ai-saas-guard 0.43.3 → 0.45.0

package/README.md

@@ -25,6 +25,11 @@
   <a href="docs/release-quality-knowledge-base.md"><img alt="Release gate documented" src="https://img.shields.io/badge/release%20gate-documented-0f766e.svg"></a>
 </p>
 
+<p align="center">
+  <strong>Try the 30-second demo — no signup, no code upload, no LLM call:</strong><br>
+  <code>npx ai-saas-guard@latest demo --summary</code>
+</p>
+
 ---
 
 ## Before You Invite Users
@@ -112,30 +117,37 @@ Want to see the report before scanning your own repo?
 npx ai-saas-guard@latest demo --summary
 ```
 
-The demo command uses packaged public fixtures: `examples/demo-risky-saas` currently returns 19 intentional findings across Stripe, Supabase, silent-success paths, Next/Vercel deploy hints, and GitHub Actions; `examples/demo-safe-saas` returns 0 findings for the same broad surfaces with safer static patterns. Rerun `demo` without `--summary` for the full human-readable report, or see [docs/demo-quickstart.md](docs/demo-quickstart.md) if you want to inspect the fixture files locally.
+The demo command uses packaged public fixtures: `examples/demo-risky-saas` currently returns 20 intentional findings across Stripe, Supabase, silent-success paths, Next/Vercel deploy hints, and GitHub Actions; `examples/demo-safe-saas` returns 0 findings for the same broad surfaces with safer static patterns. Rerun `demo` without `--summary` for the full human-readable report, or see [docs/demo-quickstart.md](docs/demo-quickstart.md) if you want to inspect the fixture files locally.
 
 ## See The Output
 
 The report is designed to be read before launch or before merging an AI-heavy PR. A longer copy-paste example is in [docs/sample-launch-report.md](docs/sample-launch-report.md).
 
 ```text
-ai-saas-guard scan summary
-Findings: 19 findings: 2 critical, 6 high, 7 medium, 3 low, 1 info
-Launch gate: blocked: critical launch-readiness findings need review before inviting users
-
-Top risks:
-- CRITICAL stripe.webhook.missing-signature at app/api/stripe/webhook/route.ts:1 - Stripe webhook does not verify the Stripe signature
-- CRITICAL supabase.rls.broad-policy at supabase/migrations/001_accounts.sql:10 - Broad Supabase RLS policy on public.accounts
-- HIGH silent-success.swallowed-error at app/api/billing/checkout/route.ts:4 - Catch block may turn upstream failure into success
-
-Manual proof to run next:
-- Send a request without a valid Stripe signature and confirm the handler rejects it before changing entitlement state.
-- Run the generated two-account IDOR test and confirm User B cannot read, update, or delete User A resources.
-- Force the upstream billing call to fail and confirm the route returns an error, not fake success.
-
-Next steps
-- Fix critical and high trust-boundary findings first.
-- Run the manual proof steps in staging and confirm each risky path fails closed.
+ai-saas-guard | SCAN SUMMARY
+----------------------------------------
+Target       /path/to/your-saas
+Launch gate  blocked: critical launch-readiness findings need review before inviting users
+Findings     20 findings | 2 critical | 6 high | 8 medium | 3 low | 1 info
+Decision     Can a real user get access they should not have? Review auth, tenant ownership, Supabase RLS, webhook entitlement, and data mutation findings first.
+
+TOP RISKS
+1. CRITICAL stripe.webhook.missing-signature at app/api/stripe/webhook/route.ts:1 - Stripe webhook does not verify the Stripe signature
+2. CRITICAL supabase.rls.broad-policy at supabase/migrations/001_accounts.sql:10 - Broad Supabase RLS policy on public.accounts
+3. HIGH silent-success.swallowed-error at app/api/billing/checkout/route.ts:4 - Catch block may turn upstream failure into success: app/api/billing/checkout/route.ts
+
+MANUAL PROOF
+1. Send a request without a valid Stripe signature and confirm the handler rejects it before changing entitlement state.
+2. Run the generated two-account IDOR test and confirm User B cannot read, update, or delete User A resources.
+3. Force the upstream API, auth provider, billing provider, or database call to fail and confirm the route returns an error or disclosed degraded mode, not a fake success.
+
+NEXT STEPS
+1. Fix critical and high trust-boundary findings first: auth/session, billing/webhook, tenant data, and silent-success paths.
+2. Run the manual proof steps above in staging and confirm each risky path fails closed.
+3. Treat low and info deploy/CI hygiene hints as cleanup after critical, high, and medium launch paths are understood.
+
+FULL REPORT
+  Rerun without --summary, or use --json, --sarif, or --markdown where supported.
 ```
 
 ## What You Get
@@ -333,7 +345,7 @@ node dist/cli.js pr-risk --root /path/to/your-saas --base origin/main --json
 node dist/cli.js pr-risk --root /path/to/your-saas --base origin/main --markdown
 ```
 
-If `--base` cannot be resolved, `pr-risk` emits `pr-risk.diff-unavailable` instead of silently reporting a clean or empty diff. In GitHub Actions, use `actions/checkout` with `fetch-depth: 0` when you need merge-base comparison against `origin/main`.
+If `--base` cannot be resolved, `pr-risk` emits `pr-risk.diff-unavailable` instead of silently reporting a clean or empty diff. `--base` accepts branch, tag, full ref, or commit SHA names only (letters, numbers, dots, underscores, slashes, hyphens); revision expressions such as `HEAD~3` are rejected so option-like or malformed values never reach git argument parsing. In GitHub Actions, use `actions/checkout` with `fetch-depth: 0` when you need merge-base comparison against `origin/main`.
 
 ## Commands
 

package/action.yml

@@ -12,7 +12,7 @@ inputs:
     required: false
     default: ${{ github.workspace }}
   format:
-    description: "Output format: terminal, json, sarif, markdown, or summary. Use summary for first-run CLI output, markdown for PR summaries, and sarif for code scanning."
+    description: "Output format: terminal, json, sarif, markdown, summary, or comment. Use summary for first-run CLI output, markdown for PR summaries, sarif for code scanning, and comment for PR-comment-ready markdown (pr-risk)."
     required: false
     default: terminal
   fail-on:
@@ -67,7 +67,7 @@ runs:
         esac
 
         case "${INPUT_FORMAT}" in
-          terminal|json|sarif|markdown|summary) ;;
+          terminal|json|sarif|markdown|summary|comment) ;;
           *)
             echo "Invalid format input: ${INPUT_FORMAT}" >&2
             exit 2
@@ -102,6 +102,8 @@ runs:
           args+=("--markdown")
         elif [ "${INPUT_FORMAT}" = "summary" ]; then
           args+=("--summary")
+        elif [ "${INPUT_FORMAT}" = "comment" ]; then
+          args+=("--format" "comment")
         fi
 
         if [ "${INPUT_FAIL_ON}" != "none" ]; then

package/dist/cli.js

@@ -2,11 +2,13 @@
 import { resolve } from "node:path";
 import { applyGuardConfig, loadGuardConfig } from "./config.js";
 import { checkActions, checkMcp, checkStripe, checkSupabase, classifyPrRisk, runShowcase, scanRepository } from "./index.js";
+import { formatCommentReport } from "./report/comment.js";
 import { formatJsonReport } from "./report/json.js";
 import { formatMarkdownReport } from "./report/markdown.js";
 import { formatSarifReport } from "./report/sarif.js";
 import { formatSummaryReport } from "./report/summary.js";
 import { formatTerminalReport } from "./report/terminal.js";
+import { isSafeGitBaseRef } from "./scanners/gitDiff.js";
 async function main(argv) {
     const args = parseArgs(argv);
     if (!args.command || args.command === "help") {
@@ -25,6 +27,9 @@ async function main(argv) {
             report = await scanRepository({ rootDir: args.rootDir });
             break;
         case "check-supabase":
+            if (args.doctor) {
+                process.stderr.write("Note: --doctor is deprecated; the Supabase RLS doctor section is always included.\n");
+            }
             report = await checkSupabase({ rootDir: args.rootDir, doctor: args.doctor });
             break;
         case "check-stripe":
@@ -81,8 +86,8 @@ function parseArgs(argv) {
         }
         if (arg === "--format") {
             const value = argv[index + 1];
-            if (value !== "terminal" && value !== "json" && value !== "sarif" && value !== "markdown" && value !== "summary") {
-                throw new Error("--format requires terminal, json, sarif, markdown, or summary");
+            if (value !== "terminal" && value !== "json" && value !== "sarif" && value !== "markdown" && value !== "summary" && value !== "comment") {
+                throw new Error("--format requires terminal, json, sarif, markdown, summary, or comment");
             }
             result.format = value;
             index += 1;
@@ -116,6 +121,9 @@ function parseArgs(argv) {
             const value = argv[index + 1];
             if (!value)
                 throw new Error("--base requires a branch or ref");
+            if (!isSafeGitBaseRef(value)) {
+                throw new Error("--base must be a safe branch or ref using letters, numbers, dots, underscores, slashes, or hyphens");
+            }
             result.base = value;
             index += 1;
             continue;
@@ -150,6 +158,8 @@ function formatReport(report, format) {
         return formatMarkdownReport(report);
     if (format === "summary")
         return `${formatSummaryReport(report)}\n`;
+    if (format === "comment")
+        return `${formatCommentReport(report)}\n`;
     return `${formatTerminalReport(report)}\n`;
 }
 function shouldFail(report, failOn) {
@@ -178,11 +188,11 @@ Repo-local launch-readiness scanner for AI-built SaaS apps.
 Usage:
   ai-saas-guard scan [--root <repo>] [--config <file>] [--json|--sarif|--summary] [--fail-on <severity>]
   ai-saas-guard demo [--json|--markdown|--summary]
-  ai-saas-guard check-supabase [--root <repo>] [--config <file>] [--doctor] [--json|--sarif|--summary] [--fail-on <severity>]
+  ai-saas-guard check-supabase [--root <repo>] [--config <file>] [--json|--sarif|--summary] [--fail-on <severity>]
   ai-saas-guard check-stripe [--root <repo>] [--config <file>] [--json|--sarif|--summary] [--fail-on <severity>]
   ai-saas-guard check-mcp [--root <repo>] [--config <file>] [--policy-template] [--json|--sarif|--summary] [--fail-on <severity>]
   ai-saas-guard check-actions [--root <repo>] [--config <file>] [--json|--sarif|--summary] [--fail-on <severity>]
-  ai-saas-guard pr-risk [--root <repo>] [--config <file>] [--base <branch>] [--json|--sarif|--markdown|--summary] [--fail-on <severity>]
+  ai-saas-guard pr-risk [--root <repo>] [--config <file>] [--base <branch>] [--json|--sarif|--markdown|--summary|--format comment] [--fail-on <severity>]
 
 Defaults:
   - read-only
@@ -192,8 +202,11 @@ Defaults:
   - terminal output by default, JSON with --json
   - SARIF output for GitHub code scanning with --sarif
   - PR-focused markdown summary with --markdown
+  - PR-comment-ready markdown with pr-risk --format comment (paste into a review)
   - first-run launch summary with --summary
   - project config auto-loaded from .ai-saas-guard.json when present
+  - --doctor is deprecated: the Supabase RLS doctor section is always included in check-supabase output; the flag is still accepted but has no effect
+  - --base accepts branch, tag, full ref, or commit SHA names only (letters, numbers, dots, underscores, slashes, hyphens); revisions like HEAD~3 are rejected
 `;
 }
 main(process.argv.slice(2)).then((code) => {

package/dist/commands/scan.js

@@ -16,7 +16,12 @@ export async function scanRepository(options) {
         scanSecrets(context),
         scanNextPublicEnv(context),
         checkStripe(context),
-        stackInventory.databases.includes("supabase") ? checkSupabase(context) : createSkippedSupabaseReport(context.rootDir),
+        // Never gate on the stack inventory: it only recognizes standard
+        // layouts (supabase/ paths, package deps, policy syntax), so SQL
+        // migrations in non-standard paths would silently skip every Supabase
+        // rule while the scan still reported clear. checkSupabase already
+        // returns an empty report when it finds no Supabase context.
+        checkSupabase(context),
         checkMcp(context),
         scanApiRoutes(context),
         scanDeployConfig(context),
@@ -35,15 +40,3 @@ export async function scanRepository(options) {
         ...actionsReport.findings
     ]), { stackInventory, fileCollection: context.fileCollection });
 }
-function createSkippedSupabaseReport(rootDir) {
-    return createReport("check-supabase", rootDir, [], {
-        riskyTables: [],
-        riskyPolicies: [],
-        manualAuthorizationTest: [],
-        doctor: {
-            staticChecks: [],
-            twoAccountVerificationSteps: [],
-            sqlCookbook: []
-        }
-    });
-}

package/dist/context.js

@@ -1,6 +1,9 @@
 import { collectTextFilesWithDiagnostics } from "./utils/files.js";
 export async function createScanContext(rootDir) {
     const collection = await collectTextFilesWithDiagnostics(rootDir);
+    if (collection.diagnostics.unreadableDirectories.includes(".")) {
+        throw new Error(`Could not read scan root: ${rootDir}`);
+    }
     const { files } = collection;
     const filesByPath = new Map(files.map((file) => [file.path, file]));
     return {

package/dist/hosted/contracts.js

@@ -477,7 +477,7 @@ export function createCompactHostedReport(input) {
 export function createHostedCheckRunSummary(input) {
     const { report } = input;
     const totalFindings = getHostedReportFindingTotal(report);
-    const localCliCommand = `npx ai-saas-guard@${report.scannerVersion} pr-risk --root . --base ${report.baseSha} --json`;
+    const localCliCommand = `npx ai-saas-guard@${safeHostedCliVersion(report.scannerVersion)} pr-risk --root . --base ${safeHostedBaseSha(report.baseSha)} --json`;
     const conclusion = resolveCheckRunConclusion(report, input.failOnSeverity);
     const launchGate = hostedLaunchGateVerdict(report);
     return {
@@ -486,7 +486,7 @@ export function createHostedCheckRunSummary(input) {
         output: {
             title: formatCheckRunTitle(totalFindings, conclusion, input.failOnSeverity),
             summary: [
-                `Launch-risk gate: ${launchGate}. Launch gate: ${launchGate}.`,
+                `Launch gate: ${launchGate}. ${totalFindings} finding${totalFindings === 1 ? "" : "s"}.`,
                 "Review task: inspect risk areas and files before merge.",
                 "Manual proof: prove changed auth, billing, data, deploy, or tests fail closed.",
                 "Boundary: selected repository only; not an AI reviewer, pentest, full audit, or certification."
@@ -1146,54 +1146,61 @@ function formatCheckRunMarkdown(report, conclusion, localCliCommand, launchGate)
     const filesToReview = getHostedCheckRunFiles(report);
     const findingLines = report.evidence.length === 0
         ? ["No findings in the compact hosted report."]
-        : [
-            "| Severity | Rule | Evidence |",
-            "| --- | --- | --- |",
-            ...report.evidence.map((finding) => `| ${escapeMarkdownTableCell(finding.severity)} | ${escapeMarkdownTableCell(finding.ruleId)} | ${escapeMarkdownTableCell(formatFindingLocation(finding))} |`)
-        ];
+        : report.evidence.flatMap((finding, index) => [
+            `${index + 1}. **${escapeHostedMarkdownInline(finding.severity.toUpperCase())}** ${hostedMarkdownCode(finding.ruleId)}`,
+            `   - Location: ${hostedMarkdownCode(formatFindingLocation(finding))}`
+        ]);
     return [
-        "### AI SaaS Guard Launch-risk gate",
+        "## AI SaaS Guard",
         "",
-        "Review task: inspect risk areas and files before merge.",
-        "Manual proof: prove changed auth, billing, data, deploy, or tests fail closed.",
-        "Boundary: selected repository only; not an AI reviewer, pentest, full audit, or certification.",
+        `**Launch gate:** ${escapeHostedMarkdownInline(launchGate)}`,
         "",
-        `Launch gate: ${launchGate}`,
-        `Conclusion: ${conclusion}`,
-        `Local CLI: \`${localCliCommand}\``,
-        `Retention: compact report ${report.retentionDays} days; no raw source, diffs, secrets, or customer payloads.`,
+        `**Conclusion:** ${escapeHostedMarkdownInline(conclusion)}`,
         "",
-        "Review categories:",
-        ...(categories.length === 0 ? ["- None"] : categories.map((category) => `- ${category}`)),
+        `**Review categories:** ${categories.length === 0 ? "None" : categories.map(hostedMarkdownCode).join(", ")}`,
         "",
-        "Verification steps:",
-        "- Inspect the listed files locally before release or merge.",
-        "- Reproduce locally with the CLI command above.",
-        "- Prove changed auth, billing, data, deploy, or tests fail closed.",
+        "> Review task: inspect the risk areas and files below before merge.",
+        "> Manual proof: prove changed auth, billing, data, deploy, or tests fail closed.",
         "",
-        "Risk areas:",
+        `**Reproduce locally:** ${hostedMarkdownCode(localCliCommand)}`,
+        "",
+        "**Scope:** Selected repository only. No raw source, diffs, secrets, installation tokens, or customer payloads are included.",
+        "",
+        "### Review First",
         ...(riskAreas.length === 0
-            ? ["- None"]
-            : riskAreas.map((area) => `- ${area.name}: ${area.count} finding(s). Proof: ${area.proof}`)),
+            ? ["No risk areas in the compact hosted report."]
+            : riskAreas.map((area, index) => `${index + 1}. **${escapeHostedMarkdownInline(area.name)}** - ${area.count} finding(s). ${escapeHostedMarkdownInline(area.proof)}`)),
+        "",
+        "### Files",
+        ...(filesToReview.length === 0
+            ? ["No files in the review queue."]
+            : filesToReview.map((file, index) => `${index + 1}. ${hostedMarkdownCode(file)}`)),
         "",
-        "Launch decision queue:",
+        "### Findings",
+        ...findingLines,
+        "",
+        "### Manual Proof",
+        "1. Inspect each listed file locally before release or merge.",
+        "2. Reproduce the result with the local CLI command below.",
+        "3. Prove changed auth, billing, data, deploy, or tests fail closed.",
+        "",
+        "### Launch Decision Queue",
         "- Can a real user get access they should not have?",
         "- Can the app claim success when something failed?",
         "- Can launch infrastructure do too much damage?",
         "",
-        "Summary:",
+        "### Scan Summary",
         ...severityOrder.map((severity) => `- ${capitalize(severity)}: ${report.summaryCounts[severity] ?? 0}`),
         "",
-        "Files to review first:",
-        ...(filesToReview.length === 0 ? ["- None"] : filesToReview.map((file) => `- ${file}`)),
-        "",
-        "Launch-boundary reviewer checklist:",
+        "### Reviewer Checklist",
         "- What changed at the launch boundary?",
         "- Why this auth billing data or deploy decision is safe?",
         "- What manual test proves it fails closed?",
         "",
-        "Findings:",
-        ...findingLines
+        "### Scope And Privacy",
+        "- Boundary: selected repository only; not an AI reviewer, pentest, full audit, or certification.",
+        `- Retention: compact report ${report.retentionDays} days.`,
+        "- No raw source, diffs, secrets, installation tokens, or customer payloads are included."
     ].join("\n");
 }
 function truncateMarkdown(markdown, maxMarkdownChars) {
@@ -1207,7 +1214,11 @@ function truncateMarkdown(markdown, maxMarkdownChars) {
     if (maxChars <= suffix.length) {
         return suffix.slice(0, maxChars);
     }
-    return `${markdown.slice(0, maxChars - suffix.length).trimEnd()}${suffix}`;
+    const availableChars = maxChars - suffix.length;
+    const candidate = markdown.slice(0, availableChars);
+    const lastLineBreak = candidate.lastIndexOf("\n");
+    const safePrefix = lastLineBreak > 0 ? candidate.slice(0, lastLineBreak) : candidate;
+    return `${safePrefix.trimEnd()}${suffix}`;
 }
 function severityRank(severity) {
     const normalized = severity.toLowerCase();
@@ -1312,8 +1323,29 @@ function categoryForRuleId(ruleId) {
 function getHostedCheckRunFiles(report) {
     return [...new Set(report.evidence.map((finding) => finding.file))].slice(0, 10);
 }
-function escapeMarkdownTableCell(value) {
-    return value.replaceAll("\\", "\\\\").replaceAll("|", "\\|").replaceAll("\r", " ").replaceAll("\n", " ");
+function escapeHostedMarkdownInline(value) {
+    return normalizeHostedMarkdownInline(value)
+        .replaceAll("&", "&amp;")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replace(/([\\`*_[\]])/g, "\\$1")
+        .replaceAll("|", "\\|");
+}
+function hostedMarkdownCode(value) {
+    return `\`${normalizeHostedMarkdownInline(value).replaceAll("`", "'")}\``;
+}
+function normalizeHostedMarkdownInline(value) {
+    return value
+        .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/g, "")
+        .replace(/[\r\n]+/g, " ")
+        .replace(/\s+/g, " ")
+        .trim();
+}
+function safeHostedCliVersion(value) {
+    return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(value) ? value : "latest";
+}
+function safeHostedBaseSha(value) {
+    return /^[a-f0-9]{40}$/i.test(value) ? value : "<base-sha>";
 }
 function capitalize(value) {
     return `${value.charAt(0).toUpperCase()}${value.slice(1)}`;

package/dist/hosted/production-adapters.js

@@ -198,6 +198,8 @@ function safeGitHubApiBaseUrl(apiBaseUrl) {
             url.password ||
             url.search ||
             url.hash ||
+            url.port ||
+            url.hostname.toLowerCase() !== "api.github.com" ||
             !isRootPath(url.pathname) ||
             isUnsafeHostedHostname(url.hostname)) {
             return undefined;

package/dist/hosted/scan-worker/engine.d.ts

@@ -0,0 +1,67 @@
+/**
+ * The real scanner engine, running inside the staging source-checkout worker.
+ *
+ * This is the same rule engine as the CLI: `classifyPrRisk` (the pr-risk
+ * review-queue engine) plus the full `scan` suite (secrets, Stripe, Supabase,
+ * MCP, API routes, deploy config, silent-success, Actions) executed over an
+ * in-memory ScanContext built from SHA-pinned file contents. No filesystem,
+ * no child processes, no network: pure deterministic rules over text.
+ *
+ * Outputs are compacted before leaving the worker: rule ID, severity, file,
+ * and line only. Raw source, raw diffs, PR text, matches, and snippets never
+ * leave the worker boundary.
+ */
+import type { Severity } from "../../types.js";
+import { STAGING_PRIVACY_FLAGS, type ValidatedScanJob } from "./job.js";
+export interface CompactFinding {
+    ruleId: string;
+    severity: Severity;
+    file: string;
+    line?: number;
+}
+export interface PrRiskSummary {
+    categories: string[];
+    topRiskyFiles: Array<{
+        path: string;
+        score: number;
+        categories: string[];
+    }>;
+    reviewChecklist: string[];
+}
+export interface SourceScanResult {
+    jobKey: string;
+    status: "completed";
+    scannerEngine: "cli-identical";
+    scannerVersion: string;
+    repositoryFullName: string;
+    pullRequestNumber: number;
+    baseSha: string;
+    headSha: string;
+    filesScanned: number;
+    startedAt: string;
+    completedAt: string;
+    durationMs: number;
+    stages: Array<{
+        id: string;
+        ok: boolean;
+    }>;
+    prRisk: PrRiskSummary;
+    summaryCounts: {
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+        info: number;
+        total: number;
+    };
+    compactFindingCount: number;
+    compactFindings: CompactFinding[];
+    scannerErrors: string[];
+    privacy: typeof STAGING_PRIVACY_FLAGS;
+}
+export declare const MAX_COMPACT_FINDINGS = 200;
+declare const SCAN_STAGES: readonly ["validate", "pr_risk", "full_scan", "compact"];
+export declare function runSourceScan(job: ValidatedScanJob, options: {
+    scannerVersion: string;
+}): Promise<SourceScanResult>;
+export { SCAN_STAGES };

package/dist/hosted/scan-worker/engine.js

@@ -0,0 +1,153 @@
+/**
+ * The real scanner engine, running inside the staging source-checkout worker.
+ *
+ * This is the same rule engine as the CLI: `classifyPrRisk` (the pr-risk
+ * review-queue engine) plus the full `scan` suite (secrets, Stripe, Supabase,
+ * MCP, API routes, deploy config, silent-success, Actions) executed over an
+ * in-memory ScanContext built from SHA-pinned file contents. No filesystem,
+ * no child processes, no network: pure deterministic rules over text.
+ *
+ * Outputs are compacted before leaving the worker: rule ID, severity, file,
+ * and line only. Raw source, raw diffs, PR text, matches, and snippets never
+ * leave the worker boundary.
+ */
+import { checkActions } from "../../scanners/actions.js";
+import { scanApiRoutes } from "../../scanners/apiRoutes.js";
+import { scanDeployConfig } from "../../scanners/deploy.js";
+import { classifyPrRisk } from "../../scanners/gitDiff.js";
+import { checkMcp } from "../../scanners/mcp.js";
+import { scanNextPublicEnv, scanSecrets } from "../../scanners/secrets.js";
+import { scanSilentSuccess } from "../../scanners/silentSuccess.js";
+import { checkStripe } from "../../scanners/stripe.js";
+import { checkSupabase } from "../../scanners/supabase.js";
+import { detectStackInventory } from "../../stackInventory.js";
+import { summarizeFindings, uniqueFindings } from "../../report/findings.js";
+import { STAGING_PRIVACY_FLAGS } from "./job.js";
+export const MAX_COMPACT_FINDINGS = 200;
+const SCAN_STAGES = ["validate", "pr_risk", "full_scan", "compact"];
+function buildScanContext(files) {
+    const textFiles = files.map((file) => ({
+        path: file.path,
+        absolutePath: file.path,
+        content: file.content
+    }));
+    const diagnostics = {
+        filesScanned: textFiles.length,
+        bytesScanned: textFiles.reduce((total, file) => total + file.content.length, 0),
+        unreadableFiles: [],
+        unreadableDirectories: [],
+        skippedLargeFiles: [],
+        skippedBudgetFiles: [],
+        maxFilesReached: false,
+        maxTotalBytesReached: false
+    };
+    return {
+        rootDir: ".",
+        files: textFiles,
+        filesByPath: new Map(textFiles.map((file) => [file.path, file])),
+        fileCollection: diagnostics,
+        getFiles: (predicate) => (predicate ? textFiles.filter(predicate) : [...textFiles])
+    };
+}
+function compactFinding(finding) {
+    const evidence = finding.evidence?.[0];
+    const file = typeof evidence?.file === "string" && evidence.file.length > 0 ? evidence.file : undefined;
+    if (!file)
+        return undefined;
+    const compact = {
+        ruleId: finding.ruleId,
+        severity: finding.severity,
+        file
+    };
+    if (typeof evidence?.line === "number" && Number.isFinite(evidence.line)) {
+        compact.line = evidence.line;
+    }
+    return compact;
+}
+export async function runSourceScan(job, options) {
+    const startedAt = new Date().toISOString();
+    const startedMs = Date.now();
+    const stages = [{ id: "validate", ok: true }];
+    const scannerErrors = [];
+    const context = buildScanContext(job.files);
+    // Stage 1: the real pr-risk review-queue engine over the unified diff.
+    const prRiskReport = await classifyPrRisk({ rootDir: ".", diffText: job.diffText });
+    stages.push({ id: "pr_risk", ok: true });
+    // Stage 2: the full CLI `scan` suite over the in-memory file contents.
+    const scannerRuns = [
+        { name: "scanSecrets", run: () => scanSecrets(context) },
+        { name: "scanNextPublicEnv", run: () => scanNextPublicEnv(context) },
+        { name: "checkStripe", run: async () => (await checkStripe(context)).findings },
+        { name: "checkMcp", run: async () => (await checkMcp(context)).findings },
+        { name: "scanApiRoutes", run: () => scanApiRoutes(context) },
+        { name: "scanDeployConfig", run: () => scanDeployConfig(context) },
+        { name: "scanSilentSuccess", run: () => scanSilentSuccess(context) },
+        { name: "checkActions", run: async () => (await checkActions(context)).findings }
+    ];
+    // checkSupabase mirrors the CLI: it only runs when the stack inventory
+    // detects Supabase usage in the scanned files.
+    const stackInventory = await detectStackInventory(context);
+    if (stackInventory.databases.includes("supabase")) {
+        scannerRuns.push({ name: "checkSupabase", run: async () => (await checkSupabase(context)).findings });
+    }
+    const collected = [...prRiskReport.findings];
+    for (const scanner of scannerRuns) {
+        try {
+            const findings = await scanner.run();
+            collected.push(...findings);
+        }
+        catch (error) {
+            scannerErrors.push(`${scanner.name}: ${error instanceof Error ? error.message : "unknown error"}`);
+        }
+    }
+    stages.push({ id: "full_scan", ok: true });
+    const merged = uniqueFindings(collected);
+    const summary = summarizeFindings(merged);
+    const compactFindings = [];
+    for (const finding of merged) {
+        const compact = compactFinding(finding);
+        if (compact)
+            compactFindings.push(compact);
+        if (compactFindings.length >= MAX_COMPACT_FINDINGS)
+            break;
+    }
+    stages.push({ id: "compact", ok: true });
+    const completedAt = new Date().toISOString();
+    return {
+        jobKey: job.jobKey,
+        status: "completed",
+        scannerEngine: "cli-identical",
+        scannerVersion: options.scannerVersion,
+        repositoryFullName: job.repositoryFullName,
+        pullRequestNumber: job.pullRequestNumber,
+        baseSha: job.baseSha,
+        headSha: job.headSha,
+        filesScanned: job.files.length,
+        startedAt,
+        completedAt,
+        durationMs: Date.now() - startedMs,
+        stages,
+        prRisk: {
+            categories: [...prRiskReport.categories],
+            topRiskyFiles: prRiskReport.topRiskyFiles.map((file) => ({
+                path: file.path,
+                score: file.score,
+                categories: [...file.categories]
+            })),
+            reviewChecklist: [...prRiskReport.reviewChecklist]
+        },
+        summaryCounts: {
+            critical: summary.critical,
+            high: summary.high,
+            medium: summary.medium,
+            low: summary.low,
+            info: summary.info,
+            total: summary.total
+        },
+        compactFindingCount: compactFindings.length,
+        compactFindings,
+        scannerErrors,
+        privacy: STAGING_PRIVACY_FLAGS
+    };
+}
+export { SCAN_STAGES };