fad-checker 2.2.4 → 2.3.0

package/lib/cve-report.js

@@ -418,6 +418,53 @@ function makeRelative(absPath, srcRoot) {
 	} catch { return absPath; }
 }
 
+// Inventory of the manifest/lockfile descriptors fad actually parsed and fed into the
+// scan: the union of every declared dep's manifestPaths (relative to the src root), with
+// the ecosystem(s) and the count of direct deps each contributed. Transitive deps (resolved
+// from a registry, no local file) and committed binaries (embedded/native — inventoried in
+// chapters 1B/1C, not "descriptors") are excluded.
+function buildScannedManifests(resolvedDeps, srcRoot, parsedManifests = []) {
+	const byPath = new Map();
+	const touch = (relPath, eco) => {
+		let e = byPath.get(relPath);
+		if (!e) { e = { path: relPath, ecosystems: new Set(), count: 0 }; byPath.set(relPath, e); }
+		if (eco) e.ecosystems.add(eco);
+		return e;
+	};
+	// Files that contributed at least one scanned dependency (count = direct deps).
+	for (const dep of (resolvedDeps?.values?.() || [])) {
+		if (dep.scope === "transitive") continue;
+		if (dep.provenance === "embedded" || dep.provenance === "binary") continue;
+		const paths = (dep.manifestPaths && dep.manifestPaths.length) ? dep.manifestPaths
+			: (dep.pomPaths && dep.pomPaths.length) ? dep.pomPaths : [];
+		for (const p of paths) touch(makeRelative(p, srcRoot), dep.ecosystemType || dep.ecosystem || "?").count++;
+	}
+	// EVERY descriptor each codec reported parsing — incl. ones that contributed nothing
+	// (ranges-only / no lockfile). These land with count 0 so nothing is silently omitted.
+	for (const pm of (parsedManifests || [])) {
+		if (!pm || !pm.path) continue;
+		touch(makeRelative(pm.path, srcRoot), pm.ecosystemType);
+	}
+	return [...byPath.values()]
+		.map(e => ({ path: e.path, ecosystems: [...e.ecosystems].sort(), count: e.count }))
+		.sort((a, b) => a.path.localeCompare(b.path));
+}
+
+function renderScannedManifests(list) {
+	if (!list.length) return `<div class="empty">No dependency descriptors were parsed (deps came only from registries or committed binaries).</div>`;
+	const emptyN = list.filter(e => e.count === 0).length;
+	const intro = `<div class="fp-intro">Every manifest / lockfile descriptor fad-checker parsed for this scan (paths relative to the source root) — the complete list, including files that contributed <strong>no scannable dependency</strong> (only version ranges, or no lockfile)${emptyN ? `: ${emptyN} such file${emptyN > 1 ? "s" : ""} shown with <code>0</code>` : ""}. Transitive deps resolved from registries, and committed binaries (chapters 1B/1C), are not descriptors and are excluded here.</div>`;
+	const rows = list.map(e => `<tr>
+		<td class="dep"><code>${esc(e.path)}</code></td>
+		<td>${esc(e.ecosystems.map(x => ECO_LABELS[x] || x).join(", "))}</td>
+		<td>${e.count > 0 ? e.count : `<span style="color:#9ca3af">0 <span style="font-style:italic">— ranges / no lockfile</span></span>`}</td>
+	</tr>`).join("\n");
+	return intro + `<table>
+		<thead><tr><th>Descriptor</th><th>Ecosystem</th><th>Direct deps</th></tr></thead>
+		<tbody>${rows}</tbody>
+	</table>`;
+}
+
 // Présentation des coordonnées, déléguée au codec. Règle générique : le codec
 // fournit la coord canonique (maven "g:a", npm "name", composer "vendor/pkg"…) ;
 // Maven la porte déjà son namespace, les autres reçoivent un tag d'écosystème
@@ -1007,7 +1054,7 @@ function renderObsoleteTable(obs) {
 	if (!obs?.length) return `<div class="empty">No obsolete / deprecated libraries detected.</div>`;
 	const rows = obs.map(o => `<tr>
 		<td>${badge((o.severity || "MEDIUM").toUpperCase())}</td>
-		<td class="dep">${esc(depDisplayName(o.dep))}<br><span style="color:#6b7280">${esc(o.dep.version || "?")}</span>${renderDefinedIn(o.dep, RENDER_CTX.srcRoot)}</td>
+		<td class="dep">${esc(depDisplayName(o.dep))}<br><span style="color:#6b7280">${esc(o.dep.version || "?")}</span>${renderDepOrigin(o.dep, RENDER_CTX.srcRoot)}</td>
 		<td class="dep">${esc(o.replacement || "—")}</td>
 		<td class="desc">${esc(o.reason || "")}</td>
 	</tr>`).join("\n");
@@ -1438,7 +1485,7 @@ function renderLicenseChapter(licenseResults) {
 	return intro + blocks;
 }
 
-function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings, wrapTables = true }) {
+function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings, parsedManifests = [], wrapTables = true }) {
 	setRenderCtx({ srcRoot: projectInfo?.src || null });
 	// Dedupe rows so a single (dep, cve) shows once with all via paths merged.
 	cveMatches      = mergeMatches(cveMatches || []);
@@ -1504,9 +1551,11 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 	// (C) Table of contents — rendered as a sticky nav. Only enumerates the
 	// chapters that actually have content (warnings, dev CVE, retire, FP appendix
 	// might be empty).
+	const scanned = buildScannedManifests(resolvedDeps, projectInfo?.src, parsedManifests);
 	const toc = renderToc({
 		hasWarnings: !!(warnings?.length),
 		prodTotal: prodStats.total,
+		scannedTotal: scanned.length,
 		retireTotal: retireMatches.length,
 		devTotal: devStats.total,
 		eolTotal: eolResults?.length || 0,
@@ -1528,7 +1577,7 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 			<h1>FAD-Checker Report</h1>
 			<div class="report-subtitle">Multi-ecosystem dependency security audit</div>
 			<div class="meta">
-				Project: <strong>${esc(projectInfo.name)}</strong> · <code class="path">${esc(projectInfo.src)}</code><br>
+				Project: <strong>${esc(projectInfo.name)}</strong><br>
 				Generated: ${esc(projectInfo.generatedAt)}${projectInfo.toolVersion ? ` · fad-checker ${esc(projectInfo.toolVersion)}` : ""}${projectInfo.cveDataDate ? ` · CVE data: ${esc(projectInfo.cveDataDate)}` : ""}
 			</div>
 		</header>
@@ -1551,6 +1600,7 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 		${majorSection(`7. Licenses (${licenseTotal}${licenseFlagged ? `, ${licenseFlagged} to review` : ""})`, licenseContent, { open: licenseFlagged > 0, id: "ch7" })}
 		${majorSection(`8. Fix Recommendations`, renderFixRecommendations(recos, prodMatchesActive, outdatedResults), { open: false, id: "ch8" })}
 		${(prodMatchesFP.length + devMatchesFP.length + embMatchesFP.length) ? majorSection(`9. Appendix: Likely false positives (CPE-filtered) (${prodMatchesFP.length + devMatchesFP.length + embMatchesFP.length})`, fpContent, { open: false, id: "ch9" }) : ""}
+		${majorSection(`10. Appendix: Scanned dependency descriptors (${scanned.length})`, renderScannedManifests(scanned), { open: false, id: "chsrc" })}
 	`;
 	return wrapTables ? wrapTablesWithCopyButtons(body) : body;
 }
@@ -1614,7 +1664,7 @@ function pickTopEol(eolResults, n) {
 	}).slice(0, n);
 }
 
-function renderToc({ hasWarnings, prodTotal, embeddedTotal, unmanagedTotal, vendoredJsTotal, retireTotal, devTotal, eolTotal, obsoleteTotal, outdatedTotal, licenseTotal, licenseFlagged, fpTotal }) {
+function renderToc({ hasWarnings, prodTotal, embeddedTotal, unmanagedTotal, vendoredJsTotal, retireTotal, devTotal, eolTotal, obsoleteTotal, outdatedTotal, licenseTotal, licenseFlagged, fpTotal, scannedTotal }) {
 	const entries = [];
 	if (hasWarnings)                  entries.push({ id: "ch0", label: "0. Warnings" });
 	entries.push({ id: "ch1", label: `1. Prod CVE (${prodTotal})` });
@@ -1629,6 +1679,7 @@ function renderToc({ hasWarnings, prodTotal, embeddedTotal, unmanagedTotal, vend
 	entries.push({ id: "ch7", label: `7. Licenses (${licenseTotal || 0}${licenseFlagged ? `, ${licenseFlagged}⚠` : ""})` });
 	entries.push({ id: "ch8", label: `8. Fix Recos` });
 	if (fpTotal)                      entries.push({ id: "ch9", label: `9. Likely FP (${fpTotal})` });
+	entries.push({ id: "chsrc", label: `10. Scanned descriptors (${scannedTotal || 0})` });
 	return `<nav class="toc">${entries.map(e => `<a href="#${e.id}">${esc(e.label)}</a>`).join("")}</nav>`;
 }
 
@@ -2169,12 +2220,12 @@ ${WORD_SECTION_PR}
 // Render the HTML and/or Word report. Callers pass explicit target paths;
 // a null/omitted path skips that format (so `--report-html` alone writes only HTML).
 // Back-compat: `outputDir` still writes both under the default file names.
-async function writeReports({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, outputDir, htmlPath, docPath, warnings }) {
+async function writeReports({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, outputDir, htmlPath, docPath, warnings, parsedManifests }) {
 	if (outputDir) {
 		if (htmlPath === undefined) htmlPath = path.join(outputDir, "cve-report.html");
 		if (docPath === undefined) docPath = path.join(outputDir, "cve-report.doc");
 	}
-	const payload = { cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings };
+	const payload = { cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings, parsedManifests };
 	const written = { htmlPath: null, docPath: null };
 	if (htmlPath) {
 		await fs.promises.mkdir(path.dirname(path.resolve(htmlPath)), { recursive: true });

package/lib/deps-descriptor.js

@@ -1,6 +1,6 @@
 /**
  * lib/deps-descriptor.js — serialize / deserialize an *anonymized* descriptor of
- * the resolved dependency set, for PASSI-style offline→online→offline audits.
+ * the resolved dependency set, for air-gapped offline→online→offline audits.
  *
  * Phase 1 (offline): collect deps → serializeDeps → write JSON. No paths, URLs,
  *   hostnames or usernames leave the air-gapped machine — only public package
@@ -10,7 +10,7 @@
  * Phase 3 (offline): `--import-cache` + a normal `--offline` scan re-collects the
  *   source locally (real paths) and gets cache hits → full detailed report.
  *
- * See docs/superpowers/specs/2026-05-30-anonymized-deps-descriptor-passi-design.md
+ * See the anonymized-deps-descriptor design spec.
  *
  * Pure functions: no I/O, no console. The caller does file read/write.
  *

package/lib/osv-db.js

@@ -9,7 +9,7 @@
  * and matches EVERY dep against it offline, deterministically, regardless of the per-dep
  * cache. That is exactly the model OSV-Scanner uses for air-gapped scans
  * (`--download-offline-databases`), and it makes fad's offline Maven recall complete and
- * cache-independent for a PASSI engagement.
+ * cache-independent for an air-gapped engagement.
  *
  * Maven only for now: range matching needs the ecosystem's version ordering, and fad has
  * a robust Maven comparator (lib/maven-version). npm/PyPI/etc. are a documented follow-up

package/lib/retire.js

@@ -29,7 +29,7 @@ const RETIRE_CACHE_TTL_MS = 24 * 3600 * 1000;
 
 // retire's own signature DB. By default retire caches it in /tmp/.retire-cache
 // (outside ~/.fad-checker/, with a 1h TTL → a network refetch on expiry). For the
-// PASSI offline workflow we instead keep a stable local copy INSIDE ~/.fad-checker/
+// air-gapped offline workflow we instead keep a stable local copy INSIDE ~/.fad-checker/
 // so `--export-cache` carries it, and feed it to retire via `--jsrepo <file>`
 // (loaded from file, never the network — no TTL).
 const RETIRE_SIG_DIR = path.join(os.homedir(), ".fad-checker", "retire-signatures");

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fad-checker",
-  "version": "2.2.4",
-  "description": "Scan ALL Maven, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
+  "version": "2.3.0",
+  "description": "Scan ALL Maven, Gradle, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
   "keywords": [
     "sca",
     "software-composition-analysis",
@@ -29,7 +29,6 @@
     "supply-chain",
     "offline",
     "air-gapped",
-    "passi",
     "maven",
     "npm",
     "yarn",