calllint 1.6.0 → 1.7.0

package/dist/index.js

@@ -895,6 +895,228 @@ function resolveArtifactIdentity(input) {
   return identity;
 }
 
+// ../../packages/evidence/src/types.ts
+var EVIDENCE_SCHEMA_VERSION = "calllint.evidence-provider.v0";
+
+// ../../packages/evidence/src/providers/skillspector.ts
+function pinnedVersion(raw) {
+  const tool = raw.tool;
+  const commit = typeof raw.commit === "string" && raw.commit || tool && typeof tool.commit === "string" && tool.commit || "";
+  if (commit) return `git:${commit}`;
+  const version = typeof raw.version === "string" && raw.version || tool && typeof tool.version === "string" && tool.version || "";
+  return version || void 0;
+}
+function parseSkillSpectorJson(parsed) {
+  const raw = asObject(parsed, "SkillSpector JSON root");
+  const degradedReasons = [];
+  const usedLlm = raw.llm_used === true || raw.llmUsed === true;
+  const scanMode = usedLlm ? "llm" : "static";
+  const rawFindings = arrayOf(raw.findings) ?? arrayOf(raw.results) ?? [];
+  const findings = rawFindings.map((f) => {
+    const o = asObject(f, "SkillSpector finding");
+    return {
+      providerRuleId: String(o.rule_id ?? o.ruleId ?? o.id ?? "unknown"),
+      providerSeverity: String(o.severity ?? o.level ?? "unknown"),
+      message: typeof o.message === "string" ? o.message : void 0,
+      locations: extractLocations(o)
+    };
+  });
+  let completenessHint;
+  const status = String(raw.status ?? raw.scan_status ?? "").toLowerCase();
+  if (status && status !== "complete" && status !== "completed" && status !== "success") {
+    degradedReasons.push(`SkillSpector reported status "${status}"`);
+    completenessHint = status === "partial" ? "partial" : "degraded";
+  }
+  if (raw.partial === true) {
+    degradedReasons.push("SkillSpector reported a partial scan");
+    completenessHint = completenessHint ?? "partial";
+  }
+  if (raw.degraded === true) {
+    degradedReasons.push("SkillSpector reported a degraded scan");
+    completenessHint = "degraded";
+  }
+  const coverage = (arrayOf(raw.categories) ?? arrayOf(raw.coverage) ?? []).map((c) => String(c));
+  return {
+    provider: "skillspector",
+    providerVersion: pinnedVersion(raw),
+    scanMode,
+    coverage,
+    findings,
+    degradedReasons,
+    completenessHint
+  };
+}
+function parseSkillSpectorSarif(parsed) {
+  const raw = asObject(parsed, "SARIF root");
+  const runs = arrayOf(raw.runs) ?? [];
+  if (runs.length === 0) {
+    return {
+      provider: "skillspector",
+      findings: [],
+      degradedReasons: ["SARIF had no runs"]
+    };
+  }
+  const degradedReasons = [];
+  const findings = [];
+  let providerVersion;
+  const coverage = [];
+  for (const runUnknown of runs) {
+    const run2 = asObject(runUnknown, "SARIF run");
+    const tool = asObject(run2.tool ?? {}, "SARIF tool");
+    const driver = asObject(tool.driver ?? {}, "SARIF tool.driver");
+    if (!providerVersion) {
+      const v = typeof driver.semanticVersion === "string" && driver.semanticVersion || typeof driver.version === "string" && driver.version || "";
+      if (v) providerVersion = v;
+    }
+    const results = arrayOf(run2.results) ?? [];
+    for (const resUnknown of results) {
+      const res = asObject(resUnknown, "SARIF result");
+      findings.push({
+        providerRuleId: String(res.ruleId ?? "unknown"),
+        providerSeverity: String(res.level ?? "warning"),
+        message: extractSarifMessage(res),
+        locations: extractSarifLocations(res)
+      });
+    }
+  }
+  degradedReasons.push("SARIF import: provider-specific fields may be lost vs JSON form");
+  return {
+    provider: "skillspector",
+    providerVersion,
+    scanMode: "static",
+    coverage,
+    findings,
+    degradedReasons
+  };
+}
+function asObject(v, what) {
+  if (v && typeof v === "object" && !Array.isArray(v)) return v;
+  throw new Error(`expected object for ${what}`);
+}
+function arrayOf(v) {
+  return Array.isArray(v) ? v : void 0;
+}
+function extractLocations(o) {
+  const loc = o.location ?? o.locations ?? o.path;
+  if (typeof loc === "string") return [loc];
+  if (Array.isArray(loc)) return loc.map((x) => String(x));
+  return void 0;
+}
+function extractSarifMessage(res) {
+  const msg = res.message;
+  if (msg && typeof msg.text === "string") return msg.text;
+  return void 0;
+}
+function extractSarifLocations(res) {
+  const locs = arrayOf(res.locations);
+  if (!locs) return void 0;
+  const out = [];
+  for (const l of locs) {
+    const lo = l;
+    const phys = lo?.physicalLocation;
+    const art = phys?.artifactLocation;
+    const uri = art && typeof art.uri === "string" ? art.uri : void 0;
+    const region = phys?.region;
+    const line = region && typeof region.startLine === "number" ? region.startLine : void 0;
+    if (uri) out.push(line ? `${uri}:${line}` : uri);
+  }
+  return out.length > 0 ? out : void 0;
+}
+
+// ../../packages/evidence/src/importEvidence.ts
+var ZERO_DIGEST = `sha256:${"0".repeat(64)}`;
+function detectProvider(raw, explicit) {
+  if (explicit) return explicit;
+  const r = raw;
+  if (!r) return "unknown";
+  const topTool = r.tool;
+  const jsonName = typeof r.scanner === "string" && r.scanner || topTool && typeof topTool.name === "string" && topTool.name || "";
+  let sarifName = "";
+  const runs = r.runs;
+  if (Array.isArray(runs) && runs.length > 0) {
+    const run2 = runs[0];
+    const tool = run2?.tool;
+    const driver = tool?.driver;
+    if (driver && typeof driver.name === "string") sarifName = driver.name;
+  }
+  if (/skillspector/i.test(String(jsonName)) || /skillspector/i.test(sarifName)) {
+    return "skillspector";
+  }
+  return "unknown";
+}
+function importEvidence(rawText, opts = {}) {
+  const format = opts.format ?? (looksLikeSarif(rawText) ? "sarif" : "json");
+  const rawReportDigest = sha256(rawText);
+  let parsed;
+  try {
+    parsed = JSON.parse(rawText);
+  } catch {
+    return failClosed(opts.provider ?? "unknown", rawReportDigest, [
+      `report is not valid JSON (format=${format})`
+    ]);
+  }
+  const provider = detectProvider(parsed, opts.provider);
+  let result;
+  try {
+    if (provider === "skillspector") {
+      result = format === "sarif" ? parseSkillSpectorSarif(parsed) : parseSkillSpectorJson(parsed);
+    } else {
+      return failClosed(provider, rawReportDigest, [
+        `no adapter for provider "${provider}"; evidence not interpreted`
+      ]);
+    }
+  } catch (err2) {
+    return failClosed(provider, rawReportDigest, [
+      `adapter error: ${err2.message}`
+    ]);
+  }
+  return finalizeEnvelope(result, rawReportDigest);
+}
+function failClosed(provider, rawReportDigest, reasons) {
+  return {
+    schema_version: EVIDENCE_SCHEMA_VERSION,
+    provider: provider || "unknown",
+    providerVersion: "unknown",
+    artifactDigest: ZERO_DIGEST,
+    scanMode: "static",
+    coverage: [],
+    completeness: "failed",
+    findings: [],
+    rawReportDigest,
+    degradedReasons: reasons
+  };
+}
+function finalizeEnvelope(r, rawReportDigest) {
+  const degradedReasons = [...r.degradedReasons ?? []];
+  const rank = { complete: 0, partial: 1, degraded: 2, failed: 3 };
+  const rankToCompleteness = ["complete", "partial", "degraded", "failed"];
+  let level = rank[r.completenessHint ?? (degradedReasons.length > 0 ? "degraded" : "complete")];
+  let providerVersion = r.providerVersion?.trim() || "";
+  if (!providerVersion) {
+    providerVersion = "unknown";
+    degradedReasons.push("provider version not pinned (no release/commit reported)");
+    level = Math.max(level, rank.degraded);
+  }
+  const completeness = rankToCompleteness[level];
+  return {
+    schema_version: EVIDENCE_SCHEMA_VERSION,
+    provider: r.provider,
+    providerVersion,
+    artifactDigest: r.artifactDigest ?? ZERO_DIGEST,
+    scanMode: r.scanMode ?? "static",
+    coverage: r.coverage ?? [],
+    completeness,
+    findings: r.findings,
+    rawReportDigest,
+    startedAt: r.startedAt,
+    finishedAt: r.finishedAt,
+    degradedReasons
+  };
+}
+function looksLikeSarif(text) {
+  return /"runs"\s*:/.test(text) && /sarif/i.test(text);
+}
+
 // ../../packages/static-analyzer/src/detectors/unpinnedPackage.ts
 function detectUnpinnedPackage(ctx) {
   const { binding } = ctx;
@@ -4658,228 +4880,6 @@ function renderTrustPacket(summary, toolVersion, style = DEFAULT_STYLE) {
   return lines.join("\n");
 }
 
-// ../../packages/evidence/src/types.ts
-var EVIDENCE_SCHEMA_VERSION = "calllint.evidence-provider.v0";
-
-// ../../packages/evidence/src/providers/skillspector.ts
-function pinnedVersion(raw) {
-  const tool = raw.tool;
-  const commit = typeof raw.commit === "string" && raw.commit || tool && typeof tool.commit === "string" && tool.commit || "";
-  if (commit) return `git:${commit}`;
-  const version = typeof raw.version === "string" && raw.version || tool && typeof tool.version === "string" && tool.version || "";
-  return version || void 0;
-}
-function parseSkillSpectorJson(parsed) {
-  const raw = asObject(parsed, "SkillSpector JSON root");
-  const degradedReasons = [];
-  const usedLlm = raw.llm_used === true || raw.llmUsed === true;
-  const scanMode = usedLlm ? "llm" : "static";
-  const rawFindings = arrayOf(raw.findings) ?? arrayOf(raw.results) ?? [];
-  const findings = rawFindings.map((f) => {
-    const o = asObject(f, "SkillSpector finding");
-    return {
-      providerRuleId: String(o.rule_id ?? o.ruleId ?? o.id ?? "unknown"),
-      providerSeverity: String(o.severity ?? o.level ?? "unknown"),
-      message: typeof o.message === "string" ? o.message : void 0,
-      locations: extractLocations(o)
-    };
-  });
-  let completenessHint;
-  const status = String(raw.status ?? raw.scan_status ?? "").toLowerCase();
-  if (status && status !== "complete" && status !== "completed" && status !== "success") {
-    degradedReasons.push(`SkillSpector reported status "${status}"`);
-    completenessHint = status === "partial" ? "partial" : "degraded";
-  }
-  if (raw.partial === true) {
-    degradedReasons.push("SkillSpector reported a partial scan");
-    completenessHint = completenessHint ?? "partial";
-  }
-  if (raw.degraded === true) {
-    degradedReasons.push("SkillSpector reported a degraded scan");
-    completenessHint = "degraded";
-  }
-  const coverage = (arrayOf(raw.categories) ?? arrayOf(raw.coverage) ?? []).map((c) => String(c));
-  return {
-    provider: "skillspector",
-    providerVersion: pinnedVersion(raw),
-    scanMode,
-    coverage,
-    findings,
-    degradedReasons,
-    completenessHint
-  };
-}
-function parseSkillSpectorSarif(parsed) {
-  const raw = asObject(parsed, "SARIF root");
-  const runs = arrayOf(raw.runs) ?? [];
-  if (runs.length === 0) {
-    return {
-      provider: "skillspector",
-      findings: [],
-      degradedReasons: ["SARIF had no runs"]
-    };
-  }
-  const degradedReasons = [];
-  const findings = [];
-  let providerVersion;
-  const coverage = [];
-  for (const runUnknown of runs) {
-    const run2 = asObject(runUnknown, "SARIF run");
-    const tool = asObject(run2.tool ?? {}, "SARIF tool");
-    const driver = asObject(tool.driver ?? {}, "SARIF tool.driver");
-    if (!providerVersion) {
-      const v = typeof driver.semanticVersion === "string" && driver.semanticVersion || typeof driver.version === "string" && driver.version || "";
-      if (v) providerVersion = v;
-    }
-    const results = arrayOf(run2.results) ?? [];
-    for (const resUnknown of results) {
-      const res = asObject(resUnknown, "SARIF result");
-      findings.push({
-        providerRuleId: String(res.ruleId ?? "unknown"),
-        providerSeverity: String(res.level ?? "warning"),
-        message: extractSarifMessage(res),
-        locations: extractSarifLocations(res)
-      });
-    }
-  }
-  degradedReasons.push("SARIF import: provider-specific fields may be lost vs JSON form");
-  return {
-    provider: "skillspector",
-    providerVersion,
-    scanMode: "static",
-    coverage,
-    findings,
-    degradedReasons
-  };
-}
-function asObject(v, what) {
-  if (v && typeof v === "object" && !Array.isArray(v)) return v;
-  throw new Error(`expected object for ${what}`);
-}
-function arrayOf(v) {
-  return Array.isArray(v) ? v : void 0;
-}
-function extractLocations(o) {
-  const loc = o.location ?? o.locations ?? o.path;
-  if (typeof loc === "string") return [loc];
-  if (Array.isArray(loc)) return loc.map((x) => String(x));
-  return void 0;
-}
-function extractSarifMessage(res) {
-  const msg = res.message;
-  if (msg && typeof msg.text === "string") return msg.text;
-  return void 0;
-}
-function extractSarifLocations(res) {
-  const locs = arrayOf(res.locations);
-  if (!locs) return void 0;
-  const out = [];
-  for (const l of locs) {
-    const lo = l;
-    const phys = lo?.physicalLocation;
-    const art = phys?.artifactLocation;
-    const uri = art && typeof art.uri === "string" ? art.uri : void 0;
-    const region = phys?.region;
-    const line = region && typeof region.startLine === "number" ? region.startLine : void 0;
-    if (uri) out.push(line ? `${uri}:${line}` : uri);
-  }
-  return out.length > 0 ? out : void 0;
-}
-
-// ../../packages/evidence/src/importEvidence.ts
-var ZERO_DIGEST = `sha256:${"0".repeat(64)}`;
-function detectProvider(raw, explicit) {
-  if (explicit) return explicit;
-  const r = raw;
-  if (!r) return "unknown";
-  const topTool = r.tool;
-  const jsonName = typeof r.scanner === "string" && r.scanner || topTool && typeof topTool.name === "string" && topTool.name || "";
-  let sarifName = "";
-  const runs = r.runs;
-  if (Array.isArray(runs) && runs.length > 0) {
-    const run2 = runs[0];
-    const tool = run2?.tool;
-    const driver = tool?.driver;
-    if (driver && typeof driver.name === "string") sarifName = driver.name;
-  }
-  if (/skillspector/i.test(String(jsonName)) || /skillspector/i.test(sarifName)) {
-    return "skillspector";
-  }
-  return "unknown";
-}
-function importEvidence(rawText, opts = {}) {
-  const format = opts.format ?? (looksLikeSarif(rawText) ? "sarif" : "json");
-  const rawReportDigest = sha256(rawText);
-  let parsed;
-  try {
-    parsed = JSON.parse(rawText);
-  } catch {
-    return failClosed(opts.provider ?? "unknown", rawReportDigest, [
-      `report is not valid JSON (format=${format})`
-    ]);
-  }
-  const provider = detectProvider(parsed, opts.provider);
-  let result;
-  try {
-    if (provider === "skillspector") {
-      result = format === "sarif" ? parseSkillSpectorSarif(parsed) : parseSkillSpectorJson(parsed);
-    } else {
-      return failClosed(provider, rawReportDigest, [
-        `no adapter for provider "${provider}"; evidence not interpreted`
-      ]);
-    }
-  } catch (err2) {
-    return failClosed(provider, rawReportDigest, [
-      `adapter error: ${err2.message}`
-    ]);
-  }
-  return finalizeEnvelope(result, rawReportDigest);
-}
-function failClosed(provider, rawReportDigest, reasons) {
-  return {
-    schema_version: EVIDENCE_SCHEMA_VERSION,
-    provider: provider || "unknown",
-    providerVersion: "unknown",
-    artifactDigest: ZERO_DIGEST,
-    scanMode: "static",
-    coverage: [],
-    completeness: "failed",
-    findings: [],
-    rawReportDigest,
-    degradedReasons: reasons
-  };
-}
-function finalizeEnvelope(r, rawReportDigest) {
-  const degradedReasons = [...r.degradedReasons ?? []];
-  const rank = { complete: 0, partial: 1, degraded: 2, failed: 3 };
-  const rankToCompleteness = ["complete", "partial", "degraded", "failed"];
-  let level = rank[r.completenessHint ?? (degradedReasons.length > 0 ? "degraded" : "complete")];
-  let providerVersion = r.providerVersion?.trim() || "";
-  if (!providerVersion) {
-    providerVersion = "unknown";
-    degradedReasons.push("provider version not pinned (no release/commit reported)");
-    level = Math.max(level, rank.degraded);
-  }
-  const completeness = rankToCompleteness[level];
-  return {
-    schema_version: EVIDENCE_SCHEMA_VERSION,
-    provider: r.provider,
-    providerVersion,
-    artifactDigest: r.artifactDigest ?? ZERO_DIGEST,
-    scanMode: r.scanMode ?? "static",
-    coverage: r.coverage ?? [],
-    completeness,
-    findings: r.findings,
-    rawReportDigest,
-    startedAt: r.startedAt,
-    finishedAt: r.finishedAt,
-    degradedReasons
-  };
-}
-function looksLikeSarif(text) {
-  return /"runs"\s*:/.test(text) && /sarif/i.test(text);
-}
-
 // src/exitCode.ts
 function exitCodeFor(summary, policy) {
   const verdict = summary.verdict;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "calllint",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "Evidence-backed security verdicts for MCP servers and agent tools. Lint agent tool-call risk before tools run — SAFE / REVIEW / BLOCK / UNKNOWN, with evidence. Never executes the server it judges.",
   "keywords": [
     "mcp",