@securecode-ai/mcp 0.5.5 → 0.5.6

package/dist/audit/findingReviewQueue.js

@@ -0,0 +1,335 @@
+"use strict";
+/**
+ * Finding review queue — non-blocking human review for INCONCLUSIVE findings.
+ *
+ * When the verify subagent cannot prove or disprove a finding (sandbox
+ * unavailable, budget exhausted, test couldn't run), the finding is added
+ * to this local review queue. The scan completes without blocking — the
+ * user can later adjudicate each item as confirmed, rejected, or deferred.
+ *
+ * Privacy contract (same as scanAuditLog.ts + agentMemory.ts):
+ *   - Source code NEVER leaves the machine.
+ *   - Evidence strings, `why` explanations, fix code, full test scripts,
+ *     and full API responses are NOT recorded. Only hashes, counts,
+ *     verdicts, file paths, and line numbers are stored.
+ *   - The review queue is per-workspace, stored at
+ *     `<workspaceRoot>/.securecode/finding-review-queue.json`.
+ *
+ * Retention:
+ *   - 500 review items per workspace.
+ *   - Resolved items pruned after 90 days.
+ *   - Unresolved items kept until explicitly resolved.
+ *
+ * Dedup: identical findings (fileHash + filePath + line + findingType +
+ * evidenceHash) are not re-enqueued — the existing item is returned.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadReviewQueue = loadReviewQueue;
+exports.enqueueFindingReview = enqueueFindingReview;
+exports.listFindingReviews = listFindingReviews;
+exports.decideFindingReview = decideFindingReview;
+exports.removeFindingReview = removeFindingReview;
+exports.clearFindingReviews = clearFindingReviews;
+exports.formatReviewItem = formatReviewItem;
+exports.formatReviewList = formatReviewList;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto = __importStar(require("crypto"));
+const REVIEW_DIR = '.securecode';
+const REVIEW_FILE = 'finding-review-queue.json';
+const REVIEW_VERSION = 1;
+const MAX_ITEMS = 500;
+const RESOLVED_TTL_MS = 90 * 24 * 60 * 60 * 1000; // 90 days
+// ── Path helpers ────────────────────────────────────────────────────────────
+function reviewQueuePath(workspaceRoot) {
+    return path.join(workspaceRoot, REVIEW_DIR, REVIEW_FILE);
+}
+function ensureReviewDir(workspaceRoot) {
+    const dir = path.join(workspaceRoot, REVIEW_DIR);
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+    return dir;
+}
+function hashEvidence(evidence) {
+    return crypto.createHash('sha256').update(evidence).digest('hex').slice(0, 16);
+}
+function hashFile(content) {
+    return crypto.createHash('sha256').update(content).digest('hex').slice(0, 16);
+}
+function genId() {
+    return 'review-' + crypto.randomBytes(4).toString('hex');
+}
+const MAX_VERIFICATION_REASON_LEN = 300;
+function truncateReason(reason) {
+    if (!reason)
+        return undefined;
+    if (reason.length <= MAX_VERIFICATION_REASON_LEN)
+        return reason;
+    return reason.slice(0, MAX_VERIFICATION_REASON_LEN) + '…';
+}
+// ── Read / Write ─────────────────────────────────────────────────────────────
+/**
+ * Load the review queue for a workspace. Returns an empty queue
+ * (version + empty array) if the file doesn't exist or is corrupt.
+ */
+function loadReviewQueue(workspaceRoot) {
+    const p = reviewQueuePath(workspaceRoot);
+    try {
+        if (!fs.existsSync(p)) {
+            return { version: REVIEW_VERSION, items: [] };
+        }
+        const raw = fs.readFileSync(p, 'utf8');
+        const data = JSON.parse(raw);
+        if (!data.version || data.version > REVIEW_VERSION) {
+            return { version: REVIEW_VERSION, items: [] };
+        }
+        return {
+            version: REVIEW_VERSION,
+            items: data.items || [],
+        };
+    }
+    catch {
+        return { version: REVIEW_VERSION, items: [] };
+    }
+}
+/** Save the review queue (atomic write — .tmp + rename). */
+function saveReviewQueue(workspaceRoot, queue) {
+    ensureReviewDir(workspaceRoot);
+    const p = reviewQueuePath(workspaceRoot);
+    const tmp = p + '.tmp';
+    fs.writeFileSync(tmp, JSON.stringify(queue, null, 2), 'utf8');
+    fs.renameSync(tmp, p);
+}
+// ── Dedup key ────────────────────────────────────────────────────────────────
+function dedupKey(item) {
+    return `${item.fileHash}:${item.workspaceRelativePath}:${item.line}:${item.findingType}:${item.evidenceHash}`;
+}
+/**
+ * Enqueue a finding for human review. Dedupes by
+ * (fileHash + filePath + line + findingType + evidenceHash).
+ * Returns the item (existing if duplicate, new otherwise).
+ *
+ * Re-enqueuing a previously-resolved item with the same dedup key
+ * reopens it (clears the decision) — the finding reappeared and needs
+ * re-review.
+ */
+function enqueueFindingReview(workspaceRoot, input) {
+    const queue = loadReviewQueue(workspaceRoot);
+    const fh = hashFile(input.fileContent);
+    const eh = hashEvidence(input.evidence);
+    const key = dedupKey({
+        fileHash: fh,
+        workspaceRelativePath: input.workspaceRelativePath,
+        line: input.line,
+        findingType: input.findingType,
+        evidenceHash: eh,
+    });
+    const now = new Date().toISOString();
+    const existingIdx = queue.items.findIndex(item => dedupKey(item) === key);
+    if (existingIdx >= 0) {
+        const existing = queue.items[existingIdx];
+        existing.updatedAt = now;
+        existing.severity = input.severity;
+        existing.confidence = input.confidence;
+        existing.proven = input.proven;
+        existing.reviewReason = input.reviewReason;
+        existing.verificationReason = truncateReason(input.verificationReason);
+        // Reopen if previously resolved — the finding reappeared.
+        existing.decision = undefined;
+        existing.decisionReason = undefined;
+        existing.decidedAt = undefined;
+        saveReviewQueue(workspaceRoot, queue);
+        return existing;
+    }
+    const item = {
+        id: genId(),
+        createdAt: now,
+        updatedAt: now,
+        workspaceRelativePath: input.workspaceRelativePath,
+        fileHash: fh,
+        line: input.line,
+        lineEnd: input.lineEnd,
+        findingType: input.findingType,
+        severity: input.severity,
+        confidence: input.confidence,
+        proven: input.proven,
+        reviewReason: input.reviewReason,
+        verificationReason: truncateReason(input.verificationReason),
+        evidenceHash: eh,
+    };
+    queue.items.push(item);
+    pruneItems(queue);
+    saveReviewQueue(workspaceRoot, queue);
+    return item;
+}
+/**
+ * List review items, optionally filtered by decision status and/or file path.
+ */
+function listFindingReviews(workspaceRoot, options) {
+    const queue = loadReviewQueue(workspaceRoot);
+    let items = queue.items;
+    if (options?.decision) {
+        if (options.decision === 'pending') {
+            items = items.filter(i => i.decision === undefined);
+        }
+        else {
+            items = items.filter(i => i.decision === options.decision);
+        }
+    }
+    if (options?.filePath) {
+        items = items.filter(i => i.workspaceRelativePath === options.filePath);
+    }
+    return items;
+}
+/**
+ * Mark a review item as confirmed, rejected, or deferred.
+ * Returns the updated item, or null if the ID was not found.
+ */
+function decideFindingReview(workspaceRoot, id, decision, reason) {
+    const queue = loadReviewQueue(workspaceRoot);
+    const item = queue.items.find(i => i.id === id);
+    if (!item)
+        return null;
+    const now = new Date().toISOString();
+    item.decision = decision;
+    item.decisionReason = reason ? reason.slice(0, 500) : undefined;
+    item.decidedAt = now;
+    item.updatedAt = now;
+    saveReviewQueue(workspaceRoot, queue);
+    return item;
+}
+/**
+ * Remove a single review item by ID. Returns true if removed.
+ */
+function removeFindingReview(workspaceRoot, id) {
+    const queue = loadReviewQueue(workspaceRoot);
+    const before = queue.items.length;
+    queue.items = queue.items.filter(i => i.id !== id);
+    if (queue.items.length === before)
+        return false;
+    saveReviewQueue(workspaceRoot, queue);
+    return true;
+}
+/**
+ * Clear review items. If `id` is given, removes just that item.
+ * If `resolvedOnly` is true, removes only items with a decision set.
+ * Otherwise removes ALL items.
+ * Returns the count of items removed.
+ */
+function clearFindingReviews(workspaceRoot, options) {
+    const queue = loadReviewQueue(workspaceRoot);
+    if (options?.id) {
+        const before = queue.items.length;
+        queue.items = queue.items.filter(i => i.id !== options.id);
+        const removed = before - queue.items.length;
+        if (removed > 0)
+            saveReviewQueue(workspaceRoot, queue);
+        return removed;
+    }
+    if (options?.resolvedOnly) {
+        const before = queue.items.length;
+        queue.items = queue.items.filter(i => i.decision === undefined);
+        const removed = before - queue.items.length;
+        if (removed > 0)
+            saveReviewQueue(workspaceRoot, queue);
+        return removed;
+    }
+    const removed = queue.items.length;
+    queue.items = [];
+    if (removed > 0)
+        saveReviewQueue(workspaceRoot, queue);
+    return removed;
+}
+// ── Pruning ──────────────────────────────────────────────────────────────────
+function pruneItems(queue) {
+    const cutoff = Date.now() - RESOLVED_TTL_MS;
+    // Drop resolved items older than the TTL.
+    queue.items = queue.items.filter(i => {
+        if (i.decision === undefined)
+            return true; // keep pending
+        if (!i.decidedAt)
+            return true;
+        try {
+            return new Date(i.decidedAt).getTime() >= cutoff;
+        }
+        catch {
+            return true;
+        }
+    });
+    // Enforce hard cap — drop oldest resolved first, then oldest pending.
+    if (queue.items.length <= MAX_ITEMS)
+        return;
+    const resolved = queue.items
+        .filter(i => i.decision !== undefined)
+        .sort((a, b) => (a.decidedAt || a.updatedAt).localeCompare(b.decidedAt || b.updatedAt));
+    const toRemove = queue.items.length - MAX_ITEMS;
+    const removeIds = new Set(resolved.slice(0, toRemove).map(i => i.id));
+    queue.items = queue.items.filter(i => !removeIds.has(i.id));
+    // If still over cap (not enough resolved to drop), drop oldest pending.
+    if (queue.items.length > MAX_ITEMS) {
+        queue.items = queue.items
+            .sort((a, b) => a.updatedAt.localeCompare(b.updatedAt))
+            .slice(-MAX_ITEMS);
+    }
+}
+// ── Formatting ───────────────────────────────────────────────────────────────
+function formatReviewItem(item) {
+    const lines = [
+        `Review ID: ${item.id}`,
+        `File: ${item.workspaceRelativePath}:${item.line}${item.lineEnd ? `-${item.lineEnd}` : ''}`,
+        `Type: ${item.findingType}`,
+        `Severity: ${item.severity}`,
+        `Confidence: ${item.confidence}%`,
+        `Verification: ${item.proven}`,
+        `Reason: ${item.reviewReason}`,
+    ];
+    if (item.verificationReason) {
+        lines.push(`Verification detail: ${item.verificationReason}`);
+    }
+    lines.push(`Decision: ${item.decision || 'pending'}`);
+    return lines.join('\n');
+}
+function formatReviewList(items) {
+    if (items.length === 0) {
+        return 'No review items found.';
+    }
+    const lines = [`Review queue (${items.length} item${items.length === 1 ? '' : 's'}):`, ''];
+    for (const item of items) {
+        lines.push(formatReviewItem(item), '');
+    }
+    return lines.join('\n').trimEnd();
+}
+//# sourceMappingURL=findingReviewQueue.js.map

package/dist/audit/findingReviewQueue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"findingReviewQueue.js","sourceRoot":"","sources":["../../src/audit/findingReviewQueue.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6FH,0CAkBC;AA0CD,oDAsDC;AAUD,gDAoBC;AAMD,kDAiBC;AAKD,kDAUC;AAaD,kDA0BC;AAkCD,4CAeC;AAED,4CASC;AApXD,uCAAyB;AACzB,2CAA6B;AAC7B,+CAAiC;AAEjC,MAAM,UAAU,GAAG,aAAa,CAAC;AACjC,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAChD,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AA6C5D,+EAA+E;AAE/E,SAAS,eAAe,CAAC,aAAqB;IAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,eAAe,CAAC,aAAqB;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IAClC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,KAAK;IACV,OAAO,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAExC,SAAS,cAAc,CAAC,MAA0B;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,MAAM,CAAC,MAAM,IAAI,2BAA2B;QAAE,OAAO,MAAM,CAAC;IAChE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,2BAA2B,CAAC,GAAG,GAAG,CAAC;AAC9D,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,SAAgB,eAAe,CAAC,aAAqB;IACjD,MAAM,CAAC,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IACzC,IAAI,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAClD,CAAC;QACD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,GAAG,cAAc,EAAE,CAAC;YACjD,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAClD,CAAC;QACD,OAAO;YACH,OAAO,EAAE,cAAc;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;SAC1B,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAClD,CAAC;AACL,CAAC;AAED,4DAA4D;AAC5D,SAAS,eAAe,CAAC,aAAqB,EAAE,KAA6B;IACzE,eAAe,CAAC,aAAa,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC;IACvB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9D,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAEhF,SAAS,QAAQ,CAAC,IAAkH;IAChI,OAAO,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,qBAAqB,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;AAClH,CAAC;AAkBD;;;;;;;;GAQG;AACH,SAAgB,oBAAoB,CAChC,aAAqB,EACrB,KAAgC;IAEhC,MAAM,KAAK,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,QAAQ,CAAC;QACjB,QAAQ,EAAE,EAAE;QACZ,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY,EAAE,EAAE;KACnB,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IAC1E,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1C,QAAQ,CAAC,SAAS,GAAG,GAAG,CAAC;QACzB,QAAQ,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QACnC,QAAQ,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACvC,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/B,QAAQ,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QAC3C,QAAQ,CAAC,kBAAkB,GAAG,cAAc,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACvE,0DAA0D;QAC1D,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC9B,QAAQ,CAAC,cAAc,GAAG,SAAS,CAAC;QACpC,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;QAC/B,eAAe,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,MAAM,IAAI,GAAsB;QAC5B,EAAE,EAAE,KAAK,EAAE;QACX,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;QACd,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,QAAQ,EAAE,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,cAAc,CAAC,KAAK,CAAC,kBAAkB,CAAC;QAC5D,YAAY,EAAE,EAAE;KACnB,CAAC;IAEF,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,UAAU,CAAC,KAAK,CAAC,CAAC;IAClB,eAAe,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AAChB,CAAC;AAOD;;GAEG;AACH,SAAgB,kBAAkB,CAC9B,aAAqB,EACrB,OAAmC;IAEnC,MAAM,KAAK,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAC7C,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAExB,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACJ,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/D,CAAC;IACL,CAAC;IAED,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;QACpB,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAC/B,aAAqB,EACrB,EAAU,EACV,QAAwB,EACxB,MAAe;IAEf,MAAM,KAAK,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACzB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;IACrB,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;IACrB,eAAe,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAC/B,aAAqB,EACrB,EAAU;IAEV,MAAM,KAAK,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;IAClC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAChD,eAAe,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AAChB,CAAC;AAOD;;;;;GAKG;AACH,SAAgB,mBAAmB,CAC/B,aAAqB,EACrB,OAAoC;IAEpC,MAAM,KAAK,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAE7C,IAAI,OAAO,EAAE,EAAE,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QAClC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QAC5C,IAAI,OAAO,GAAG,CAAC;YAAE,eAAe,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QAClC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QAC5C,IAAI,OAAO,GAAG,CAAC;YAAE,eAAe,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;IACnC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;IACjB,IAAI,OAAO,GAAG,CAAC;QAAE,eAAe,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACvD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,gFAAgF;AAEhF,SAAS,UAAU,CAAC,KAA6B;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;IAC5C,0CAA0C;IAC1C,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACjC,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,CAAC,eAAe;QAC1D,IAAI,CAAC,CAAC,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,CAAC;YACD,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC,CAAC,CAAC;IACH,sEAAsE;IACtE,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK;SACvB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC;SACrC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,wEAAwE;IACxE,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QACjC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK;aACpB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;aACtD,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;AACL,CAAC;AAED,gFAAgF;AAEhF,SAAgB,gBAAgB,CAAC,IAAuB;IACpD,MAAM,KAAK,GAAa;QACpB,cAAc,IAAI,CAAC,EAAE,EAAE;QACvB,SAAS,IAAI,CAAC,qBAAqB,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3F,SAAS,IAAI,CAAC,WAAW,EAAE;QAC3B,aAAa,IAAI,CAAC,QAAQ,EAAE;QAC5B,eAAe,IAAI,CAAC,UAAU,GAAG;QACjC,iBAAiB,IAAI,CAAC,MAAM,EAAE;QAC9B,WAAW,IAAI,CAAC,YAAY,EAAE;KACjC,CAAC;IACF,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAA0B;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,wBAAwB,CAAC;IACpC,CAAC;IACD,MAAM,KAAK,GAAa,CAAC,iBAAiB,KAAK,CAAC,MAAM,QAAQ,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;IACrG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AACtC,CAAC"}

package/dist/audit/scanAuditLog.d.ts

@@ -0,0 +1,160 @@
+/**
+ * Metadata-only scan audit log — samples per-scan metadata (no source code,
+ * no evidence strings) for quality auditing and regression tracking.
+ *
+ * Privacy contract (same as agentTrace.ts):
+ *   - Source code NEVER leaves the machine.
+ *   - Evidence strings, `why` explanations, fix code, and file content are
+ *     NOT recorded. Only hashes, counts, verdicts, cost, steps, and action
+ *     type histograms are stored.
+ *   - The audit log is per-workspace, stored at
+ *     `<workspaceRoot>/.securecode/scan-audit.jsonl`.
+ *
+ * Sampling:
+ *   - Not every scan is recorded — a configurable sampling rate (default 1.0
+ *     = 100% for local audit; the caller can lower it) gates which scans
+ *     are persisted. Sampling is deterministic per scan (hash of file path
+ *     + timestamp) so the same scan re-run doesn't double-count.
+ *
+ * Reuses metric vocabulary from agentEvalScoring.ts for aggregation:
+ *   - provenRate, inconclusiveRate, meanSteps, meanCostUsd
+ *
+ * Retention:
+ *   - 90-day TTL (longer than trace's 7 days — audit is long-term quality).
+ *   - 1000 entries per workspace (3x the approval audit cap).
+ */
+export interface ScanAuditSample {
+    timestamp: string;
+    filePath: string;
+    fileHash: string;
+    language: string;
+    scanStatus: string;
+    stepsUsed: number;
+    costSpentUsd: number;
+    findings: {
+        type: string;
+        severity: string;
+        line: number;
+        confidence: number;
+        proven: string;
+        evidenceLevel?: string;
+        verificationLevel?: string;
+    }[];
+    findingCounts: {
+        total: number;
+        proven: number;
+        unproven: number;
+        inconclusive: number;
+        notReproducible: number;
+        skipped: number;
+    };
+    precisionMetrics?: {
+        investigationNotesCount: number;
+        coverageGapsCount: number;
+        verificationLevelDistribution: Record<string, number>;
+        rootCauseCount: number;
+        hasArchitectureContext: boolean;
+        stepsGranted?: number;
+        extensionsGranted?: number;
+        terminationReason?: string;
+        provenStrictCount?: number;
+        provenRejectedByGate?: number;
+        proofGateFailures?: Record<string, number>;
+        syntheticProofCount?: number;
+        extractedLogicProofCount?: number;
+        realImportProofCount?: number;
+        baselinePassRate?: number;
+        exploitPassRate?: number;
+        targetReachedRate?: number;
+        flakyProofCount?: number;
+        mutationDiscriminationRate?: number;
+        humanReviewPendingCount?: number;
+    };
+    verifyUsage?: {
+        findingsAttempted: number;
+        roundsUsed: number;
+        llmCallsUsed: number;
+        costSpentUsd: number;
+        wallClockMs: number;
+    };
+    actionHistogram: Record<string, number>;
+    cached: boolean;
+    scope?: {
+        changedFiles: number;
+        blastRadius: number;
+        baseRef?: string;
+    };
+}
+export declare function recordScanAuditSample(workspaceRoot: string, scanResult: {
+    filePath: string;
+    fileHash: string;
+    language: string;
+    scanStatus: string;
+    stepsUsed: number;
+    costSpentUsd: number;
+    agentFindings: any[];
+    transcript?: any[];
+    cached: boolean;
+    verifyUsage?: any;
+    scope?: any;
+    investigationNotes?: any[];
+    coverageGaps?: any[];
+    hasArchitectureContext?: boolean;
+    stepsGranted?: number;
+    extensionsGranted?: number;
+    terminationReason?: string;
+}, options?: {
+    samplingRate?: number;
+}): boolean;
+export interface ScanAuditSummary {
+    totalScans: number;
+    cachedScans: number;
+    freshScans: number;
+    totalFindings: number;
+    byProven: Record<string, number>;
+    bySeverity: Record<string, number>;
+    byType: Record<string, number>;
+    provenRate: number;
+    inconclusiveRate: number;
+    meanSteps: number;
+    meanCostUsd: number;
+    meanFindingsPerScan: number;
+    actionTypeUsage: Record<string, number>;
+    oldestEntry: string | null;
+    newestEntry: string | null;
+}
+export declare function readScanAuditLog(workspaceRoot: string, limit?: number): ScanAuditSample[];
+export declare function summarizeScanAuditLog(workspaceRoot: string): ScanAuditSummary;
+export declare function clearScanAuditLog(workspaceRoot: string): void;
+export declare function formatAuditSummary(summary: ScanAuditSummary): string;
+export interface ProofAuditMetrics {
+    provenStrictCount: number;
+    provenRejectedByGate: number;
+    proofGateFailures: Record<string, number>;
+    syntheticProofCount: number;
+    extractedLogicProofCount: number;
+    realImportProofCount: number;
+    baselinePassRate: number;
+    exploitPassRate: number;
+    targetReachedRate: number;
+    flakyProofCount: number;
+    mutationDiscriminationRate: number;
+    humanReviewPendingCount: number;
+}
+export interface ProofInvariantCheck {
+    findingIndex: number;
+    violations: string[];
+}
+/**
+ * Validate the PROVEN invariant: every PROVEN finding must have:
+ *   - proofEvidence
+ *   - proofGateResult.eligibleForProven === true
+ *   - sourceMode = real-import or real-server
+ *   - repeatedRuns >= 3
+ *   - repeatPasses === repeatedRuns
+ *   - mutation discrimination passed
+ *
+ * Returns an array of violations per finding. An empty array means all
+ * PROVEN findings satisfy the invariant.
+ */
+export declare function validateProvenInvariant(findings: any[]): ProofInvariantCheck[];