@quantakrypto/qscan 0.3.0 → 0.4.0

package/dist/triage-run.js

@@ -0,0 +1,98 @@
+/**
+ * `qscan --triage` glue (BYOK plane). Runs the LLM triage pass over a scan
+ * result and attaches an exposure annotation to each finding, then re-sorts by
+ * exposure. It NEVER drops a finding and NEVER touches the exit code — the CLI
+ * computes the exit code from raw severities before this ever runs.
+ *
+ * `@quantakrypto/agent` (the only networked package) is loaded via dynamic
+ * `import()` so a plain scan never pulls in the network client.
+ */
+import { readFile as fsReadFile } from "node:fs/promises";
+import path from "node:path";
+import process from "node:process";
+import { buildContext, compareFindings, fingerprintFinding, renderPreflight, } from "@quantakrypto/core";
+const SEVERITY_RANK = {
+    critical: 0,
+    high: 1,
+    medium: 2,
+    low: 3,
+    info: 4,
+};
+function envKey(provider) {
+    return (process.env.QK_LLM_API_KEY ??
+        (provider === "anthropic" ? process.env.ANTHROPIC_API_KEY : process.env.OPENAI_API_KEY));
+}
+function defaultModel(provider) {
+    return provider === "anthropic" ? "claude-sonnet-5" : "gpt-4o-mini";
+}
+/**
+ * Annotate `result.findings` with triage verdicts (mutating `result`). Returns a
+ * preflight string when `--dry-run` is set (no provider is contacted). Failures
+ * degrade gracefully: the scan/report proceed without triage.
+ */
+export async function runTriage(result, opts) {
+    const level = opts.level;
+    const floorRank = SEVERITY_RANK[opts.floor ?? "medium"];
+    const targets = result.findings.filter((f) => SEVERITY_RANK[f.severity] <= floorRank);
+    const stderr = opts.stderr ?? ((s) => void process.stderr.write(s));
+    const root = opts.root ?? result.root ?? ".";
+    const readFile = opts.readFile ?? ((rel) => fsReadFile(path.resolve(root, rel), "utf8"));
+    // --dry-run: show exactly what would be sent; contact nothing.
+    if (opts.dryRun) {
+        const contexts = [];
+        for (const f of targets) {
+            const content = level === "metadata" ? "" : await readFile(f.location.file).catch(() => "");
+            contexts.push(buildContext(f, level, content));
+        }
+        return {
+            preflight: contexts.length
+                ? renderPreflight(contexts)
+                : "qscan --triage --dry-run: no findings at or above the triage floor.",
+        };
+    }
+    const provider = opts.provider ?? "anthropic";
+    const key = opts.resolveKey ? opts.resolveKey() : envKey(provider);
+    // No key and no injected triage function → graceful degrade (never fatal).
+    if (!opts.triageFn && !key) {
+        stderr("qscan: --triage needs an API key (set QK_LLM_API_KEY, ANTHROPIC_API_KEY, or OPENAI_API_KEY). Skipping triage.\n");
+        return {};
+    }
+    const model = opts.model ?? defaultModel(provider);
+    const triageFn = opts.triageFn ??
+        (async (findings) => {
+            const agent = await import("@quantakrypto/agent");
+            const client = agent.resolveClient({ provider, model, apiKey: key });
+            return agent.triageFindings(findings, {
+                client,
+                level,
+                readFile,
+                fingerprint: fingerprintFinding,
+                floor: opts.floor,
+                cacheFile: opts.cacheFile,
+                model,
+            });
+        });
+    try {
+        const verdicts = await triageFn(result.findings);
+        for (const f of result.findings) {
+            const v = verdicts.get(fingerprintFinding(f));
+            if (v) {
+                f.triage = { exposureScore: v.exposureScore, priority: v.priority, rationale: v.rationale };
+            }
+        }
+        // Re-sort by exposure (desc), falling back to the stable finding order.
+        result.findings = [...result.findings].sort((a, b) => {
+            const ea = a.triage?.exposureScore ?? -1;
+            const eb = b.triage?.exposureScore ?? -1;
+            if (eb !== ea)
+                return eb - ea;
+            return compareFindings(a, b);
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        stderr(`qscan: triage failed (${msg}); showing findings without triage.\n`);
+    }
+    return {};
+}
+//# sourceMappingURL=triage-run.js.map

package/dist/triage-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-run.js","sourceRoot":"","sources":["../src/triage-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,OAAO,EACL,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAW5B,MAAM,aAAa,GAA6B;IAC9C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;CACR,CAAC;AA0BF,SAAS,MAAM,CAAC,QAAqB;IACnC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,cAAc;QAC1B,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CACxF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,QAAqB;IACzC,OAAO,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAkB,EAClB,IAAsB;IAEtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAEjG,+DAA+D;IAC/D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5F,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,OAAO;YACL,SAAS,EAAE,QAAQ,CAAC,MAAM;gBACxB,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC;gBAC3B,CAAC,CAAC,qEAAqE;SAC1E,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAgB,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEnE,2EAA2E;IAC3E,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,CACJ,iHAAiH,CAClH,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,QAAQ,GACZ,IAAI,CAAC,QAAQ;QACb,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAa,EAAE,CAAC,CAAC;YAC/E,OAAO,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE;gBACpC,MAAM;gBACN,KAAK;gBACL,QAAQ;gBACR,WAAW,EAAE,kBAAkB;gBAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,KAAK;aACN,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,IAAI,CAAC,EAAE,CAAC;gBACN,CAAC,CAAC,MAAM,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;YAC9F,CAAC;QACH,CAAC;QACD,wEAAwE;QACxE,MAAM,CAAC,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACnD,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,IAAI,CAAC,CAAC,CAAC;YACzC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,IAAI,CAAC,CAAC,CAAC;YACzC,IAAI,EAAE,KAAK,EAAE;gBAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YAC9B,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,CAAC,yBAAyB,GAAG,uCAAuC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantakrypto/qscan",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "qScan — find quantum-vulnerable cryptography in any codebase (CLI). Zero runtime dependencies.",
   "license": "Apache-2.0",
   "author": "Dandelion Labs <hello@dandelionlabs.io> (https://dandelionlabs.io)",
@@ -15,7 +15,8 @@
   },
   "type": "module",
   "bin": {
-    "qscan": "./dist/cli.js"
+    "qscan": "./dist/cli.js",
+    "qremediate": "./dist/remediate-bin.js"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -36,7 +37,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@quantakrypto/core": "0.3.0"
+    "@quantakrypto/agent": "0.4.0",
+    "@quantakrypto/core": "0.4.0"
   },
   "scripts": {
     "build": "tsc -b",