coverme-scanner 1.3.3 → 1.4.1

package/dist/prompts/orchestration.md

@@ -6,9 +6,24 @@ Execute this 22-agent security scan with cross-validation.
 
 ---
 
-## PHASE 0: PROJECT DISCOVERY & RUNTIME CHECK
+## PHASE 0: PROJECT DISCOVERY & STATISTICS
 
-Before scanning, understand what you're scanning:
+Before scanning, understand what you're scanning and gather statistics:
+
+### Step 1: Gather Project Statistics
+
+```bash
+# Count files and lines of code
+find . -type f \( -name "*.ts" -o -name "*.js" -o -name "*.tsx" -o -name "*.jsx" -o -name "*.py" -o -name "*.go" -o -name "*.java" -o -name "*.rb" -o -name "*.php" -o -name "*.cs" -o -name "*.swift" -o -name "*.kt" \) -not -path "*/node_modules/*" -not -path "*/.git/*" -not -path "*/dist/*" -not -path "*/build/*" -not -path "*/__pycache__/*" | wc -l
+
+# Count lines of code (approximate)
+find . -type f \( -name "*.ts" -o -name "*.js" -o -name "*.tsx" -o -name "*.jsx" -o -name "*.py" -o -name "*.go" \) -not -path "*/node_modules/*" -not -path "*/.git/*" -not -path "*/dist/*" 2>/dev/null | head -100 | xargs wc -l 2>/dev/null | tail -1
+
+# Generate project tree (max 3 levels deep, exclude node_modules etc)
+find . -maxdepth 3 -type d -not -path "*/node_modules/*" -not -path "*/.git/*" -not -path "*/dist/*" -not -path "*/__pycache__/*" | head -30 | sort
+```
+
+### Step 2: Read Project Info
 
 ```bash
 cat package.json 2>/dev/null | head -30
@@ -17,10 +32,15 @@ ls -la
 ls src/ 2>/dev/null || ls app/ 2>/dev/null || ls lib/ 2>/dev/null
 ```
 
-Create a **Project Overview** to include in the report:
+### Step 3: Create Project Overview
+
+Include these statistics in the final report:
 
 ```json
 {
+  "filesScanned": 45,
+  "linesOfCode": 4850,
+  "projectTree": "project-name/\n├── src/\n│   ├── api/\n│   ├── services/\n│   └── utils/\n├── tests/\n└── package.json",
   "projectOverview": {
     "name": "project-name",
     "type": "Backend API | Frontend SPA | Full-stack | CLI | Library | Microservice",
@@ -32,6 +52,11 @@ Create a **Project Overview** to include in the report:
 }
 ```
 
+**IMPORTANT**:
+- `filesScanned` - Count of source code files analyzed (not node_modules/dist)
+- `linesOfCode` - Total lines in source files (approximate is fine)
+- `projectTree` - ASCII tree representation of main directories (use tree format with ├── and └──)
+
 This context helps readers understand the security findings in context.
 
 ### Step 3: Check for Runtime Verification (SSH)
@@ -1594,6 +1619,9 @@ The final report should ONLY contain findings that are:
 {
   "projectName": "project-name",
   "scanDate": "{{SCAN_DATE}}",
+  "filesScanned": 45,
+  "linesOfCode": 4850,
+  "projectTree": "project-name/\n├── src/\n│   ├── api/\n│   ├── services/\n│   └── utils/\n├── tests/\n└── package.json",
 
   "projectOverview": {
     "name": "project-name",
@@ -1630,6 +1658,187 @@ The final report should ONLY contain findings that are:
     }
   },
 
+  "architectureOverview": {
+    "components": [
+      {
+        "name": "API Server",
+        "type": "service",
+        "description": "Express.js REST API handling all client requests",
+        "trustLevel": "semi-trusted"
+      },
+      {
+        "name": "PostgreSQL",
+        "type": "database",
+        "description": "Primary data store for user and application data",
+        "trustLevel": "trusted"
+      },
+      {
+        "name": "Redis",
+        "type": "cache",
+        "description": "Session storage and rate limiting",
+        "trustLevel": "trusted"
+      },
+      {
+        "name": "External Payment API",
+        "type": "external",
+        "description": "Third-party payment processor",
+        "trustLevel": "untrusted"
+      }
+    ],
+    "trustBoundaries": [
+      {
+        "name": "Client to API",
+        "from": "Browser/Mobile",
+        "to": "API Server",
+        "protocol": "HTTPS"
+      },
+      {
+        "name": "API to Database",
+        "from": "API Server",
+        "to": "PostgreSQL",
+        "protocol": "TLS"
+      }
+    ],
+    "criticalAssets": [
+      {
+        "name": "User Credentials",
+        "type": "credential",
+        "location": "PostgreSQL users table",
+        "protection": "bcrypt hashed"
+      },
+      {
+        "name": "API Keys",
+        "type": "key",
+        "location": "Environment variables",
+        "protection": "Encrypted at rest"
+      },
+      {
+        "name": "Session Tokens",
+        "type": "token",
+        "location": "Redis",
+        "protection": "HMAC signed"
+      }
+    ],
+    "dataFlows": [
+      "User Authentication Flow",
+      "Payment Processing Flow",
+      "Data Export Flow"
+    ]
+  },
+
+  "threatModel": [
+    {
+      "id": "T-001",
+      "threat": "SQL Injection via user input",
+      "category": "STRIDE",
+      "strideType": "T",
+      "status": "open",
+      "relatedFindings": ["SEC-001", "DB-002"],
+      "mitigation": "Use parameterized queries",
+      "dreadScore": 8.5
+    },
+    {
+      "id": "T-002",
+      "threat": "Session hijacking via XSS",
+      "category": "STRIDE",
+      "strideType": "S",
+      "status": "partial",
+      "relatedFindings": ["SEC-003"],
+      "mitigation": "CSP headers implemented but not comprehensive",
+      "dreadScore": 7.2
+    },
+    {
+      "id": "T-003",
+      "threat": "Unauthorized data access",
+      "category": "LINDDUN",
+      "status": "mitigated",
+      "relatedFindings": [],
+      "mitigation": "Row-level security implemented",
+      "dreadScore": 3.0
+    }
+  ],
+
+  "qualityReview": {
+    "deleteItems": [
+      {
+        "type": "delete",
+        "file": "src/utils/oldHelpers.ts",
+        "lines": 250,
+        "description": "Entire file is dead code - functions never called",
+        "reason": "No imports found in codebase"
+      },
+      {
+        "type": "delete",
+        "file": "src/legacy/auth.js",
+        "lines": 180,
+        "description": "Legacy auth implementation replaced by Clerk",
+        "reason": "Migration completed 6 months ago"
+      }
+    ],
+    "mergeItems": [
+      {
+        "type": "merge",
+        "file": "src/utils/validate.ts, src/helpers/validation.ts",
+        "description": "Two files with overlapping validation functions",
+        "reason": "DRY violation - consolidate into single module"
+      }
+    ],
+    "simplifyItems": [
+      {
+        "type": "simplify",
+        "file": "src/services/payment.ts",
+        "lines": 450,
+        "description": "Overly complex payment flow with excessive error handling",
+        "reason": "Can be reduced to ~200 lines with proper abstraction"
+      }
+    ],
+    "totalLinesRemovable": 680,
+    "percentageOfCodebase": 4.2
+  },
+
+  "actionItems": [
+    {
+      "id": "A-001",
+      "title": "Fix SQL injection in user search",
+      "priority": "immediate",
+      "relatedFindings": ["SEC-001"],
+      "effort": "low",
+      "description": "Replace string concatenation with parameterized query"
+    },
+    {
+      "id": "A-002",
+      "title": "Implement rate limiting on auth endpoints",
+      "priority": "immediate",
+      "relatedFindings": ["AUTH-003"],
+      "effort": "medium",
+      "description": "Add Redis-based rate limiter to /login and /register"
+    },
+    {
+      "id": "A-003",
+      "title": "Add CSP headers",
+      "priority": "high",
+      "relatedFindings": ["SEC-005"],
+      "effort": "low",
+      "description": "Configure helmet with strict CSP policy"
+    },
+    {
+      "id": "A-004",
+      "title": "Clean up dead code",
+      "priority": "medium",
+      "relatedFindings": ["DEAD-001", "DEAD-002"],
+      "effort": "medium",
+      "description": "Remove 680 lines of unused code identified in quality review"
+    },
+    {
+      "id": "A-005",
+      "title": "Implement audit logging",
+      "priority": "long-term",
+      "relatedFindings": ["DATA-002"],
+      "effort": "high",
+      "description": "Add comprehensive audit trail for sensitive operations"
+    }
+  ],
+
   "summary": {
     "total": 10,
     "critical": 1,
@@ -1638,17 +1847,42 @@ The final report should ONLY contain findings that are:
     "low": 2,
     "info": 0,
     "mitigatedCount": 5,
-    "falsePositiveCount": 3
+    "falsePositiveCount": 3,
+    "avgConfidence": 0.85
   },
 
   "findings": [
     {
       "id": "SEC-001",
-      "title": "Example finding",
-      "severity": "high",
+      "title": "SQL Injection in User Search",
+      "severity": "critical",
+      "category": "security",
+      "file": "src/routes/users.ts",
+      "line": 45,
+      "code": "db.query(`SELECT * FROM users WHERE name LIKE '%${searchTerm}%'`)",
+      "description": "User search parameter is directly concatenated into SQL query without sanitization",
+      "impact": "Attacker can extract entire database contents, modify data, or execute system commands",
+      "attackChain": [
+        {"step": 1, "action": "Send malicious search term: ' OR '1'='1' --", "result": "Query returns all users"},
+        {"step": 2, "action": "Use UNION SELECT to extract data from other tables", "result": "Database schema exposed"},
+        {"step": 3, "action": "Extract password hashes and sensitive data", "result": "Full data breach"}
+      ],
+      "recommendation": "Use parameterized queries: db.query('SELECT * FROM users WHERE name LIKE $1', [`%${searchTerm}%`])",
+      "cwe": "CWE-89",
+      "owasp": "A03:2021",
+      "dreadScore": {
+        "damage": 10,
+        "reproducibility": 10,
+        "exploitability": 9,
+        "affectedUsers": 10,
+        "discoverability": 8,
+        "total": 9.4
+      },
+      "status": "open",
+      "crossReferences": ["T-001"],
+      "confidence": 95,
       "fixOwner": "developer",
-      "fixType": "code",
-      "...": "other fields"
+      "fixType": "code"
     }
   ],
 
@@ -1682,8 +1916,22 @@ The final report should ONLY contain findings that are:
   ],
 
   "positiveObservations": [
-    "Good pattern 1",
-    "Good pattern 2"
+    {
+      "title": "Strong Authentication Implementation",
+      "description": "Clerk integration with proper session management, MFA support, and secure cookie settings"
+    },
+    {
+      "title": "Comprehensive Input Validation",
+      "description": "Zod schemas used consistently across API endpoints with proper error handling"
+    },
+    {
+      "title": "Secure Database Access",
+      "description": "Prisma ORM with parameterized queries, preventing SQL injection in core modules"
+    },
+    {
+      "title": "Good Error Handling Patterns",
+      "description": "Errors are caught and logged without exposing internal details to clients"
+    }
   ],
 
   "validationSummary": {

package/dist/report/generator.d.ts

@@ -56,6 +56,30 @@ interface ExecutiveSummaryData {
         architect?: number;
     };
 }
+interface ScanStats {
+    filesScanned: number;
+    linesOfCode: number;
+    agentCount: number;
+    avgConfidence: number;
+}
+interface QualityReviewData {
+    deleteItems: Array<{
+        file: string;
+        lines: number;
+        description: string;
+    }>;
+    mergeItems: Array<{
+        file: string;
+        description: string;
+    }>;
+    simplifyItems: Array<{
+        file: string;
+        description: string;
+    }>;
+    totalLinesRemovable: number;
+    percentageOfCodebase: number;
+    totalItems: number;
+}
 interface ReportData {
     projectName: string;
     scanDate: string;
@@ -97,6 +121,9 @@ interface ReportData {
     architectureOverviewHtml: string;
     threatModelHtml: string;
     actionItemsHtml: string;
+    scanStats?: ScanStats;
+    projectTree?: string;
+    qualityReview?: QualityReviewData;
 }
 export declare function calculateScore(result: ScanResult): {
     grade: string;
@@ -116,5 +143,11 @@ export declare function generateHtmlReport(result: ScanResult, outputPath: strin
     file?: string;
     rejectionReason: string;
 }>): Promise<void>;
+export declare function generateProfessionalPdf(result: ScanResult, outputPath: string, falsePositives?: Array<{
+    id: string;
+    title: string;
+    file?: string;
+    rejectionReason: string;
+}>): Promise<void>;
 export {};
 //# sourceMappingURL=generator.d.ts.map

package/dist/report/generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/report/generator.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAY,MAAM,aAAa,CAAC;AAE1E,UAAU,SAAS;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAED,UAAU,eAAe;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAED,UAAU,SAAS;IACjB,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAED,UAAU,eAAe;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,oBAAoB;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,kBAAkB,CAAC,EAAE,KAAK,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IACH,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,UAAU,UAAU;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;IACrC,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,cAAc,EAAE,gBAAgB,EAAE,CAAC;IACnC,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,gBAAgB,EAAE,eAAe,EAAE,CAAC;IACpC,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7F,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,CAAC,MAAM,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IAEnB,wBAAwB,EAAE,MAAM,CAAC;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;CACzB;AA2BD,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA0BnF;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAkBnE;AA6bD,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,MAAM,CAuB7E;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,MAAM,EAClB,cAAc,GAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAM,GAChG,OAAO,CAAC,IAAI,CAAC,CAoFf;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,MAAM,EAClB,cAAc,GAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAM,GAChG,OAAO,CAAC,IAAI,CAAC,CA8Df"}
+{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/report/generator.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAyC,MAAM,aAAa,CAAC;AAEvG,UAAU,SAAS;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAED,UAAU,eAAe;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAED,UAAU,SAAS;IACjB,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAED,UAAU,eAAe;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,oBAAoB;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,kBAAkB,CAAC,EAAE,KAAK,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IACH,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,UAAU,SAAS;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,iBAAiB;IACzB,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzE,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzD,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,UAAU;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;IACrC,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,cAAc,EAAE,gBAAgB,EAAE,CAAC;IACnC,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,gBAAgB,EAAE,eAAe,EAAE,CAAC;IACpC,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7F,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,CAAC,MAAM,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IAEnB,wBAAwB,EAAE,MAAM,CAAC;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IAExB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,iBAAiB,CAAC;CACnC;AA2BD,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA0BnF;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAkBnE;AA6bD,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,MAAM,CAuB7E;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,MAAM,EAClB,cAAc,GAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAM,GAChG,OAAO,CAAC,IAAI,CAAC,CAoFf;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,MAAM,EAClB,cAAc,GAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAM,GAChG,OAAO,CAAC,IAAI,CAAC,CA+Ff;AAwID,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,MAAM,EAClB,cAAc,GAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAM,GAChG,OAAO,CAAC,IAAI,CAAC,CAgPf"}

package/dist/report/generator.js

@@ -41,6 +41,7 @@ exports.generateExecutiveSummary = generateExecutiveSummary;
 exports.renderTemplate = renderTemplate;
 exports.generatePdfReport = generatePdfReport;
 exports.generateHtmlReport = generateHtmlReport;
+exports.generateProfessionalPdf = generateProfessionalPdf;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const puppeteer_1 = __importDefault(require("puppeteer"));
@@ -616,6 +617,33 @@ async function generateHtmlReport(result, outputPath, falsePositives = []) {
     const typeGroups = createTypeGroups(result.findings);
     const codeGroup = typeGroups.find(g => g.type === 'code');
     const devopsGroup = typeGroups.find(g => g.type === 'devops');
+    // Prepare scan statistics
+    const scanStats = (result.filesScanned || result.linesOfCode) ? {
+        filesScanned: result.filesScanned || 0,
+        linesOfCode: result.linesOfCode || 0,
+        agentCount: result.agentsUsed?.length || 0,
+        avgConfidence: Math.round((result.summary?.avgConfidence || 0) * 100),
+    } : undefined;
+    // Prepare quality review data
+    const qr = result.qualityReview;
+    const qualityReview = qr ? {
+        deleteItems: qr.deleteItems?.map(i => ({
+            file: i.file,
+            lines: i.lines || 0,
+            description: i.description,
+        })) || [],
+        mergeItems: qr.mergeItems?.map(i => ({
+            file: i.file,
+            description: i.description,
+        })) || [],
+        simplifyItems: qr.simplifyItems?.map(i => ({
+            file: i.file,
+            description: i.description,
+        })) || [],
+        totalLinesRemovable: qr.totalLinesRemovable || 0,
+        percentageOfCodebase: qr.percentageOfCodebase || 0,
+        totalItems: (qr.deleteItems?.length || 0) + (qr.mergeItems?.length || 0) + (qr.simplifyItems?.length || 0),
+    } : undefined;
     const data = {
         projectName: result.projectName,
         scanDate: new Date(result.scanDate).toLocaleDateString('en-US', {
@@ -654,9 +682,248 @@ async function generateHtmlReport(result, outputPath, falsePositives = []) {
         architectureOverviewHtml: generateArchitectureOverviewHtml(result),
         threatModelHtml: generateThreatModelHtml(result),
         actionItemsHtml: generateActionItemsHtml(result),
+        // New scan statistics and quality review
+        scanStats,
+        projectTree: result.projectTree,
+        qualityReview,
     };
     const renderedHtml = renderTemplate(templateHtml, data);
     fs.writeFileSync(outputPath, renderedHtml);
     console.log(`HTML report generated: ${outputPath}`);
 }
+function formatDreadScore(score) {
+    if (!score)
+        return 'N/A';
+    return score.total.toFixed(2);
+}
+function getRiskLevel(result) {
+    const counts = getSeverityCounts(result.summary);
+    if (counts.critical > 0)
+        return 'CRITICAL';
+    if (counts.high > 0)
+        return 'HIGH';
+    if (counts.medium > 0)
+        return 'MEDIUM';
+    return 'LOW';
+}
+function enhanceFinding(f) {
+    return {
+        ...f,
+        dreadTotal: formatDreadScore(f.dreadScore),
+    };
+}
+async function generateProfessionalPdf(result, outputPath, falsePositives = []) {
+    const templatePath = path.join(__dirname, '..', 'templates', 'report-pdf.html');
+    const templateHtml = fs.readFileSync(templatePath, 'utf-8');
+    const counts = getSeverityCounts(result.summary);
+    const riskLevel = getRiskLevel(result);
+    const { grade, value } = calculateScore(result);
+    // Prepare findings with enhanced data
+    const criticalFindings = result.findings.filter(f => f.severity === 'critical').map(enhanceFinding);
+    const highFindings = result.findings.filter(f => f.severity === 'high').map(enhanceFinding);
+    const mediumFindings = result.findings.filter(f => f.severity === 'medium').map(enhanceFinding);
+    const lowFindings = result.findings.filter(f => f.severity === 'low' || f.severity === 'info').map(enhanceFinding);
+    // Prepare executive summary data
+    const execSummary = result.executiveSummary;
+    const topRisks = typeof execSummary === 'object' && execSummary?.topRisks
+        ? execSummary.topRisks
+        : criticalFindings.slice(0, 3).map(f => f.title);
+    const keyPositives = typeof execSummary === 'object' && execSummary?.positives
+        ? execSummary.positives
+        : (result.positiveObservations || []).slice(0, 3).map(o => typeof o === 'string' ? o : o.title || o.description || '');
+    // Prepare architecture data
+    const arch = result.architectureOverview;
+    const architectureComponents = arch?.components?.map(c => ({
+        name: c.name,
+        type: c.type,
+        description: c.description,
+        trustLevel: c.trustLevel,
+    })) || [];
+    const criticalAssets = arch?.criticalAssets?.map(a => ({
+        name: a.name,
+        type: a.type,
+        location: a.location,
+    })) || [];
+    const entryPoints = arch?.dataFlows || [];
+    // Prepare threat model
+    const threatModelEntries = result.threatModel?.map(t => ({
+        id: t.id,
+        threat: t.threat,
+        category: t.category,
+        strideType: t.strideType,
+        status: t.status,
+        dreadScore: t.dreadScore,
+        relatedFindings: t.relatedFindings?.join(', ') || '',
+    })) || [];
+    // Prepare quality review
+    const qr = result.qualityReview;
+    const qualityReview = {
+        deleteItems: qr?.deleteItems?.map(i => ({
+            file: i.file,
+            lines: i.lines || 0,
+            description: i.description,
+        })) || [],
+        mergeItems: qr?.mergeItems?.map(i => ({
+            files: i.file,
+            description: i.description,
+        })) || [],
+        simplifyItems: qr?.simplifyItems?.map(i => ({
+            file: i.file,
+            description: i.description,
+        })) || [],
+        totalLinesRemovable: qr?.totalLinesRemovable || 0,
+        percentageOfCodebase: qr?.percentageOfCodebase || 0,
+    };
+    // Prepare action items
+    const actions = result.actionItems || [];
+    const mapActions = (items) => items.map(a => ({
+        id: a.id,
+        title: a.title,
+        effort: a.effort,
+        relatedFindings: a.relatedFindings?.join(', ') || '',
+    }));
+    const immediateActions = mapActions(actions.filter(a => a.priority === 'immediate'));
+    const highPriorityActions = mapActions(actions.filter(a => a.priority === 'high'));
+    const mediumPriorityActions = mapActions(actions.filter(a => a.priority === 'medium'));
+    const longTermActions = mapActions(actions.filter(a => a.priority === 'long-term'));
+    // Prepare positive observations
+    const positiveObservations = (result.positiveObservations || []).map(o => {
+        if (typeof o === 'string') {
+            return { title: o, description: '' };
+        }
+        return { title: o.title || '', description: o.description || '' };
+    });
+    // Prepare project overview
+    const projOverview = result.projectOverview;
+    const projectType = projOverview?.type || 'Application';
+    const projectDescription = projOverview?.purpose || '';
+    const stack = projOverview?.stack?.join(', ') || '';
+    const componentsText = projOverview?.keyComponents?.join(', ') || '';
+    // Prepare trust boundaries and assets as strings for display
+    const trustBoundariesText = arch?.trustBoundaries?.map(b => `${b.from} -> ${b.to} (${b.protocol || 'N/A'})`).join(', ') || '';
+    const criticalAssetsText = arch?.criticalAssets?.map(a => `${a.name} (${a.type})`).join(', ') || '';
+    const entryPointsText = entryPoints.join(', ') || '';
+    // Quality review with total items count
+    const qualityReviewWithTotals = {
+        ...qualityReview,
+        totalItems: (qualityReview.deleteItems?.length || 0) +
+            (qualityReview.mergeItems?.length || 0) +
+            (qualityReview.simplifyItems?.length || 0),
+    };
+    // Generate executive summary HTML
+    const execSummaryText = generateExecutiveSummary(result);
+    const executiveSummaryHtml = `<p>${execSummaryText}</p>`;
+    // Cover description
+    const coverDescription = projectDescription ||
+        `Security assessment covering ${result.filesScanned || 0} files with ${result.findings?.length || 0} findings identified.`;
+    const data = {
+        projectName: result.projectName,
+        scanDate: new Date(result.scanDate).toLocaleDateString('en-US', {
+            year: 'numeric',
+            month: 'long',
+            day: 'numeric',
+        }),
+        scanDateFull: new Date(result.scanDate).toISOString(),
+        branch: result.branch,
+        commit: result.commit?.substring(0, 8),
+        scope: 'Full Security Assessment',
+        assessedBy: 'CoverMe Security Scanner',
+        version: '2.0',
+        // Project Overview
+        projectType,
+        projectDescription,
+        stack,
+        componentsText,
+        coverDescription,
+        // Project Tree and Lines of Code
+        projectTree: result.projectTree,
+        linesOfCode: result.linesOfCode || 0,
+        // Severity counts
+        criticalCount: counts.critical,
+        highCount: counts.high,
+        mediumCount: counts.medium,
+        lowCount: counts.low,
+        infoCount: counts.info,
+        totalFindings: result.findings?.length || 0,
+        // Risk
+        riskScore: `${grade.toUpperCase()} (${value}/100)`,
+        riskLevel,
+        // Executive Summary
+        executiveSummary: execSummaryText,
+        executiveSummaryHtml,
+        topRisks,
+        keyPositives,
+        // Architecture
+        architectureComponents,
+        criticalAssets: criticalAssetsText,
+        trustBoundaries: trustBoundariesText,
+        entryPoints: entryPointsText,
+        // Findings
+        criticalFindings,
+        highFindings,
+        mediumFindings,
+        lowFindings,
+        // Threat Model
+        threatModel: threatModelEntries,
+        // Quality Review
+        qualityReview: qualityReviewWithTotals,
+        // Resolved Issues (empty for now, can be populated from scan results)
+        resolvedIssues: [],
+        // Action Items
+        immediateActions,
+        highPriorityActions,
+        mediumPriorityActions,
+        longTermActions,
+        // Positive Observations
+        positiveObservations,
+        // Stats
+        filesScanned: result.filesScanned || 0,
+        agentCount: result.agentsUsed?.length || 0,
+        scanDuration: `${Math.round((result.scanDuration || 0) / 1000)} seconds`,
+        avgConfidence: Math.round((result.summary?.avgConfidence || 0) * 100),
+    };
+    // Register Handlebars helpers
+    handlebars_1.default.registerHelper('eq', (a, b) => a === b);
+    handlebars_1.default.registerHelper('gt', (a, b) => a > b);
+    handlebars_1.default.registerHelper('gte', (a, b) => a >= b);
+    handlebars_1.default.registerHelper('lt', (a, b) => a < b);
+    handlebars_1.default.registerHelper('add', (a, b) => a + b);
+    handlebars_1.default.registerHelper('toFixed', (n, digits) => n?.toFixed(digits) || 'N/A');
+    const template = handlebars_1.default.compile(templateHtml);
+    const renderedHtml = template(data);
+    // Generate PDF with proper pagination
+    const browser = await puppeteer_1.default.launch({
+        headless: true,
+        args: ['--no-sandbox', '--disable-setuid-sandbox'],
+    });
+    const page = await browser.newPage();
+    await page.setContent(renderedHtml, { waitUntil: 'networkidle0' });
+    // A4 PDF with proper page breaks
+    await page.pdf({
+        path: outputPath,
+        format: 'A4',
+        margin: {
+            top: '20mm',
+            right: '15mm',
+            bottom: '20mm',
+            left: '15mm',
+        },
+        printBackground: true,
+        displayHeaderFooter: true,
+        headerTemplate: `
+      <div style="width: 100%; font-size: 9px; color: #666; padding: 0 15mm; display: flex; justify-content: space-between;">
+        <span>${escapeHtml(result.projectName)} - Security Assessment</span>
+        <span>CONFIDENTIAL</span>
+      </div>
+    `,
+        footerTemplate: `
+      <div style="width: 100%; font-size: 9px; color: #666; padding: 0 15mm; display: flex; justify-content: space-between;">
+        <span>Generated by CoverMe Security Scanner</span>
+        <span>Page <span class="pageNumber"></span> of <span class="totalPages"></span></span>
+      </div>
+    `,
+    });
+    await browser.close();
+    console.log(`Professional PDF report generated: ${outputPath}`);
+}
 //# sourceMappingURL=generator.js.map