argus-ci 1.0.0

package/dist/core/scanner.js

@@ -0,0 +1,173 @@
+/**
+ * Semgrep CLI wrapper.
+ * Runs `semgrep --json` on a set of files and returns normalised Issue[].
+ *
+ * Semgrep must be installed: pip install semgrep  OR  brew install semgrep
+ * We check for it on first run and give a clear install message if missing.
+ */
+import { execSync, spawnSync } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+const DEFAULT_RULESETS = ["p/secrets", "p/owasp-top-ten"];
+const DEFAULT_EXCLUDE = ["node_modules", "dist", ".git", "coverage", "build", ".next", "vendor"];
+// ─── Main export ─────────────────────────────────────────────────────────────
+export async function scanFiles(files, cwd, config = {}) {
+    const t0 = Date.now();
+    // Check semgrep is available
+    const semgrepPath = findSemgrep();
+    if (!semgrepPath) {
+        return {
+            issues: [], skipped: true, filesScanned: 0, durationMs: 0, rulesets: [],
+            skipReason: "semgrep not found. Install with: pip install semgrep  or  brew install semgrep",
+        };
+    }
+    // Filter to files that exist and are under size limit
+    const maxBytes = (config.maxFileSizeKb ?? 500) * 1024;
+    const eligible = files
+        .filter((f) => {
+        const abs = f.startsWith("/") ? f : join(cwd, f);
+        if (!existsSync(abs))
+            return false;
+        try {
+            const stat = readFileSync(abs);
+            return stat.length <= maxBytes;
+        }
+        catch {
+            return false;
+        }
+    });
+    if (eligible.length === 0) {
+        return { issues: [], skipped: true, skipReason: "No eligible files to scan", filesScanned: 0, durationMs: 0, rulesets: [] };
+    }
+    const rulesets = config.rulesets ?? DEFAULT_RULESETS;
+    const excludes = [...DEFAULT_EXCLUDE, ...(config.exclude ?? [])];
+    // Build semgrep command
+    const args = [
+        ...rulesets.flatMap((r) => ["--config", r]),
+        "--json",
+        "--no-git-ignore", // we control which files to scan explicitly
+        "--quiet",
+        ...excludes.flatMap((e) => ["--exclude", e]),
+        "--",
+        ...eligible,
+    ];
+    const result = spawnSync(semgrepPath, args, {
+        cwd,
+        encoding: "utf8",
+        maxBuffer: 50 * 1024 * 1024, // 50MB
+    });
+    // semgrep exits 1 when findings are present — that's normal
+    const stdout = result.stdout ?? "";
+    const stderr = result.stderr ?? "";
+    if (result.status !== 0 && result.status !== 1) {
+        // Real error (exit 2+)
+        return {
+            issues: [], skipped: true, filesScanned: eligible.length, durationMs: Date.now() - t0, rulesets,
+            skipReason: `semgrep failed (exit ${result.status}): ${stderr.slice(0, 300)}`,
+        };
+    }
+    let raw;
+    try {
+        raw = JSON.parse(stdout);
+    }
+    catch {
+        return {
+            issues: [], skipped: true, filesScanned: eligible.length, durationMs: Date.now() - t0, rulesets,
+            skipReason: `Failed to parse semgrep output: ${stdout.slice(0, 200)}`,
+        };
+    }
+    const issues = raw.results.map((f) => mapFinding(f, cwd));
+    return {
+        issues,
+        skipped: false,
+        filesScanned: eligible.length,
+        durationMs: Date.now() - t0,
+        rulesets,
+    };
+}
+/**
+ * Scans only the git-staged files in cwd.
+ * Used by the pre-commit hook.
+ */
+export async function scanStaged(cwd, config = {}) {
+    let staged;
+    try {
+        const out = execSync("git diff --name-only --cached --diff-filter=ACM", { cwd, encoding: "utf8" });
+        staged = out.trim().split("\n").filter(Boolean);
+    }
+    catch {
+        return { issues: [], skipped: true, skipReason: "Not a git repository or no staged files", filesScanned: 0, durationMs: 0, rulesets: [] };
+    }
+    if (staged.length === 0) {
+        return { issues: [], skipped: true, skipReason: "No staged files", filesScanned: 0, durationMs: 0, rulesets: [] };
+    }
+    return scanFiles(staged, cwd, config);
+}
+/**
+ * Scans files changed on a branch vs a base branch.
+ */
+export async function scanBranch(cwd, branch, base = "main", config = {}) {
+    let files;
+    try {
+        // Files changed on branch compared to base
+        const out = execSync(`git diff --name-only --diff-filter=ACM $(git merge-base ${base} ${branch}) ${branch}`, { cwd, encoding: "utf8" });
+        files = out.trim().split("\n").filter(Boolean);
+    }
+    catch (e) {
+        // Fallback: diff between branch and base directly
+        try {
+            const out = execSync(`git diff --name-only --diff-filter=ACM ${base}...${branch}`, { cwd, encoding: "utf8" });
+            files = out.trim().split("\n").filter(Boolean);
+        }
+        catch {
+            return { issues: [], skipped: true, skipReason: `Could not diff ${branch} vs ${base}: ${String(e).slice(0, 200)}`, filesScanned: 0, durationMs: 0, rulesets: [] };
+        }
+    }
+    if (files.length === 0) {
+        return { issues: [], skipped: true, skipReason: `No changed files between ${base} and ${branch}`, filesScanned: 0, durationMs: 0, rulesets: [] };
+    }
+    // Checkout the branch content to a temp worktree isn't practical;
+    // scan the working tree files (they may be on that branch already)
+    return scanFiles(files, cwd, config);
+}
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+function findSemgrep() {
+    for (const candidate of ["semgrep", "/usr/local/bin/semgrep", "/opt/homebrew/bin/semgrep"]) {
+        try {
+            const r = spawnSync(candidate, ["--version"], { encoding: "utf8" });
+            if (r.status === 0)
+                return candidate;
+        }
+        catch { /* continue */ }
+    }
+    // Try python-installed semgrep
+    try {
+        const r = spawnSync("python3", ["-m", "semgrep", "--version"], { encoding: "utf8" });
+        if (r.status === 0)
+            return "python3 -m semgrep"; // caller handles space
+    }
+    catch { /* continue */ }
+    return null;
+}
+function mapFinding(f, cwd) {
+    return {
+        ruleId: f.check_id,
+        path: f.path,
+        line: f.start.line,
+        col: f.start.col,
+        severity: mapSeverity(f.extra.severity),
+        message: f.extra.message,
+        sourceLine: f.extra.lines?.trim(),
+        cwe: f.extra.metadata?.cwe,
+        owasp: f.extra.metadata?.owasp,
+        references: f.extra.metadata?.references,
+    };
+}
+function mapSeverity(s) {
+    if (s === "ERROR")
+        return "error";
+    if (s === "WARNING")
+        return "warning";
+    return "info";
+}
+//# sourceMappingURL=scanner.js.map

package/dist/core/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../src/core/scanner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,MAAM,gBAAgB,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;AAC1D,MAAM,eAAe,GAAI,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAElG,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAe,EACf,GAAa,EACb,SAAqB,EAAE;IAEvB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEtB,6BAA6B;IAC7B,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;IAClC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE;YACvE,UAAU,EACR,gFAAgF;SACnF,CAAC;IACJ,CAAC;IAED,sDAAsD;IACtD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAK;SACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEL,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,2BAA2B,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC9H,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,gBAAgB,CAAC;IACrD,MAAM,QAAQ,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IAEjE,wBAAwB;IACxB,MAAM,IAAI,GAAa;QACrB,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC3C,QAAQ;QACR,iBAAiB,EAAM,4CAA4C;QACnE,SAAS;QACT,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC5C,IAAI;QACJ,GAAG,QAAQ;KACZ,CAAC;IAEF,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE;QAC1C,GAAG;QACH,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO;KACrC,CAAC,CAAC;IAEH,4DAA4D;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IAEnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,uBAAuB;QACvB,OAAO;YACL,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ;YAC/F,UAAU,EAAE,wBAAwB,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SAC9E,CAAC;IACJ,CAAC;IAED,IAAI,GAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAqB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ;YAC/F,UAAU,EAAE,mCAAmC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACtE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAE1D,OAAO;QACL,MAAM;QACN,OAAO,EAAE,KAAK;QACd,YAAY,EAAE,QAAQ,CAAC,MAAM;QAC7B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;QAC3B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,SAAqB,EAAE;IACnE,IAAI,MAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,iDAAiD,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACnG,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,yCAAyC,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5I,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpH,CAAC;IAED,OAAO,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAc,EACd,MAAc,EACd,OAAiB,MAAM,EACvB,SAAqB,EAAE;IAEvB,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,2CAA2C;QAC3C,MAAM,GAAG,GAAG,QAAQ,CAClB,2DAA2D,IAAI,IAAI,MAAM,KAAK,MAAM,EAAE,EACtF,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAC1B,CAAC;QACF,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,kDAAkD;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAClB,0CAA0C,IAAI,MAAM,MAAM,EAAE,EAC5D,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAC1B,CAAC;YACF,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,kBAAkB,MAAM,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACpK,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,4BAA4B,IAAI,QAAQ,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACnJ,CAAC;IAED,kEAAkE;IAClE,mEAAmE;IACnE,OAAO,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,gFAAgF;AAEhF,SAAS,WAAW;IAClB,KAAK,MAAM,SAAS,IAAI,CAAC,SAAS,EAAE,wBAAwB,EAAE,2BAA2B,CAAC,EAAE,CAAC;QAC3F,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;IAC5B,CAAC;IACD,+BAA+B;IAC/B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,oBAAoB,CAAC,CAAE,uBAAuB;IAC3E,CAAC;IAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,CAAiB,EAAE,GAAW;IAChD,OAAO;QACL,MAAM,EAAO,CAAC,CAAC,QAAQ;QACvB,IAAI,EAAS,CAAC,CAAC,IAAI;QACnB,IAAI,EAAS,CAAC,CAAC,KAAK,CAAC,IAAI;QACzB,GAAG,EAAU,CAAC,CAAC,KAAK,CAAC,GAAG;QACxB,QAAQ,EAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC1C,OAAO,EAAM,CAAC,CAAC,KAAK,CAAC,OAAO;QAC5B,UAAU,EAAG,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE;QAClC,GAAG,EAAU,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG;QAClC,KAAK,EAAQ,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK;QACpC,UAAU,EAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,CAAsC;IACzD,IAAI,CAAC,KAAK,OAAO;QAAI,OAAO,OAAO,CAAC;IACpC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/hooks/setup.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Pre-commit hook installer.
+ * Writes a git hook that runs `argus-ci scan --staged`
+ * and blocks the commit if any ERROR-severity findings are found.
+ */
+export declare function setupHook(cwd: string): Promise<void>;
+//# sourceMappingURL=setup.d.ts.map

package/dist/hooks/setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/hooks/setup.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkCH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6D1D"}

package/dist/hooks/setup.js

@@ -0,0 +1,117 @@
+/**
+ * Pre-commit hook installer.
+ * Writes a git hook that runs `argus-ci scan --staged`
+ * and blocks the commit if any ERROR-severity findings are found.
+ */
+import { existsSync, mkdirSync, writeFileSync, chmodSync, readFileSync } from "fs";
+import { join } from "path";
+const HOOK_MARKER = "# argus-ci-hook";
+const HOOK_SCRIPT = `#!/usr/bin/env sh
+${HOOK_MARKER}
+# Semgrep quality gate — runs on every commit.
+# Remove with: argus-ci setup --remove
+# Bypass (emergency only): git commit --no-verify
+
+echo "🔍 Running Semgrep security scan on staged files..."
+
+# Run argus-ci scan on staged files
+# Exit code 1 = errors found → block commit
+# Exit code 0 = clean → allow commit
+npx --yes argus-ci scan --staged
+
+EXIT_CODE=$?
+
+if [ $EXIT_CODE -ne 0 ]; then
+  echo ""
+  echo "❌ Semgrep found security issues — commit blocked."
+  echo "   Fix the issues above, then run: git commit"
+  echo "   To skip (not recommended): git commit --no-verify"
+  exit 1
+fi
+
+echo "✅ Semgrep scan passed."
+exit 0
+`;
+export async function setupHook(cwd) {
+    const remove = process.argv.includes("--remove");
+    // Find .git directory
+    const gitDir = join(cwd, ".git");
+    if (!existsSync(gitDir)) {
+        console.error("❌ Not a git repository. Run this from the repo root.");
+        process.exit(1);
+    }
+    const hooksDir = join(gitDir, "hooks");
+    const hookPath = join(hooksDir, "pre-commit");
+    if (remove) {
+        await removeHook(hookPath);
+        return;
+    }
+    // Create hooks dir if needed
+    if (!existsSync(hooksDir))
+        mkdirSync(hooksDir, { recursive: true });
+    // Check if a hook already exists (not ours)
+    if (existsSync(hookPath)) {
+        const existing = readFileSync(hookPath, "utf8");
+        if (existing.includes(HOOK_MARKER)) {
+            console.log("✅ argus-ci pre-commit hook already installed.");
+            return;
+        }
+        // Append to existing hook
+        const appended = existing.trimEnd() + "\n\n" + HOOK_SCRIPT;
+        writeFileSync(hookPath, appended, "utf8");
+        chmodSync(hookPath, 0o755);
+        console.log("✅ argus-ci hook appended to existing pre-commit hook.");
+    }
+    else {
+        writeFileSync(hookPath, HOOK_SCRIPT, "utf8");
+        chmodSync(hookPath, 0o755);
+        console.log("✅ argus-ci pre-commit hook installed.");
+    }
+    // Verify semgrep is available
+    const { spawnSync } = await import("child_process");
+    const check = spawnSync("semgrep", ["--version"], { encoding: "utf8" });
+    if (check.status !== 0) {
+        console.log("\n⚠️  semgrep not found on PATH.");
+        console.log("   Install it before the hook will work:");
+        console.log("   → pip install semgrep");
+        console.log("   → brew install semgrep\n");
+    }
+    else {
+        const version = check.stdout.trim();
+        console.log(`   Using semgrep ${version}`);
+    }
+    console.log("\nThe hook will:");
+    console.log("  • Run on every git commit automatically");
+    console.log("  • Scan only the files you're committing (fast)");
+    console.log("  • Block the commit if any ERROR-severity issues are found");
+    console.log("  • Allow commits with only warnings");
+    console.log("\nTo remove:  argus-ci setup --remove");
+    console.log("To bypass:  git commit --no-verify  (emergency only)\n");
+}
+async function removeHook(hookPath) {
+    if (!existsSync(hookPath)) {
+        console.log("No pre-commit hook found.");
+        return;
+    }
+    const content = readFileSync(hookPath, "utf8");
+    if (!content.includes(HOOK_MARKER)) {
+        console.log("argus-ci hook not found in pre-commit hook.");
+        return;
+    }
+    // If the entire file is our hook, delete it
+    if (content.trim() === HOOK_SCRIPT.trim()) {
+        const { unlinkSync } = await import("fs");
+        unlinkSync(hookPath);
+        console.log("✅ argus-ci pre-commit hook removed.");
+        return;
+    }
+    // Otherwise strip our section from the file
+    const lines = content.split("\n");
+    const markerIdx = lines.findIndex((l) => l.includes(HOOK_MARKER));
+    if (markerIdx > 0) {
+        const stripped = lines.slice(0, markerIdx).join("\n").trimEnd() + "\n";
+        writeFileSync(hookPath, stripped, "utf8");
+        console.log("✅ argus-ci section removed from pre-commit hook.");
+    }
+}
+//# sourceMappingURL=setup.js.map

package/dist/hooks/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../src/hooks/setup.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AACnF,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAEtC,MAAM,WAAW,GAAG;EAClB,WAAW;;;;;;;;;;;;;;;;;;;;;;;;CAwBZ,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAEjD,sBAAsB;IACtB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAI,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAI,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAE/C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,6BAA6B;IAC7B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpE,4CAA4C;IAC5C,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEhD,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,MAAM,GAAG,WAAW,CAAC;QAC3D,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1C,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,aAAa,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC7C,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;IACvD,CAAC;IAED,8BAA8B;IAC9B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO;IACT,CAAC;IAED,4CAA4C;IAC5C,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IAED,4CAA4C;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAClE,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QACvE,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAClE,CAAC;AACH,CAAC"}

package/dist/mcp/server.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Semgrep Agent — MCP Server
+ *
+ * Exposes four tools to Cursor / Claude Code / any MCP client:
+ *
+ *   scan_files   — scan specific files (called post code-generation)
+ *   scan_staged  — scan git staged files (pre-commit check)
+ *   scan_branch  — scan changed files on a branch vs base
+ *   scan_pr      — scan a GitHub PR by URL
+ *
+ * Add to Cursor: Settings → MCP → add entry:
+ *   { "command": "npx", "args": ["argus-ci"] }
+ *
+ * Add to Claude Code (~/.claude/settings.json):
+ *   { "mcpServers": { "semgrep": { "command": "npx", "args": ["argus-ci"] } } }
+ */
+export {};
+//# sourceMappingURL=server.d.ts.map

package/dist/mcp/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG"}

package/dist/mcp/server.js

@@ -0,0 +1,141 @@
+/**
+ * Semgrep Agent — MCP Server
+ *
+ * Exposes four tools to Cursor / Claude Code / any MCP client:
+ *
+ *   scan_files   — scan specific files (called post code-generation)
+ *   scan_staged  — scan git staged files (pre-commit check)
+ *   scan_branch  — scan changed files on a branch vs base
+ *   scan_pr      — scan a GitHub PR by URL
+ *
+ * Add to Cursor: Settings → MCP → add entry:
+ *   { "command": "npx", "args": ["argus-ci"] }
+ *
+ * Add to Claude Code (~/.claude/settings.json):
+ *   { "mcpServers": { "semgrep": { "command": "npx", "args": ["argus-ci"] } } }
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { scanFiles, scanStaged, scanBranch } from "../core/scanner.js";
+import { fetchPRFiles, postPRComment } from "../core/github.js";
+import { detectRulesets } from "../core/detector.js";
+import { toMarkdown, toPRComment } from "../core/reporter.js";
+const server = new McpServer({
+    name: "argus",
+    version: "1.0.0",
+});
+// ─── Tool: scan_files ─────────────────────────────────────────────────────────
+// Called by AI agents right after generating/modifying code.
+server.tool("scan_files", "Scan specific files with Semgrep for security vulnerabilities and quality issues. " +
+    "Call this immediately after generating or modifying code files.", {
+    files: z.array(z.string()).describe("List of file paths to scan (relative to cwd or absolute)"),
+    cwd: z.string().optional().describe("Working directory / repo root. Defaults to process.cwd()"),
+    rulesets: z.array(z.string()).optional().describe("Semgrep rulesets to use. Defaults to auto-detected from stack. " +
+        "Examples: p/secrets, p/owasp-top-ten, p/javascript"),
+}, async ({ files, cwd, rulesets }) => {
+    const workdir = cwd ?? process.cwd();
+    const detected = detectRulesets(workdir);
+    const config = { rulesets: rulesets ?? detected.rulesets };
+    const result = await scanFiles(files, workdir, config);
+    const markdown = toMarkdown(result, `${files.length} file${files.length !== 1 ? "s" : ""}`);
+    const hasErrors = result.issues.some((i) => i.severity === "error");
+    return {
+        content: [
+            {
+                type: "text",
+                text: markdown,
+            },
+        ],
+        isError: hasErrors,
+    };
+});
+// ─── Tool: scan_staged ────────────────────────────────────────────────────────
+// Scans only git-staged files. Designed for pre-commit hook integration.
+server.tool("scan_staged", "Scan all git-staged files with Semgrep. Use this before committing to catch issues in code about to be committed.", {
+    cwd: z.string().optional().describe("Repo root directory. Defaults to process.cwd()"),
+    rulesets: z.array(z.string()).optional().describe("Semgrep rulesets to use. Defaults to auto-detected."),
+}, async ({ cwd, rulesets }) => {
+    const workdir = cwd ?? process.cwd();
+    const detected = detectRulesets(workdir);
+    const config = { rulesets: rulesets ?? detected.rulesets };
+    const result = await scanStaged(workdir, config);
+    const markdown = toMarkdown(result, "staged files");
+    const hasErrors = result.issues.some((i) => i.severity === "error");
+    return {
+        content: [{ type: "text", text: markdown }],
+        isError: hasErrors,
+    };
+});
+// ─── Tool: scan_branch ────────────────────────────────────────────────────────
+server.tool("scan_branch", "Scan all files changed on a branch compared to a base branch (default: main). " +
+    "Use when asked to review a branch or check what a feature branch introduces.", {
+    branch: z.string().describe("Branch name to scan (e.g. feature/auth)"),
+    base: z.string().optional().default("main").describe("Base branch to compare against (default: main)"),
+    cwd: z.string().optional().describe("Repo root. Defaults to process.cwd()"),
+    rulesets: z.array(z.string()).optional().describe("Semgrep rulesets. Defaults to auto-detected."),
+}, async ({ branch, base, cwd, rulesets }) => {
+    const workdir = cwd ?? process.cwd();
+    const detected = detectRulesets(workdir);
+    const config = { rulesets: rulesets ?? detected.rulesets };
+    const result = await scanBranch(workdir, branch, base ?? "main", config);
+    const markdown = toMarkdown(result, `branch \`${branch}\` vs \`${base ?? "main"}\``);
+    const hasErrors = result.issues.some((i) => i.severity === "error");
+    return {
+        content: [{ type: "text", text: markdown }],
+        isError: hasErrors,
+    };
+});
+// ─── Tool: scan_pr ────────────────────────────────────────────────────────────
+server.tool("scan_pr", "Scan a GitHub Pull Request by URL. Fetches the changed files and runs Semgrep on them. " +
+    "Optionally posts results as a PR comment.", {
+    pr_url: z.string().describe("Full GitHub PR URL, e.g. https://github.com/owner/repo/pull/142"),
+    cwd: z.string().optional().describe("Local repo root to scan files from. Required if repo is cloned locally. " +
+        "If not provided, files are reported by path only."),
+    rulesets: z.array(z.string()).optional().describe("Semgrep rulesets. Defaults to auto-detected."),
+    post_comment: z.boolean().optional().default(false).describe("Post scan results as a comment on the PR (requires GITHUB_TOKEN env var)"),
+}, async ({ pr_url, cwd, rulesets, post_comment }) => {
+    // Fetch PR info from GitHub
+    let prInfo;
+    try {
+        prInfo = await fetchPRFiles(pr_url);
+    }
+    catch (err) {
+        return {
+            content: [{ type: "text", text: `❌ Failed to fetch PR: ${String(err)}` }],
+            isError: true,
+        };
+    }
+    if (!prInfo) {
+        return {
+            content: [{ type: "text", text: `❌ Could not parse PR URL: ${pr_url}` }],
+            isError: true,
+        };
+    }
+    const workdir = cwd ?? process.cwd();
+    const detected = detectRulesets(workdir);
+    const config = { rulesets: rulesets ?? detected.rulesets };
+    const result = await scanFiles(prInfo.files, workdir, config);
+    const context = `PR #${prInfo.meta.number}: ${prInfo.meta.title}`;
+    const markdown = toMarkdown(result, context);
+    // Optionally post to GitHub
+    if (post_comment) {
+        const comment = toPRComment(result, prInfo.meta.title, prInfo.meta.url);
+        const posted = await postPRComment(prInfo.owner, prInfo.repo, prInfo.meta.number, comment);
+        const postNote = posted
+            ? "\n\n✅ Results posted as PR comment."
+            : "\n\n⚠️ Could not post PR comment — check GITHUB_TOKEN.";
+        return {
+            content: [{ type: "text", text: markdown + postNote }],
+            isError: result.issues.some((i) => i.severity === "error"),
+        };
+    }
+    return {
+        content: [{ type: "text", text: markdown }],
+        isError: result.issues.some((i) => i.severity === "error"),
+    };
+});
+// ─── Start ────────────────────────────────────────────────────────────────────
+const transport = new StdioServerTransport();
+await server.connect(transport);
+//# sourceMappingURL=server.js.map

package/dist/mcp/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAE9D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAK,OAAO;IAChB,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,iFAAiF;AACjF,6DAA6D;AAE7D,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,oFAAoF;IACpF,iEAAiE,EACjE;IACE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CACjC,0DAA0D,CAC3D;IACD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACjC,0DAA0D,CAC3D;IACD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC/C,iEAAiE;QACjE,oDAAoD,CACrD;CACF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE;IACjC,MAAM,OAAO,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAE3D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,QAAQ,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE5F,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAEpE,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,QAAQ;aACf;SACF;QACD,OAAO,EAAE,SAAS;KACnB,CAAC;AACJ,CAAC,CACF,CAAC;AAEF,iFAAiF;AACjF,yEAAyE;AAEzE,MAAM,CAAC,IAAI,CACT,aAAa,EACb,mHAAmH,EACnH;IACE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;IACrF,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;CACzG,EACD,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE;IAC1B,MAAM,OAAO,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAE3D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAEpD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAEpE,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpD,OAAO,EAAE,SAAS;KACnB,CAAC;AACJ,CAAC,CACF,CAAC;AAEF,iFAAiF;AAEjF,MAAM,CAAC,IAAI,CACT,aAAa,EACb,gFAAgF;IAChF,8EAA8E,EAC9E;IACE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IACtE,IAAI,EAAI,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,gDAAgD,CAAC;IACxG,GAAG,EAAK,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IAC9E,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;CAClG,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE;IACxC,MAAM,OAAO,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAE3D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,YAAY,MAAM,WAAW,IAAI,IAAI,MAAM,IAAI,CAAC,CAAC;IAErF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAEpE,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpD,OAAO,EAAE,SAAS;KACnB,CAAC;AACJ,CAAC,CACF,CAAC;AAEF,iFAAiF;AAEjF,MAAM,CAAC,IAAI,CACT,SAAS,EACT,yFAAyF;IACzF,2CAA2C,EAC3C;IACE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CACzB,iEAAiE,CAClE;IACD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACjC,0EAA0E;QAC1E,mDAAmD,CACpD;IACD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;IACjG,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAC1D,0EAA0E,CAC3E;CACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE;IAChD,4BAA4B;IAC5B,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,yBAAyB,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YAClF,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,6BAA6B,MAAM,EAAE,EAAE,CAAC;YACjF,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAE3D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IAClE,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE7C,4BAA4B;IAC5B,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3F,MAAM,QAAQ,GAAG,MAAM;YACrB,CAAC,CAAC,qCAAqC;YACvC,CAAC,CAAC,wDAAwD,CAAC;QAC7D,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,QAAQ,GAAG,QAAQ,EAAE,CAAC;YAC/D,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;SAC3D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpD,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;KAC3D,CAAC;AACJ,CAAC,CACF,CAAC;AAEF,iFAAiF;AAEjF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,79 @@
+export interface SemgrepRawResult {
+    results: SemgrepFinding[];
+    errors: SemgrepError[];
+    stats?: {
+        total_time?: number;
+    };
+}
+export interface SemgrepFinding {
+    check_id: string;
+    path: string;
+    start: {
+        line: number;
+        col: number;
+    };
+    end: {
+        line: number;
+        col: number;
+    };
+    extra: {
+        message: string;
+        severity: "ERROR" | "WARNING" | "INFO";
+        lines?: string;
+        metadata?: {
+            cwe?: string[];
+            owasp?: string[];
+            references?: string[];
+            category?: string;
+            technology?: string[];
+        };
+    };
+}
+export interface SemgrepError {
+    code: number;
+    level: string;
+    message: string;
+    type: string;
+}
+export type Severity = "error" | "warning" | "info";
+export interface Issue {
+    ruleId: string;
+    path: string;
+    line: number;
+    col: number;
+    severity: Severity;
+    message: string;
+    sourceLine?: string;
+    cwe?: string[];
+    owasp?: string[];
+    references?: string[];
+}
+export interface ScanResult {
+    issues: Issue[];
+    skipped: boolean;
+    skipReason?: string;
+    filesScanned: number;
+    durationMs: number;
+    rulesets: string[];
+}
+export interface ScanConfig {
+    /** Semgrep rulesets to run — defaults to auto-detected from stack */
+    rulesets?: string[];
+    /** Fail (exit 1) if any issue of these severities is found */
+    failOn?: Severity[];
+    /** Max file size in KB to scan — default 500 */
+    maxFileSizeKb?: number;
+    /** Directories to exclude */
+    exclude?: string[];
+    /** GITHUB_TOKEN for private repo PR access */
+    githubToken?: string;
+    /** Anthropic API key for the agent interface */
+    anthropicKey?: string;
+}
+export interface ToolResponse {
+    success: boolean;
+    result?: ScanResult;
+    markdown?: string;
+    error?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,MAAM,EAAG,YAAY,EAAE,CAAC;IACxB,KAAK,CAAC,EAAG;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAM,MAAM,CAAC;IACjB,KAAK,EAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,GAAG,EAAO;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QACL,OAAO,EAAI,MAAM,CAAC;QAClB,QAAQ,EAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;QACxC,KAAK,CAAC,EAAK,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE;YACT,GAAG,CAAC,EAAS,MAAM,EAAE,CAAC;YACtB,KAAK,CAAC,EAAO,MAAM,EAAE,CAAC;YACtB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;YACtB,QAAQ,CAAC,EAAI,MAAM,CAAC;YACpB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;SACvB,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAK,MAAM,CAAC;IAChB,KAAK,EAAI,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAK,MAAM,CAAC;CACjB;AAID,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,KAAK;IACpB,MAAM,EAAO,MAAM,CAAC;IACpB,IAAI,EAAS,MAAM,CAAC;IACpB,IAAI,EAAS,MAAM,CAAC;IACpB,GAAG,EAAU,MAAM,CAAC;IACpB,QAAQ,EAAK,QAAQ,CAAC;IACtB,OAAO,EAAM,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAS,MAAM,EAAE,CAAC;IACtB,KAAK,CAAC,EAAO,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAID,MAAM,WAAW,UAAU;IACzB,MAAM,EAAM,KAAK,EAAE,CAAC;IACpB,OAAO,EAAK,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAG,MAAM,CAAC;IACpB,QAAQ,EAAK,MAAM,EAAE,CAAC;CACvB;AAID,MAAM,WAAW,UAAU;IACzB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,8DAA8D;IAC9D,MAAM,CAAC,EAAI,QAAQ,EAAE,CAAC;IACtB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6BAA6B;IAC7B,OAAO,CAAC,EAAG,MAAM,EAAE,CAAC;IACpB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAG,OAAO,CAAC;IAClB,MAAM,CAAC,EAAG,UAAU,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAI,MAAM,CAAC;CAClB"}

package/dist/types.js

@@ -0,0 +1,3 @@
+// ─── Semgrep raw output ───────────────────────────────────────────────────────
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,iFAAiF"}