claude-crap 0.1.2

package/dist/sarif/sarif-builder.js

@@ -0,0 +1,79 @@
+/**
+ * Minimal SARIF 2.1.0 document builder.
+ *
+ * Every report that leaves the MCP server on its way to the agent is
+ * normalized to SARIF 2.1.0 first. This module provides the typed
+ * helpers used to wrap raw findings in the canonical
+ * `tool → runs → results` taxonomy with exact file coordinates.
+ *
+ * Per-scanner adapters (Semgrep, ESLint, Bandit, Stryker) live under
+ * `src/adapters/` and call into `buildSarifDocument` through the
+ * `wrapResultsInSarif` helper in `src/adapters/common.ts`. The
+ * on-disk deduplication store lives in `./sarif-store.ts`.
+ *
+ * The SARIF 2.1.0 spec lives at:
+ *   https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html
+ *
+ * @module sarif/sarif-builder
+ */
+/**
+ * Build a minimal but valid SARIF 2.1.0 document from a list of findings.
+ *
+ * The returned object conforms to the SARIF JSON schema hosted at:
+ *   https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0.json
+ *
+ * Rules are deduplicated by `ruleId` and emitted in the `tool.driver.rules`
+ * array so that downstream consumers (Claude Code, the dashboard, or any
+ * third-party SARIF viewer) can render a rule index.
+ *
+ * @param tool     Metadata about the producing tool.
+ * @param findings Findings to include in the single run.
+ * @returns        A SARIF 2.1.0 document literal (frozen by `as const`).
+ */
+export function buildSarifDocument(tool, findings) {
+    return {
+        $schema: "https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0.json",
+        version: "2.1.0",
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: tool.name,
+                        version: tool.version,
+                        informationUri: tool.informationUri ?? "https://github.com/local/claude-crap",
+                        // Deduplicate rules by id while preserving insertion order so
+                        // the emitted `rules` array matches the order findings appear.
+                        rules: Array.from(new Map(findings.map((f) => [
+                            f.ruleId,
+                            {
+                                id: f.ruleId,
+                                shortDescription: { text: f.ruleId },
+                                defaultConfiguration: { level: f.level },
+                            },
+                        ])).values()),
+                    },
+                },
+                results: findings.map((f) => ({
+                    ruleId: f.ruleId,
+                    level: f.level,
+                    message: { text: f.message },
+                    locations: [
+                        {
+                            physicalLocation: {
+                                artifactLocation: { uri: f.location.uri },
+                                region: {
+                                    startLine: f.location.startLine,
+                                    startColumn: f.location.startColumn,
+                                    ...(f.location.endLine !== undefined ? { endLine: f.location.endLine } : {}),
+                                    ...(f.location.endColumn !== undefined ? { endColumn: f.location.endColumn } : {}),
+                                },
+                            },
+                        },
+                    ],
+                    ...(f.properties ? { properties: f.properties } : {}),
+                })),
+            },
+        ],
+    };
+}
+//# sourceMappingURL=sarif-builder.js.map

package/dist/sarif/sarif-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif-builder.js","sourceRoot":"","sources":["../../src/sarif/sarif-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA0DH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAmB,EAAE,QAAqC;IAC3F,OAAO;QACL,OAAO,EAAE,qEAAqE;QAC9E,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,sCAAsC;wBAC7E,8DAA8D;wBAC9D,+DAA+D;wBAC/D,KAAK,EAAE,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,CACL,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;4BAClB,CAAC,CAAC,MAAM;4BACR;gCACE,EAAE,EAAE,CAAC,CAAC,MAAM;gCACZ,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;gCACpC,oBAAoB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;6BACzC;yBACF,CAAC,CACH,CAAC,MAAM,EAAE,CACX;qBACF;iBACF;gBACD,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;oBAC5B,SAAS,EAAE;wBACT;4BACE,gBAAgB,EAAE;gCAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE;gCACzC,MAAM,EAAE;oCACN,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS;oCAC/B,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW;oCACnC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oCAC5E,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iCACnF;6BACF;yBACF;qBACF;oBACD,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtD,CAAC,CAAC;aACJ;SACF;KACO,CAAC;AACb,CAAC"}

package/dist/sarif/sarif-store.d.ts

@@ -0,0 +1,205 @@
+/**
+ * On-disk SARIF 2.1.0 store with finding deduplication.
+ *
+ * The Stop quality gate and the `ingest_sarif` MCP tool both need a
+ * single, consolidated view of every finding produced across the current
+ * session. This module provides:
+ *
+ *   - `loadLatest()` — read the consolidated SARIF document from disk,
+ *                       or return an empty seed when no report exists yet.
+ *   - `ingestRun()`  — merge a new SARIF run from an external scanner
+ *                       (Semgrep, ESLint, Bandit, Stryker, ...) into the
+ *                       in-memory store, deduplicating by
+ *                       `(ruleId, uri, startLine, startColumn)`.
+ *   - `persist()`    — atomically write the consolidated document back
+ *                       to disk so other processes (the dashboard) can
+ *                       read it.
+ *
+ * The store is intentionally simple: it does NOT attempt to preserve
+ * per-tool run separation inside the persisted file. Instead, every
+ * ingested run is flattened into a single `runs[0]` entry whose `tool.driver`
+ * is claude-crap itself, and the original scanner name is recorded on
+ * each finding via the `properties.sourceTool` field. This keeps the
+ * consolidated document easy to diff between sessions.
+ *
+ * @module sarif/sarif-store
+ */
+import { type SarifFinding, type SarifLevel } from "./sarif-builder.js";
+/**
+ * The shape of a persisted SARIF 2.1.0 document, narrowed to the fields
+ * we actually read and write. The full spec has many more optional
+ * fields; we ignore them on read and do not emit them on write.
+ */
+export interface PersistedSarif {
+    readonly $schema?: string;
+    readonly version: "2.1.0";
+    readonly runs: ReadonlyArray<SarifRun>;
+}
+interface SarifRun {
+    readonly tool: {
+        readonly driver: {
+            readonly name: string;
+            readonly version: string;
+            readonly informationUri?: string;
+            readonly rules?: ReadonlyArray<unknown>;
+        };
+    };
+    readonly results: ReadonlyArray<SarifResult>;
+}
+interface SarifResult {
+    readonly ruleId: string;
+    readonly level?: SarifLevel;
+    readonly message: {
+        readonly text: string;
+    };
+    readonly locations?: ReadonlyArray<SarifResultLocation>;
+    readonly properties?: Record<string, unknown>;
+}
+interface SarifResultLocation {
+    readonly physicalLocation?: {
+        readonly artifactLocation?: {
+            readonly uri?: string;
+        };
+        readonly region?: {
+            readonly startLine?: number;
+            readonly startColumn?: number;
+            readonly endLine?: number;
+            readonly endColumn?: number;
+        };
+    };
+}
+/**
+ * Options accepted by the {@link SarifStore} constructor.
+ */
+export interface SarifStoreOptions {
+    /** Workspace root. Used to resolve relative `outputDir`. */
+    readonly workspaceRoot: string;
+    /** Directory (absolute or workspace-relative) where reports are written. */
+    readonly outputDir: string;
+    /** Filename for the consolidated SARIF document. Defaults to `latest.sarif`. */
+    readonly fileName?: string;
+}
+/**
+ * A finding together with its deduplication key. Used internally and
+ * returned by {@link SarifStore.ingestRun} so callers can see which
+ * findings were accepted.
+ */
+export interface IngestedFinding extends SarifFinding {
+    /** Stable deduplication key, shape: `ruleId|uri|line|col`. */
+    readonly dedupKey: string;
+    /** Name of the scanner that produced the finding (propagated from `sourceTool`). */
+    readonly sourceTool: string;
+}
+/**
+ * On-disk SARIF store.
+ */
+export declare class SarifStore {
+    private readonly filePath;
+    /** In-memory index of findings keyed by their dedup string. */
+    private readonly findings;
+    /** Tool invocations we have already ingested, for telemetry. */
+    private toolInvocations;
+    constructor(options: SarifStoreOptions);
+    /**
+     * Absolute path to the consolidated SARIF file on disk.
+     */
+    get consolidatedReportPath(): string;
+    /**
+     * Load the consolidated document from disk into memory. If the file is
+     * missing, the store is initialized empty. Top-level parsing errors
+     * still throw (a file that is not valid JSON, or that declares a
+     * different SARIF version, is a real safety signal). However, once
+     * the document is parsed, malformed individual runs and results are
+     * tolerated: F-A08-01 showed that a single bad entry in `latest.sarif`
+     * could crash the MCP server on boot and persistently DoS the
+     * developer. Each run / result is wrapped in its own try/catch so a
+     * single bad entry logs to stderr and is dropped, but the rest of
+     * the file still loads.
+     *
+     * @throws When the file exists but is not valid SARIF 2.1.0 JSON.
+     */
+    loadLatest(): Promise<void>;
+    /**
+     * Merge a raw SARIF document (from any external scanner) into the
+     * store, deduplicating by `(ruleId, uri, startLine, startColumn)`. The
+     * last writer wins for the message and level fields — later ingestions
+     * can refine earlier ones.
+     *
+     * @param sarifDocument  The raw SARIF document as received from the tool.
+     * @param sourceTool     Stable identifier of the producing scanner.
+     * @returns              Stats describing what was accepted.
+     */
+    ingestRun(sarifDocument: PersistedSarif, sourceTool: string): {
+        accepted: number;
+        duplicates: number;
+        total: number;
+    };
+    /**
+     * Snapshot all currently tracked findings as a plain array. Mostly
+     * useful for tests and for the dashboard API.
+     */
+    list(): ReadonlyArray<IngestedFinding>;
+    /**
+     * Atomically write the consolidated document back to disk. Uses a
+     * temporary file and `rename` so concurrent readers never observe
+     * a half-written document.
+     */
+    persist(): Promise<void>;
+    /**
+     * Build the current consolidated SARIF document from the in-memory
+     * findings without touching disk.
+     */
+    toSarifDocument(): {
+        readonly $schema: "https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0.json";
+        readonly version: "2.1.0";
+        readonly runs: readonly [{
+            readonly tool: {
+                readonly driver: {
+                    readonly name: string;
+                    readonly version: string;
+                    readonly informationUri: string;
+                    readonly rules: {
+                        id: string;
+                        shortDescription: {
+                            text: string;
+                        };
+                        defaultConfiguration: {
+                            level: SarifLevel;
+                        };
+                    }[];
+                };
+            };
+            readonly results: {
+                properties?: Record<string, unknown>;
+                ruleId: string;
+                level: SarifLevel;
+                message: {
+                    text: string;
+                };
+                locations: {
+                    physicalLocation: {
+                        artifactLocation: {
+                            uri: string;
+                        };
+                        region: {
+                            endColumn?: number;
+                            endLine?: number;
+                            startLine: number;
+                            startColumn: number;
+                        };
+                    };
+                }[];
+            }[];
+        }];
+    };
+    /**
+     * Number of unique findings currently tracked.
+     */
+    size(): number;
+    /**
+     * Number of times `ingestRun` has been called on this instance.
+     */
+    get invocationsCount(): number;
+}
+export {};
+//# sourceMappingURL=sarif-store.d.ts.map

package/dist/sarif/sarif-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif-store.d.ts","sourceRoot":"","sources":["../../src/sarif/sarif-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAKH,OAAO,EAAsB,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAE5F;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;CACxC;AAED,UAAU,QAAQ;IAChB,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,MAAM,EAAE;YACf,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;YACzB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;YACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;SACzC,CAAC;KACH,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;CAC9C;AAED,UAAU,WAAW;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IACxD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/C;AAED,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAC1B,QAAQ,CAAC,gBAAgB,CAAC,EAAE;YAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE;YAChB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;YAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;SAC7B,CAAC;KACH,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,+DAA+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsC;IAC/D,gEAAgE;IAChE,OAAO,CAAC,eAAe,CAAK;gBAEhB,OAAO,EAAE,iBAAiB;IAOtC;;OAEG;IACH,IAAI,sBAAsB,IAAI,MAAM,CAEnC;IAED;;;;;;;;;;;;;OAaG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAqDjC;;;;;;;;;OASG;IACH,SAAS,CACP,aAAa,EAAE,cAAc,EAC7B,UAAU,EAAE,MAAM,GACjB;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAgC1D;;;OAGG;IACH,IAAI,IAAI,aAAa,CAAC,eAAe,CAAC;IAItC;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ9B;;;OAGG;IACH,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAyBf;;OAEG;IACH,IAAI,IAAI,MAAM;IAId;;OAEG;IACH,IAAI,gBAAgB,IAAI,MAAM,CAE7B;CACF"}

package/dist/sarif/sarif-store.js

@@ -0,0 +1,246 @@
+/**
+ * On-disk SARIF 2.1.0 store with finding deduplication.
+ *
+ * The Stop quality gate and the `ingest_sarif` MCP tool both need a
+ * single, consolidated view of every finding produced across the current
+ * session. This module provides:
+ *
+ *   - `loadLatest()` — read the consolidated SARIF document from disk,
+ *                       or return an empty seed when no report exists yet.
+ *   - `ingestRun()`  — merge a new SARIF run from an external scanner
+ *                       (Semgrep, ESLint, Bandit, Stryker, ...) into the
+ *                       in-memory store, deduplicating by
+ *                       `(ruleId, uri, startLine, startColumn)`.
+ *   - `persist()`    — atomically write the consolidated document back
+ *                       to disk so other processes (the dashboard) can
+ *                       read it.
+ *
+ * The store is intentionally simple: it does NOT attempt to preserve
+ * per-tool run separation inside the persisted file. Instead, every
+ * ingested run is flattened into a single `runs[0]` entry whose `tool.driver`
+ * is claude-crap itself, and the original scanner name is recorded on
+ * each finding via the `properties.sourceTool` field. This keeps the
+ * consolidated document easy to diff between sessions.
+ *
+ * @module sarif/sarif-store
+ */
+import { promises as fs } from "node:fs";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { buildSarifDocument } from "./sarif-builder.js";
+/**
+ * On-disk SARIF store.
+ */
+export class SarifStore {
+    filePath;
+    /** In-memory index of findings keyed by their dedup string. */
+    findings = new Map();
+    /** Tool invocations we have already ingested, for telemetry. */
+    toolInvocations = 0;
+    constructor(options) {
+        const dir = isAbsolute(options.outputDir)
+            ? options.outputDir
+            : resolve(options.workspaceRoot, options.outputDir);
+        this.filePath = join(dir, options.fileName ?? "latest.sarif");
+    }
+    /**
+     * Absolute path to the consolidated SARIF file on disk.
+     */
+    get consolidatedReportPath() {
+        return this.filePath;
+    }
+    /**
+     * Load the consolidated document from disk into memory. If the file is
+     * missing, the store is initialized empty. Top-level parsing errors
+     * still throw (a file that is not valid JSON, or that declares a
+     * different SARIF version, is a real safety signal). However, once
+     * the document is parsed, malformed individual runs and results are
+     * tolerated: F-A08-01 showed that a single bad entry in `latest.sarif`
+     * could crash the MCP server on boot and persistently DoS the
+     * developer. Each run / result is wrapped in its own try/catch so a
+     * single bad entry logs to stderr and is dropped, but the rest of
+     * the file still loads.
+     *
+     * @throws When the file exists but is not valid SARIF 2.1.0 JSON.
+     */
+    async loadLatest() {
+        try {
+            const raw = await fs.readFile(this.filePath, "utf8");
+            const parsed = JSON.parse(raw);
+            if (parsed.version !== "2.1.0") {
+                throw new Error(`Expected SARIF 2.1.0, got ${parsed.version}`);
+            }
+            this.findings.clear();
+            // Defensive against tampered / mis-generated files: `runs` must
+            // be an array. Anything else is dropped with a stderr warning.
+            if (!Array.isArray(parsed.runs)) {
+                process.stderr.write(`[sarif-store] ${this.filePath}: 'runs' is not an array, dropping entire document\n`);
+                return;
+            }
+            for (const run of parsed.runs) {
+                try {
+                    if (!run || typeof run !== "object" || !Array.isArray(run.results)) {
+                        process.stderr.write(`[sarif-store] ${this.filePath}: skipping run with non-iterable 'results'\n`);
+                        continue;
+                    }
+                    for (const result of run.results) {
+                        try {
+                            const finding = hydrateFindingFromResult(result);
+                            if (finding)
+                                this.findings.set(finding.dedupKey, finding);
+                        }
+                        catch (entryErr) {
+                            process.stderr.write(`[sarif-store] ${this.filePath}: dropping malformed result: ${entryErr.message}\n`);
+                        }
+                    }
+                }
+                catch (runErr) {
+                    process.stderr.write(`[sarif-store] ${this.filePath}: dropping malformed run: ${runErr.message}\n`);
+                }
+            }
+        }
+        catch (err) {
+            const error = err;
+            if (error.code === "ENOENT") {
+                // No report on disk yet — normal for a fresh workspace.
+                this.findings.clear();
+                return;
+            }
+            throw new Error(`[sarif-store] Failed to load consolidated report at ${this.filePath}: ${error.message}`);
+        }
+    }
+    /**
+     * Merge a raw SARIF document (from any external scanner) into the
+     * store, deduplicating by `(ruleId, uri, startLine, startColumn)`. The
+     * last writer wins for the message and level fields — later ingestions
+     * can refine earlier ones.
+     *
+     * @param sarifDocument  The raw SARIF document as received from the tool.
+     * @param sourceTool     Stable identifier of the producing scanner.
+     * @returns              Stats describing what was accepted.
+     */
+    ingestRun(sarifDocument, sourceTool) {
+        if (sarifDocument.version !== "2.1.0") {
+            throw new Error(`[sarif-store] ingestRun received version ${sarifDocument.version}, expected 2.1.0`);
+        }
+        this.toolInvocations += 1;
+        let accepted = 0;
+        let duplicates = 0;
+        let total = 0;
+        for (const run of sarifDocument.runs) {
+            for (const result of run.results) {
+                total += 1;
+                const finding = hydrateFindingFromResult(result, sourceTool);
+                if (!finding)
+                    continue;
+                if (this.findings.has(finding.dedupKey)) {
+                    duplicates += 1;
+                    // Overwrite with the latest metadata so the consolidated view
+                    // reflects the most recent scanner output for this location.
+                    this.findings.set(finding.dedupKey, finding);
+                    continue;
+                }
+                this.findings.set(finding.dedupKey, finding);
+                accepted += 1;
+            }
+        }
+        return { accepted, duplicates, total };
+    }
+    /**
+     * Snapshot all currently tracked findings as a plain array. Mostly
+     * useful for tests and for the dashboard API.
+     */
+    list() {
+        return Array.from(this.findings.values());
+    }
+    /**
+     * Atomically write the consolidated document back to disk. Uses a
+     * temporary file and `rename` so concurrent readers never observe
+     * a half-written document.
+     */
+    async persist() {
+        const doc = this.toSarifDocument();
+        await fs.mkdir(dirname(this.filePath), { recursive: true });
+        const tmp = `${this.filePath}.${process.pid}.tmp`;
+        await fs.writeFile(tmp, JSON.stringify(doc, null, 2), "utf8");
+        await fs.rename(tmp, this.filePath);
+    }
+    /**
+     * Build the current consolidated SARIF document from the in-memory
+     * findings without touching disk.
+     */
+    toSarifDocument() {
+        // Strip the store-only `dedupKey` and `sourceTool` fields before
+        // serializing, but keep `sourceTool` in the per-finding `properties`
+        // bag so consumers can still trace origin.
+        const findings = Array.from(this.findings.values()).map((f) => ({
+            ruleId: f.ruleId,
+            level: f.level,
+            message: f.message,
+            location: f.location,
+            properties: {
+                ...(f.properties ?? {}),
+                sourceTool: f.sourceTool,
+            },
+        }));
+        return buildSarifDocument({
+            name: "claude-crap",
+            version: "0.1.0",
+            informationUri: "https://github.com/local/claude-crap",
+        }, findings);
+    }
+    /**
+     * Number of unique findings currently tracked.
+     */
+    size() {
+        return this.findings.size;
+    }
+    /**
+     * Number of times `ingestRun` has been called on this instance.
+     */
+    get invocationsCount() {
+        return this.toolInvocations;
+    }
+}
+/**
+ * Convert a raw SARIF `result` object into an {@link IngestedFinding}.
+ * Returns `null` when the result is malformed (missing ruleId, message,
+ * or physical location), since a finding without coordinates cannot be
+ * deduplicated and is therefore useless.
+ *
+ * @param result     Raw SARIF `result` object from the scanner's document.
+ * @param sourceTool Optional scanner identifier. If omitted, we read it
+ *                   from `result.properties.sourceTool` (used when
+ *                   reloading a persisted report).
+ * @returns          The hydrated finding, or `null` when invalid.
+ */
+function hydrateFindingFromResult(result, sourceTool) {
+    if (!result.ruleId || !result.message?.text)
+        return null;
+    const loc = result.locations?.[0]?.physicalLocation;
+    const uri = loc?.artifactLocation?.uri;
+    const region = loc?.region;
+    if (!uri || region?.startLine === undefined || region.startColumn === undefined)
+        return null;
+    const resolvedSourceTool = sourceTool ??
+        (typeof result.properties?.sourceTool === "string"
+            ? result.properties.sourceTool
+            : "unknown");
+    const level = result.level ?? "warning";
+    const dedupKey = `${result.ruleId}|${uri}|${region.startLine}|${region.startColumn}`;
+    return {
+        ruleId: result.ruleId,
+        level,
+        message: result.message.text,
+        location: {
+            uri,
+            startLine: region.startLine,
+            startColumn: region.startColumn,
+            ...(region.endLine !== undefined ? { endLine: region.endLine } : {}),
+            ...(region.endColumn !== undefined ? { endColumn: region.endColumn } : {}),
+        },
+        ...(result.properties ? { properties: result.properties } : {}),
+        dedupKey,
+        sourceTool: resolvedSourceTool,
+    };
+}
+//# sourceMappingURL=sarif-store.js.map

package/dist/sarif/sarif-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif-store.js","sourceRoot":"","sources":["../../src/sarif/sarif-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE/D,OAAO,EAAE,kBAAkB,EAAsC,MAAM,oBAAoB,CAAC;AAqE5F;;GAEG;AACH,MAAM,OAAO,UAAU;IACJ,QAAQ,CAAS;IAClC,+DAA+D;IAC9C,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC/D,gEAAgE;IACxD,eAAe,GAAG,CAAC,CAAC;IAE5B,YAAY,OAA0B;QACpC,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC;YACvC,CAAC,CAAC,OAAO,CAAC,SAAS;YACnB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;YACjD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACtB,gEAAgE;YAChE,+DAA+D;YAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iBAAiB,IAAI,CAAC,QAAQ,sDAAsD,CACrF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;wBACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iBAAiB,IAAI,CAAC,QAAQ,8CAA8C,CAC7E,CAAC;wBACF,SAAS;oBACX,CAAC;oBACD,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;wBACjC,IAAI,CAAC;4BACH,MAAM,OAAO,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;4BACjD,IAAI,OAAO;gCAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;wBAC5D,CAAC;wBAAC,OAAO,QAAQ,EAAE,CAAC;4BAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iBAAiB,IAAI,CAAC,QAAQ,gCAAiC,QAAkB,CAAC,OAAO,IAAI,CAC9F,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,MAAM,EAAE,CAAC;oBAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iBAAiB,IAAI,CAAC,QAAQ,6BAA8B,MAAgB,CAAC,OAAO,IAAI,CACzF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAA4B,CAAC;YAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,wDAAwD;gBACxD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,MAAM,IAAI,KAAK,CACb,uDAAuD,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,SAAS,CACP,aAA6B,EAC7B,UAAkB;QAElB,IAAI,aAAa,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,4CAA4C,aAAa,CAAC,OAAO,kBAAkB,CACpF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC;QAC1B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,KAAK,MAAM,GAAG,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC;YACrC,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBACjC,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM,OAAO,GAAG,wBAAwB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;gBAC7D,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACxC,UAAU,IAAI,CAAC,CAAC;oBAChB,8DAA8D;oBAC9D,6DAA6D;oBAC7D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;oBAC7C,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC7C,QAAQ,IAAI,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IAED;;;OAGG;IACH,IAAI;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACnC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QAClD,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,eAAe;QACb,iEAAiE;QACjE,qEAAqE;QACrE,2CAA2C;QAC3C,MAAM,QAAQ,GAAmB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,UAAU,EAAE;gBACV,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;gBACvB,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB;SACF,CAAC,CAAC,CAAC;QAEJ,OAAO,kBAAkB,CACvB;YACE,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,OAAO;YAChB,cAAc,EAAE,sCAAsC;SACvD,EACD,QAAQ,CACT,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,SAAS,wBAAwB,CAC/B,MAAmB,EACnB,UAAmB;IAEnB,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC;IACpD,MAAM,GAAG,GAAG,GAAG,EAAE,gBAAgB,EAAE,GAAG,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,CAAC;IAC3B,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAE7F,MAAM,kBAAkB,GACtB,UAAU;QACV,CAAC,OAAO,MAAM,CAAC,UAAU,EAAE,UAAU,KAAK,QAAQ;YAChD,CAAC,CAAE,MAAM,CAAC,UAAU,CAAC,UAAqB;YAC1C,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,MAAM,KAAK,GAAe,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC;IACpD,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;IAErF,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QAC5B,QAAQ,EAAE;YACR,GAAG;YACH,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E;QACD,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,QAAQ;QACR,UAAU,EAAE,kBAAkB;KAC/B,CAAC;AACJ,CAAC"}

package/dist/sarif/sarif-validator.d.ts

@@ -0,0 +1,45 @@
+/**
+ * AJV-backed minimal SARIF 2.1.0 document validator.
+ *
+ * F-A05-01: the `ingest_sarif` MCP tool accepts a caller-supplied
+ * `sarifDocument` object and, before this module existed, only
+ * checked `version === "2.1.0"`. That was enough for tool-call
+ * dispatch but not for the payload itself — a SARIF with a missing
+ * `runs[]`, a `results` array of wrong-type entries, or a result
+ * without a `ruleId` would still be accepted by the MCP tool and
+ * flow through to the store, the dashboard, and any downstream
+ * consumer that uploads claude-crap's SARIF to GitHub code-scanning
+ * or an IDE viewer.
+ *
+ * This module uses the `ajv` dependency (already in package.json) to
+ * compile a minimal JSON Schema that covers exactly the fields
+ * claude-crap reads: `version`, `runs`, `runs[].tool.driver.name`,
+ * and the per-result shape. Everything else (tool metadata, rule
+ * definitions, snippets, etc.) is passthrough — we do not enforce
+ * the full SARIF 2.1.0 spec because claude-crap does not consume
+ * those fields.
+ *
+ * The compiled validator is cached so the ~5 ms AJV compile cost is
+ * paid once per MCP server process, not once per ingestion.
+ *
+ * @module sarif/sarif-validator
+ */
+/**
+ * Returned by {@link validateSarifDocument} when the document fails
+ * schema validation. Includes the full AJV error array for callers
+ * that want to surface structured diagnostics.
+ */
+export declare class SarifValidationError extends Error {
+    readonly errors: unknown;
+    constructor(message: string, errors: unknown);
+}
+/**
+ * Validate a SARIF 2.1.0 document against the minimal schema. Throws
+ * {@link SarifValidationError} when the document does not match.
+ *
+ * @param doc Document to validate. May be any value — the validator
+ *            treats non-object inputs as a schema violation.
+ * @throws    {@link SarifValidationError} on any validation failure.
+ */
+export declare function validateSarifDocument(doc: unknown): void;
+//# sourceMappingURL=sarif-validator.d.ts.map

package/dist/sarif/sarif-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif-validator.d.ts","sourceRoot":"","sources":["../../src/sarif/sarif-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAsEH;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,SAAgB,MAAM,EAAE,OAAO,CAAC;gBAEpB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;CAK7C;AAkBD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAUxD"}