calllint 1.3.0 → 1.4.0

package/dist/index.js

@@ -106,6 +106,10 @@ SCAN OPTIONS
   --badge            Emit a shields.io endpoint badge JSON (SAFE/REVIEW/UNKNOWN/BLOCK)
   --receipt          Generate a cryptographically-verifiable audit receipt (for CI/compliance)
   --receipt-out <f>  Receipt output path (default: calllint-receipt.json)
+  --evidence <file>  Attach an external scanner report (e.g. SkillSpector JSON/SARIF)
+                     as supporting evidence; shown side-by-side in a joint Trust
+                     Packet. Never re-scored, never changes the CallLint verdict.
+  --evidence-format <fmt>  Force evidence format (json|sarif); default auto-detect
   --policy <file>    Use a policy file (default: built-in defaults)
   --stdin            Read config JSON from stdin
   --ci               Exit non-zero per policy (BLOCK=30, UNKNOWN=20, REVIEW=10 if enabled)
@@ -130,6 +134,7 @@ EXAMPLES
   calllint scan .cursor/mcp.json --markdown
   calllint scan .cursor/mcp.json --badge > calllint-badge.json
   calllint scan .cursor/mcp.json --receipt  # Generate audit receipt
+  calllint scan .cursor/mcp.json --evidence skillspector-report.json  # Joint Trust Packet
   calllint receipt verify calllint-receipt.json  # Verify receipt integrity
   calllint action inspect payment.json
   calllint inbox inspect gmail-reply.normalized.json
@@ -682,7 +687,8 @@ function resolveScanOptions(opts) {
     now: opts?.now ?? 0,
     generatedAt: opts?.generatedAt ?? "1970-01-01T00:00:00.000Z",
     extraFindings: opts?.extraFindings ?? {},
-    surfaces: opts?.surfaces ?? []
+    surfaces: opts?.surfaces ?? [],
+    evidence: opts?.evidence ?? []
   };
 }
 
@@ -2670,7 +2676,7 @@ function enrichEvidencePositions(reports, positions) {
 }
 
 // ../../packages/core/src/scanConfig.ts
-function aggregate(configPath, reports, generatedAt) {
+function aggregate(configPath, reports, generatedAt, evidence) {
   const counts = { SAFE: 0, REVIEW: 0, BLOCK: 0, UNKNOWN: 0 };
   for (const r of reports) counts[r.verdict]++;
   const verdict = reports.length === 0 ? "UNKNOWN" : mostSevereVerdict(reports.map((r) => r.verdict));
@@ -2683,18 +2689,23 @@ function aggregate(configPath, reports, generatedAt) {
     counts,
     reports,
     diagnostics: [],
-    generatedAt
+    generatedAt,
+    // Additive projection (ADR 0034). Attached only when the CLI imported evidence
+    // via `scan --evidence`; omitted otherwise so default scan output is
+    // byte-identical (the offline corpus never attaches evidence). Never re-scored:
+    // the `verdict` above is unaffected by these findings.
+    ...evidence.length > 0 ? { evidence } : {}
   };
 }
 function scanParsed(parsed, opts) {
-  const { generatedAt, surfaces } = resolveScanOptions(opts);
+  const { generatedAt, surfaces, evidence } = resolveScanOptions(opts);
   const reports = parsed.servers.map(
     (server) => scanServer({ server, targetKind: parsed.kind }, opts)
   );
   enrichEvidencePositions(reports, parsed.positions);
   const surfaceReport = scanDocumentSurfaces(surfaces, parsed.configPath, generatedAt);
   if (surfaceReport) reports.push(surfaceReport);
-  return aggregate(parsed.configPath, reports, generatedAt);
+  return aggregate(parsed.configPath, reports, generatedAt, evidence);
 }
 function scanConfigText(text, configPath, opts) {
   return scanParsed(parseConfigText(text, configPath), opts);
@@ -4442,6 +4453,275 @@ function renderHtml(summary) {
 </html>`;
 }
 
+// ../../packages/report-renderer/src/renderTrustPacket.ts
+var COMPLETENESS_HINT = {
+  complete: "complete",
+  partial: "partial (incomplete \u2014 treat as inconclusive)",
+  degraded: "degraded (not a pass)",
+  failed: "failed (not a pass)"
+};
+function topProviderSeverity(ev) {
+  const sevs = ev.findings.map(
+    (f) => f && typeof f === "object" && "providerSeverity" in f ? String(f.providerSeverity) : void 0
+  ).filter((s) => Boolean(s));
+  return sevs[0];
+}
+function whyTheyDiffer(ev, authorityVerdict) {
+  if (ev.completeness === "failed" || ev.completeness === "degraded") {
+    return "Why they differ: the content scan is " + COMPLETENESS_HINT[ev.completeness] + ", so it carries no weight here; CallLint's authority verdict stands on its own evidence.";
+  }
+  if (ev.findings.length === 0 && authorityVerdict !== "SAFE") {
+    return "Why they differ: the content scan found nothing malicious, but CallLint judges the granted authority itself too broad \u2014 clean code can still request unsafe capabilities.";
+  }
+  return "Why they differ: the two tools answer different questions \u2014 content risk (the scanner) vs. whether the requested authority is acceptable (CallLint). Neither overrides the other.";
+}
+function renderTrustPacket(summary, toolVersion, style = DEFAULT_STYLE) {
+  const evidence = summary.evidence;
+  if (!evidence || evidence.length === 0) return "";
+  const lines = ["", "Joint Trust Packet", "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"];
+  lines.push("Content scan");
+  for (const ev of evidence) {
+    const sev = topProviderSeverity(ev);
+    const findingsLabel = ev.findings.length === 0 ? "no findings" : `${ev.findings.length} finding${ev.findings.length === 1 ? "" : "s"}` + (sev ? ` (top severity: ${sev})` : "");
+    lines.push(
+      `  ${ev.provider} ${ev.providerVersion}  scanMode: ${ev.scanMode}  completeness: ${COMPLETENESS_HINT[ev.completeness]}`
+    );
+    lines.push(`    ${findingsLabel}`);
+    lines.push(`    raw report digest: ${ev.rawReportDigest}`);
+    for (const reason of ev.degradedReasons) {
+      lines.push(`    degraded: ${reason}`);
+    }
+  }
+  lines.push("Authority scan");
+  lines.push(
+    `  CallLint ${toolVersion}  ${verdictTag(summary.verdict, style)}  (${summary.publicVerdictLabel})`
+  );
+  lines.push(whyTheyDiffer(evidence[0], summary.verdict));
+  return lines.join("\n");
+}
+
+// ../../packages/evidence/src/types.ts
+var EVIDENCE_SCHEMA_VERSION = "calllint.evidence-provider.v0";
+
+// ../../packages/evidence/src/providers/skillspector.ts
+function pinnedVersion(raw) {
+  const tool = raw.tool;
+  const commit = typeof raw.commit === "string" && raw.commit || tool && typeof tool.commit === "string" && tool.commit || "";
+  if (commit) return `git:${commit}`;
+  const version = typeof raw.version === "string" && raw.version || tool && typeof tool.version === "string" && tool.version || "";
+  return version || void 0;
+}
+function parseSkillSpectorJson(parsed) {
+  const raw = asObject(parsed, "SkillSpector JSON root");
+  const degradedReasons = [];
+  const usedLlm = raw.llm_used === true || raw.llmUsed === true;
+  const scanMode = usedLlm ? "llm" : "static";
+  const rawFindings = arrayOf(raw.findings) ?? arrayOf(raw.results) ?? [];
+  const findings = rawFindings.map((f) => {
+    const o = asObject(f, "SkillSpector finding");
+    return {
+      providerRuleId: String(o.rule_id ?? o.ruleId ?? o.id ?? "unknown"),
+      providerSeverity: String(o.severity ?? o.level ?? "unknown"),
+      message: typeof o.message === "string" ? o.message : void 0,
+      locations: extractLocations(o)
+    };
+  });
+  let completenessHint;
+  const status = String(raw.status ?? raw.scan_status ?? "").toLowerCase();
+  if (status && status !== "complete" && status !== "completed" && status !== "success") {
+    degradedReasons.push(`SkillSpector reported status "${status}"`);
+    completenessHint = status === "partial" ? "partial" : "degraded";
+  }
+  if (raw.partial === true) {
+    degradedReasons.push("SkillSpector reported a partial scan");
+    completenessHint = completenessHint ?? "partial";
+  }
+  if (raw.degraded === true) {
+    degradedReasons.push("SkillSpector reported a degraded scan");
+    completenessHint = "degraded";
+  }
+  const coverage = (arrayOf(raw.categories) ?? arrayOf(raw.coverage) ?? []).map((c) => String(c));
+  return {
+    provider: "skillspector",
+    providerVersion: pinnedVersion(raw),
+    scanMode,
+    coverage,
+    findings,
+    degradedReasons,
+    completenessHint
+  };
+}
+function parseSkillSpectorSarif(parsed) {
+  const raw = asObject(parsed, "SARIF root");
+  const runs = arrayOf(raw.runs) ?? [];
+  if (runs.length === 0) {
+    return {
+      provider: "skillspector",
+      findings: [],
+      degradedReasons: ["SARIF had no runs"]
+    };
+  }
+  const degradedReasons = [];
+  const findings = [];
+  let providerVersion;
+  const coverage = [];
+  for (const runUnknown of runs) {
+    const run2 = asObject(runUnknown, "SARIF run");
+    const tool = asObject(run2.tool ?? {}, "SARIF tool");
+    const driver = asObject(tool.driver ?? {}, "SARIF tool.driver");
+    if (!providerVersion) {
+      const v = typeof driver.semanticVersion === "string" && driver.semanticVersion || typeof driver.version === "string" && driver.version || "";
+      if (v) providerVersion = v;
+    }
+    const results = arrayOf(run2.results) ?? [];
+    for (const resUnknown of results) {
+      const res = asObject(resUnknown, "SARIF result");
+      findings.push({
+        providerRuleId: String(res.ruleId ?? "unknown"),
+        providerSeverity: String(res.level ?? "warning"),
+        message: extractSarifMessage(res),
+        locations: extractSarifLocations(res)
+      });
+    }
+  }
+  degradedReasons.push("SARIF import: provider-specific fields may be lost vs JSON form");
+  return {
+    provider: "skillspector",
+    providerVersion,
+    scanMode: "static",
+    coverage,
+    findings,
+    degradedReasons
+  };
+}
+function asObject(v, what) {
+  if (v && typeof v === "object" && !Array.isArray(v)) return v;
+  throw new Error(`expected object for ${what}`);
+}
+function arrayOf(v) {
+  return Array.isArray(v) ? v : void 0;
+}
+function extractLocations(o) {
+  const loc = o.location ?? o.locations ?? o.path;
+  if (typeof loc === "string") return [loc];
+  if (Array.isArray(loc)) return loc.map((x) => String(x));
+  return void 0;
+}
+function extractSarifMessage(res) {
+  const msg = res.message;
+  if (msg && typeof msg.text === "string") return msg.text;
+  return void 0;
+}
+function extractSarifLocations(res) {
+  const locs = arrayOf(res.locations);
+  if (!locs) return void 0;
+  const out = [];
+  for (const l of locs) {
+    const lo = l;
+    const phys = lo?.physicalLocation;
+    const art = phys?.artifactLocation;
+    const uri = art && typeof art.uri === "string" ? art.uri : void 0;
+    const region = phys?.region;
+    const line = region && typeof region.startLine === "number" ? region.startLine : void 0;
+    if (uri) out.push(line ? `${uri}:${line}` : uri);
+  }
+  return out.length > 0 ? out : void 0;
+}
+
+// ../../packages/evidence/src/importEvidence.ts
+var ZERO_DIGEST = `sha256:${"0".repeat(64)}`;
+function detectProvider(raw, explicit) {
+  if (explicit) return explicit;
+  const r = raw;
+  if (!r) return "unknown";
+  const topTool = r.tool;
+  const jsonName = typeof r.scanner === "string" && r.scanner || topTool && typeof topTool.name === "string" && topTool.name || "";
+  let sarifName = "";
+  const runs = r.runs;
+  if (Array.isArray(runs) && runs.length > 0) {
+    const run2 = runs[0];
+    const tool = run2?.tool;
+    const driver = tool?.driver;
+    if (driver && typeof driver.name === "string") sarifName = driver.name;
+  }
+  if (/skillspector/i.test(String(jsonName)) || /skillspector/i.test(sarifName)) {
+    return "skillspector";
+  }
+  return "unknown";
+}
+function importEvidence(rawText, opts = {}) {
+  const format = opts.format ?? (looksLikeSarif(rawText) ? "sarif" : "json");
+  const rawReportDigest = sha256(rawText);
+  let parsed;
+  try {
+    parsed = JSON.parse(rawText);
+  } catch {
+    return failClosed(opts.provider ?? "unknown", rawReportDigest, [
+      `report is not valid JSON (format=${format})`
+    ]);
+  }
+  const provider = detectProvider(parsed, opts.provider);
+  let result;
+  try {
+    if (provider === "skillspector") {
+      result = format === "sarif" ? parseSkillSpectorSarif(parsed) : parseSkillSpectorJson(parsed);
+    } else {
+      return failClosed(provider, rawReportDigest, [
+        `no adapter for provider "${provider}"; evidence not interpreted`
+      ]);
+    }
+  } catch (err2) {
+    return failClosed(provider, rawReportDigest, [
+      `adapter error: ${err2.message}`
+    ]);
+  }
+  return finalizeEnvelope(result, rawReportDigest);
+}
+function failClosed(provider, rawReportDigest, reasons) {
+  return {
+    schema_version: EVIDENCE_SCHEMA_VERSION,
+    provider: provider || "unknown",
+    providerVersion: "unknown",
+    artifactDigest: ZERO_DIGEST,
+    scanMode: "static",
+    coverage: [],
+    completeness: "failed",
+    findings: [],
+    rawReportDigest,
+    degradedReasons: reasons
+  };
+}
+function finalizeEnvelope(r, rawReportDigest) {
+  const degradedReasons = [...r.degradedReasons ?? []];
+  const rank = { complete: 0, partial: 1, degraded: 2, failed: 3 };
+  const rankToCompleteness = ["complete", "partial", "degraded", "failed"];
+  let level = rank[r.completenessHint ?? (degradedReasons.length > 0 ? "degraded" : "complete")];
+  let providerVersion = r.providerVersion?.trim() || "";
+  if (!providerVersion) {
+    providerVersion = "unknown";
+    degradedReasons.push("provider version not pinned (no release/commit reported)");
+    level = Math.max(level, rank.degraded);
+  }
+  const completeness = rankToCompleteness[level];
+  return {
+    schema_version: EVIDENCE_SCHEMA_VERSION,
+    provider: r.provider,
+    providerVersion,
+    artifactDigest: r.artifactDigest ?? ZERO_DIGEST,
+    scanMode: r.scanMode ?? "static",
+    coverage: r.coverage ?? [],
+    completeness,
+    findings: r.findings,
+    rawReportDigest,
+    startedAt: r.startedAt,
+    finishedAt: r.finishedAt,
+    degradedReasons
+  };
+}
+function looksLikeSarif(text) {
+  return /"runs"\s*:/.test(text) && /sarif/i.test(text);
+}
+
 // src/exitCode.ts
 function exitCodeFor(summary, policy) {
   const verdict = summary.verdict;
@@ -5030,6 +5310,15 @@ function scanCommand(args, deps) {
 function scanOneConfig(text, configPath, policy, args, deps, allowReceipt = true) {
   const surfaceDir = flagStr(args.flags, "surface-dir");
   const surfaces = surfaceDir ? readDocumentSurfaces(resolve3(deps.cwd, surfaceDir)) : void 0;
+  const evidenceFile = flagStr(args.flags, "evidence");
+  let evidence;
+  if (evidenceFile) {
+    const loaded = loadEvidence(evidenceFile, args, deps);
+    if ("error" in loaded) {
+      return { stdout: "", stderr: loaded.error, exitCode: loaded.exitCode };
+    }
+    evidence = [loaded];
+  }
   let summary;
   try {
     summary = scanConfigText(text, configPath, {
@@ -5037,7 +5326,8 @@ function scanOneConfig(text, configPath, policy, args, deps, allowReceipt = true
       now: deps.now,
       generatedAt: deps.generatedAt,
       extraFindings: deps.online?.extraFindings,
-      surfaces
+      surfaces,
+      evidence
     });
   } catch (err2) {
     if (err2 instanceof ConfigParseError) {
@@ -5055,7 +5345,7 @@ function scanOneConfig(text, configPath, policy, args, deps, allowReceipt = true
     } catch {
     }
   }
-  const stdout = renderSummary(summary, args);
+  const stdout = renderSummary(summary, args, deps.toolVersion);
   if (allowReceipt && flagBool(args.flags, "receipt")) {
     const err2 = writeReceiptFile(summary, text, configPath, policy, args, deps);
     if (err2) return { stdout: "", stderr: err2, exitCode: EXIT.ERROR };
@@ -5088,15 +5378,31 @@ function writeReceiptFile(summary, text, configPath, policy, args, deps) {
   }
   return void 0;
 }
-function renderSummary(summary, args) {
+function loadEvidence(file, args, deps) {
+  let rawText;
+  try {
+    rawText = readFileSync12(resolve3(deps.cwd, file), "utf8");
+  } catch (err2) {
+    const e = err2;
+    return {
+      error: e.code === "ENOENT" ? `Evidence file not found: ${file}` : e.message,
+      exitCode: EXIT.USAGE
+    };
+  }
+  const fmt = flagStr(args.flags, "evidence-format");
+  const format = fmt === "sarif" ? "sarif" : fmt === "json" ? "json" : void 0;
+  return importEvidence(rawText, { format });
+}
+function renderSummary(summary, args, toolVersion) {
   const style = flagBool(args.flags, "no-emoji") ? NO_EMOJI_STYLE : DEFAULT_STYLE;
   if (flagBool(args.flags, "json")) return renderJson(summary);
   if (flagBool(args.flags, "sarif")) return renderSarif(summary);
   if (flagBool(args.flags, "markdown")) return renderMarkdown(summary);
   if (flagBool(args.flags, "badge")) return renderBadge(summary);
   if (flagBool(args.flags, "html")) return renderHtml(summary);
-  if (flagBool(args.flags, "compact")) return renderCompact(summary, style);
-  return renderTerminal(summary, style);
+  const base = flagBool(args.flags, "compact") ? renderCompact(summary, style) : renderTerminal(summary, style);
+  const packet = renderTrustPacket(summary, toolVersion ?? "0.0.0-dev", style);
+  return packet ? base + "\n" + packet : base;
 }
 function scanChangedCommand(args, deps) {
   const policyPath = flagStr(args.flags, "policy");
@@ -7502,230 +7808,6 @@ function formatAgentType(agentType) {
 // src/commands/evidence.ts
 import { readFileSync as readFileSync16 } from "node:fs";
 import { resolve as resolve8 } from "node:path";
-
-// ../../packages/evidence/src/types.ts
-var EVIDENCE_SCHEMA_VERSION = "calllint.evidence-provider.v0";
-
-// ../../packages/evidence/src/providers/skillspector.ts
-function pinnedVersion(raw) {
-  const tool = raw.tool;
-  const commit = typeof raw.commit === "string" && raw.commit || tool && typeof tool.commit === "string" && tool.commit || "";
-  if (commit) return `git:${commit}`;
-  const version = typeof raw.version === "string" && raw.version || tool && typeof tool.version === "string" && tool.version || "";
-  return version || void 0;
-}
-function parseSkillSpectorJson(parsed) {
-  const raw = asObject(parsed, "SkillSpector JSON root");
-  const degradedReasons = [];
-  const usedLlm = raw.llm_used === true || raw.llmUsed === true;
-  const scanMode = usedLlm ? "llm" : "static";
-  const rawFindings = arrayOf(raw.findings) ?? arrayOf(raw.results) ?? [];
-  const findings = rawFindings.map((f) => {
-    const o = asObject(f, "SkillSpector finding");
-    return {
-      providerRuleId: String(o.rule_id ?? o.ruleId ?? o.id ?? "unknown"),
-      providerSeverity: String(o.severity ?? o.level ?? "unknown"),
-      message: typeof o.message === "string" ? o.message : void 0,
-      locations: extractLocations(o)
-    };
-  });
-  let completenessHint;
-  const status = String(raw.status ?? raw.scan_status ?? "").toLowerCase();
-  if (status && status !== "complete" && status !== "completed" && status !== "success") {
-    degradedReasons.push(`SkillSpector reported status "${status}"`);
-    completenessHint = status === "partial" ? "partial" : "degraded";
-  }
-  if (raw.partial === true) {
-    degradedReasons.push("SkillSpector reported a partial scan");
-    completenessHint = completenessHint ?? "partial";
-  }
-  if (raw.degraded === true) {
-    degradedReasons.push("SkillSpector reported a degraded scan");
-    completenessHint = "degraded";
-  }
-  const coverage = (arrayOf(raw.categories) ?? arrayOf(raw.coverage) ?? []).map((c) => String(c));
-  return {
-    provider: "skillspector",
-    providerVersion: pinnedVersion(raw),
-    scanMode,
-    coverage,
-    findings,
-    degradedReasons,
-    completenessHint
-  };
-}
-function parseSkillSpectorSarif(parsed) {
-  const raw = asObject(parsed, "SARIF root");
-  const runs = arrayOf(raw.runs) ?? [];
-  if (runs.length === 0) {
-    return {
-      provider: "skillspector",
-      findings: [],
-      degradedReasons: ["SARIF had no runs"]
-    };
-  }
-  const degradedReasons = [];
-  const findings = [];
-  let providerVersion;
-  const coverage = [];
-  for (const runUnknown of runs) {
-    const run2 = asObject(runUnknown, "SARIF run");
-    const tool = asObject(run2.tool ?? {}, "SARIF tool");
-    const driver = asObject(tool.driver ?? {}, "SARIF tool.driver");
-    if (!providerVersion) {
-      const v = typeof driver.semanticVersion === "string" && driver.semanticVersion || typeof driver.version === "string" && driver.version || "";
-      if (v) providerVersion = v;
-    }
-    const results = arrayOf(run2.results) ?? [];
-    for (const resUnknown of results) {
-      const res = asObject(resUnknown, "SARIF result");
-      findings.push({
-        providerRuleId: String(res.ruleId ?? "unknown"),
-        providerSeverity: String(res.level ?? "warning"),
-        message: extractSarifMessage(res),
-        locations: extractSarifLocations(res)
-      });
-    }
-  }
-  degradedReasons.push("SARIF import: provider-specific fields may be lost vs JSON form");
-  return {
-    provider: "skillspector",
-    providerVersion,
-    scanMode: "static",
-    coverage,
-    findings,
-    degradedReasons
-  };
-}
-function asObject(v, what) {
-  if (v && typeof v === "object" && !Array.isArray(v)) return v;
-  throw new Error(`expected object for ${what}`);
-}
-function arrayOf(v) {
-  return Array.isArray(v) ? v : void 0;
-}
-function extractLocations(o) {
-  const loc = o.location ?? o.locations ?? o.path;
-  if (typeof loc === "string") return [loc];
-  if (Array.isArray(loc)) return loc.map((x) => String(x));
-  return void 0;
-}
-function extractSarifMessage(res) {
-  const msg = res.message;
-  if (msg && typeof msg.text === "string") return msg.text;
-  return void 0;
-}
-function extractSarifLocations(res) {
-  const locs = arrayOf(res.locations);
-  if (!locs) return void 0;
-  const out = [];
-  for (const l of locs) {
-    const lo = l;
-    const phys = lo?.physicalLocation;
-    const art = phys?.artifactLocation;
-    const uri = art && typeof art.uri === "string" ? art.uri : void 0;
-    const region = phys?.region;
-    const line = region && typeof region.startLine === "number" ? region.startLine : void 0;
-    if (uri) out.push(line ? `${uri}:${line}` : uri);
-  }
-  return out.length > 0 ? out : void 0;
-}
-
-// ../../packages/evidence/src/importEvidence.ts
-var ZERO_DIGEST = `sha256:${"0".repeat(64)}`;
-function detectProvider(raw, explicit) {
-  if (explicit) return explicit;
-  const r = raw;
-  if (!r) return "unknown";
-  const topTool = r.tool;
-  const jsonName = typeof r.scanner === "string" && r.scanner || topTool && typeof topTool.name === "string" && topTool.name || "";
-  let sarifName = "";
-  const runs = r.runs;
-  if (Array.isArray(runs) && runs.length > 0) {
-    const run2 = runs[0];
-    const tool = run2?.tool;
-    const driver = tool?.driver;
-    if (driver && typeof driver.name === "string") sarifName = driver.name;
-  }
-  if (/skillspector/i.test(String(jsonName)) || /skillspector/i.test(sarifName)) {
-    return "skillspector";
-  }
-  return "unknown";
-}
-function importEvidence(rawText, opts = {}) {
-  const format = opts.format ?? (looksLikeSarif(rawText) ? "sarif" : "json");
-  const rawReportDigest = sha256(rawText);
-  let parsed;
-  try {
-    parsed = JSON.parse(rawText);
-  } catch {
-    return failClosed(opts.provider ?? "unknown", rawReportDigest, [
-      `report is not valid JSON (format=${format})`
-    ]);
-  }
-  const provider = detectProvider(parsed, opts.provider);
-  let result;
-  try {
-    if (provider === "skillspector") {
-      result = format === "sarif" ? parseSkillSpectorSarif(parsed) : parseSkillSpectorJson(parsed);
-    } else {
-      return failClosed(provider, rawReportDigest, [
-        `no adapter for provider "${provider}"; evidence not interpreted`
-      ]);
-    }
-  } catch (err2) {
-    return failClosed(provider, rawReportDigest, [
-      `adapter error: ${err2.message}`
-    ]);
-  }
-  return finalizeEnvelope(result, rawReportDigest);
-}
-function failClosed(provider, rawReportDigest, reasons) {
-  return {
-    schema_version: EVIDENCE_SCHEMA_VERSION,
-    provider: provider || "unknown",
-    providerVersion: "unknown",
-    artifactDigest: ZERO_DIGEST,
-    scanMode: "static",
-    coverage: [],
-    completeness: "failed",
-    findings: [],
-    rawReportDigest,
-    degradedReasons: reasons
-  };
-}
-function finalizeEnvelope(r, rawReportDigest) {
-  const degradedReasons = [...r.degradedReasons ?? []];
-  const rank = { complete: 0, partial: 1, degraded: 2, failed: 3 };
-  const rankToCompleteness = ["complete", "partial", "degraded", "failed"];
-  let level = rank[r.completenessHint ?? (degradedReasons.length > 0 ? "degraded" : "complete")];
-  let providerVersion = r.providerVersion?.trim() || "";
-  if (!providerVersion) {
-    providerVersion = "unknown";
-    degradedReasons.push("provider version not pinned (no release/commit reported)");
-    level = Math.max(level, rank.degraded);
-  }
-  const completeness = rankToCompleteness[level];
-  return {
-    schema_version: EVIDENCE_SCHEMA_VERSION,
-    provider: r.provider,
-    providerVersion,
-    artifactDigest: r.artifactDigest ?? ZERO_DIGEST,
-    scanMode: r.scanMode ?? "static",
-    coverage: r.coverage ?? [],
-    completeness,
-    findings: r.findings,
-    rawReportDigest,
-    startedAt: r.startedAt,
-    finishedAt: r.finishedAt,
-    degradedReasons
-  };
-}
-function looksLikeSarif(text) {
-  return /"runs"\s*:/.test(text) && /sarif/i.test(text);
-}
-
-// src/commands/evidence.ts
 function evidenceCommand(args, deps) {
   const subcommand = args.positionals[0];
   if (!subcommand || subcommand === "help") {
@@ -8681,7 +8763,7 @@ function writePlanFile(plan, deps) {
   writeFileSync10(file, JSON.stringify(plan, null, 2) + "\n", "utf8");
   return file;
 }
-function loadEvidence(file, deps, format, provider) {
+function loadEvidence2(file, deps, format, provider) {
   let rawText;
   try {
     rawText = readFileSync18(resolvePath4(deps.cwd, file), "utf8");
@@ -8720,7 +8802,7 @@ function trustPrepare(args, deps) {
   const providerFlag = typeof args.flags["provider"] === "string" ? args.flags["provider"] : void 0;
   let evidence;
   if (evidenceFile) {
-    const imported = loadEvidence(evidenceFile, deps, format, providerFlag);
+    const imported = loadEvidence2(evidenceFile, deps, format, providerFlag);
     if ("error" in imported) {
       return { stdout: "", stderr: `Error: ${imported.error}`, exitCode: imported.exitCode };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "calllint",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Evidence-backed security verdicts for MCP servers and agent tools. Lint agent tool-call risk before tools run — SAFE / REVIEW / BLOCK / UNKNOWN, with evidence. Never executes the server it judges.",
   "keywords": [
     "mcp",