@skillsmith/core 0.5.5 → 0.5.6

package/dist/scripts/skill-scanner/reporter.js

@@ -0,0 +1,218 @@
+/**
+ * SMI-1189: Reporter
+ *
+ * Report generation and summary output.
+ */
+import { countBySeverity } from './categorizer.js';
+import { calculateAverageRiskScore, calculateMaxRiskScore, getPassFailStats, } from './trust-scorer.js';
+/**
+ * ANSI color codes for terminal output
+ */
+const COLORS = {
+    reset: '\x1b[0m',
+    bold: '\x1b[1m',
+    dim: '\x1b[2m',
+    red: '\x1b[31m',
+    green: '\x1b[32m',
+    yellow: '\x1b[33m',
+    cyan: '\x1b[36m',
+    magenta: '\x1b[35m',
+};
+/**
+ * Check if colors should be used
+ */
+function useColors() {
+    return process.stdout.isTTY && !process.env.CI && !process.env.NO_COLOR;
+}
+/**
+ * Apply color to text if colors are enabled
+ */
+function colorize(text, color) {
+    return useColors() ? `${COLORS[color]}${text}${COLORS.reset}` : text;
+}
+/**
+ * Create a visual bar for statistics
+ */
+function createStatBar(value, total, width = 20) {
+    const percentage = total > 0 ? value / total : 0;
+    const filled = Math.round(width * percentage);
+    const bar = '█'.repeat(filled) + '░'.repeat(width - filled);
+    return bar;
+}
+/**
+ * Log summary statistics to console with improved formatting
+ *
+ * @param results - Array of scan results
+ */
+export function logSummary(results) {
+    const total = results.length;
+    const { passed, quarantined } = getPassFailStats(results);
+    const bySeverity = countBySeverity(results);
+    const avgRiskScore = calculateAverageRiskScore(results);
+    const maxRiskScore = calculateMaxRiskScore(results);
+    const border = '═'.repeat(60);
+    const thinBorder = '─'.repeat(60);
+    console.log();
+    console.log(colorize(border, 'cyan'));
+    console.log(colorize('                    SCAN SUMMARY', 'bold'));
+    console.log(colorize(border, 'cyan'));
+    console.log();
+    // Main stats with visual bars
+    const passedPct = total > 0 ? ((passed / total) * 100).toFixed(1) : '0.0';
+    const quarantinedPct = total > 0 ? ((quarantined / total) * 100).toFixed(1) : '0.0';
+    console.log(`  ${colorize('Total Skills Scanned:', 'bold')}  ${total}`);
+    console.log();
+    console.log(`  ${colorize('Safe (Passed):', 'green')}         ${passed.toString().padStart(4)} ${createStatBar(passed, total)} ${passedPct}%`);
+    console.log(`  ${colorize('Quarantined:', 'red')}           ${quarantined.toString().padStart(4)} ${createStatBar(quarantined, total)} ${quarantinedPct}%`);
+    console.log();
+    console.log(colorize(thinBorder, 'dim'));
+    console.log();
+    // Severity breakdown
+    console.log(`  ${colorize('By Severity:', 'bold')}`);
+    console.log();
+    console.log(`    ${colorize('CRITICAL:', 'red')}  ${bySeverity.CRITICAL.toString().padStart(4)} ${createStatBar(bySeverity.CRITICAL, total, 15)}`);
+    console.log(`    ${colorize('HIGH:', 'magenta')}      ${bySeverity.HIGH.toString().padStart(4)} ${createStatBar(bySeverity.HIGH, total, 15)}`);
+    console.log(`    ${colorize('MEDIUM:', 'yellow')}    ${bySeverity.MEDIUM.toString().padStart(4)} ${createStatBar(bySeverity.MEDIUM, total, 15)}`);
+    console.log(`    ${colorize('LOW:', 'cyan')}       ${bySeverity.LOW.toString().padStart(4)} ${createStatBar(bySeverity.LOW, total, 15)}`);
+    console.log();
+    console.log(colorize(thinBorder, 'dim'));
+    console.log();
+    // Risk score stats
+    console.log(`  ${colorize('Risk Scores:', 'bold')}`);
+    console.log(`    Average:             ${avgRiskScore.toFixed(1)}`);
+    console.log(`    Maximum:             ${maxRiskScore}`);
+    console.log();
+    console.log(colorize(border, 'cyan'));
+    console.log();
+}
+/**
+ * Calculate top findings by type
+ *
+ * @param findings - Array of findings with context
+ * @param limit - Maximum number of top findings to return
+ * @returns Array of top findings with counts
+ */
+export function calculateTopFindings(findings, limit = 10) {
+    const findingCounts = new Map();
+    for (const finding of findings) {
+        const existing = findingCounts.get(finding.type);
+        if (existing) {
+            existing.count++;
+            // Keep the highest severity seen for this type
+            if (finding.severity === 'critical' ||
+                (finding.severity === 'high' && existing.severity !== 'critical') ||
+                (finding.severity === 'medium' &&
+                    existing.severity !== 'critical' &&
+                    existing.severity !== 'high')) {
+                existing.severity = finding.severity;
+            }
+        }
+        else {
+            findingCounts.set(finding.type, { count: 1, severity: finding.severity });
+        }
+    }
+    return Array.from(findingCounts.entries())
+        .map(([type, data]) => ({ type, count: data.count, severity: data.severity }))
+        .sort((a, b) => b.count - a.count)
+        .slice(0, limit);
+}
+/**
+ * Generate the full security report
+ *
+ * @param results - Array of scan results
+ * @param findings - Array of findings with context
+ * @param inputPath - Path to the input file
+ * @returns SecurityReportOutput object
+ */
+export function generateSecurityReport(results, findings, inputPath) {
+    const total = results.length;
+    const { passed, quarantined } = getPassFailStats(results);
+    const bySeverity = countBySeverity(results);
+    const avgRiskScore = calculateAverageRiskScore(results);
+    const maxRiskScore = calculateMaxRiskScore(results);
+    const topFindings = calculateTopFindings(findings);
+    return {
+        scanDate: new Date().toISOString(),
+        inputFile: inputPath,
+        summary: {
+            totalScanned: total,
+            passed,
+            quarantined,
+            bySeverity,
+            averageRiskScore: Math.round(avgRiskScore * 100) / 100,
+            maxRiskScore,
+        },
+        results,
+        topFindings,
+    };
+}
+/**
+ * Generate the quarantine output
+ *
+ * @param results - Array of quarantined scan results
+ * @returns QuarantineOutput object
+ */
+export function generateQuarantineOutput(results) {
+    const quarantinedSkills = results.filter((r) => r.isQuarantined);
+    return {
+        generatedAt: new Date().toISOString(),
+        reason: 'Skills with HIGH or CRITICAL security findings, or risk score >= 40',
+        count: quarantinedSkills.length,
+        skills: quarantinedSkills.map((r) => ({
+            skillId: r.skillId,
+            skillName: r.skillName,
+            author: r.author,
+            riskScore: r.scanReport.riskScore,
+            severityCategory: r.severityCategory,
+            topFindings: r.scanReport.findings
+                .filter((f) => f.severity === 'critical' || f.severity === 'high')
+                .slice(0, 5)
+                .map((f) => `${f.type}: ${f.message}`),
+        })),
+    };
+}
+/**
+ * Generate the safe skills output
+ *
+ * @param results - Array of scan results
+ * @returns SafeSkillsOutput object
+ */
+export function generateSafeSkillsOutput(results) {
+    const safeSkills = results.filter((r) => !r.isQuarantined);
+    return {
+        generatedAt: new Date().toISOString(),
+        count: safeSkills.length,
+        skills: safeSkills.map((r) => ({
+            skillId: r.skillId,
+            skillName: r.skillName,
+            author: r.author,
+            source: r.source,
+            riskScore: r.scanReport.riskScore,
+        })),
+    };
+}
+/**
+ * Log recommendations based on scan results
+ *
+ * @param results - Array of scan results
+ * @param criticalCount - Number of critical findings
+ */
+export function logRecommendations(results, criticalCount) {
+    const { passed, quarantined } = getPassFailStats(results);
+    console.log('RECOMMENDATIONS:');
+    if (quarantined > 0) {
+        console.log(`  - ${quarantined} skills have been quarantined`);
+        console.log('  - Review quarantine-skills.json for manual triage');
+        console.log('  - Critical/high findings require security review before import');
+    }
+    if (criticalCount > 0) {
+        console.log(`  - ${criticalCount} CRITICAL findings detected`);
+        console.log('  - These skills should NOT be imported without thorough review');
+    }
+    if (passed > 0) {
+        console.log(`  - ${passed} skills passed security checks`);
+        console.log('  - These are ready for import from safe-skills.json');
+    }
+    console.log();
+}
+//# sourceMappingURL=reporter.js.map

package/dist/scripts/skill-scanner/reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporter.js","sourceRoot":"","sources":["../../../src/scripts/skill-scanner/reporter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,mBAAmB,CAAA;AAE1B;;GAEG;AACH,MAAM,MAAM,GAAG;IACb,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,UAAU;IACf,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,UAAU;CACpB,CAAA;AAED;;GAEG;AACH,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;AACzE,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,IAAY,EAAE,KAA0B;IACxD,OAAO,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACtE,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa,EAAE,QAAgB,EAAE;IACrE,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,CAAA;IAC3D,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAA0B;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAA;IAC5B,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACzD,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAA;IACvD,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAEnD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAEjC,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACrC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC,CAAA;IACjE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACrC,OAAO,CAAC,GAAG,EAAE,CAAA;IAEb,8BAA8B;IAC9B,MAAM,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACzE,MAAM,cAAc,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAEnF,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC,CAAA;IACvE,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CACT,KAAK,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC,YAAY,MAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,SAAS,GAAG,CAClI,CAAA;IACD,OAAO,CAAC,GAAG,CACT,KAAK,QAAQ,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,WAAW,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,cAAc,GAAG,CAC/I,CAAA;IACD,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAA;IACxC,OAAO,CAAC,GAAG,EAAE,CAAA;IAEb,qBAAqB;IACrB,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;IACpD,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CACT,OAAO,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,CACtI,CAAA;IACD,OAAO,CAAC,GAAG,CACT,OAAO,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,CAClI,CAAA;IACD,OAAO,CAAC,GAAG,CACT,OAAO,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,CACrI,CAAA;IACD,OAAO,CAAC,GAAG,CACT,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,CAC7H,CAAA;IACD,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAA;IACxC,OAAO,CAAC,GAAG,EAAE,CAAA;IAEb,mBAAmB;IACnB,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;IACpD,OAAO,CAAC,GAAG,CAAC,4BAA4B,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAClE,OAAO,CAAC,GAAG,CAAC,4BAA4B,YAAY,EAAE,CAAC,CAAA;IACvD,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACrC,OAAO,CAAC,GAAG,EAAE,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAA8B,EAC9B,QAAgB,EAAE;IAElB,MAAM,aAAa,GAAG,IAAI,GAAG,EAAyD,CAAA;IAEtF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAChD,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,KAAK,EAAE,CAAA;YAChB,+CAA+C;YAC/C,IACE,OAAO,CAAC,QAAQ,KAAK,UAAU;gBAC/B,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,KAAK,UAAU,CAAC;gBACjE,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ;oBAC5B,QAAQ,CAAC,QAAQ,KAAK,UAAU;oBAChC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,EAC/B,CAAC;gBACD,QAAQ,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;YACtC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;SACvC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;SAC7E,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SACjC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA0B,EAC1B,QAA8B,EAC9B,SAAiB;IAEjB,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAA;IAC5B,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACzD,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAA;IACvD,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IACnD,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IAElD,OAAO;QACL,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,SAAS,EAAE,SAAS;QACpB,OAAO,EAAE;YACP,YAAY,EAAE,KAAK;YACnB,MAAM;YACN,WAAW;YACX,UAAU;YACV,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,GAAG,GAAG;YACtD,YAAY;SACb;QACD,OAAO;QACP,WAAW;KACZ,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA0B;IACjE,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;IAEhE,OAAO;QACL,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,MAAM,EAAE,qEAAqE;QAC7E,KAAK,EAAE,iBAAiB,CAAC,MAAM;QAC/B,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,SAAS;YACjC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;YACpC,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ;iBAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC;iBACjE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;SACzC,CAAC,CAAC;KACJ,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA0B;IACjE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;IAE1D,OAAO;QACL,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,KAAK,EAAE,UAAU,CAAC,MAAM;QACxB,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7B,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,SAAS;SAClC,CAAC,CAAC;KACJ,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA0B,EAAE,aAAqB;IAClF,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAEzD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC/B,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,OAAO,WAAW,+BAA+B,CAAC,CAAA;QAC9D,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAA;QAClE,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAA;IACjF,CAAC;IACD,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,OAAO,aAAa,6BAA6B,CAAC,CAAA;QAC9D,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAA;IAChF,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,gCAAgC,CAAC,CAAA;QAC1D,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAA;AACf,CAAC"}

package/dist/scripts/skill-scanner/scanner.d.ts

@@ -0,0 +1,55 @@
+/**
+ * SMI-1189: Scanner
+ *
+ * Main scanning logic for imported skills.
+ */
+import { SecurityScanner } from '../../security/index.js';
+import type { AllowlistMatcher, ImportedSkill, SkillScanResult, ScannerCliOptions } from './types.js';
+import { type TrustScorerConfig } from './trust-scorer.js';
+/**
+ * Scanner configuration
+ */
+export interface ScannerConfig {
+    /** Default input file path */
+    defaultInput: string;
+    /** Output directory for reports */
+    outputDir: string;
+    /** Scanner options */
+    scannerOptions: {
+        riskThreshold: number;
+    };
+    /** Trust scorer config */
+    trustConfig: TrustScorerConfig;
+    /** Progress logging interval */
+    progressInterval: number;
+    /** SMI-4396: Path to the version-controlled allowlist file. */
+    allowlistPath: string;
+}
+/** Default scanner configuration */
+export declare const DEFAULT_CONFIG: ScannerConfig;
+/**
+ * Scan a single skill and return the result
+ *
+ * SMI-4396: accepts an optional AllowlistMatcher. Findings whose
+ * (skillId, type, message/location) match a non-expired allowlist entry are
+ * excluded from the quarantine decision. severityCategory still reflects
+ * the raw findings so the security report preserves audit visibility.
+ *
+ * @param skill - The skill to scan
+ * @param scanner - The security scanner instance
+ * @param config - Trust scorer configuration
+ * @param allowlist - Optional per-skill allowlist (SMI-4396)
+ * @returns The scan result
+ */
+export declare function scanSkill(skill: ImportedSkill, scanner: SecurityScanner, config?: TrustScorerConfig, allowlist?: AllowlistMatcher): SkillScanResult;
+/** Default CLI options */
+export declare const DEFAULT_CLI_OPTIONS: ScannerCliOptions;
+/**
+ * Scan all imported skills
+ *
+ * @param inputPath - Path to the imported skills JSON file
+ * @param config - Scanner configuration
+ * @param cliOptions - CLI options for output control
+ */
+export declare function scanImportedSkills(inputPath: string, config?: ScannerConfig, cliOptions?: Partial<ScannerCliOptions>): Promise<void>;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/scripts/skill-scanner/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../../src/scripts/skill-scanner/scanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,EACV,gBAAgB,EAChB,aAAa,EACb,eAAe,EAEf,iBAAiB,EAElB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAKL,KAAK,iBAAiB,EAEvB,MAAM,mBAAmB,CAAA;AA8B1B;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,sBAAsB;IACtB,cAAc,EAAE;QACd,aAAa,EAAE,MAAM,CAAA;KACtB,CAAA;IACD,0BAA0B;IAC1B,WAAW,EAAE,iBAAiB,CAAA;IAC9B,gCAAgC;IAChC,gBAAgB,EAAE,MAAM,CAAA;IACxB,+DAA+D;IAC/D,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,oCAAoC;AACpC,eAAO,MAAM,cAAc,EAAE,aAS5B,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,eAAe,EACxB,MAAM,GAAE,iBAAwC,EAChD,SAAS,GAAE,gBAAkC,GAC5C,eAAe,CAgBjB;AAED,0BAA0B;AAC1B,eAAO,MAAM,mBAAmB,EAAE,iBAKjC,CAAA;AA0DD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,aAA8B,EACtC,UAAU,GAAE,OAAO,CAAC,iBAAiB,CAAM,GAC1C,OAAO,CAAC,IAAI,CAAC,CAmLf"}

package/dist/scripts/skill-scanner/scanner.js

@@ -0,0 +1,269 @@
+/**
+ * SMI-1189: Scanner
+ *
+ * Main scanning logic for imported skills.
+ */
+import * as path from 'path';
+import { SecurityScanner } from '../../security/index.js';
+import { EMPTY_ALLOWLIST, loadAllowlist } from './allowlist.js';
+import { shouldQuarantine, getPassFailStats, calculateAverageRiskScore, calculateMaxRiskScore, DEFAULT_TRUST_CONFIG, } from './trust-scorer.js';
+import { determineSeverityCategory, countBySeverity } from './categorizer.js';
+import { extractScannableContent, readImportedSkills, ensureDirectoryExists, fileExists, writeJsonFile, } from './file-scanner.js';
+import { formatDuration, logHeader, logFindings, logProgress, logCompletion, logFileOutput, logScanStart, logProgressBar, clearProgressLine, logQuarantineTable, logCategorizedResults, } from './logger.js';
+import { logSummary, generateSecurityReport, generateQuarantineOutput, generateSafeSkillsOutput, logRecommendations, } from './reporter.js';
+/** Default scanner configuration */
+export const DEFAULT_CONFIG = {
+    defaultInput: './data/imported-skills.json',
+    outputDir: './data',
+    scannerOptions: {
+        riskThreshold: 40,
+    },
+    trustConfig: DEFAULT_TRUST_CONFIG,
+    progressInterval: 100,
+    allowlistPath: './data/skills-security-allowlist.json',
+};
+/**
+ * Scan a single skill and return the result
+ *
+ * SMI-4396: accepts an optional AllowlistMatcher. Findings whose
+ * (skillId, type, message/location) match a non-expired allowlist entry are
+ * excluded from the quarantine decision. severityCategory still reflects
+ * the raw findings so the security report preserves audit visibility.
+ *
+ * @param skill - The skill to scan
+ * @param scanner - The security scanner instance
+ * @param config - Trust scorer configuration
+ * @param allowlist - Optional per-skill allowlist (SMI-4396)
+ * @returns The scan result
+ */
+export function scanSkill(skill, scanner, config = DEFAULT_TRUST_CONFIG, allowlist = EMPTY_ALLOWLIST) {
+    const content = extractScannableContent(skill);
+    const report = scanner.scan(skill.id, content);
+    const isQuarantined = shouldQuarantine(report, config, allowlist);
+    const severityCategory = determineSeverityCategory(report.findings);
+    return {
+        skillId: skill.id,
+        skillName: skill.name,
+        author: skill.author || 'unknown',
+        source: skill.source || 'unknown',
+        scanReport: report,
+        severityCategory,
+        isQuarantined,
+        scanTimestamp: new Date().toISOString(),
+    };
+}
+/** Default CLI options */
+export const DEFAULT_CLI_OPTIONS = {
+    json: false,
+    verbose: false,
+    quiet: false,
+    inputPath: DEFAULT_CONFIG.defaultInput,
+};
+/**
+ * Generate JSON output for machine-readable format
+ */
+function generateJsonOutput(results, config, durationMs) {
+    const { passed, quarantined: quarantinedCount } = getPassFailStats(results);
+    const bySeverity = countBySeverity(results);
+    const avgRiskScore = calculateAverageRiskScore(results);
+    const maxRiskScore = calculateMaxRiskScore(results);
+    const quarantinedSkills = results
+        .filter((r) => r.isQuarantined)
+        .sort((a, b) => b.scanReport.riskScore - a.scanReport.riskScore)
+        .map((r) => ({
+        skillId: r.skillId,
+        riskScore: r.scanReport.riskScore,
+        severity: r.severityCategory,
+        topFinding: r.scanReport.findings.length > 0
+            ? `${r.scanReport.findings[0].type}: ${r.scanReport.findings[0].message}`
+            : 'N/A',
+    }));
+    const safeSkills = results
+        .filter((r) => !r.isQuarantined)
+        .sort((a, b) => a.scanReport.riskScore - b.scanReport.riskScore)
+        .map((r) => ({
+        skillId: r.skillId,
+        riskScore: r.scanReport.riskScore,
+    }));
+    return {
+        success: true,
+        summary: {
+            totalScanned: results.length,
+            passed,
+            quarantined: quarantinedCount,
+            bySeverity,
+            averageRiskScore: Math.round(avgRiskScore * 100) / 100,
+            maxRiskScore,
+            duration: Math.round(durationMs),
+            skillsPerSecond: Math.round((results.length / durationMs) * 1000 * 10) / 10,
+        },
+        quarantined: quarantinedSkills,
+        safe: safeSkills,
+        outputFiles: {
+            report: path.join(config.outputDir, 'security-report.json'),
+            quarantine: path.join(config.outputDir, 'quarantine-skills.json'),
+            safe: path.join(config.outputDir, 'safe-skills.json'),
+        },
+    };
+}
+/**
+ * Scan all imported skills
+ *
+ * @param inputPath - Path to the imported skills JSON file
+ * @param config - Scanner configuration
+ * @param cliOptions - CLI options for output control
+ */
+export async function scanImportedSkills(inputPath, config = DEFAULT_CONFIG, cliOptions = {}) {
+    const options = { ...DEFAULT_CLI_OPTIONS, ...cliOptions, inputPath };
+    const startTime = performance.now();
+    // Validate input file exists (always check, regardless of output mode)
+    if (!fileExists(inputPath)) {
+        if (options.json) {
+            console.log(JSON.stringify({ success: false, error: `Input file not found: ${inputPath}` }));
+        }
+        else {
+            console.error(`Error: Input file not found: ${inputPath}`);
+            console.error('Usage: npx tsx packages/core/src/scripts/scan-imported-skills.ts [options] [path-to-imported-skills.json]');
+            console.error('\nOptions:');
+            console.error('  --json      Output results in JSON format (machine-readable)');
+            console.error('  --verbose   Show detailed output');
+            console.error('  --quiet     Minimal output');
+        }
+        process.exit(1);
+    }
+    // Ensure output directory exists
+    ensureDirectoryExists(config.outputDir);
+    // Read and parse imported skills
+    let skills;
+    try {
+        skills = await readImportedSkills(inputPath);
+    }
+    catch (error) {
+        if (options.json) {
+            console.log(JSON.stringify({
+                success: false,
+                error: `Failed to read input: ${error.message}`,
+            }));
+        }
+        else {
+            console.error(`Error reading/parsing input file: ${error.message}`);
+        }
+        process.exit(1);
+    }
+    // For JSON output, skip all console logging until the end
+    if (!options.json && !options.quiet) {
+        logScanStart(skills.length, inputPath, config.outputDir);
+    }
+    // Initialize scanner
+    const scanner = new SecurityScanner(config.scannerOptions);
+    // SMI-4396: Load the security allowlist (returns EMPTY_ALLOWLIST if the file
+    // doesn't exist, so pre-SMI-4396 environments keep working). A malformed
+    // file throws — fail-safe toward quarantine, never silently proceed.
+    const allowlist = loadAllowlist(config.allowlistPath);
+    // Scan all skills
+    const results = [];
+    const allFindings = [];
+    let processedCount = 0;
+    // Use progress bar for interactive output
+    const useProgressBar = !options.json && !options.quiet && process.stdout.isTTY;
+    for (const skill of skills) {
+        processedCount++;
+        const result = scanSkill(skill, scanner, config.trustConfig, allowlist);
+        results.push(result);
+        // Collect findings with skill context
+        for (const finding of result.scanReport.findings) {
+            allFindings.push({ ...finding, skillId: skill.id });
+        }
+        // Log progress
+        if (useProgressBar) {
+            logProgressBar(processedCount, skills.length, true);
+        }
+        else if (!options.json && !options.quiet && processedCount % config.progressInterval === 0) {
+            logProgress(processedCount, skills.length);
+        }
+    }
+    // Clear progress bar line
+    if (useProgressBar) {
+        clearProgressLine();
+    }
+    if (!options.json && !options.quiet) {
+        logCompletion(processedCount, skills.length);
+    }
+    // Log critical and high findings (if not JSON mode)
+    const criticalFindings = allFindings.filter((f) => f.severity === 'critical');
+    const highFindings = allFindings.filter((f) => f.severity === 'high');
+    if (!options.json && !options.quiet) {
+        logFindings(criticalFindings, 20, 'CRITICAL FINDINGS');
+        logFindings(highFindings, 10, 'HIGH SEVERITY FINDINGS');
+    }
+    // Print categorized results
+    if (!options.json && !options.quiet) {
+        logCategorizedResults(results);
+    }
+    // Print quarantine table (if not JSON mode)
+    if (!options.json && !options.quiet) {
+        logHeader('QUARANTINED SKILLS');
+        logQuarantineTable(results);
+    }
+    // Print summary
+    if (!options.json && !options.quiet) {
+        logSummary(results);
+    }
+    // Generate output files
+    if (!options.json && !options.quiet) {
+        console.log('Generating output files...\n');
+    }
+    // 1. Full security report
+    const securityReport = generateSecurityReport(results, allFindings, inputPath);
+    const reportPath = path.join(config.outputDir, 'security-report.json');
+    await writeJsonFile(reportPath, securityReport);
+    if (!options.json && !options.quiet) {
+        logFileOutput('security-report.json', results.length);
+    }
+    // 2. Quarantine list
+    const quarantineOutput = generateQuarantineOutput(results);
+    const quarantinePath = path.join(config.outputDir, 'quarantine-skills.json');
+    await writeJsonFile(quarantinePath, quarantineOutput);
+    if (!options.json && !options.quiet) {
+        logFileOutput('quarantine-skills.json', quarantineOutput.count, 'blocked');
+    }
+    // 3. Safe skills list
+    const safeOutput = generateSafeSkillsOutput(results);
+    const safePath = path.join(config.outputDir, 'safe-skills.json');
+    await writeJsonFile(safePath, safeOutput);
+    if (!options.json && !options.quiet) {
+        logFileOutput('safe-skills.json', safeOutput.count, 'approved');
+    }
+    // Final timing
+    const endTime = performance.now();
+    const durationMs = endTime - startTime;
+    const duration = formatDuration(durationMs);
+    // JSON output mode
+    if (options.json) {
+        const jsonOutput = generateJsonOutput(results, config, durationMs);
+        console.log(JSON.stringify(jsonOutput, null, 2));
+        return;
+    }
+    // Human-readable completion output
+    if (!options.quiet) {
+        const border = '═'.repeat(60);
+        console.log();
+        console.log('\x1b[36m' + border + '\x1b[0m');
+        console.log('\x1b[1m                    SCAN COMPLETE\x1b[0m');
+        console.log('\x1b[36m' + border + '\x1b[0m');
+        console.log();
+        console.log(`  Duration:              ${duration}`);
+        console.log(`  Skills per second:     ${((results.length / durationMs) * 1000).toFixed(1)}`);
+        console.log();
+        console.log('  Output files:');
+        console.log(`    - ${reportPath}`);
+        console.log(`    - ${quarantinePath}`);
+        console.log(`    - ${safePath}`);
+        console.log();
+        console.log('\x1b[36m' + border + '\x1b[0m');
+        console.log();
+        // Recommendations
+        logRecommendations(results, criticalFindings.length);
+    }
+}
+//# sourceMappingURL=scanner.js.map

package/dist/scripts/skill-scanner/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../../src/scripts/skill-scanner/scanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AASzD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EAErB,oBAAoB,GACrB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,UAAU,EACV,aAAa,GACd,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,cAAc,EACd,SAAS,EACT,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,UAAU,EACV,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,eAAe,CAAA;AAsBtB,oCAAoC;AACpC,MAAM,CAAC,MAAM,cAAc,GAAkB;IAC3C,YAAY,EAAE,6BAA6B;IAC3C,SAAS,EAAE,QAAQ;IACnB,cAAc,EAAE;QACd,aAAa,EAAE,EAAE;KAClB;IACD,WAAW,EAAE,oBAAoB;IACjC,gBAAgB,EAAE,GAAG;IACrB,aAAa,EAAE,uCAAuC;CACvD,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,SAAS,CACvB,KAAoB,EACpB,OAAwB,EACxB,SAA4B,oBAAoB,EAChD,YAA8B,eAAe;IAE7C,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAA;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAC9C,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;IACjE,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAEnE,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,SAAS;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,SAAS;QACjC,UAAU,EAAE,MAAM;QAClB,gBAAgB;QAChB,aAAa;QACb,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACxC,CAAA;AACH,CAAC;AAED,0BAA0B;AAC1B,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,IAAI,EAAE,KAAK;IACX,OAAO,EAAE,KAAK;IACd,KAAK,EAAE,KAAK;IACZ,SAAS,EAAE,cAAc,CAAC,YAAY;CACvC,CAAA;AAED;;GAEG;AACH,SAAS,kBAAkB,CACzB,OAA0B,EAC1B,MAAqB,EACrB,UAAkB;IAElB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC3E,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAA;IACvD,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAEnD,MAAM,iBAAiB,GAAG,OAAO;SAC9B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;SAC9B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;SAC/D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,SAAS;QACjC,QAAQ,EAAE,CAAC,CAAC,gBAAgB;QAC5B,UAAU,EACR,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC9B,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;YACzE,CAAC,CAAC,KAAK;KACZ,CAAC,CAAC,CAAA;IAEL,MAAM,UAAU,GAAG,OAAO;SACvB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;SAC/B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;SAC/D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,SAAS;KAClC,CAAC,CAAC,CAAA;IAEL,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE;YACP,YAAY,EAAE,OAAO,CAAC,MAAM;YAC5B,MAAM;YACN,WAAW,EAAE,gBAAgB;YAC7B,UAAU;YACV,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,GAAG,GAAG;YACtD,YAAY;YACZ,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAChC,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,GAAG,EAAE;SAC5E;QACD,WAAW,EAAE,iBAAiB;QAC9B,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE;YACX,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,sBAAsB,CAAC;YAC3D,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,wBAAwB,CAAC;YACjE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,kBAAkB,CAAC;SACtD;KACF,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAiB,EACjB,SAAwB,cAAc,EACtC,aAAyC,EAAE;IAE3C,MAAM,OAAO,GAAG,EAAE,GAAG,mBAAmB,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAA;IACpE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;IAEnC,uEAAuE;IACvE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,SAAS,EAAE,EAAE,CAAC,CAAC,CAAA;QAC9F,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAA;YAC1D,OAAO,CAAC,KAAK,CACX,2GAA2G,CAC5G,CAAA;YACD,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;YAC3B,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAA;YAC/E,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAA;YACnD,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;QAC/C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,iCAAiC;IACjC,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAEvC,iCAAiC;IACjC,IAAI,MAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAA;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,yBAA0B,KAAe,CAAC,OAAO,EAAE;aAC3D,CAAC,CACH,CAAA;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,qCAAsC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAA;QAChF,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,0DAA0D;IAC1D,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;IAC1D,CAAC;IAED,qBAAqB;IACrB,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;IAE1D,6EAA6E;IAC7E,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;IAErD,kBAAkB;IAClB,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,MAAM,WAAW,GAAyB,EAAE,CAAA;IAC5C,IAAI,cAAc,GAAG,CAAC,CAAA;IAEtB,0CAA0C;IAC1C,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAA;IAE9E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,cAAc,EAAE,CAAA;QAEhB,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;QACvE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAEpB,sCAAsC;QACtC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACjD,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QACrD,CAAC;QAED,eAAe;QACf,IAAI,cAAc,EAAE,CAAC;YACnB,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACrD,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,cAAc,GAAG,MAAM,CAAC,gBAAgB,KAAK,CAAC,EAAE,CAAC;YAC7F,WAAW,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,IAAI,cAAc,EAAE,CAAC;QACnB,iBAAiB,EAAE,CAAA;IACrB,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,aAAa,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAC9C,CAAC;IAED,oDAAoD;IACpD,MAAM,gBAAgB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAA;IAC7E,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAA;IAErE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,WAAW,CAAC,gBAAgB,EAAE,EAAE,EAAE,mBAAmB,CAAC,CAAA;QACtD,WAAW,CAAC,YAAY,EAAE,EAAE,EAAE,wBAAwB,CAAC,CAAA;IACzD,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAChC,CAAC;IAED,4CAA4C;IAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,SAAS,CAAC,oBAAoB,CAAC,CAAA;QAC/B,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAED,gBAAgB;IAChB,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,UAAU,CAAC,OAAO,CAAC,CAAA;IACrB,CAAC;IAED,wBAAwB;IACxB,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAA;IAC7C,CAAC;IAED,0BAA0B;IAC1B,MAAM,cAAc,GAAG,sBAAsB,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;IAC9E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAA;IACtE,MAAM,aAAa,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;IAC/C,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,aAAa,CAAC,sBAAsB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;IACvD,CAAC;IAED,qBAAqB;IACrB,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;IAC1D,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAA;IAC5E,MAAM,aAAa,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAA;IACrD,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,aAAa,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IAC5E,CAAC;IAED,sBAAsB;IACtB,MAAM,UAAU,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;IAChE,MAAM,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IACzC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,aAAa,CAAC,kBAAkB,EAAE,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IACjE,CAAC;IAED,eAAe;IACf,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;IACjC,MAAM,UAAU,GAAG,OAAO,GAAG,SAAS,CAAA;IACtC,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;IAE3C,mBAAmB;IACnB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;QAClE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAChD,OAAM;IACR,CAAC;IAED,mCAAmC;IACnC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC7B,OAAO,CAAC,GAAG,EAAE,CAAA;QACb,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC,CAAA;QAC5C,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAA;QAC9D,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC,CAAA;QAC5C,OAAO,CAAC,GAAG,EAAE,CAAA;QACb,OAAO,CAAC,GAAG,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAA;QACnD,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC5F,OAAO,CAAC,GAAG,EAAE,CAAA;QACb,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;QAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,UAAU,EAAE,CAAC,CAAA;QAClC,OAAO,CAAC,GAAG,CAAC,SAAS,cAAc,EAAE,CAAC,CAAA;QACtC,OAAO,CAAC,GAAG,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAA;QAChC,OAAO,CAAC,GAAG,EAAE,CAAA;QACb,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC,CAAA;QAC5C,OAAO,CAAC,GAAG,EAAE,CAAA;QAEb,kBAAkB;QAClB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAA;IACtD,CAAC;AACH,CAAC"}

package/dist/scripts/skill-scanner/trust-scorer.d.ts

@@ -0,0 +1,73 @@
+/**
+ * SMI-1189: Trust Scorer
+ * SMI-4396: Allowlist-aware quarantine predicate.
+ *
+ * Trust score calculation and quarantine decision logic.
+ */
+import type { ScanReport } from '../../security/index.js';
+import type { AllowlistMatcher } from './types.js';
+/**
+ * Configuration for trust scoring
+ */
+export interface TrustScorerConfig {
+    /** Risk threshold for quarantine (skills at or above this are quarantined) */
+    quarantineThreshold: number;
+}
+/** Default trust scorer configuration */
+export declare const DEFAULT_TRUST_CONFIG: TrustScorerConfig;
+/**
+ * Determines if a skill should be quarantined based on findings.
+ *
+ * SMI-4396: when an allowlist matcher is provided, findings the matcher
+ * approves are removed BEFORE the quarantine check runs, and the risk score
+ * is recomputed from the filtered set rather than trusting report.riskScore
+ * (which was computed pre-allowlist inside SecurityScanner.scan).
+ *
+ * !report.passed is intentionally NOT part of the predicate: `passed` is
+ * also computed pre-allowlist, so keeping it here would re-quarantine every
+ * allowlisted skill whose raw scan had critical/high findings — defeating
+ * the allowlist's purpose. The new two-clause predicate still covers the old
+ * semantics: any scan that was `passed: false` must have had at least one
+ * critical/high finding OR score >= threshold, both of which are still caught.
+ *
+ * A skill is quarantined if ANY of:
+ * 1. Post-allowlist findings contain a critical or high severity entry
+ * 2. Post-allowlist risk score >= quarantineThreshold
+ *
+ * @param report - The scan report for the skill
+ * @param config - Trust scorer configuration
+ * @param allowlist - Optional per-skill allowlist (SMI-4396)
+ * @returns true if the skill should be quarantined
+ */
+export declare function shouldQuarantine(report: ScanReport, config?: TrustScorerConfig, allowlist?: AllowlistMatcher): boolean;
+/**
+ * Calculate average risk score from results
+ *
+ * @param results - Array of scan results with risk scores
+ * @returns Average risk score (0 if no results)
+ */
+export declare function calculateAverageRiskScore(results: Array<{
+    scanReport: ScanReport;
+}>): number;
+/**
+ * Calculate maximum risk score from results
+ *
+ * @param results - Array of scan results with risk scores
+ * @returns Maximum risk score (0 if no results)
+ */
+export declare function calculateMaxRiskScore(results: Array<{
+    scanReport: ScanReport;
+}>): number;
+/**
+ * Get pass/fail statistics from results
+ *
+ * @param results - Array of scan results
+ * @returns Object with passed and quarantined counts
+ */
+export declare function getPassFailStats(results: Array<{
+    isQuarantined: boolean;
+}>): {
+    passed: number;
+    quarantined: number;
+};
+//# sourceMappingURL=trust-scorer.d.ts.map

package/dist/scripts/skill-scanner/trust-scorer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-scorer.d.ts","sourceRoot":"","sources":["../../../src/scripts/skill-scanner/trust-scorer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAEzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,mBAAmB,EAAE,MAAM,CAAA;CAC5B;AAED,yCAAyC;AACzC,eAAO,MAAM,oBAAoB,EAAE,iBAElC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,EAClB,MAAM,GAAE,iBAAwC,EAChD,SAAS,CAAC,EAAE,gBAAgB,GAC3B,OAAO,CAWT;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC;IAAE,UAAU,EAAE,UAAU,CAAA;CAAE,CAAC,GAAG,MAAM,CAM5F;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC;IAAE,UAAU,EAAE,UAAU,CAAA;CAAE,CAAC,GAAG,MAAM,CAGxF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC;IAAE,aAAa,EAAE,OAAO,CAAA;CAAE,CAAC,GAAG;IAC5E,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;CACpB,CAKA"}