@xagents_in/unmask 0.1.2 → 0.1.4

package/dist/server/queue.mjs

@@ -3,6 +3,7 @@ import {
   boundedVulnerabilityCheck,
   unavailableVulnerabilityCheck,
 } from "./enrichment.mjs";
+import { advisoryOnlyResult } from "./advisory-result.mjs";
 
 export const DEFAULT_LIMITS = Object.freeze({
   maxBodyBytes: 4096,
@@ -57,7 +58,22 @@ export function createQueue({
         })
       )
         return;
-      const { report, vulnerabilityCheck, ...small } = job;
+      if (
+        job.advisoryResult &&
+        store.put({
+          ...job,
+          advisoryResult: advisoryOnlyResult(
+            unavailableVulnerabilityCheck(
+              job.nameAtExactVersion,
+              clock,
+              "storage-byte-cap",
+            ),
+            { artifactReason: job.reason },
+          ),
+        })
+      )
+        return;
+      const { report, vulnerabilityCheck, advisoryResult, ...small } = job;
       store.put({ ...small, status: "incomplete", reason: "report-too-large" });
     }
   }
@@ -71,6 +87,38 @@ export function createQueue({
     delete job.queueTimer;
     persist(job);
   }
+  async function enrich(job, controller) {
+    let abort;
+    const interrupted = new Promise((resolve) => {
+      abort = () =>
+        resolve(
+          unavailableVulnerabilityCheck(
+            job.nameAtExactVersion,
+            clock,
+            "aborted",
+          ),
+        );
+      controller.signal.addEventListener("abort", abort, { once: true });
+      if (controller.signal.aborted) abort();
+    });
+    try {
+      const value = await Promise.race([
+        Promise.resolve().then(() =>
+          enrichJob(job.nameAtExactVersion, { signal: controller.signal }),
+        ),
+        interrupted,
+      ]);
+      return boundedVulnerabilityCheck(value, job.nameAtExactVersion, clock);
+    } catch {
+      return unavailableVulnerabilityCheck(
+        job.nameAtExactVersion,
+        clock,
+        "lookup-failed",
+      );
+    } finally {
+      controller.signal.removeEventListener("abort", abort);
+    }
+  }
   function begin(job) {
     active = job;
     waiting = undefined;
@@ -79,7 +127,7 @@ export function createQueue({
     job.status = "running";
     job.startedAt = clock.now();
     const controller = new AbortController();
-    let coreReport;
+    let coreReport, advisorySnapshot;
     const timer = clock.setTimeout(() => {
       job.finishedAt = clock.now();
       if (coreReport) {
@@ -87,16 +135,33 @@ export function createQueue({
         persist({
           ...publicJob(job),
           report: coreReport,
-          vulnerabilityCheck: unavailableVulnerabilityCheck(
-            job.nameAtExactVersion,
-            clock,
-            "aborted",
-          ),
+          vulnerabilityCheck:
+            advisorySnapshot ??
+            unavailableVulnerabilityCheck(
+              job.nameAtExactVersion,
+              clock,
+              "aborted",
+            ),
         });
       } else {
         job.status = "incomplete";
         job.reason = "execution-timeout";
-        persist(job);
+        persist(
+          enrichJob
+            ? {
+                ...publicJob(job),
+                advisoryResult: advisoryOnlyResult(
+                  advisorySnapshot ??
+                    unavailableVulnerabilityCheck(
+                      job.nameAtExactVersion,
+                      clock,
+                      "aborted",
+                    ),
+                  { artifactReason: job.reason },
+                ),
+              }
+            : job,
+        );
       }
       controller.abort();
     }, limits.executionMs);
@@ -105,10 +170,14 @@ export function createQueue({
       clock.clearTimeout(timer);
       controller.abort();
     };
-    Promise.resolve()
-      .then(() =>
-        runAnalysis(job.nameAtExactVersion, { signal: controller.signal }),
-      )
+    const analysis = Promise.resolve().then(() =>
+      runAnalysis(job.nameAtExactVersion, { signal: controller.signal }),
+    );
+    // The advisory lookup runs beside acquisition so a hung or failed artifact still keeps it.
+    const advisory = enrichJob
+      ? enrich(job, controller).then((check) => (advisorySnapshot = check))
+      : Promise.resolve(undefined);
+    analysis
       .then(async (report) => {
         if (job.status !== "running" || closed) return;
         if (
@@ -119,45 +188,7 @@ export function createQueue({
         )
           throw new TypeError("Invalid report");
         coreReport = report;
-        let vulnerabilityCheck;
-        if (enrichJob) {
-          let abort;
-          const interrupted = new Promise((resolve) => {
-            abort = () =>
-              resolve(
-                unavailableVulnerabilityCheck(
-                  job.nameAtExactVersion,
-                  clock,
-                  "aborted",
-                ),
-              );
-            controller.signal.addEventListener("abort", abort, { once: true });
-            if (controller.signal.aborted) abort();
-          });
-          try {
-            const value = await Promise.race([
-              Promise.resolve().then(() =>
-                enrichJob(job.nameAtExactVersion, {
-                  signal: controller.signal,
-                }),
-              ),
-              interrupted,
-            ]);
-            vulnerabilityCheck = boundedVulnerabilityCheck(
-              value,
-              job.nameAtExactVersion,
-              clock,
-            );
-          } catch {
-            vulnerabilityCheck = unavailableVulnerabilityCheck(
-              job.nameAtExactVersion,
-              clock,
-              "lookup-failed",
-            );
-          } finally {
-            controller.signal.removeEventListener("abort", abort);
-          }
-        }
+        const vulnerabilityCheck = await advisory;
         if (job.status !== "running" || closed) return;
         const status = report.policy.exitCode === 2 ? "incomplete" : "done";
         const finishedAt = clock.now();
@@ -171,13 +202,24 @@ export function createQueue({
         job.status = status;
         job.finishedAt = finishedAt;
       })
-      .catch(() => {
+      .catch(async () => {
+        if (job.status !== "running" || closed) return;
+        const vulnerabilityCheck = coreReport ? undefined : await advisory;
         if (job.status !== "running" || closed) return;
         job.status = "failed";
         job.reason = "analysis-failed";
         job.finishedAt = clock.now();
         delete job.report;
-        persist(publicJob(job));
+        persist({
+          ...publicJob(job),
+          ...(vulnerabilityCheck
+            ? {
+                advisoryResult: advisoryOnlyResult(vulnerabilityCheck, {
+                  artifactReason: job.reason,
+                }),
+              }
+            : {}),
+        });
       })
       .finally(() => {
         clock.clearTimeout(timer);

package/dist/server/registry-facts.mjs

@@ -0,0 +1,118 @@
+import {
+  getRegistryFacts,
+  getRegistryHistory,
+  registryIdentity,
+} from "../core/registry-facts.mjs";
+
+export function createRegistryFactsHandler(options = {}) {
+  const maxConcurrent = options.maxConcurrent ?? 2;
+  const maxRequests = options.maxRequests ?? 30;
+  if (
+    !Number.isSafeInteger(maxConcurrent) ||
+    maxConcurrent < 1 ||
+    maxConcurrent > 2 ||
+    !Number.isSafeInteger(maxRequests) ||
+    maxRequests < 1 ||
+    maxRequests > 30
+  )
+    throw new TypeError("Invalid registry lookup admission limits");
+  let active = 0,
+    used = 0,
+    windowStart = Date.now();
+  return async function handleRegistryFacts(req, json) {
+    const url = new URL(req.url, "http://localhost");
+    const history = url.pathname === "/api/registry/history";
+    if (url.pathname !== "/api/registry/facts" && !history) return false;
+    if (req.method !== "GET") {
+      json(
+        405,
+        { status: "rejected", reason: "method-not-allowed" },
+        { allow: "GET" },
+      );
+      return true;
+    }
+    const spec = url.searchParams.get("package");
+    let limit = 20;
+    try {
+      const allowed = history ? ["package", "limit"] : ["package"];
+      if (
+        !spec ||
+        [...url.searchParams.keys()].some((key) => !allowed.includes(key)) ||
+        allowed.some((key) => url.searchParams.getAll(key).length > 1)
+      )
+        throw new Error();
+      if (history) {
+        registryIdentity(`${spec}@0.0.0`);
+        if (url.searchParams.has("limit")) {
+          const raw = url.searchParams.get("limit");
+          if (!/^[1-9]\d{0,2}$/.test(raw)) throw new Error();
+          limit = Number(raw);
+          if (limit > 100) throw new Error();
+        }
+      } else registryIdentity(spec);
+    } catch {
+      json(400, {
+        status: "rejected",
+        reason: history
+          ? "package-name-and-bounded-limit-required"
+          : "exact-package-required",
+      });
+      return true;
+    }
+    const now = Date.now();
+    if (now - windowStart >= 60000) {
+      used = 0;
+      windowStart = now;
+    }
+    if (active >= maxConcurrent || used >= maxRequests) {
+      json(
+        429,
+        { status: "unavailable", reason: "registry-lookup-limit" },
+        {
+          "retry-after": String(
+            Math.max(1, Math.ceil((60000 - (now - windowStart)) / 1000)),
+          ),
+        },
+      );
+      return true;
+    }
+    used++;
+    active++;
+    try {
+      json(
+        200,
+        history
+          ? await getRegistryHistory(spec, { ...options, limit })
+          : await getRegistryFacts(spec, options),
+      );
+    } catch (error) {
+      const reason = [
+        "acquisition-timeout",
+        "response-cap",
+        "redirect-refused",
+        "invalid-registry-document",
+        "registry-identity-mismatch",
+        "http-status",
+        "network-failure",
+        "invalid-response",
+        "registry-history-cap",
+      ].includes(error.code)
+        ? error.code
+        : "registry-unavailable";
+      const status =
+        reason === "acquisition-timeout"
+          ? 504
+          : error.observation?.status === 404
+            ? 404
+            : 502;
+      json(status, {
+        status: "unavailable",
+        reason,
+        safetyVerdict: "not-provided",
+      });
+    } finally {
+      active--;
+    }
+    return true;
+  };
+}

package/dist/server/report-exploration.mjs

@@ -0,0 +1,87 @@
+import {
+  buildReportFileInventory,
+  buildReportFileEvidence,
+  explorationJson,
+} from "../core/report-exploration.mjs";
+
+function queryParameters(raw, allowed) {
+  if (raw.length > 16384) throw new TypeError("Query too long");
+  decodeURIComponent(raw.replace(/\+/g, " "));
+  const params = new URLSearchParams(raw);
+  for (const key of params.keys())
+    if (!allowed.includes(key) || params.getAll(key).length !== 1)
+      throw new TypeError("Unknown or duplicate query key");
+  return params;
+}
+function integer(params, name, fallback) {
+  if (!params.has(name)) return fallback;
+  const value = params.get(name);
+  if (!/^(0|[1-9]\d*)$/.test(value)) throw new TypeError("Invalid integer");
+  return Number(value);
+}
+
+export function handleReportExploration({ path, getJob, send }) {
+  const match = /^\/r\/([a-f0-9]{32})\/(files|file)\.json(?:\?([^#]*))?$/.exec(
+    path,
+  );
+  if (!match) return false;
+  const json = (status, body, headers = {}) =>
+    send(status, explorationJson(body), "application/json; charset=utf-8", {
+      "content-disposition":
+        match[2] === "file"
+          ? 'attachment; filename="unmask-file-evidence.json"'
+          : 'attachment; filename="unmask-files.json"',
+      ...headers,
+    });
+  const drilldown = match[2] === "file";
+  const context = { reportId: match[1] };
+  let options;
+  try {
+    if (drilldown) {
+      const params = queryParameters(match[3] ?? "", [
+        "path",
+        "originalPath",
+        "fileId",
+      ]);
+      options = Object.fromEntries(params);
+      buildReportFileEvidence({ files: [] }, options, context);
+    } else {
+      const params = queryParameters(match[3] ?? "", [
+        "state",
+        "prefix",
+        "offset",
+        "limit",
+      ]);
+      options = {
+        state: params.get("state") ?? "all",
+        prefix: params.get("prefix") ?? "",
+        offset: integer(params, "offset", 0),
+        limit: integer(params, "limit", 50),
+      };
+      buildReportFileInventory({ files: [] }, options, context);
+    }
+  } catch {
+    json(400, { error: "invalid-query" });
+    return true;
+  }
+  const job = getJob(match[1]);
+  if (!job) json(404, { error: "report-unavailable" });
+  else if (!job.report) {
+    const pending = ["queued", "running"].includes(job.status);
+    json(
+      pending ? 202 : 409,
+      {
+        error: pending ? "report-pending" : "report-unavailable",
+        status: job.status,
+      },
+      pending ? { "retry-after": "3" } : {},
+    );
+  } else {
+    const body = drilldown
+      ? buildReportFileEvidence(job.report, options, context)
+      : buildReportFileInventory(job.report, options, context);
+    if (!body) json(404, { error: "file-unavailable" });
+    else json(200, { reportId: match[1], ...body });
+  }
+  return true;
+}

package/dist/server/store.mjs

@@ -8,6 +8,14 @@ const deterministicCaps = new Set([
   "path-node-cap",
   "metadata-cap",
 ]);
+const deterministicAdvisoryCaps = new Set([
+  "result-byte-cap",
+  "storage-byte-cap",
+  "response-limit",
+  "page-limit",
+  "advisory-limit",
+  "record-limit",
+]);
 const transientModelStatuses = new Set([
   "unavailable",
   "timeout",
@@ -17,7 +25,19 @@ const transientModelStatuses = new Set([
 ]);
 
 function reusable(record) {
-  if (!record.report || transientModelStatuses.has(record.report.model?.status))
+  // A transiently incomplete advisory snapshot stays readable by id but must not answer a resubmission; repeatable caps may.
+  if (
+    !record.report ||
+    transientModelStatuses.has(record.report.model?.status) ||
+    (record.vulnerabilityCheck !== undefined &&
+      record.vulnerabilityCheck?.complete !== true &&
+      !(
+        record.vulnerabilityCheck?.reasons?.length > 0 &&
+        record.vulnerabilityCheck.reasons.every((reason) =>
+          deterministicAdvisoryCaps.has(reason),
+        )
+      ))
+  )
     return false;
   if (record.status === "done") return record.report.policy?.exitCode !== 2;
   return (

package/dist/version.json

@@ -1 +1 @@
-{"buildSchema":"1","version":"0.1.2","dirty":false,"commit":"85bd6d9c0ce7bc31c16d3b1aef695826c0b52354","sourceSha256":"41b4925fd7f4c0d5e8a0018bce3244e138397b48b9663b68a08a9e0e4b32f898","packageSha256":"97af1181106db21be2cde05366ede4e8c018c367cf9bd6b21168dcb78baaff56","lockfileSha256":"84beb1a861f96a8cb788de5bfeeaddcaff04af8c766ec6489601ba42b89fc583","files":{"cli/hosted.mjs":{"sha256":"dea7b512a2e811102521565e9f218c77aab916fe05e838f55a9aeb7b43cd0852","size":7436},"cli/main.mjs":{"sha256":"3bff23e18025d73dbfd8eb3a9571a7797702f03ed14e8d2d1edd6a12304c579e","size":6597},"core/acquire.mjs":{"sha256":"aee5ed002292edf1b03385ceec8ebfb03de452dba36bbdced96f888eaafa1d67","size":9549},"core/advisories.mjs":{"sha256":"388088e44422ffeb3b60d930c84cec29fbc89b98d8dfd2879bc6ede50f4e7ea9","size":13004},"core/archive.mjs":{"sha256":"80aa4373c0324458fe322a83af18a4cfd0ffec4b39ebdeffc9084639a8655410","size":16193},"core/compare.mjs":{"sha256":"540614266e06a2875010793d036d256ddfac72f978157cd3d147ffb99015d8e4","size":7579},"core/manifests.mjs":{"sha256":"29c40e01ff1e1dfaed444600d8c78380d23d4bc9be71960251e39ea3594de2f1","size":17891},"core/online.mjs":{"sha256":"368a3f2558e16db0701d2eaf068b48e2661e7e01ab7cf5605cdd22766aeb5cca","size":9741},"core/package-details.mjs":{"sha256":"770551a6ab84e523dbc56ede6131b08eb22b8c21fc9c8b179fe0d1769fb2ec00","size":21538},"core/pipeline.mjs":{"sha256":"9c4ddc5c258a99455a1230c978fd132c135057ad7bb6c7baa201ae530ee136fd","size":11060},"core/policy.mjs":{"sha256":"4281c626c00a6424992f5e1eba26876e2b70f4b968450a8ca52fa42f5a121ba5","size":2954},"core/report.mjs":{"sha256":"aa167c94c257a5ff6d830630a37a51a9a9e47f82aa4a0a7b96ead91a5967294b","size":15844},"core/resolve.mjs":{"sha256":"d5575da49ff78e8fea8df1f2fc10a39540adea285eddfa347746e848f9fdf957","size":5202},"core/source.mjs":{"sha256":"798fe74e3fba836b82576cd46e1b91e6f6e0a4e3cf273c533b5e074247c81373","size":3238},"core/syntax.mjs":{"sha256":"2d50f2e73e17aedbcbccd92af280e171de4ef78b55acccd23d6b6ef11e891776","size":10450},"model/client.mjs":{"sha256":"efb68132710cbdff6b86b58cbac006c48e10f9317e852f00b120ef7c3c7ed9c1","size":42865},"model/config.mjs":{"sha256":"127605979a299616be15f4a47e94dcd82928b00ad2af71744ffaa6e359516486","size":3245},"server/app.mjs":{"sha256":"54cb435f6ab70739c16a2db9eb63eb91704a5e1515cbb2c25793f47baa4e0299","size":10128},"server/enrichment.mjs":{"sha256":"3c5cc57f2c8f019f79418457f366a9422e0a03a8ba86a41b0767aba636bde179","size":3825},"server/main.mjs":{"sha256":"e5bdcd02209c2ccc1ed8c73b85b9988d61aa3e1bcf7c8d119eed782a4bfcd224","size":4587},"server/queue.mjs":{"sha256":"23e30f3ff570771b77a244be9200ad510d2f19811eee566d68b364b7f741a9d7","size":7371},"server/runner.mjs":{"sha256":"a6ca5bfbd7b239f7110639d854ca9a263f4cf3aaf06701ea54493b29f8244706","size":9071},"server/store.mjs":{"sha256":"efa2a35c7e9d0344c26e24ba360a457cdf80f4f48975f0186f81844b9fb7a097","size":2706},"server/worker.mjs":{"sha256":"1df839608cd1c691fc2801d89e698daeef3e48d7f4b8843ce1252a21fde9730a","size":1902},"viewer/render.mjs":{"sha256":"c77442c27041a5fe28269b8c80c9d24c72b73a226e8d4491e6d7285a9feb5309","size":19443},"viewer/shell.mjs":{"sha256":"5f800d0a97fe416d02cf9abef766d651b444b4745ad3a998926599469358ca79","size":9408}}}
+{"buildSchema":"1","version":"0.1.4","dirty":false,"commit":"99771a0fe5b9df4d0d98f5e7d7f56cad11e2a005","sourceSha256":"48f4fc48bcce841253639ff72bb90557d9284155d4aa8ed5d0d25c03a5904ea4","packageSha256":"d3b26f02f381b527f441b4bd526d93992b618a05f3e59767449613d871a396c9","lockfileSha256":"d7c23757a0a9662a41414f1a7b026f838b883d313765f05b9a1a151ce62f9000","files":{"cli/annotations.mjs":{"sha256":"9dd89e6bfcb44aa4f24e71dc2c85418093ad19e8824a467c21fe2208aceae260","size":5179},"cli/audit.mjs":{"sha256":"bf3d7d0bb77a5b5baaee36d7c8363f3d29c00eda3bb105da29d5be0dd3c28cfd","size":8047},"cli/batch.mjs":{"sha256":"101f7ecb4c3d5890c42f402e5ca00ab97351c4a4d90e07a1fa4367e3c0807650","size":7296},"cli/cache.mjs":{"sha256":"ce7f608249ac61082f408239187a9e87176d82c3a4f288a933eb6a0f7a29fd3c","size":15783},"cli/compare.mjs":{"sha256":"30870240034847064c7d7fdf6e1de833cc73c7b70ebdc56d2e7fa90c62eefb18","size":9569},"cli/config.mjs":{"sha256":"845767f86dbe1e909fbb02684bdec8588dc7e85e30e1131938ee64865c6e0206","size":4436},"cli/discovery.mjs":{"sha256":"182f3c659cb042025d1bf5ca3c05e39895416706c72e3b1537e7052a2fda71a9","size":11982},"cli/doctor.mjs":{"sha256":"a6f6441cefea069f8f453afea7af48a45ce29c28545e233db30839fefeb15237","size":11007},"cli/exceptions.mjs":{"sha256":"246d70c8675182688f971fb29ede6b5511feb8b6462fe136efee8706382786da","size":6133},"cli/file.mjs":{"sha256":"6cdc85178af71ea11b1a82fb20ca4dd5525f1e1959e6ad97fdf3cea1a9074aad","size":9002},"cli/files.mjs":{"sha256":"16ae0daec2157dda4ee7989db0d0fb98f97fee8873e3ca588e456c42f16390eb","size":5046},"cli/history.mjs":{"sha256":"be2dabf364486b1e484c22354ceb10e30cbb983772d8b555ccc498ab305ec5d2","size":8260},"cli/hosted.mjs":{"sha256":"eb30b1ca566c8164a3b1ae3e21eaf45e41445fa209cd8eef273f844065bec510","size":15100},"cli/info.mjs":{"sha256":"15d359aa45b4a8dd3bddc923c42ef1ed25b9a052a317d9da04628944ab3be929","size":4392},"cli/init.mjs":{"sha256":"09d6eb86046b2832687f6eafd85cf2f1472a4ceb399eece9435a166ea525b6bb","size":1955},"cli/install-guard.mjs":{"sha256":"b5e532e3709d9c9d6c990e116bde9d62464f24c44b43ba5da4a5236076a01003","size":29538},"cli/lockfile.mjs":{"sha256":"9165572bd853dcdb30c7dc1efcde61874784218300b0b9f501a6175795fc4324","size":11452},"cli/main.mjs":{"sha256":"e99f78c25bb5a2abb0f989f076fc3f3fa064e87f5ce6b8ec593179a521015192","size":10436},"cli/preflight.mjs":{"sha256":"801bf1aa12b2b32cccda64f01fc8bbc63e977083130c6657849bd1907c0ee137","size":13308},"cli/sarif.mjs":{"sha256":"7fc60dcef01be06ad79393a8c52dca0af9f24bc2969a410bedf731ab9fbbb4e1","size":3147},"cli/scan.mjs":{"sha256":"9bf33e926ededf1beb1e4af73c861ba5bf33bee74ca0544151112284e0afc1b5","size":3906},"cli/shell-integration.mjs":{"sha256":"76a1714cbd128d559c2c15e051220a4e37c4860fe3b0687e615498c8004a0ed8","size":4287},"cli/terminal.mjs":{"sha256":"730ceb8c2e8d2948afb67b0a79fc804849a5eb52d9ddc6ef7a6db65404119471","size":14324},"cli/watch.mjs":{"sha256":"206fdcd262dc6962fd19adfb2bf8cc1a951ec98219cd7901f60f3ee8fd8aa7fa","size":7184},"cli/why.mjs":{"sha256":"9c287b22ddd0e0ae44d84297d3b5c759c25db116370f8a5878e0f5a2eb621ad8","size":8306},"core/acquire.mjs":{"sha256":"aee5ed002292edf1b03385ceec8ebfb03de452dba36bbdced96f888eaafa1d67","size":9549},"core/advisories.mjs":{"sha256":"d0dbf9d9ed4a79655da9613c7f8cbca80e3f2de54c47b128d1dba3b67a2ac750","size":15537},"core/advisory-cache.mjs":{"sha256":"88808779b455e8d28708ec8afc11bb441a85df2783e224726920f20387eede64","size":8720},"core/archive.mjs":{"sha256":"80aa4373c0324458fe322a83af18a4cfd0ffec4b39ebdeffc9084639a8655410","size":16193},"core/behavior-signals.mjs":{"sha256":"9a119e620c9b5868b33a91da72f22b8462fb74313871ce7d99c43a55cae656dd","size":33504},"core/compare.mjs":{"sha256":"540614266e06a2875010793d036d256ddfac72f978157cd3d147ffb99015d8e4","size":7579},"core/dependency-graph.mjs":{"sha256":"25ab2d6180750ff63717e6e3d1ff5284c1c8a5a2aee4ab373ebd6812e3559225","size":10591},"core/evidence-exports.mjs":{"sha256":"0d8c77b7afdee20ba381c77c94745d76edb7b4e8c1c5e6cd12843558ad9334d7","size":15923},"core/guard-config.mjs":{"sha256":"bb1f1f0df2fe374aacb6b90e3c051a89f7e32c61e8f742307dc7a31b6b3ca7ec","size":14884},"core/guard-policy.mjs":{"sha256":"0c5b356da66f30c2b8f2cb53d3141035f50c4631b4ef032464e455aa7c4e821c","size":10435},"core/manifests.mjs":{"sha256":"29c40e01ff1e1dfaed444600d8c78380d23d4bc9be71960251e39ea3594de2f1","size":17891},"core/online.mjs":{"sha256":"368a3f2558e16db0701d2eaf068b48e2661e7e01ab7cf5605cdd22766aeb5cca","size":9741},"core/package-details.mjs":{"sha256":"eac0b19390caaf0c7cc56b1379fd7d64ecd1b3efd6f2d7414065f4c3a80985aa","size":22611},"core/pipeline.mjs":{"sha256":"9c4ddc5c258a99455a1230c978fd132c135057ad7bb6c7baa201ae530ee136fd","size":11060},"core/policy.mjs":{"sha256":"4281c626c00a6424992f5e1eba26876e2b70f4b968450a8ca52fa42f5a121ba5","size":2954},"core/registry-facts.mjs":{"sha256":"726344597044b0c23fb74aff4fbfe7c60cbbfc4c0bee838abf9257134f9c96db","size":11013},"core/report-exploration.mjs":{"sha256":"1dcc9897d3bbc98ee3107ef8f8279d9eed6ee6d104455eb214a5e5644bd197fb","size":10137},"core/report.mjs":{"sha256":"45a83f45307cabf7067496784ad63f2f913075cf27193b4022ac501794d8fe39","size":16119},"core/resolve.mjs":{"sha256":"d5575da49ff78e8fea8df1f2fc10a39540adea285eddfa347746e848f9fdf957","size":5202},"core/sarif.mjs":{"sha256":"dd3d4ebcc3b3700052983573956372db0876422e0813e1ea9c270aca916ad775","size":18424},"core/source.mjs":{"sha256":"798fe74e3fba836b82576cd46e1b91e6f6e0a4e3cf273c533b5e074247c81373","size":3238},"core/syntax.mjs":{"sha256":"e09d4b62101a006876761410e042369fe4d82633da4cb229172afbfa94ab3c64","size":19841},"model/client.mjs":{"sha256":"af3acdfb0dfaf16f1455e025e779e8380cb416a577dc1b04d6d06fdee5df9494","size":47819},"model/config.mjs":{"sha256":"127605979a299616be15f4a47e94dcd82928b00ad2af71744ffaa6e359516486","size":3245},"model/diff-evidence.mjs":{"sha256":"64c19e53e2e2cb72c4ee0807ed3ed2fb929e75d5359dc16fbfd60454872403c9","size":5763},"model/summary.mjs":{"sha256":"0f950a699e5db898482fe6e220955c8dcda68786976d9a68eba2a7209aa22d62","size":7267},"server/advisory-result.mjs":{"sha256":"e91ef844a3fb319631905cd343f77f0a1c087f63cd38e262dd7257c4a410841a","size":4774},"server/app.mjs":{"sha256":"9915d70330106bd4a713bf002ea9b57e368df0ae35dccca76b15dd8765595bc2","size":12900},"server/dependency-screening.mjs":{"sha256":"18c77b1933f79bb287620342ac7c4995351da6ddb3b457bc8fd5fc374e2647a6","size":12430},"server/enrichment.mjs":{"sha256":"3c5cc57f2c8f019f79418457f366a9422e0a03a8ba86a41b0767aba636bde179","size":3825},"server/exports.mjs":{"sha256":"5b4e9b4206d57ac2970dbf3a29d35cad8e0acfd2995fb23fd9561bf347f5a926","size":1847},"server/guard-decision.mjs":{"sha256":"1c886f7bde97bbccad18f1f2c619579c16ca139c112520d2a29dec08bd64a7e5","size":1097},"server/main.mjs":{"sha256":"1823983aff551478c44e505931c9983a85efd6a74876ef17dd2b1d2bd9267354","size":5342},"server/queue.mjs":{"sha256":"09ae8ff8eda7071ae3ba3004d8cefebd2cd84ceef3320fc9b7cf8a75d8e2b5d4","size":8715},"server/registry-facts.mjs":{"sha256":"58bce5b2a40f25e7561f122ea012594c9eb6789f993ca83dadc07f198afca9e3","size":3315},"server/report-exploration.mjs":{"sha256":"862b8d0ea07b627368aaca3a0f66359cfc638b14c54ab4158f8ef313602c3810","size":2774},"server/runner.mjs":{"sha256":"a6ca5bfbd7b239f7110639d854ca9a263f4cf3aaf06701ea54493b29f8244706","size":9071},"server/store.mjs":{"sha256":"51e5ca409acd67945be232f7fe156c17eea79f4f24860c48a9c9b3e08d97dbfc","size":3309},"server/worker.mjs":{"sha256":"1df839608cd1c691fc2801d89e698daeef3e48d7f4b8843ce1252a21fde9730a","size":1902},"viewer/render.mjs":{"sha256":"cf6e3daa572d4b001257c25e6e68dfd5420e8e6f39edfe2fb73ca7219671e7f3","size":20366},"viewer/shell.mjs":{"sha256":"037ebbeec3e73e962252acb2cea6eef0056cd3c6be7a56a78c082086eabe1d9f","size":9629}}}

package/dist/viewer/render.mjs

@@ -237,7 +237,15 @@ export function renderReport(report) {
   const modelText =
     model.status === "disabled"
       ? "Model is disabled"
-      : `Model status: ${model.status}`;
+      : `Model status: ${model.status}${model.reason ? ` (${model.reason})` : ""}`;
+  const assessed =
+    model.status === "complete" &&
+    typeof model.summary === "string" &&
+    model.assessment?.source === "model";
+  const scope = assessed ? model.assessment.checkedScope || {} : {};
+  const assessment = assessed
+    ? `<h3>AI summary</h3><p>${text(model.summary, 600)}</p><dl><dt>Uncertainty</dt><dd>${text(model.assessment.uncertainty, 300)}</dd><dt>Next action</dt><dd>${text(model.assessment.nextAction, 200)}</dd><dt>Checked scope</dt><dd>${text(scope.evidenceSupplied ?? 0)} evidence items supplied, ${text(scope.evidenceOmitted ?? 0)} omitted. Not checked: ${text((scope.notChecked || []).join(", ") || "unspecified")}.</dd></dl><p class="note">The AI summary is advisory and is not a safety signal.</p>`
+    : '<p class="note">No AI summary is available for this check. This notice is not model output and is not a safety signal.</p>';
   const csp = `default-src 'none'; script-src 'sha256-${assetHash(script)}'; style-src 'sha256-${assetHash(css)}'; connect-src 'none'; base-uri 'none'; form-action 'none'`;
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="Content-Security-Policy" content="${escape(csp)}"><meta name="referrer" content="no-referrer"><meta name="robots" content="noindex"><title>UNMASK · ${text(identity)}</title><style>${css}</style></head><body>
 <a class="skip" href="#content">Skip to evidence</a><header><strong>UNMASK</strong><p>Published bytes. Source claims. Evidence to review.</p></header>
@@ -250,6 +258,6 @@ export function renderReport(report) {
 <section><h2>Inert links</h2><p class="note">Artifact links: ${text(report.coverage?.links?.artifact ?? "unknown")}. Source links: ${text(report.coverage?.links?.source ?? "unknown")}.</p>${links.html || '<p class="empty">No inert link entries recorded.</p>'}</section>
 <section><h2>Source-only paths</h2>${sourceOnly.html ? `<ul>${sourceOnly.body}</ul>${sourceOnly.notice}` : '<p class="empty">No source-only paths recorded. Source availability and completeness still apply.</p>'}</section>
 <section><h2>Bound evidence</h2><p class="note">Excerpts show original text data. Excerpt display limit: 512 bytes per evidence item. Byte ranges are half-open: start included, end excluded. Open a citation to inspect its digest-bound evidence.</p>${catalog.html || '<p class="empty">No bound evidence recorded.</p>'}</section>
-<section class="model"><h2>Model explanations</h2><p>${text(modelText)}</p><p class="note">Hypotheses are separate from deterministic evidence. A valid citation proves its location, not the reasoning.</p>${hypotheses.html}</section>
+<section class="model"><h2>Model explanations</h2><p>${text(modelText)}</p>${assessment}<p class="note">Hypotheses are separate from deterministic evidence. A valid citation proves its location, not the reasoning.</p>${hypotheses.html}</section>
 </div></main><footer>UNMASK presents evidence for review. It never declares a package safe. HTML display limits do not change the full JSON report.</footer><script>${script}</script></body></html>`;
 }

package/dist/viewer/shell.mjs

@@ -58,7 +58,7 @@ export function renderError({
 }
 export function renderCompleted(reportHtml, job) {
   const time = new Date(job.finishedAt).toISOString();
-  const navigation = `<nav class="summary" aria-label="Report actions"><a href="/">Check another release</a> | <a href="/r/${escape(job.id)}.json" download="unmask-report.json">Download report JSON</a><p>Cached analysis: <time datetime="${time}">${time}</time>. Eligible results may be reused for up to 30 minutes after completion. Capacity eviction or restart can remove them sooner. Viewing a result does not extend this period. Unavailable model explanations and other retryable failures need a new attempt.</p></nav>`;
+  const navigation = `<nav class="summary" aria-label="Report actions"><a href="/">Check another release</a> | <a href="/r/${escape(job.id)}.json" download="unmask-report.json">Download report JSON</a> | <a href="/r/${escape(job.id)}.cdx.json" download="unmask-sbom.cdx.json">Download CycloneDX SBOM</a> | <a href="/r/${escape(job.id)}.evidence.json" download="unmask-evidence-manifest.json">Download evidence manifest</a><p>Cached analysis: <time datetime="${time}">${time}</time>. Eligible results may be reused for up to 30 minutes after completion. Capacity eviction or restart can remove them sooner. Viewing a result does not extend this period. Unavailable model explanations and other retryable failures need a new attempt.</p></nav>`;
   if (/<\/header\s*>/i.test(reportHtml))
     return reportHtml.replace(
       /<\/header\s*>/i,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xagents_in/unmask",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "private": false,
   "description": "Evidence-based comparison of npm packages and their source archives",
   "license": "MIT",