properties).length === 0)
+            return undefined;
+        return [{ executionSuccessful: true, properties }];
+    }
     buildRules(results) {
         const seen = new Map();
         for (const check of results.checks) {
@@ -85,6 +130,41 @@ export class SarifFormatter {
             if (issue.dataFlow && issue.dataFlow.length > 0) {
                 result.codeFlows = [this.buildCodeFlow(issue.dataFlow)];
             }
+            // Judge verdict → SARIF kind and properties
+            if (issue.judge) {
+                result.kind = mapVerdictToKind(issue.judge.verdict);
+                result.properties = {
+                    ...(result.properties ?? {}),
+                    judge: {
+                        verdict: issue.judge.verdict,
+                        confidence: issue.judge.confidence,
+                        rationale: issue.judge.rationale,
+                        model: issue.judge.model,
+                        provider: issue.judge.provider,
+                    },
+                };
+                if (issue.judge.verdict === 'false_positive') {
+                    // Match how false-positive-validation dismissals are already
+                    // represented: a suppression carries the reason, so a consumer that
+                    // only understands standard SARIF still learns why the finding was
+                    // dismissed without reading our `properties` bag.
+                    result.suppressions = [
+                        ...(result.suppressions ?? []),
+                        { kind: 'external', justification: issue.judge.rationale },
+                    ];
+                    // `level` is meaningless alongside `kind: "pass"` per SARIF 2.1.0, and
+                    // `buildValidationResults` omits it for the same reason. Leaving a
+                    // severity-derived level here would tell a consumer the finding is
+                    // both dismissed and an error.
+                    delete result.level;
+                }
+            }
+            if (issue.flagSource) {
+                result.properties = {
+                    ...(result.properties ?? {}),
+                    flagSource: issue.flagSource,
+                };
+            }
             return result;
         });
     }

package/dist/formatters/sarif-formatter.js.map

@@ -1 +1 @@
-{"version":3,"file":"sarif-formatter.js","sourceRoot":"","sources":["../../src/formatters/sarif-formatter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,kDAAkD;AAClD,MAAM,UAAU,kBAAkB,CAAC,QAA4B;IAC7D,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;QACnB,KAAK,KAAK,CAAC;QACX,KAAK,eAAe,CAAC;QACrB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAiED,MAAM,OAAO,cAAc;IAChB,EAAE,GAAG,OAAO,CAAC;IACb,aAAa,GAAG,QAAQ,CAAC;IAElC,MAAM,CAAC,OAAoB;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvD,0EAA0E;QAC1E,4EAA4E;QAC5E,kEAAkE;QAClE,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,KAAK,GAAa;YACtB,OAAO,EAAE,4FAA4F;YACrG,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE;gBACJ;oBACE,IAAI,EAAE;wBACJ,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,eAAe,EAAE,OAAO,CAAC,OAAO;4BAChC,KAAK;yBACN;qBACF;oBACD,OAAO,EAAE,YAAY;iBACtB;aACF;SACF,CAAC;QAEF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAEO,UAAU,CAAC,OAAoB;QACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE;oBACtB,EAAE,EAAE,KAAK,CAAC,OAAO;oBACjB,IAAI,EAAE,KAAK,CAAC,SAAS;oBACrB,gBAAgB,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE;iBAC5C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC,CAAC;IAEO,YAAY,CAAC,MAAuB;QAC1C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,MAAM,GAAgB;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC;YACF,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtB,MAAM,CAAC,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;YAC/C,CAAC;YAED,MAAM,MAAM,GAAgB;gBAC1B,MAAM,EAAE,KAAK,CAAC,OAAO;gBACrB,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE;gBACpC,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACzC,SAAS,EAAE;oBACT;wBACE,gBAAgB,EAAE;4BAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE;4BACrC,MAAM;yBACP;qBACF;iBACF;aACF,CAAC;YAEF,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,MAAM,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1D,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,sBAAsB,CAAC,WAA+B;QAC5D,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,gBAAgB,CAAC;aAC7C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,MAAM,MAAM,GAAgB;gBAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS;gBAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO;aAC1B,CAAC;YACF,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACrB,MAAM,CAAC,OAAO,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9C,CAAC;YACD,gEAAgE;YAChE,sEAAsE;YACtE,uEAAuE;YACvE,OAAO;gBACL,MAAM,EAAE,CAAC,CAAC,OAAO;gBACjB,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,uCAAuC,EAAE;gBAC9E,SAAS,EAAE;oBACT;wBACE,gBAAgB,EAAE;4BAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;4BACxC,MAAM;yBACP;qBACF;iBACF;gBACD,YAAY,EAAE;oBACZ;wBACE,IAAI,EAAE,UAAU;wBAChB,aAAa,EAAE,CAAC,CAAC,SAAS;qBAC3B;iBACF;aACoB,CAAC;QAC1B,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,aAAa,CAAC,KAAqB;QACzC,OAAO;YACL,WAAW,EAAE;gBACX;oBACE,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wBAC9B,QAAQ,EAAE;4BACR,gBAAgB,EAAE;gCAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE;gCACpC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE;6BACvC;4BACD,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;yBAC9B;qBACF,CAAC,CAAC;iBACJ;aACF;SACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sarif-formatter.js","sourceRoot":"","sources":["../../src/formatters/sarif-formatter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,kDAAkD;AAClD,MAAM,UAAU,kBAAkB,CAAC,QAA4B;IAC7D,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;QACnB,KAAK,KAAK,CAAC;QACX,KAAK,eAAe,CAAC;QACrB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAmCD;;;;;;;;;;;;GAYG;AACH,SAAS,gBAAgB,CAAC,OAAgC;IACxD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,eAAe,CAAC,CAAC,OAAO,MAAM,CAAC;QACpC,KAAK,gBAAgB,CAAC,CAAC,OAAO,MAAM,CAAC;QACrC,KAAK,WAAW,CAAC,CAAC,OAAO,QAAQ,CAAC;IACpC,CAAC;AACH,CAAC;AA+CD,MAAM,OAAO,cAAc;IAChB,EAAE,GAAG,OAAO,CAAC;IACb,aAAa,GAAG,QAAQ,CAAC;IAElC,MAAM,CAAC,OAAoB;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvD,0EAA0E;QAC1E,4EAA4E;QAC5E,kEAAkE;QAClE,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEnD,MAAM,KAAK,GAAa;YACtB,OAAO,EAAE,4FAA4F;YACrG,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE;gBACJ;oBACE,IAAI,EAAE;wBACJ,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,eAAe,EAAE,OAAO,CAAC,OAAO;4BAChC,KAAK;yBACN;qBACF;oBACD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,OAAO,EAAE,YAAY;iBACtB;aACF;SACF,CAAC;QAEF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACK,gBAAgB,CAAC,OAAoB;QAC3C,MAAM,EAAE,GAA2B,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC;QAChE,IAAI,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC1B,MAAM,UAAU,GAA2B,EAAE,CAAC;QAC9C,IAAI,EAAE,CAAC,MAAM;YAAE,UAAU,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;QACzD,IAAI,EAAE,CAAC,MAAM;YAAE,UAAU,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;QACzD,IAAI,EAAE,CAAC,cAAc;YAAE,UAAU,CAAC,yBAAyB,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC;QACjF,IAAI,EAAE,CAAC,YAAY;YAAE,UAAU,CAAC,uBAAuB,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC;QAC3E,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3D,OAAO,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IACrD,CAAC;IAEO,UAAU,CAAC,OAAoB;QACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE;oBACtB,EAAE,EAAE,KAAK,CAAC,OAAO;oBACjB,IAAI,EAAE,KAAK,CAAC,SAAS;oBACrB,gBAAgB,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE;iBAC5C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC,CAAC;IAEO,YAAY,CAAC,MAAuB;QAC1C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,MAAM,GAAgB;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC;YACF,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtB,MAAM,CAAC,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;YAC/C,CAAC;YAED,MAAM,MAAM,GAAgB;gBAC1B,MAAM,EAAE,KAAK,CAAC,OAAO;gBACrB,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE;gBACpC,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACzC,SAAS,EAAE;oBACT;wBACE,gBAAgB,EAAE;4BAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE;4BACrC,MAAM;yBACP;qBACF;iBACF;aACF,CAAC;YAEF,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,MAAM,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1D,CAAC;YAED,4CAA4C;YAC5C,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACpD,MAAM,CAAC,UAAU,GAAG;oBAClB,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;oBAC5B,KAAK,EAAE;wBACL,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;wBAC5B,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;wBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;wBAChC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK;wBACxB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;qBAC/B;iBACF,CAAC;gBAEF,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,gBAAgB,EAAE,CAAC;oBAC7C,6DAA6D;oBAC7D,oEAAoE;oBACpE,mEAAmE;oBACnE,kDAAkD;oBAClD,MAAM,CAAC,YAAY,GAAG;wBACpB,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;wBAC9B,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE;qBAC3D,CAAC;oBACF,uEAAuE;oBACvE,mEAAmE;oBACnE,mEAAmE;oBACnE,+BAA+B;oBAC/B,OAAO,MAAM,CAAC,KAAK,CAAC;gBACtB,CAAC;YACH,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gBACrB,MAAM,CAAC,UAAU,GAAG;oBAClB,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;oBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;iBAC7B,CAAC;YACJ,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,sBAAsB,CAAC,WAA+B;QAC5D,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,gBAAgB,CAAC;aAC7C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,MAAM,MAAM,GAAgB;gBAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS;gBAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO;aAC1B,CAAC;YACF,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACrB,MAAM,CAAC,OAAO,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9C,CAAC;YACD,gEAAgE;YAChE,sEAAsE;YACtE,uEAAuE;YACvE,OAAO;gBACL,MAAM,EAAE,CAAC,CAAC,OAAO;gBACjB,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,uCAAuC,EAAE;gBAC9E,SAAS,EAAE;oBACT;wBACE,gBAAgB,EAAE;4BAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;4BACxC,MAAM;yBACP;qBACF;iBACF;gBACD,YAAY,EAAE;oBACZ;wBACE,IAAI,EAAE,UAAU;wBAChB,aAAa,EAAE,CAAC,CAAC,SAAS;qBAC3B;iBACF;aACoB,CAAC;QAC1B,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,aAAa,CAAC,KAAqB;QACzC,OAAO;YACL,WAAW,EAAE;gBACX;oBACE,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wBAC9B,QAAQ,EAAE;4BACR,gBAAgB,EAAE;gCAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE;gCACpC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE;6BACvC;4BACD,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;yBAC9B;qBACF,CAAC,CAAC;iBACJ;aACF;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/formatters/types.d.ts

@@ -6,6 +6,30 @@ import type { ScanResults } from '../types.js';
 export interface OutputFormatter {
     readonly id: string;
     readonly fileExtension: string;
+    /**
+     * Renders `results` to the formatter's output string.
+     *
+     * **Escaping contract.** `ScanResults` carries AI-authored free text —
+     * `SecurityIssue.description`, `.recommendation`, and `judge.rationale` — that
+     * is derived from the LLM's analysis of the *scanned* repository and can
+     * therefore contain attacker-crafted content. Any formatter that renders these
+     * fields into a surface where such content could break structure or become
+     * active MUST neutralise them for that surface before emitting:
+     *   - HTML     → `escapeHtml` (entity-encode; see `html-formatter.ts`)
+     *   - Markdown → `description`/`.recommendation` are rendered as their own
+     *     Markdown block, so they need the block-safe `escapeMarkdownText`
+     *     (backslash-escape, newlines preserved). `judge.rationale` is always
+     *     rendered inline after a fixed bullet prefix on a single line, so the
+     *     narrower `escapeInlineText` (backslash-escape + collapse newlines to
+     *     spaces) is sufficient — see `markdown-formatter.ts`.
+     *   - CSV      → `escapeCsvField` (formula-injection guard + RFC-4180 quoting)
+     *
+     * Structured, non-rendered formats (JSON, SARIF) carry the raw text verbatim —
+     * their serialisers already prevent structural breakout — so escaping there
+     * would corrupt the payload and is intentionally omitted. Do NOT pre-sanitise
+     * these fields centrally: the required transform differs per surface, and
+     * mangling the shared `ScanResults` would corrupt the structured formats.
+     */
     format(results: ScanResults): string;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/formatters/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/formatters/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC;CACtC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/formatters/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC;CACtC"}

package/dist/index.d.ts

@@ -3,5 +3,9 @@
  * Usage: aghast scan <repository-path> --config-dir <path> [options]
  */
 import 'dotenv/config';
+export declare function parseRepoSlug(slug: string | undefined): {
+    owner: string;
+    repo: string;
+} | undefined;
 export declare function runScan(args: string[]): Promise<void>;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,eAAe,CAAC;AA+ZvB,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA+b3D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,eAAe,CAAC;AAqjBvB,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAQnG;AAgED,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAwkB3D"}