@securecode-ai/mcp 0.3.9 → 0.4.1

package/dist/tools/agentMemoryTools.js

@@ -0,0 +1,107 @@
+"use strict";
+/**
+ * MCP tools for agent memory management — record false positives,
+ * view memory, and clear memory.
+ *
+ * These let the user (or the VS Code extension) dismiss findings as false
+ * positives so the agent learns not to repeat them in future scans.
+ *
+ * Storage: <workspaceRoot>/.securecode/agent-memory.json (per-workspace)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toolRecordFalsePositive = toolRecordFalsePositive;
+exports.toolGetAgentMemory = toolGetAgentMemory;
+exports.toolClearAgentMemory = toolClearAgentMemory;
+exports.toolAddKnownFact = toolAddKnownFact;
+const agentMemory_1 = require("../project-map/agentMemory");
+/** record_false_positive — dismiss a finding so the agent won't report it again. */
+async function toolRecordFalsePositive(ctx, args) {
+    const required = ['filePath', 'findingType', 'line', 'evidence', 'reason'];
+    for (const field of required) {
+        if (!args[field]) {
+            throw new Error(`Missing required parameter '${field}' for record_false_positive.`);
+        }
+    }
+    const entry = (0, agentMemory_1.recordFalsePositive)(ctx.workspaceRoot, {
+        filePath: args.filePath,
+        findingType: args.findingType,
+        line: args.line,
+        evidence: args.evidence,
+        reason: args.reason,
+        pattern: args.pattern,
+        codeSnippet: args.codeSnippet,
+    });
+    if (!entry) {
+        return { success: false, error: 'Invalid input — could not record false positive.' };
+    }
+    return {
+        success: true,
+        recorded: {
+            id: entry.id,
+            findingType: entry.findingType,
+            pattern: entry.pattern,
+            reason: entry.reason,
+            addedAt: entry.addedAt,
+        },
+        message: `False positive recorded. The agent will not report similar patterns in future scans of this workspace.`,
+    };
+}
+/** get_agent_memory — view all false positives and known facts. */
+async function toolGetAgentMemory(ctx, _args) {
+    const memory = (0, agentMemory_1.loadAgentMemory)(ctx.workspaceRoot);
+    return {
+        falsePositives: {
+            count: memory.falsePositives.length,
+            entries: memory.falsePositives.map(fp => ({
+                id: fp.id,
+                findingType: fp.findingType,
+                file: fp.file,
+                line: fp.line,
+                pattern: fp.pattern,
+                reason: fp.reason,
+                addedAt: fp.addedAt,
+            })),
+        },
+        knownFacts: {
+            count: memory.knownFacts.length,
+            entries: memory.knownFacts.map(kf => ({
+                id: kf.id,
+                fact: kf.fact,
+                source: kf.source,
+                addedAt: kf.addedAt,
+            })),
+        },
+        formatted: (0, agentMemory_1.formatMemoryForPrompt)(memory),
+    };
+}
+/** clear_agent_memory — remove all false positives and known facts. */
+async function toolClearAgentMemory(ctx, args) {
+    // If a specific false-positive ID is given, remove just that one
+    if (args.id) {
+        const removed = (0, agentMemory_1.removeFalsePositive)(ctx.workspaceRoot, args.id);
+        return { success: removed, message: removed ? `Removed false positive ${args.id}.` : `False positive ${args.id} not found.` };
+    }
+    const cleared = (0, agentMemory_1.clearAgentMemory)(ctx.workspaceRoot);
+    return {
+        success: cleared,
+        message: cleared
+            ? 'All agent memory cleared (false positives + known facts).'
+            : 'No agent memory file found — nothing to clear.',
+    };
+}
+/** add_known_fact — add a fact about the project the agent should know. */
+async function toolAddKnownFact(ctx, args) {
+    if (!args.fact || !args.source) {
+        throw new Error('Missing required parameters "fact" and "source" for add_known_fact.');
+    }
+    const entry = (0, agentMemory_1.addKnownFact)(ctx.workspaceRoot, args.fact, args.source);
+    if (!entry) {
+        return { success: false, message: 'Fact already exists (duplicate).' };
+    }
+    return {
+        success: true,
+        recorded: { id: entry.id, fact: entry.fact, source: entry.source, addedAt: entry.addedAt },
+        message: 'Known fact added. The agent will use this in future scans.',
+    };
+}
+//# sourceMappingURL=agentMemoryTools.js.map

package/dist/tools/agentMemoryTools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentMemoryTools.js","sourceRoot":"","sources":["../../src/tools/agentMemoryTools.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAaH,0DAiCC;AAGD,gDA0BC;AAGD,oDAcC;AAGD,4CAaC;AAzGD,4DAOoC;AAEpC,oFAAoF;AAC7E,KAAK,UAAU,uBAAuB,CAAC,GAAkB,EAAE,IAAS;IACvE,MAAM,QAAQ,GAAG,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC3E,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,8BAA8B,CAAC,CAAC;QACxF,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,IAAA,iCAAmB,EAAC,GAAG,CAAC,aAAa,EAAE;QACjD,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;KAChC,CAAC,CAAC;IAEH,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC;IACzF,CAAC;IAED,OAAO;QACH,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE;YACN,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;SACzB;QACD,OAAO,EAAE,wGAAwG;KACpH,CAAC;AACN,CAAC;AAED,mEAAmE;AAC5D,KAAK,UAAU,kBAAkB,CAAC,GAAkB,EAAE,KAAU;IACnE,MAAM,MAAM,GAAG,IAAA,6BAAe,EAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAClD,OAAO;QACH,cAAc,EAAE;YACZ,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC,MAAM;YACnC,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACtC,EAAE,EAAE,EAAE,CAAC,EAAE;gBACT,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,OAAO,EAAE,EAAE,CAAC,OAAO;gBACnB,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,OAAO,EAAE,EAAE,CAAC,OAAO;aACtB,CAAC,CAAC;SACN;QACD,UAAU,EAAE;YACR,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM;YAC/B,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAClC,EAAE,EAAE,EAAE,CAAC,EAAE;gBACT,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,OAAO,EAAE,EAAE,CAAC,OAAO;aACtB,CAAC,CAAC;SACN;QACD,SAAS,EAAE,IAAA,mCAAqB,EAAC,MAAM,CAAC;KAC3C,CAAC;AACN,CAAC;AAED,uEAAuE;AAChE,KAAK,UAAU,oBAAoB,CAAC,GAAkB,EAAE,IAAS;IACpE,iEAAiE;IACjE,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,IAAA,iCAAmB,EAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAChE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,0BAA0B,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC;IAClI,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,8BAAgB,EAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACpD,OAAO;QACH,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,OAAO;YACZ,CAAC,CAAC,2DAA2D;YAC7D,CAAC,CAAC,gDAAgD;KACzD,CAAC;AACN,CAAC;AAED,2EAA2E;AACpE,KAAK,UAAU,gBAAgB,CAAC,GAAkB,EAAE,IAAS;IAChE,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,0BAAY,EAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;IAC3E,CAAC;IACD,OAAO;QACH,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;QAC1F,OAAO,EAAE,4DAA4D;KACxE,CAAC;AACN,CAAC"}

package/dist/tools/agentScan.d.ts

@@ -1,19 +1,20 @@
 /**
- * securecode.agent-scan MCP tool — agent-mode scan.
+ * securecode.agent-scan MCP tool — agent-mode scan with exploit proof.
  *
  * An AI investigator that reads files, traces data flows, checks guards,
- * and compares endpoint policies to find vulnerabilities. Slower but deeper
- * than a deep scan. The agent replaces the Scout; its findings are verified
- * by the existing Juror + Phase 3 pipeline.
+ * and compares endpoint policies to find vulnerabilities. Each high/critical
+ * finding is then sent to the sandbox for PROVEN/UNPROVEN verification before
+ * the Juror confirms it.
  *
  * Flow:
  *   1. Resolve code + language from filePath
  *   2. Build endpoint context from the project map
  *   3. Run the agent loop (POST /agent/scan/start + /step loop)
- *   4. Map agent findings → CandidateContext[]
- *   5. POST /scan with scanDepth: 'agent' + candidateContexts (skips Scout,
+ *   4. For each high/critical finding → POST /sandbox/prove → PROVEN/UNPROVEN
+ *   5. Map agent findings → CandidateContext[]
+ *   6. POST /scan with scanDepth: 'agent' + candidateContexts (skips Scout,
  *      Juror + Phase 3 verify the agent's candidates)
- *   6. Return merged result (agent findings + Juror-verified findings)
+ *   7. Return merged result (agent findings + proven stamps + Juror-verified)
  */
 import type { ServerContext } from '../mcp/types';
 export declare function toolAgentScan(ctx: ServerContext, args: any): Promise<unknown>;

package/dist/tools/agentScan.js

@@ -1,26 +1,29 @@
 "use strict";
 /**
- * securecode.agent-scan MCP tool — agent-mode scan.
+ * securecode.agent-scan MCP tool — agent-mode scan with exploit proof.
  *
  * An AI investigator that reads files, traces data flows, checks guards,
- * and compares endpoint policies to find vulnerabilities. Slower but deeper
- * than a deep scan. The agent replaces the Scout; its findings are verified
- * by the existing Juror + Phase 3 pipeline.
+ * and compares endpoint policies to find vulnerabilities. Each high/critical
+ * finding is then sent to the sandbox for PROVEN/UNPROVEN verification before
+ * the Juror confirms it.
  *
  * Flow:
  *   1. Resolve code + language from filePath
  *   2. Build endpoint context from the project map
  *   3. Run the agent loop (POST /agent/scan/start + /step loop)
- *   4. Map agent findings → CandidateContext[]
- *   5. POST /scan with scanDepth: 'agent' + candidateContexts (skips Scout,
+ *   4. For each high/critical finding → POST /sandbox/prove → PROVEN/UNPROVEN
+ *   5. Map agent findings → CandidateContext[]
+ *   6. POST /scan with scanDepth: 'agent' + candidateContexts (skips Scout,
  *      Juror + Phase 3 verify the agent's candidates)
- *   6. Return merged result (agent findings + Juror-verified findings)
+ *   7. Return merged result (agent findings + proven stamps + Juror-verified)
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.toolAgentScan = toolAgentScan;
 const client_1 = require("../api/client");
 const files_1 = require("../utils/files");
 const mapContext_1 = require("../project-map/mapContext");
+const scanCache_1 = require("../project-map/scanCache");
+const agentMemory_1 = require("../project-map/agentMemory");
 const agentScanLoop_1 = require("../attack/agentScanLoop");
 function mapFindingsToCandidates(findings) {
     return findings.map(f => ({
@@ -31,6 +34,10 @@ function mapFindingsToCandidates(findings) {
         definitionContext: f.why,
     }));
 }
+/** Prove high/critical/medium findings — skip only low. */
+function shouldProve(finding) {
+    return finding.severity === 'critical' || finding.severity === 'high' || finding.severity === 'medium';
+}
 async function toolAgentScan(ctx, args) {
     const progress = args._progress;
     // 1. Resolve code + language
@@ -50,6 +57,35 @@ async function toolAgentScan(ctx, args) {
     else {
         throw new Error('Either filePath or code must be provided.');
     }
+    // 1b. Validate the code — empty, binary, or too-large files cause confusing
+    // downstream errors (HTTP 400/413) that the user can't interpret.
+    // The API server has a 2MB body limit; we cap at 1.5MB to leave room for
+    // the JSON envelope and transcript.
+    const MAX_FILE_BYTES = 1_500_000;
+    if (code.trim().length === 0) {
+        return {
+            status: 'completed',
+            summary: 'File is empty — nothing to scan.',
+            agentFindings: [],
+            findings: [],
+            stepsUsed: 0,
+            costSpentUsd: 0,
+            transcript: [],
+            cached: false,
+            provenCount: 0,
+        };
+    }
+    // Binary file detection: if the first 1000 bytes contain a NUL byte, it's
+    // almost certainly binary (compiled, image, archive). Sending it to the LLM
+    // would produce garbage results.
+    const headBytes = Buffer.from(code.slice(0, 1000), 'utf8');
+    if (headBytes.includes(0)) {
+        throw new Error('Cannot scan binary file. SecureCode only scans text source files (.ts, .js, .py, etc.).');
+    }
+    if (Buffer.byteLength(code, 'utf8') > MAX_FILE_BYTES) {
+        const sizeMB = (Buffer.byteLength(code, 'utf8') / 1_000_000).toFixed(1);
+        throw new Error(`File too large (${sizeMB}MB). Maximum is 1.5MB. Split the file or scan a specific section using the API directly.`);
+    }
     // 2. Build endpoint context from the project map
     let endpointContext = [];
     if (filePath) {
@@ -60,14 +96,53 @@ async function toolAgentScan(ctx, args) {
             // best-effort — proceed without endpoint context
         }
     }
+    // 2b. Check scan cache — if the file hasn't changed, return cached results
+    const skipCacheRead = !!args._noCache;
+    const useCache = !!filePath;
+    if (useCache && !skipCacheRead) {
+        try {
+            const cached = (0, scanCache_1.getCachedScan)(ctx.workspaceRoot, filePath, code);
+            if (cached) {
+                if (progress)
+                    progress(1, 1, 'Cached result — file unchanged since last scan.');
+                return {
+                    status: cached.status,
+                    summary: cached.summary || 'Agent completed (cached).',
+                    agentFindings: cached.findings,
+                    findings: [],
+                    stepsUsed: cached.stepsUsed,
+                    costSpentUsd: 0,
+                    transcript: [],
+                    cached: true,
+                    provenCount: cached.findings.filter((f) => f.proven === 'PROVEN').length,
+                };
+            }
+        }
+        catch (err) {
+            // Cache read failure (corrupt file, permissions, etc) should NOT
+            // block the scan — just skip the cache and proceed.
+            console.warn(`[Agent Scan] Cache read skipped: ${err?.message || err}`);
+        }
+    }
     // 3. Run the agent loop
+    // Load workspace memory (false positives + known facts) to inject into target
+    let workspaceMemory;
+    try {
+        const memory = (0, agentMemory_1.loadAgentMemory)(ctx.workspaceRoot);
+        workspaceMemory = (0, agentMemory_1.formatMemoryForPrompt)(memory) || undefined;
+    }
+    catch {
+        // best-effort — proceed without memory
+    }
     const target = {
         filePath: filePath || 'inline-code',
         language,
         fileContent: code,
         endpointContext,
+        workspaceMemory,
     };
     const agentResult = await (0, agentScanLoop_1.runAgentScan)(ctx, target, {
+        signal: args._signal,
         onProgress: (steps, max, msg) => {
             if (progress)
                 progress(steps, max, msg);
@@ -76,37 +151,181 @@ async function toolAgentScan(ctx, args) {
     if (agentResult.status === 'spawn_failed') {
         throw new Error(agentResult.error || 'Agent scan failed to start.');
     }
-    // 4. Map agent findings → CandidateContext[]
-    const candidateContexts = mapFindingsToCandidates(agentResult.findings);
-    // 5. If no findings, return early
+    // 4. Prove each high/critical finding via the sandbox
+    const client = new client_1.ApiClient({ baseUrl: ctx.apiUrl, token: ctx.apiToken });
+    const provenFindings = [];
+    const proveable = agentResult.findings.filter(shouldProve);
+    if (proveable.length > 0 && progress) {
+        progress(0, proveable.length, `Proving ${proveable.length} finding(s) in sandbox...`);
+    }
+    let proveIdx = 0;
+    for (const finding of agentResult.findings) {
+        if (!shouldProve(finding)) {
+            provenFindings.push({ ...finding, proven: 'SKIPPED', provenReason: 'Low severity — not proven' });
+            continue;
+        }
+        if (progress) {
+            proveIdx++;
+            progress(proveIdx, proveable.length, `Proving ${finding.type} at line ${finding.line}...`);
+        }
+        let proved = false;
+        for (let attempt = 1; attempt <= 2; attempt++) {
+            try {
+                const proveResp = await client.postJson('/sandbox/prove', {
+                    code,
+                    language,
+                    vulnerabilityType: finding.type,
+                    line: finding.line,
+                    lineEnd: finding.lineEnd,
+                    evidence: finding.evidence,
+                    why: finding.why,
+                });
+                provenFindings.push({
+                    ...finding,
+                    proven: proveResp.proven,
+                    provenReason: proveResp.rationale || proveResp.skipReason || proveResp.sandbox?.reason,
+                });
+                proved = true;
+                break;
+            }
+            catch (err) {
+                if (attempt === 1) {
+                    console.warn(`[Agent Scan] Prove attempt 1 failed: ${err.message}. Retrying...`);
+                    await new Promise(r => setTimeout(r, 2000));
+                }
+                else {
+                    provenFindings.push({
+                        ...finding,
+                        proven: 'INCONCLUSIVE',
+                        provenReason: `Sandbox prove failed after 2 attempts: ${err.message || err}`,
+                    });
+                }
+            }
+        }
+    }
+    // 4b. Generate fixes for proven/suspected findings
+    const fixableFindings = provenFindings.filter(f => f.proven === 'PROVEN' || (f.proven !== 'UNPROVEN' && f.confidence >= 60));
+    if (fixableFindings.length > 0 && progress) {
+        progress(0, fixableFindings.length, `Generating fixes for ${fixableFindings.length} finding(s)...`);
+    }
+    let fixIdx = 0;
+    for (const finding of fixableFindings) {
+        if (progress) {
+            fixIdx++;
+            progress(fixIdx, fixableFindings.length, `Fixing ${finding.type} at line ${finding.line}...`);
+        }
+        try {
+            const fixResp = await client.postJson('/fix', {
+                code,
+                language,
+                vulnerability: {
+                    type: finding.type,
+                    line_start: finding.line,
+                    line_end: finding.lineEnd || finding.line,
+                    evidence_snippet: finding.evidence,
+                },
+            });
+            if (fixResp.fixed_code) {
+                finding.fix = {
+                    fixedCode: fixResp.fixed_code,
+                    replaceRange: { start_line: finding.line, end_line: finding.lineEnd || finding.line },
+                    fixSummary: fixResp.fix_summary || '',
+                    importsNeeded: fixResp.imports_needed,
+                    confidence: fixResp.confidence,
+                };
+            }
+        }
+        catch (err) {
+            // Best-effort — finding stays without fix
+            console.warn(`[Agent Scan] Fix generation failed for ${finding.type} at L${finding.line}: ${err.message}`);
+        }
+    }
+    // 5. Map findings → CandidateContext[]
+    const candidateContexts = mapFindingsToCandidates(provenFindings);
+    // 6. If no findings, return early
     if (candidateContexts.length === 0) {
+        if (useCache) {
+            try {
+                (0, scanCache_1.writeCachedScan)(ctx.workspaceRoot, filePath, code, {
+                    findings: provenFindings,
+                    status: agentResult.status,
+                    summary: agentResult.summary,
+                    stepsUsed: agentResult.stepsUsed,
+                    costSpentUsd: agentResult.costSpentUsd,
+                });
+            }
+            catch (err) {
+                console.warn(`[Agent Scan] Cache write skipped: ${err?.message || err}`);
+            }
+        }
         return {
             status: agentResult.status,
             summary: agentResult.summary || 'Agent completed with no findings.',
             findings: [],
-            agentFindings: agentResult.findings,
+            agentFindings: provenFindings,
             stepsUsed: agentResult.stepsUsed,
             costSpentUsd: agentResult.costSpentUsd,
             transcript: agentResult.transcript,
         };
     }
-    // 6. POST /scan with scanDepth: 'agent' + candidateContexts
+    // 7. POST /scan with scanDepth: 'agent' + candidateContexts
     //    This skips Scout and sends the agent's candidates directly to Juror
     //    + Phase 3 for verification.
-    const client = new client_1.ApiClient({ baseUrl: ctx.apiUrl, token: ctx.apiToken });
-    const scanResp = await client.postJson('/scan', {
-        code,
-        language,
-        ...(filePath ? { filePath } : {}),
-        scanDepth: 'agent',
-        candidateContexts,
-        ...(endpointContext.length > 0 ? { endpointContext } : {}),
-    });
-    // 7. Return merged result
+    //    If this call fails, return the agent findings without Juror
+    //    verification (degraded mode) instead of throwing everything away.
+    let scanResp = null;
+    try {
+        scanResp = await client.postJson('/scan', {
+            code,
+            language,
+            ...(filePath ? { filePath } : {}),
+            scanDepth: 'agent',
+            candidateContexts,
+            ...(endpointContext.length > 0 ? { endpointContext } : {}),
+        });
+    }
+    catch (err) {
+        // Juror verification failed — return agent findings as-is (degraded).
+        // This is better than throwing, which would lose all the agent's work.
+        console.warn(`[Agent Scan] Juror verification failed (${err?.message || err}). Returning agent findings without verification.`);
+    }
+    // 8. Write to cache before returning
+    if (useCache) {
+        try {
+            (0, scanCache_1.writeCachedScan)(ctx.workspaceRoot, filePath, code, {
+                findings: provenFindings,
+                status: agentResult.status,
+                summary: agentResult.summary,
+                stepsUsed: agentResult.stepsUsed,
+                costSpentUsd: agentResult.costSpentUsd,
+            });
+        }
+        catch (err) {
+            console.warn(`[Agent Scan] Cache write skipped: ${err?.message || err}`);
+        }
+    }
+    // 9. Return merged result with proven stamps
+    //    If Juror failed, scanResp is null — return agent findings as verified=false
+    if (!scanResp) {
+        return {
+            status: agentResult.status,
+            summary: (agentResult.summary || 'Agent completed') + ' (Juror verification skipped — degraded)',
+            agentFindings: provenFindings,
+            verifiedFindings: [],
+            allFindings: [],
+            degraded: true,
+            stepsUsed: agentResult.stepsUsed,
+            costSpentUsd: agentResult.costSpentUsd,
+            transcript: agentResult.transcript,
+            provenCount: provenFindings.filter(f => f.proven === 'PROVEN').length,
+            unprovenCount: provenFindings.filter(f => f.proven === 'UNPROVEN').length,
+            inconclusiveCount: provenFindings.filter(f => f.proven === 'INCONCLUSIVE').length,
+        };
+    }
     return {
         status: agentResult.status,
         summary: agentResult.summary,
-        agentFindings: agentResult.findings,
+        agentFindings: provenFindings,
         verifiedFindings: scanResp.finalFindings || [],
         allFindings: scanResp.findings || [],
         scanId: scanResp.scanId,
@@ -117,6 +336,9 @@ async function toolAgentScan(ctx, args) {
         stepsUsed: agentResult.stepsUsed,
         costSpentUsd: agentResult.costSpentUsd,
         transcript: agentResult.transcript,
+        provenCount: provenFindings.filter(f => f.proven === 'PROVEN').length,
+        unprovenCount: provenFindings.filter(f => f.proven === 'UNPROVEN').length,
+        inconclusiveCount: provenFindings.filter(f => f.proven === 'INCONCLUSIVE').length,
     };
 }
 //# sourceMappingURL=agentScan.js.map

package/dist/tools/agentScan.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentScan.js","sourceRoot":"","sources":["../../src/tools/agentScan.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;AA4BH,sCA6FC;AAvHD,0CAA0C;AAE1C,0CAAuD;AACvD,0DAAsE;AACtE,2DAAuD;AAYvD,SAAS,uBAAuB,CAAC,QAA4B;IACzD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,iBAAiB,EAAE,CAAC,CAAC,GAAG;KAC3B,CAAC,CAAC,CAAC;AACR,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,IAAS;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAqF,CAAC;IAE5G,6BAA6B;IAC7B,IAAI,IAAY,CAAC;IACjB,IAAI,QAAgB,CAAC;IACrB,IAAI,QAA4B,CAAC;IAEjC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACzB,MAAM,UAAU,GAAG,IAAA,6BAAqB,EAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QACvB,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC;IACpD,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACjB,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IAC7C,CAAC;SAAM,CAAC;QACJ,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACjE,CAAC;IAED,iDAAiD;IACjD,IAAI,eAAe,GAAU,EAAE,CAAC;IAChC,IAAI,QAAQ,EAAE,CAAC;QACX,IAAI,CAAC;YACD,eAAe,GAAG,MAAM,IAAA,sCAAyB,EAAC,QAAQ,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC;YACL,iDAAiD;QACrD,CAAC;IACL,CAAC;IAED,wBAAwB;IACxB,MAAM,MAAM,GAAoB;QAC5B,QAAQ,EAAE,QAAQ,IAAI,aAAa;QACnC,QAAQ;QACR,WAAW,EAAE,IAAI;QACjB,eAAe;KAClB,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,IAAA,4BAAY,EAAC,GAAG,EAAE,MAAM,EAAE;QAChD,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,QAAQ;gBAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5C,CAAC;KACJ,CAAC,CAAC;IAEH,IAAI,WAAW,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI,6BAA6B,CAAC,CAAC;IACxE,CAAC;IAED,6CAA6C;IAC7C,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAExE,kCAAkC;IAClC,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO;YACH,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,OAAO,EAAE,WAAW,CAAC,OAAO,IAAI,mCAAmC;YACnE,QAAQ,EAAE,EAAE;YACZ,aAAa,EAAE,WAAW,CAAC,QAAQ;YACnC,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,UAAU,EAAE,WAAW,CAAC,UAAU;SACrC,CAAC;IACN,CAAC;IAED,4DAA4D;IAC5D,yEAAyE;IACzE,iCAAiC;IACjC,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAe,OAAO,EAAE;QAC1D,IAAI;QACJ,QAAQ;QACR,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,SAAS,EAAE,OAAO;QAClB,iBAAiB;QACjB,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC,CAAC;IAEH,0BAA0B;IAC1B,OAAO;QACH,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,aAAa,EAAE,WAAW,CAAC,QAAQ;QACnC,gBAAgB,EAAE,QAAQ,CAAC,aAAa,IAAI,EAAE;QAC9C,WAAW,EAAE,QAAQ,CAAC,QAAQ,IAAI,EAAE;QACpC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,UAAU,EAAE,WAAW,CAAC,UAAU;KACrC,CAAC;AACN,CAAC"}
+{"version":3,"file":"agentScan.js","sourceRoot":"","sources":["../../src/tools/agentScan.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;AAwCH,sCA4TC;AAlWD,0CAA0C;AAE1C,0CAAuD;AACvD,0DAAsE;AACtE,wDAA0E;AAC1E,4DAAoF;AACpF,2DAAuD;AAiBvD,SAAS,uBAAuB,CAAC,QAAyB;IACtD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,iBAAiB,EAAE,CAAC,CAAC,GAAG;KAC3B,CAAC,CAAC,CAAC;AACR,CAAC;AAED,2DAA2D;AAC3D,SAAS,WAAW,CAAC,OAAyB;IAC1C,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;AAC3G,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,IAAS;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAqF,CAAC;IAE5G,6BAA6B;IAC7B,IAAI,IAAY,CAAC;IACjB,IAAI,QAAgB,CAAC;IACrB,IAAI,QAA4B,CAAC;IAEjC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACzB,MAAM,UAAU,GAAG,IAAA,6BAAqB,EAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QACvB,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC;IACpD,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACjB,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IAC7C,CAAC;SAAM,CAAC;QACJ,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACjE,CAAC;IAED,4EAA4E;IAC5E,kEAAkE;IAClE,yEAAyE;IACzE,oCAAoC;IACpC,MAAM,cAAc,GAAG,SAAS,CAAC;IACjC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACH,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,kCAAkC;YAC3C,aAAa,EAAE,EAAE;YACjB,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,CAAC;YACZ,YAAY,EAAE,CAAC;YACf,UAAU,EAAE,EAAE;YACd,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,CAAC;SACjB,CAAC;IACN,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,iCAAiC;IACjC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3D,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,cAAc,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,0FAA0F,CAAC,CAAC;IACzI,CAAC;IAED,iDAAiD;IACjD,IAAI,eAAe,GAAU,EAAE,CAAC;IAChC,IAAI,QAAQ,EAAE,CAAC;QACX,IAAI,CAAC;YACD,eAAe,GAAG,MAAM,IAAA,sCAAyB,EAAC,QAAQ,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC;YACL,iDAAiD;QACrD,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC5B,IAAI,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;QAC7B,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,GAAG,CAAC,aAAa,EAAE,QAAS,EAAE,IAAI,CAAC,CAAC;YACjE,IAAI,MAAM,EAAE,CAAC;gBACT,IAAI,QAAQ;oBAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,iDAAiD,CAAC,CAAC;gBAChF,OAAO;oBACH,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,2BAA2B;oBACtD,aAAa,EAAE,MAAM,CAAC,QAAQ;oBAC9B,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,YAAY,EAAE,CAAC;oBACf,UAAU,EAAE,EAAE;oBACd,MAAM,EAAE,IAAI;oBACZ,WAAW,EAAG,MAAM,CAAC,QAAkB,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;iBAC3F,CAAC;YACN,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,iEAAiE;YACjE,oDAAoD;YACpD,OAAO,CAAC,IAAI,CAAC,oCAAoC,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;QAC5E,CAAC;IACL,CAAC;IAED,wBAAwB;IACxB,8EAA8E;IAC9E,IAAI,eAAmC,CAAC;IACxC,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,6BAAe,EAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAClD,eAAe,GAAG,IAAA,mCAAqB,EAAC,MAAM,CAAC,IAAI,SAAS,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACL,uCAAuC;IAC3C,CAAC;IAED,MAAM,MAAM,GAAoB;QAC5B,QAAQ,EAAE,QAAQ,IAAI,aAAa;QACnC,QAAQ;QACR,WAAW,EAAE,IAAI;QACjB,eAAe;QACf,eAAe;KAClB,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,IAAA,4BAAY,EAAC,GAAG,EAAE,MAAM,EAAE;QAChD,MAAM,EAAG,IAAY,CAAC,OAAkC;QACxD,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,QAAQ;gBAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5C,CAAC;KACJ,CAAC,CAAC;IAEH,IAAI,WAAW,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI,6BAA6B,CAAC,CAAC;IACxE,CAAC;IAED,sDAAsD;IACtD,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3E,MAAM,cAAc,GAAoB,EAAE,CAAC;IAE3C,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;QACnC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,WAAW,SAAS,CAAC,MAAM,2BAA2B,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;QACzC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,cAAc,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAClG,SAAS;QACb,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,CAAC;YACX,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,WAAW,OAAO,CAAC,IAAI,YAAY,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAuB,gBAAgB,EAAE;oBAC5E,IAAI;oBACJ,QAAQ;oBACR,iBAAiB,EAAE,OAAO,CAAC,IAAI;oBAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;iBACnB,CAAC,CAAC;gBAEH,cAAc,CAAC,IAAI,CAAC;oBAChB,GAAG,OAAO;oBACV,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,YAAY,EAAE,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,UAAU,IAAI,SAAS,CAAC,OAAO,EAAE,MAAM;iBACzF,CAAC,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM;YACV,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAChB,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;oBAChB,OAAO,CAAC,IAAI,CAAC,wCAAwC,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC;oBACjF,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBAChD,CAAC;qBAAM,CAAC;oBACJ,cAAc,CAAC,IAAI,CAAC;wBAChB,GAAG,OAAO;wBACV,MAAM,EAAE,cAAc;wBACtB,YAAY,EAAE,0CAA0C,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE;qBAC/E,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,mDAAmD;IACnD,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAC9C,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAC3E,CAAC;IAEF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzC,QAAQ,CAAC,CAAC,EAAE,eAAe,CAAC,MAAM,EAAE,wBAAwB,eAAe,CAAC,MAAM,gBAAgB,CAAC,CAAC;IACxG,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,CAAC;YACT,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,UAAU,OAAO,CAAC,IAAI,YAAY,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;QAClG,CAAC;QAED,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAc,MAAM,EAAE;gBACvD,IAAI;gBACJ,QAAQ;gBACR,aAAa,EAAE;oBACX,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,UAAU,EAAE,OAAO,CAAC,IAAI;oBACxB,QAAQ,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI;oBACzC,gBAAgB,EAAE,OAAO,CAAC,QAAQ;iBACrC;aACJ,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACrB,OAAO,CAAC,GAAG,GAAG;oBACV,SAAS,EAAE,OAAO,CAAC,UAAU;oBAC7B,YAAY,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE;oBACrF,UAAU,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;oBACrC,aAAa,EAAE,OAAO,CAAC,cAAc;oBACrC,UAAU,EAAE,OAAO,CAAC,UAAU;iBACjC,CAAC;YACN,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,0CAA0C;YAC1C,OAAO,CAAC,IAAI,CAAC,0CAA0C,OAAO,CAAC,IAAI,QAAQ,OAAO,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/G,CAAC;IACL,CAAC;IAED,uCAAuC;IACvC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;IAElE,kCAAkC;IAClC,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,IAAI,QAAQ,EAAE,CAAC;YACX,IAAI,CAAC;gBACD,IAAA,2BAAe,EAAC,GAAG,CAAC,aAAa,EAAE,QAAS,EAAE,IAAI,EAAE;oBAChD,QAAQ,EAAE,cAAc;oBACxB,MAAM,EAAE,WAAW,CAAC,MAAM;oBAC1B,OAAO,EAAE,WAAW,CAAC,OAAO;oBAC5B,SAAS,EAAE,WAAW,CAAC,SAAS;oBAChC,YAAY,EAAE,WAAW,CAAC,YAAY;iBACzC,CAAC,CAAC;YACP,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,qCAAqC,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;YAC7E,CAAC;QACL,CAAC;QACD,OAAO;YACH,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,OAAO,EAAE,WAAW,CAAC,OAAO,IAAI,mCAAmC;YACnE,QAAQ,EAAE,EAAE;YACZ,aAAa,EAAE,cAAc;YAC7B,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,UAAU,EAAE,WAAW,CAAC,UAAU;SACrC,CAAC;IACN,CAAC;IAED,4DAA4D;IAC5D,yEAAyE;IACzE,iCAAiC;IACjC,iEAAiE;IACjE,uEAAuE;IACvE,IAAI,QAAQ,GAAwB,IAAI,CAAC;IACzC,IAAI,CAAC;QACD,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAe,OAAO,EAAE;YACpD,IAAI;YACJ,QAAQ;YACR,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,SAAS,EAAE,OAAO;YAClB,iBAAiB;YACjB,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,sEAAsE;QACtE,uEAAuE;QACvE,OAAO,CAAC,IAAI,CAAC,2CAA2C,GAAG,EAAE,OAAO,IAAI,GAAG,mDAAmD,CAAC,CAAC;IACpI,CAAC;IAED,qCAAqC;IACrC,IAAI,QAAQ,EAAE,CAAC;QACX,IAAI,CAAC;YACD,IAAA,2BAAe,EAAC,GAAG,CAAC,aAAa,EAAE,QAAS,EAAE,IAAI,EAAE;gBAChD,QAAQ,EAAE,cAAc;gBACxB,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,YAAY,EAAE,WAAW,CAAC,YAAY;aACzC,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,qCAAqC,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;IACL,CAAC;IAED,6CAA6C;IAC7C,iFAAiF;IACjF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO;YACH,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,OAAO,EAAE,CAAC,WAAW,CAAC,OAAO,IAAI,iBAAiB,CAAC,GAAG,0CAA0C;YAChG,aAAa,EAAE,cAAc;YAC7B,gBAAgB,EAAE,EAAE;YACpB,WAAW,EAAE,EAAE;YACf,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,WAAW,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;YACrE,aAAa,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM;YACzE,iBAAiB,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,MAAM;SACpF,CAAC;IACN,CAAC;IACD,OAAO;QACH,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,aAAa,EAAE,cAAc;QAC7B,gBAAgB,EAAE,QAAQ,CAAC,aAAa,IAAI,EAAE;QAC9C,WAAW,EAAE,QAAQ,CAAC,QAAQ,IAAI,EAAE;QACpC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,WAAW,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;QACrE,aAAa,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM;QACzE,iBAAiB,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,MAAM;KACpF,CAAC;AACN,CAAC"}

package/dist/utils/files.js

@@ -47,11 +47,28 @@ const SUPPORTED_EXTENSIONS = {
     '.ts': 'typescript',
     '.tsx': 'typescriptreact',
     '.py': 'python',
-    '.php': 'php',
+    // Note: .php is intentionally omitted — the MCP parserLoader has no
+    // tree-sitter-php.wasm. PHP files will return 'Unsupported file type'
+    // with a clear message instead of silently producing zero findings.
+    '.json': 'json',
+    '.yaml': 'yaml',
+    '.yml': 'yaml',
+    '.toml': 'toml',
+    '.ini': 'ini',
+    '.env': 'env',
+    '.cfg': 'ini',
+    '.conf': 'ini',
+    '.config': 'ini',
 };
 function inferLanguage(filePath) {
     const ext = path.extname(filePath).toLowerCase();
-    return SUPPORTED_EXTENSIONS[ext];
+    if (SUPPORTED_EXTENSIONS[ext])
+        return SUPPORTED_EXTENSIONS[ext];
+    // Dotfiles like .env, .env.local, .env.production have no extension
+    const base = path.basename(filePath).toLowerCase();
+    if (base === '.env' || /^\.env\.[\w.-]+$/.test(base))
+        return 'env';
+    return undefined;
 }
 function isSupportedFile(filePath) {
     return inferLanguage(filePath) !== undefined;

package/dist/utils/files.js.map

@@ -1 +1 @@
-{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/utils/files.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,sCAGC;AAED,0CAEC;AAED,oDAOC;AAED,sDAWC;AA3CD,uCAAyB;AACzB,2CAA6B;AAE7B,MAAM,oBAAoB,GAA2B;IACjD,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,iBAAiB;IACzB,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,iBAAiB;IACzB,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,KAAK;CAChB,CAAC;AAEF,SAAgB,aAAa,CAAC,QAAgB;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,SAAgB,eAAe,CAAC,QAAgB;IAC5C,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;AACjD,CAAC;AAED,SAAgB,oBAAoB,CAAC,aAAqB,EAAE,SAAiB;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,SAAS,SAAS,+EAA+E,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,SAAgB,qBAAqB,CAAC,aAAqB,EAAE,SAAiB;IAC1E,MAAM,OAAO,GAAG,oBAAoB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAC/D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC"}
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/utils/files.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,sCASC;AAED,0CAEC;AAED,oDAOC;AAED,sDAWC;AA5DD,uCAAyB;AACzB,2CAA6B;AAE7B,MAAM,oBAAoB,GAA2B;IACjD,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,iBAAiB;IACzB,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,iBAAiB;IACzB,KAAK,EAAE,QAAQ;IACf,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,OAAO,EAAE,MAAM;IACf,OAAO,EAAE,MAAM;IACf,MAAM,EAAE,MAAM;IACd,OAAO,EAAE,MAAM;IACf,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;IACb,OAAO,EAAE,KAAK;IACd,SAAS,EAAE,KAAK;CACnB,CAAC;AAEF,SAAgB,aAAa,CAAC,QAAgB;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,oBAAoB,CAAC,GAAG,CAAC;QAAE,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAEhE,oEAAoE;IACpE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,IAAI,KAAK,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnE,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,SAAgB,eAAe,CAAC,QAAgB;IAC5C,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;AACjD,CAAC;AAED,SAAgB,oBAAoB,CAAC,aAAqB,EAAE,SAAiB;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,SAAS,SAAS,+EAA+E,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,SAAgB,qBAAqB,CAAC,aAAqB,EAAE,SAAiB;IAC1E,MAAM,OAAO,GAAG,oBAAoB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAC/D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC"}

package/dist/utils/listFiles.d.ts

@@ -0,0 +1,17 @@
+/**
+ * File listing utility — walks a directory and returns source files,
+ * respecting .securecodeignore and skip directories.
+ */
+export interface ListFilesOptions {
+    /** Directory to list (relative to workspace root). Defaults to root. */
+    dir?: string;
+    /** Optional glob filter (e.g. "*.ts"). */
+    glob?: string;
+}
+export interface FileEntry {
+    path: string;
+    size: number;
+    lines: number;
+}
+export declare function listFiles(workspaceRoot: string, options?: ListFilesOptions): FileEntry[];
+export declare function formatFileList(files: FileEntry[]): string;