codictator 0.0.0 → 0.1.3

package/dist/features/packs/enforcers/external-check.js

@@ -0,0 +1,131 @@
+// SPEC §4.4.5 check runner: probe, input collection, batched runs, output
+// parsing, same-pack rule mapping and tool events. Parse failures, timeouts
+// and unlisted codes fail closed; findings carry the pack rule id and never
+// quote tool output (§9.2) — the parsed finding message is the verdict
+// payload the section designs, not an error leak.
+import { err, ok, stableStringify, } from "../../../kernel/index.js";
+import { field } from "../manifest.js";
+import { bindRule, findingFor } from "./binding.js";
+import { closedFinding, detailVars, runBatch, } from "./external-attribute.js";
+import { narrowExternalArgs } from "./external-bind.js";
+import { probeToolVersion } from "./external-probe.js";
+import { executeBatch, planRuns } from "./external-runs.js";
+const OUT_BASE = ".codictator-tool-out";
+async function collectInput(ports, input, ctx) {
+    const sorted = [...ctx.scope.files].sort();
+    if (input === "staged") {
+        const staged = await ports.git.stagedFiles();
+        if (!staged.ok) {
+            return err(staged.error);
+        }
+        return ok({ files: [...staged.value].sort(), stdin: undefined });
+    }
+    if (input === "stdin-json") {
+        const payload = ctx.scope.sessionId === undefined
+            ? { files: sorted }
+            : { files: sorted, sessionId: ctx.scope.sessionId };
+        return ok({ files: [], stdin: stableStringify(payload) });
+    }
+    if (input === "diff") {
+        return err({
+            code: "CDX-E903",
+            message: "diff input needs base and head revisions the pack does not declare",
+            remediation: "Bind the diff range in the pack, then reload.",
+        });
+    }
+    return ok({ files: sorted, stdin: undefined });
+}
+function buildEnv(ports, tool) {
+    const env = {};
+    for (const name of tool.envPass) {
+        const value = ports.env.get(name);
+        if (value !== undefined) {
+            env[name] = value;
+        }
+    }
+    return env;
+}
+async function runCheck(ports, binding, resolved, probeCache, outSeq, ctx) {
+    const probed = await probeToolVersion(ports, resolved.tool, probeCache);
+    if (!probed.ok) {
+        return [
+            closedFinding(binding, resolved.tool.id, probed.error.code, `failed its version probe: ${probed.error.message}`),
+        ];
+    }
+    const collected = await collectInput(ports, resolved.args.input, ctx);
+    if (!collected.ok) {
+        return [
+            findingFor(binding, {
+                code: collected.error.code,
+                message: `the guard could not collect its input; the code was not judged`,
+                vars: detailVars(resolved.tool.id),
+            }),
+        ];
+    }
+    const outBase = `${OUT_BASE}-${String(outSeq.next)}`;
+    outSeq.next += 1;
+    const runs = planRuns(resolved.tool, resolved.args.input, collected.value.files, collected.value.stdin, outBase);
+    const env = buildEnv(ports, resolved.tool);
+    const findings = [];
+    for (const run of runs) {
+        const outcome = await executeBatch(ports, {
+            argv: run.argv,
+            stdin: run.stdin,
+            outPath: run.outPath,
+            timeoutMs: resolved.timeoutMs,
+            env,
+        });
+        const batch = runBatch(binding, resolved, probed.value, run.argv, outcome);
+        findings.push(...batch.findings);
+        if (resolved.onToolEvent !== undefined) {
+            resolved.onToolEvent(batch.event);
+        }
+    }
+    return findings.sort((a, b) => {
+        const pathA = a.path ?? "";
+        const pathB = b.path ?? "";
+        if (pathA !== pathB) {
+            return pathA < pathB ? -1 : 1;
+        }
+        const lineA = a.line ?? 0;
+        const lineB = b.line ?? 0;
+        if (lineA !== lineB) {
+            return lineA - lineB;
+        }
+        if (a.message === b.message) {
+            return 0;
+        }
+        return a.message < b.message ? -1 : 1;
+    });
+}
+// SPEC §4.4.3 step 4: one enforcer per referencing rule. The instance keeps
+// only the tool findings mapped to its own rule id (the "*" wildcard maps
+// every tool finding to it); its siblings keep theirs.
+export function resolveExternal(decl, rule, ports, tool, options = {}) {
+    const binding = bindRule(rule);
+    const args = narrowExternalArgs(decl.id, decl.args);
+    if (!args.ok) {
+        return err(args.error);
+    }
+    const ruleMap = decl.ruleMap ?? {};
+    const specificRules = Object.keys(ruleMap)
+        .filter((toolRule) => ruleMap[toolRule] === rule.id)
+        .sort();
+    const wildcard = field(ruleMap, "*") === rule.id;
+    const probeCache = new Map();
+    const outSeq = { next: 0 };
+    const resolved = {
+        tool,
+        args: args.value,
+        specificRules,
+        wildcard,
+        timeoutMs: args.value.timeoutMs ?? tool.timeoutMs,
+        onToolEvent: options.onToolEvent,
+    };
+    return ok({
+        id: rule.id,
+        kinds: binding.triggers,
+        budgetMs: decl.budgetMs,
+        check: (ctx) => runCheck(ports, binding, resolved, probeCache, outSeq, ctx),
+    });
+}

package/dist/features/packs/enforcers/external-output.d.ts

@@ -0,0 +1,30 @@
+import { type Result } from "../../../kernel/index.ts";
+export type OutputFormat = "sarif" | "json" | "regex" | "exit-code";
+export interface JsonSelect {
+    readonly results: string;
+    readonly path: string;
+    readonly line: string;
+    readonly rule: string;
+    readonly message: string;
+}
+export interface ParsedToolFinding {
+    readonly toolRule: string;
+    readonly path: string | undefined;
+    readonly line: number | undefined;
+    readonly message: string;
+}
+export interface ParsedToolOutput {
+    readonly findings: ReadonlyArray<ParsedToolFinding>;
+    readonly escapes: number;
+}
+export declare function parseError(detail: string): Result<never>;
+export declare function pushEntry(out: Array<ParsedToolFinding>, escapes: {
+    count: number;
+}, entry: {
+    toolRule: string;
+    path: unknown;
+    line: unknown;
+    message: unknown;
+}): void;
+export declare function parseJsonOutput(text: string, select: JsonSelect): Result<ParsedToolOutput>;
+export declare function parseRegexOutput(text: string, pattern: RegExp): Result<ParsedToolOutput>;

package/dist/features/packs/enforcers/external-output.js

@@ -0,0 +1,144 @@
+// SPEC §4.4.5 output parsers: sarif, json (dotted select), regex (named
+// groups) and exit-code. Tool output is untrusted: an absolute path or a
+// `..` segment never becomes a finding (dropped, counted as an escape),
+// and every shape violation fails the batch closed (CDX-E207).
+import { err, makeError, ok, parseJson, } from "../../../kernel/index.js";
+import { field, isRecord } from "../manifest.js";
+export function parseError(detail) {
+    return err(makeError("CDX-E207", `external tool output is unusable: ${detail}`, "Fix the tool output format or the pack output binding, then retry."));
+}
+function getPath(value, dotted) {
+    let current = value;
+    for (const segment of dotted.split(".")) {
+        if (Array.isArray(current)) {
+            const index = Number(segment);
+            if (!Number.isInteger(index) || index < 0) {
+                return undefined;
+            }
+            const next = current[index];
+            current = next;
+        }
+        else if (isRecord(current)) {
+            current = current[segment];
+        }
+        else {
+            return undefined;
+        }
+        if (current === undefined) {
+            return undefined;
+        }
+    }
+    return current;
+}
+function cleanPath(raw) {
+    if (typeof raw !== "string" || raw.length === 0) {
+        return undefined;
+    }
+    const slashed = raw.replace(/\\/g, "/");
+    const path = slashed.startsWith("file://")
+        ? slashed.slice("file://".length)
+        : slashed;
+    if (path.startsWith("/") ||
+        /^[A-Za-z]:/.test(path) ||
+        path.startsWith("\\\\")) {
+        return "escape";
+    }
+    for (const segment of path.split("/")) {
+        if (segment === "..") {
+            return "escape";
+        }
+    }
+    return path;
+}
+function cleanLine(raw) {
+    if (typeof raw === "number" && Number.isInteger(raw) && raw >= 1) {
+        return raw;
+    }
+    if (typeof raw === "string" && raw !== "") {
+        const parsed = Number(raw);
+        if (Number.isInteger(parsed) && parsed >= 1) {
+            return parsed;
+        }
+    }
+    return undefined;
+}
+function cleanMessage(raw, toolRule) {
+    if (typeof raw === "string" && raw.length > 0) {
+        return raw;
+    }
+    return `tool rule ${toolRule} reported a finding`;
+}
+export function pushEntry(out, escapes, entry) {
+    if (typeof entry.toolRule !== "string" || entry.toolRule.length === 0) {
+        return;
+    }
+    const path = cleanPath(entry.path);
+    if (path === "escape") {
+        escapes.count += 1;
+        return;
+    }
+    out.push({
+        toolRule: entry.toolRule,
+        path,
+        line: cleanLine(entry.line),
+        message: cleanMessage(entry.message, entry.toolRule),
+    });
+}
+// SPEC §4.4.5: json with a dotted-path select for results, path, line,
+// rule and message. A non-array results node fails the batch (CDX-E207).
+export function parseJsonOutput(text, select) {
+    const parsed = parseJson(text);
+    if (!parsed.ok) {
+        return parseError("json output is not JSON");
+    }
+    const results = getPath(parsed.value, select.results);
+    if (!Array.isArray(results)) {
+        return parseError("json output has no results array at select.results");
+    }
+    const findings = [];
+    const escapes = { count: 0 };
+    for (const entry of results) {
+        if (!isRecord(entry)) {
+            continue;
+        }
+        const toolRule = getPath(entry, select.rule);
+        if (typeof toolRule !== "string" || toolRule.length === 0) {
+            continue;
+        }
+        pushEntry(findings, escapes, {
+            toolRule,
+            path: getPath(entry, select.path),
+            line: getPath(entry, select.line),
+            message: getPath(entry, select.message),
+        });
+    }
+    return ok({ findings, escapes: escapes.count });
+}
+// SPEC §4.4.5: regex with named groups path, line, rule, message, applied
+// per output line. A findings-coded run that parses to zero entries is an
+// unparseable-tool-output failure (CDX-E207), decided by the caller.
+export function parseRegexOutput(text, pattern) {
+    const findings = [];
+    const escapes = { count: 0 };
+    for (const content of text.split("\n")) {
+        if (content === "") {
+            continue;
+        }
+        const matched = pattern.exec(content);
+        const groups = matched?.groups;
+        if (groups === undefined) {
+            continue;
+        }
+        const toolRule = field(groups, "rule");
+        if (typeof toolRule !== "string" || toolRule.length === 0) {
+            continue;
+        }
+        pushEntry(findings, escapes, {
+            toolRule,
+            path: field(groups, "path"),
+            line: field(groups, "line"),
+            message: field(groups, "message"),
+        });
+    }
+    return ok({ findings, escapes: escapes.count });
+}

package/dist/features/packs/enforcers/external-probe.d.ts

@@ -0,0 +1,4 @@
+import type { Ports } from "../../../kernel/index.ts";
+import { type Result } from "../../../kernel/index.ts";
+import type { ToolDecl } from "./external.ts";
+export declare function probeToolVersion(ports: Ports, tool: ToolDecl, cache: Map<string, string>): Promise<Result<string>>;

package/dist/features/packs/enforcers/external-probe.js

@@ -0,0 +1,65 @@
+// SPEC §4.4.5 version probe: the probe runs once per tool per enforcer
+// lifetime (the session cache); its output must match the pattern, and a
+// capture group must equal the pin. Anything else is CDX-E208 and blocks.
+// A probe that never starts is CDX-E209. The Fs port exposes no mtime, so
+// the key is the tool id rather than path plus mtime.
+import { checkPattern, err, makeError, ok, } from "../../../kernel/index.js";
+import { field, isRecord } from "../manifest.js";
+import { executeBatch } from "./external-runs.js";
+function probeError(code, detail) {
+    return err(makeError(code, detail, "Fix the external tool or its version binding, then retry the hook."));
+}
+export async function probeToolVersion(ports, tool, cache) {
+    const cached = cache.get(tool.id);
+    if (cached !== undefined) {
+        return ok(cached);
+    }
+    const probed = await executeBatch(ports, {
+        argv: [...tool.version.probe],
+        stdin: undefined,
+        outPath: undefined,
+        timeoutMs: tool.timeoutMs,
+        env: {},
+    });
+    if (!probed.ok) {
+        if (probed.error.code === "CDX-E209") {
+            return err(probed.error);
+        }
+        return probeError("CDX-E207", `external tool "${tool.id}" probe failed`);
+    }
+    if (probed.timedOut) {
+        return probeError("CDX-E902", `external tool "${tool.id}" probe timed out`);
+    }
+    if (probed.truncated || probed.code !== 0) {
+        return probeError("CDX-E207", `external tool "${tool.id}" probe failed`);
+    }
+    const safe = checkPattern(tool.version.pattern);
+    if (!safe.ok) {
+        return err(safe.error);
+    }
+    let matched;
+    try {
+        matched = new RegExp(tool.version.pattern).exec(probed.text);
+    }
+    catch {
+        return probeError("CDX-E203", `tool "${tool.id}" carries a bad version pattern`);
+    }
+    if (matched === null) {
+        return probeError("CDX-E208", `external tool "${tool.id}" version output matches nothing pinned`);
+    }
+    const groups = matched.groups;
+    const named = isRecord(groups)
+        ? field(groups, "version")
+        : undefined;
+    const captured = matched[1];
+    const reported = typeof named === "string"
+        ? named
+        : typeof captured === "string"
+            ? captured
+            : tool.version.pin;
+    if (reported !== tool.version.pin) {
+        return probeError("CDX-E208", `external tool "${tool.id}" reports ${reported}, pinned ${tool.version.pin}`);
+    }
+    cache.set(tool.id, reported);
+    return ok(reported);
+}

package/dist/features/packs/enforcers/external-runs.d.ts

@@ -0,0 +1,33 @@
+import type { CdxError, Ports } from "../../../kernel/index.ts";
+import type { ExternalInput, ToolDecl } from "./external.ts";
+export declare const COMMAND_LINE_LIMIT = 24576;
+export declare const OUTPUT_CAP_BYTES: number;
+export declare function safePath(path: string): string;
+export declare function commandLength(argv: ReadonlyArray<string>): number;
+export declare function expandTemplate(template: ReadonlyArray<string>, files: ReadonlyArray<string>, single: string | undefined, outPath: string): Array<string>;
+export declare function batchFiles(fixedLength: number, files: ReadonlyArray<string>): Array<Array<string>>;
+export interface BatchRun {
+    readonly argv: ReadonlyArray<string>;
+    readonly stdin: string | undefined;
+    readonly outPath: string | undefined;
+}
+export declare function planRuns(tool: ToolDecl, input: ExternalInput, files: ReadonlyArray<string>, stdin: string | undefined, outBase: string): Array<BatchRun>;
+export interface BatchRequest {
+    readonly argv: ReadonlyArray<string>;
+    readonly stdin: string | undefined;
+    readonly outPath: string | undefined;
+    readonly timeoutMs: number;
+    readonly env: Readonly<Record<string, string>>;
+}
+export type BatchOutcome = {
+    readonly ok: true;
+    readonly code: number;
+    readonly timedOut: boolean;
+    readonly truncated: boolean;
+    readonly text: string;
+} | {
+    readonly ok: false;
+    readonly error: CdxError;
+};
+export declare function executeBatch(ports: Ports, request: BatchRequest): Promise<BatchOutcome>;
+export declare function digestArgv(argv: ReadonlyArray<string>): string;

package/dist/features/packs/enforcers/external-runs.js

@@ -0,0 +1,162 @@
+// SPEC §4.4.5 execution and safety: argv expansion, 24 KB batching,
+// dash-prefixing, the version probe and batch execution. Parsing lives in
+// external-output.ts; orchestration lives in external.ts.
+import { makeError, sha256Text, stableStringify, } from "../../../kernel/index.js";
+export const COMMAND_LINE_LIMIT = 24576;
+export const OUTPUT_CAP_BYTES = 16 * 1024 * 1024;
+// SPEC §4.4.5: a path starting with `-` is passed as `./-…` so it never
+// parses as a flag; every placeholder expands to separate argv entries.
+export function safePath(path) {
+    return path.startsWith("-") ? `./${path}` : path;
+}
+export function commandLength(argv) {
+    return argv.reduce((total, entry) => total + entry.length + 1, 0);
+}
+export function expandTemplate(template, files, single, outPath) {
+    const expanded = [];
+    for (const entry of template) {
+        if (entry === "{files}" || entry === "{staged}") {
+            for (const file of files) {
+                expanded.push(safePath(file));
+            }
+        }
+        else if (entry === "{file}") {
+            if (single !== undefined) {
+                expanded.push(safePath(single));
+            }
+        }
+        else if (entry === "{root}") {
+            expanded.push(".");
+        }
+        else if (entry === "{out}") {
+            expanded.push(outPath);
+        }
+        else {
+            expanded.push(entry);
+        }
+    }
+    return expanded;
+}
+// SPEC §4.4.8 EC-10: {files}/{staged} expansions batch so no command line
+// exceeds 24 KB; results merge. A single path longer than the budget still
+// runs alone rather than being split.
+export function batchFiles(fixedLength, files) {
+    const batches = [];
+    let current = [];
+    let length = fixedLength;
+    for (const file of files) {
+        const entry = commandLength([safePath(file)]);
+        if (current.length > 0 && length + entry > COMMAND_LINE_LIMIT) {
+            batches.push(current);
+            current = [];
+            length = fixedLength;
+        }
+        current.push(file);
+        length += entry;
+    }
+    if (current.length > 0) {
+        batches.push(current);
+    }
+    return batches;
+}
+export function planRuns(tool, input, files, stdin, outBase) {
+    const template = tool.command;
+    const hasOut = template.includes("{out}");
+    const outName = (index) => `${outBase}-${String(index)}.json`;
+    if (input === "file") {
+        return files.map((file, index) => ({
+            argv: expandTemplate(template, [], file, outName(index)),
+            stdin: undefined,
+            outPath: hasOut ? outName(index) : undefined,
+        }));
+    }
+    const filesPlaceholder = input === "staged" ? "{staged}" : input === "files" ? "{files}" : undefined;
+    if (filesPlaceholder === undefined) {
+        return [
+            {
+                argv: expandTemplate(template, [], undefined, outName(0)),
+                stdin,
+                outPath: hasOut ? outName(0) : undefined,
+            },
+        ];
+    }
+    const fixed = expandTemplate(template, [], undefined, outName(0));
+    const batches = batchFiles(commandLength(fixed), files);
+    if (batches.length === 0) {
+        return [{ argv: fixed, stdin, outPath: undefined }];
+    }
+    return batches.map((batch, index) => ({
+        argv: expandTemplate(template, batch, undefined, outName(index)),
+        stdin,
+        outPath: hasOut ? outName(index) : undefined,
+    }));
+}
+function outcomeError(detail) {
+    const error = makeError("CDX-E207", detail, "Fix the external tool or its binding, then retry the hook.");
+    return { ok: false, error };
+}
+// SPEC §4.4.5: output comes from stdout or the {out} temp file the tool
+// wrote; the file is deleted after reading. A spawn failure is E209;
+// timeout, truncation and code flow to the caller for E902/E207 mapping.
+export async function executeBatch(ports, request) {
+    let result;
+    try {
+        const baseOptions = {
+            cwd: ".",
+            env: request.env,
+            timeoutMs: request.timeoutMs,
+            maxOutputBytes: OUTPUT_CAP_BYTES,
+        };
+        result =
+            request.stdin === undefined
+                ? await ports.proc.run(request.argv, baseOptions)
+                : await ports.proc.run(request.argv, {
+                    ...baseOptions,
+                    stdin: request.stdin,
+                });
+    }
+    catch {
+        const error = makeError("CDX-E209", "the external tool could not start", "Install the tool the pack binds, then retry the hook.");
+        return { ok: false, error };
+    }
+    if (result.timedOut || result.truncated) {
+        return {
+            ok: true,
+            code: result.code,
+            timedOut: result.timedOut,
+            truncated: result.truncated,
+            text: "",
+        };
+    }
+    // SPEC §4.4.5: the spawn-failure convention (NodeProc finishes -1 when
+    // the executable never starts) means the tool is not installed; the
+    // caller maps it to CDX-E209. A timeout resolve first, above.
+    if (result.code === -1) {
+        const error = makeError("CDX-E209", "the external tool could not start", "Install the tool the pack binds, then retry the hook.");
+        return { ok: false, error };
+    }
+    if (request.outPath === undefined) {
+        return {
+            ok: true,
+            code: result.code,
+            timedOut: false,
+            truncated: false,
+            text: result.stdout,
+        };
+    }
+    const loaded = await ports.fs.readText(request.outPath);
+    await ports.fs.remove(request.outPath);
+    if (!loaded.ok) {
+        return outcomeError("the tool output file is unreadable");
+    }
+    return {
+        ok: true,
+        code: result.code,
+        timedOut: false,
+        truncated: false,
+        text: loaded.value,
+    };
+}
+export function digestArgv(argv) {
+    return sha256Text(stableStringify([...argv]));
+}

package/dist/features/packs/enforcers/external-sarif.d.ts

@@ -0,0 +1,3 @@
+import { type Result } from "../../../kernel/index.ts";
+import { type ParsedToolOutput } from "./external-output.ts";
+export declare function parseSarif(text: string): Result<ParsedToolOutput>;

package/dist/features/packs/enforcers/external-sarif.js

@@ -0,0 +1,109 @@
+// SPEC §4.4.5 sarif (2.1.0) output. Every result needs a rule id; entries
+// the pack cannot attribute are dropped, escapes counted for EC-9.
+import { ok, parseJson } from "../../../kernel/index.js";
+import { field, isRecord } from "../manifest.js";
+import { parseError, pushEntry, } from "./external-output.js";
+function sarifRuleId(result, run) {
+    const direct = field(result, "ruleId");
+    if (typeof direct === "string" && direct.length > 0) {
+        return direct;
+    }
+    const tool = field(run, "tool");
+    if (!isRecord(tool)) {
+        return undefined;
+    }
+    const driver = field(tool, "driver");
+    if (!isRecord(driver)) {
+        return undefined;
+    }
+    const rules = field(driver, "rules");
+    const index = field(result, "ruleIndex");
+    if (!Array.isArray(rules) || typeof index !== "number") {
+        return undefined;
+    }
+    const rule = rules[index];
+    if (!isRecord(rule)) {
+        return undefined;
+    }
+    const id = field(rule, "id");
+    return typeof id === "string" && id.length > 0 ? id : undefined;
+}
+function sarifLocation(result) {
+    const locations = field(result, "locations");
+    if (!Array.isArray(locations)) {
+        return { path: undefined, line: undefined };
+    }
+    const first = locations[0];
+    if (!isRecord(first)) {
+        return { path: undefined, line: undefined };
+    }
+    const physical = field(first, "physicalLocation");
+    if (!isRecord(physical)) {
+        return { path: undefined, line: undefined };
+    }
+    const artifact = field(physical, "artifactLocation");
+    let uri;
+    if (isRecord(artifact)) {
+        const raw = field(artifact, "uri");
+        if (typeof raw === "string" && raw.length > 0) {
+            uri = raw;
+        }
+    }
+    const region = field(physical, "region");
+    let line;
+    if (isRecord(region)) {
+        const raw = field(region, "startLine");
+        if (typeof raw === "number" && Number.isInteger(raw) && raw >= 1) {
+            line = raw;
+        }
+    }
+    return { path: uri, line };
+}
+function collectSarifEntry(entry, run, findings, escapes) {
+    if (!isRecord(entry)) {
+        return;
+    }
+    const toolRule = sarifRuleId(entry, run);
+    if (toolRule === undefined) {
+        return;
+    }
+    const location = sarifLocation(entry);
+    const detail = field(entry, "message");
+    pushEntry(findings, escapes, {
+        toolRule,
+        path: location.path,
+        line: location.line,
+        message: isRecord(detail) ? field(detail, "text") : undefined,
+    });
+}
+function collectSarifRun(run, findings, escapes) {
+    if (!isRecord(run)) {
+        return;
+    }
+    const results = field(run, "results");
+    if (!Array.isArray(results)) {
+        return;
+    }
+    for (const entry of results) {
+        collectSarifEntry(entry, run, findings, escapes);
+    }
+}
+export function parseSarif(text) {
+    const parsed = parseJson(text);
+    if (!parsed.ok) {
+        return parseError("sarif output is not JSON");
+    }
+    if (!isRecord(parsed.value)) {
+        return parseError("sarif output is not an object");
+    }
+    const runs = field(parsed.value, "runs");
+    if (!Array.isArray(runs)) {
+        return parseError("sarif output has no runs array");
+    }
+    const findings = [];
+    const escapes = { count: 0 };
+    for (const run of runs) {
+        collectSarifRun(run, findings, escapes);
+    }
+    return ok({ findings, escapes: escapes.count });
+}