kirograph 0.27.1 → 0.28.0

package/dist/mcp/handlers/security.js

@@ -0,0 +1,699 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var security_exports = {};
+__export(security_exports, {
+  handleSecurity: () => handleSecurity
+});
+module.exports = __toCommonJS(security_exports);
+var import_utils = require("./utils");
+async function handleSecurity(toolName, args, cg) {
+  switch (toolName) {
+    case "kirograph_security": {
+      const { loadConfig } = await Promise.resolve().then(() => require("../../config.js"));
+      const projectRoot = cg.getProjectRoot();
+      const config = await loadConfig(projectRoot);
+      if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
+      if (!config.enableArchitecture) return "Security requires architecture analysis. Set enableArchitecture: true in .kirograph/config.json and run kirograph index.";
+      const db = cg.getDatabase();
+      db.applySecuritySchema();
+      const rawDb = db.getRawDb();
+      const depCount = rawDb.get(
+        `SELECT COUNT(*) as count FROM sec_dependencies`
+      ) ?? { count: 0 };
+      const vulnCount = rawDb.get(
+        `SELECT COUNT(*) as count FROM sec_vulnerabilities`
+      ) ?? { count: 0 };
+      const verdictRows = rawDb.all(
+        `SELECT verdict, COUNT(*) as count FROM sec_reachability GROUP BY verdict`
+      );
+      const verdicts = {};
+      for (const row of verdictRows) {
+        verdicts[row.verdict] = row.count;
+      }
+      const staleCount = rawDb.get(
+        `SELECT COUNT(*) as count FROM sec_dependencies WHERE vuln_data_stale = 1`
+      ) ?? { count: 0 };
+      const { SuppressionManager: SecSuppressionManager } = await Promise.resolve().then(() => require("../../security/suppressions.js"));
+      const secSuppressions = new SecSuppressionManager(projectRoot);
+      const allCveIds = rawDb.all(`SELECT cve_id FROM sec_vulnerabilities`);
+      const suppressedCveCount = allCveIds.filter((r) => secSuppressions.isSuppressed(r.cve_id)).length;
+      const visibleVulnCount = vulnCount.count - suppressedCveCount;
+      const lines = [
+        "# Security Overview",
+        "",
+        `Dependencies: ${depCount.count}`,
+        `Vulnerabilities: ${visibleVulnCount}${suppressedCveCount > 0 ? ` (${suppressedCveCount} suppressed)` : ""}`
+      ];
+      if (visibleVulnCount > 0) {
+        const affected = verdicts["affected"] ?? 0;
+        const notAffected = verdicts["not_affected"] ?? 0;
+        const underInvestigation = verdicts["under_investigation"] ?? 0;
+        const pending = visibleVulnCount - affected - notAffected - underInvestigation;
+        lines.push("", "## Reachability Verdicts", "");
+        if (affected > 0) lines.push(`\u25CF Affected: ${affected}`);
+        if (notAffected > 0) lines.push(`\u25CF Not affected: ${notAffected}`);
+        if (underInvestigation > 0) lines.push(`\u25CF Under investigation: ${underInvestigation}`);
+        if (pending > 0) lines.push(`\u25CF Pending analysis: ${pending}`);
+      }
+      if (staleCount.count > 0) {
+        lines.push("", `\u26A0 ${staleCount.count} dependenc${staleCount.count === 1 ? "y has" : "ies have"} stale vulnerability data. Use kirograph_vulns with refresh=true to update.`);
+      }
+      const lastVulnCheck = rawDb.get(
+        `SELECT MIN(last_vuln_check) as oldest FROM sec_dependencies WHERE last_vuln_check IS NOT NULL`
+      )?.oldest;
+      if (lastVulnCheck != null) {
+        const ageMs = Date.now() - lastVulnCheck;
+        const ageDays = ageMs / (1e3 * 60 * 60 * 24);
+        const maxAge = config.securityEnrichMaxAgeDays ?? 7;
+        if (ageDays > maxAge) {
+          lines.push("", `\u26A0 Vulnerability data is ${Math.floor(ageDays)} days old (max: ${maxAge}). Run kirograph vulns --refresh to update.`);
+        }
+      }
+      try {
+        const rawDbSec = db.getRawDb();
+        const tableExistsSec = rawDbSec.get("SELECT name FROM sqlite_master WHERE type='table' AND name='pattern_matches'");
+        if (tableExistsSec) {
+          const patternCount = rawDbSec.get("SELECT COUNT(*) as cnt FROM pattern_matches")?.cnt ?? 0;
+          if (patternCount > 0) {
+            const critCount = rawDbSec.get("SELECT COUNT(*) as cnt FROM pattern_matches WHERE severity = 'critical'")?.cnt ?? 0;
+            lines.push(`SAST findings: ${patternCount} pattern matches (${critCount} critical)`);
+          }
+        }
+      } catch {
+      }
+      return lines.join("\n");
+    }
+    case "kirograph_vulns": {
+      const { loadConfig } = await Promise.resolve().then(() => require("../../config.js"));
+      const projectRoot = cg.getProjectRoot();
+      const config = await loadConfig(projectRoot);
+      if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
+      const db = cg.getDatabase();
+      db.applySecuritySchema();
+      const rawDb = db.getRawDb();
+      if (args.refresh === true) {
+        const { OsvAdapter } = await Promise.resolve().then(() => require("../../security/vuln/osv-adapter.js"));
+        const { VulnerabilityDatabaseClient } = await Promise.resolve().then(() => require("../../security/vuln/client.js"));
+        const adapters = config.securityDatabases.map((dbName) => {
+          if (dbName.toUpperCase() === "OSV") return new OsvAdapter();
+          return null;
+        }).filter(Boolean);
+        const client = new VulnerabilityDatabaseClient(adapters, db);
+        await client.enrichAll();
+      }
+      let query = `
+        SELECT
+          v.node_id, v.cve_id, v.severity_score, v.fixed_version, v.summary,
+          v.epss_score, v.epss_percentile, v.risk_score,
+          d.package_name, d.ecosystem, d.resolved_version, d.declared_constraint,
+          r.verdict
+        FROM sec_vulnerabilities v
+        LEFT JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'
+        LEFT JOIN sec_dependencies d ON d.node_id = e.source
+        LEFT JOIN sec_reachability r ON r.vulnerability_node_id = v.node_id
+        WHERE 1=1
+      `;
+      const params = [];
+      if (args.severity) {
+        const severityRanges = {
+          critical: [9, 10],
+          high: [7, 8.9],
+          medium: [4, 6.9],
+          low: [0.1, 3.9]
+        };
+        const range = severityRanges[args.severity.toLowerCase()];
+        if (!range) return `Invalid severity: ${args.severity}. Use: critical, high, medium, low`;
+        query += ` AND v.severity_score >= ? AND v.severity_score <= ?`;
+        params.push(range[0], range[1]);
+      }
+      if (args.verdict) {
+        const validVerdicts = ["affected", "not_affected", "under_investigation"];
+        if (!validVerdicts.includes(args.verdict)) {
+          return `Invalid verdict: ${args.verdict}. Use: affected, not_affected, under_investigation`;
+        }
+        query += ` AND r.verdict = ?`;
+        params.push(args.verdict);
+      }
+      const limit = (0, import_utils.clampLimit)(args.limit, 20);
+      query += ` ORDER BY v.risk_score DESC NULLS LAST LIMIT ?`;
+      params.push(limit);
+      const rows = rawDb.all(query, params);
+      const verdictRankMcp = (v) => v === "affected" ? 3 : v === "under_investigation" ? 2 : v === "not_affected" ? 1 : 0;
+      const dedupMapMcp = /* @__PURE__ */ new Map();
+      for (const row of rows) {
+        const key = `${row.cve_id}::${row.package_name ?? ""}::${row.ecosystem ?? ""}`;
+        const ex = dedupMapMcp.get(key);
+        if (!ex || verdictRankMcp(row.verdict) > verdictRankMcp(ex.verdict)) dedupMapMcp.set(key, row);
+      }
+      const dedupedRowsMcp = [...dedupMapMcp.values()];
+      const { SuppressionManager } = await Promise.resolve().then(() => require("../../security/suppressions.js"));
+      const suppressionMgr = new SuppressionManager(projectRoot);
+      const suppressedCount = dedupedRowsMcp.filter((row) => suppressionMgr.isSuppressed(row.cve_id)).length;
+      const filteredRows = dedupedRowsMcp.filter((row) => !suppressionMgr.isSuppressed(row.cve_id));
+      if (filteredRows.length === 0) {
+        const noMatch = "No vulnerabilities found" + (args.severity || args.verdict ? " matching filters." : ".");
+        return suppressedCount > 0 ? `${noMatch} (${suppressedCount} suppressed)` : noMatch;
+      }
+      const { formatFixSuggestion } = await Promise.resolve().then(() => require("../../security/export/fix-suggestions.js"));
+      const lines = [`Vulnerabilities (${filteredRows.length}${suppressedCount > 0 ? `, ${suppressedCount} suppressed` : ""}):
+`];
+      for (const row of filteredRows) {
+        const score = row.severity_score;
+        let severityLabel;
+        if (score == null) severityLabel = "UNKNOWN";
+        else if (score >= 9) severityLabel = "CRITICAL";
+        else if (score >= 7) severityLabel = "HIGH";
+        else if (score >= 4) severityLabel = "MEDIUM";
+        else severityLabel = "LOW";
+        let verdictLabel;
+        if (!row.verdict) verdictLabel = "pending";
+        else if (row.verdict === "affected") verdictLabel = "affected";
+        else if (row.verdict === "not_affected") verdictLabel = "not affected";
+        else verdictLabel = "investigating";
+        const pkg = row.package_name ? `${row.package_name}@${row.resolved_version || row.declared_constraint || "?"}` : "unknown package";
+        const epssNote = row.epss_score != null ? ` [EPSS: ${row.epss_score.toFixed(2)}]` : "";
+        const riskNote = row.risk_score != null ? ` [Risk: ${row.risk_score.toFixed(1)}]` : "";
+        lines.push(`${severityLabel}  ${row.cve_id}  ${pkg}  [${verdictLabel}]${epssNote}${riskNote}`);
+        if (row.summary && row.summary !== "Manually registered") {
+          const truncSummary = row.summary.length > 120 ? row.summary.slice(0, 120) + "\u2026" : row.summary;
+          lines.push(`  ${truncSummary}`);
+        }
+        if (row.fixed_version && row.ecosystem && row.package_name) {
+          const fix = formatFixSuggestion(row.ecosystem, row.package_name, row.fixed_version);
+          if (fix) lines.push(`  ${fix}`);
+        }
+      }
+      return (0, import_utils.truncate)(lines.join("\n"));
+    }
+    case "kirograph_vuln_add": {
+      const { loadConfig } = await Promise.resolve().then(() => require("../../config.js"));
+      const projectRoot = cg.getProjectRoot();
+      const config = await loadConfig(projectRoot);
+      if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
+      const cveId = args.cveId;
+      const pkgName = args.package;
+      if (!cveId) return "Error: cveId is required.";
+      if (!pkgName) return "Error: package is required.";
+      const db = cg.getDatabase();
+      db.applySecuritySchema();
+      const rawDb = db.getRawDb();
+      const depRow = rawDb.get(
+        `SELECT node_id, ecosystem FROM sec_dependencies WHERE package_name = ?`,
+        [pkgName]
+      );
+      if (!depRow) {
+        return `No dependency found matching "${pkgName}". Run kirograph index first to discover dependencies.`;
+      }
+      const vulnNodeId = `vuln:${cveId}`;
+      const now = Date.now();
+      const severity = args.severity;
+      const summary = args.summary ?? "Manually registered";
+      const fixedVersion = args.fixedVersion ?? null;
+      rawDb.run(
+        `INSERT OR REPLACE INTO nodes
+          (id, kind, name, qualified_name, file_path, language,
+           start_line, end_line, start_column, end_column,
+           is_exported, is_async, is_static, is_abstract, updated_at)
+         VALUES (?, 'vulnerability', ?, ?, '', 'unknown', 0, 0, 0, 0, 0, 0, 0, 0, ?)`,
+        [vulnNodeId, cveId, cveId, now]
+      );
+      rawDb.run(
+        `INSERT OR REPLACE INTO sec_vulnerabilities
+          (node_id, cve_id, severity_score, affected_ranges, fixed_version, summary, source_database)
+         VALUES (?, ?, ?, '[]', ?, ?, 'manual')`,
+        [vulnNodeId, cveId, severity ?? null, fixedVersion, summary]
+      );
+      rawDb.run(
+        `INSERT OR IGNORE INTO edges (source, target, kind, confidence, confidence_score)
+         VALUES (?, ?, 'has_vulnerability', 'extracted', 1.0)`,
+        [depRow.node_id, vulnNodeId]
+      );
+      return `Registered ${cveId} against ${pkgName}.`;
+    }
+    case "kirograph_vuln_suppress": {
+      const projectRoot = cg.getProjectRoot();
+      const cveId = args.cveId;
+      if (!cveId) return "Error: cveId is required.";
+      const { SuppressionManager } = await Promise.resolve().then(() => require("../../security/suppressions.js"));
+      const manager = new SuppressionManager(projectRoot);
+      manager.add(cveId, args.reason, args.expires);
+      const reasonNote = args.reason ? ` Reason: ${args.reason}.` : "";
+      const expiresNote = args.expires ? ` Expires: ${args.expires}.` : "";
+      return `${cveId} suppressed.${reasonNote}${expiresNote}`;
+    }
+    case "kirograph_sbom": {
+      const { loadConfig } = await Promise.resolve().then(() => require("../../config.js"));
+      const projectRoot = cg.getProjectRoot();
+      const config = await loadConfig(projectRoot);
+      if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
+      const db = cg.getDatabase();
+      db.applySecuritySchema();
+      const { SBOMExporter } = await Promise.resolve().then(() => require("../../security/export/sbom.js"));
+      const exporter = new SBOMExporter(db, projectRoot);
+      const json = exporter.exportJSON();
+      return (0, import_utils.truncate)(json);
+    }
+    case "kirograph_vex": {
+      const { loadConfig } = await Promise.resolve().then(() => require("../../config.js"));
+      const projectRoot = cg.getProjectRoot();
+      const config = await loadConfig(projectRoot);
+      if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
+      const db = cg.getDatabase();
+      db.applySecuritySchema();
+      const { VEXExporter } = await Promise.resolve().then(() => require("../../security/export/vex.js"));
+      const exporter = new VEXExporter(db, projectRoot);
+      const json = exporter.exportJSON();
+      return (0, import_utils.truncate)(json);
+    }
+    case "kirograph_reachability": {
+      const { loadConfig } = await Promise.resolve().then(() => require("../../config.js"));
+      const projectRoot = cg.getProjectRoot();
+      const config = await loadConfig(projectRoot);
+      if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
+      const target = args.target;
+      if (!target) return "Error: target is required (dependency name or CVE ID).";
+      const db = cg.getDatabase();
+      db.applySecuritySchema();
+      const rawDb = db.getRawDb();
+      let vulnerabilityNodeId = null;
+      let targetLabel = target;
+      const vulnRow = rawDb.get(
+        `SELECT node_id FROM sec_vulnerabilities WHERE cve_id = ?`,
+        [target]
+      );
+      if (vulnRow) {
+        vulnerabilityNodeId = vulnRow.node_id;
+      } else {
+        const depRow = rawDb.get(
+          `SELECT node_id, package_name FROM sec_dependencies WHERE package_name = ?`,
+          [target]
+        );
+        if (depRow) {
+          targetLabel = depRow.package_name;
+          const vulnEdge = rawDb.get(
+            `SELECT target FROM edges WHERE source = ? AND kind = 'has_vulnerability' LIMIT 1`,
+            [depRow.node_id]
+          );
+          if (vulnEdge) {
+            vulnerabilityNodeId = vulnEdge.target;
+          } else {
+            return `No vulnerabilities found for dependency "${target}". The dependency exists but has no known vulnerabilities.`;
+          }
+        } else {
+          return `Target "${target}" not found. Provide a valid CVE ID or dependency package name.`;
+        }
+      }
+      const { ReachabilityAnalyzer } = await Promise.resolve().then(() => require("../../security/reachability.js"));
+      const analyzer = new ReachabilityAnalyzer(db, config);
+      const result = await analyzer.analyze(vulnerabilityNodeId);
+      const lines = [
+        `# Reachability: ${targetLabel}`,
+        "",
+        `Verdict: ${result.verdict}`,
+        `Reaching entry points: ${result.reachingEntryPointCount}`
+      ];
+      if (result.paths.length > 0) {
+        lines.push("", "## Paths");
+        for (const p of result.paths.slice(0, 5)) {
+          lines.push(`- From ${p.entryPoint}: ${p.path.join(" \u2192 ")}`);
+        }
+        if (result.paths.length > 5) {
+          lines.push(`  \u2026and ${result.paths.length - 5} more paths`);
+        }
+      }
+      if (result.unresolvedSymbols.length > 0) {
+        lines.push("", "## Unresolved Symbols");
+        for (const sym of result.unresolvedSymbols.slice(0, 10)) {
+          lines.push(`- ${sym}`);
+        }
+        if (result.unresolvedSymbols.length > 10) {
+          lines.push(`  \u2026and ${result.unresolvedSymbols.length - 10} more`);
+        }
+      }
+      if (result.verdict === "affected") {
+        const impact = await analyzer.getImpactSummary(vulnerabilityNodeId);
+        if (impact) {
+          lines.push("", "## Impact Summary");
+          if (impact.affectedLayers.length > 0) {
+            lines.push(`Affected layers: ${impact.affectedLayers.join(", ")}`);
+          }
+          lines.push(`Affected entry points: ${impact.affectedEntryPoints.length}`);
+          lines.push(`Distinct paths: ${impact.distinctPathCount}`);
+        }
+      }
+      return (0, import_utils.truncate)(lines.join("\n"));
+    }
+    case "kirograph_staleness": {
+      const { loadConfig } = await Promise.resolve().then(() => require("../../config.js"));
+      const projectRoot = cg.getProjectRoot();
+      const config = await loadConfig(projectRoot);
+      if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
+      const db = cg.getDatabase();
+      db.applySecuritySchema();
+      const rawDb = db.getRawDb();
+      const threshold = typeof args.threshold === "number" ? args.threshold : 0.3;
+      if (args.refresh === true) {
+        const { StalenessChecker } = await Promise.resolve().then(() => require("../../security/staleness.js"));
+        const checker = new StalenessChecker(db);
+        await checker.checkAll();
+      }
+      const rows = rawDb.all(
+        `SELECT package_name, ecosystem, resolved_version, declared_constraint,
+                latest_version, latest_published, staleness_score
+         FROM sec_dependencies
+         WHERE staleness_score >= ?
+         ORDER BY staleness_score DESC`,
+        [threshold]
+      );
+      if (rows.length === 0) {
+        return `No dependencies found with staleness_score >= ${threshold}.` + (args.refresh ? "" : " Use refresh=true to fetch latest version data from registries.");
+      }
+      const lines = [`Stale Dependencies (threshold: ${threshold}):
+`];
+      for (const row of rows) {
+        const resolved = row.resolved_version ?? row.declared_constraint ?? "?";
+        const latest = row.latest_version ?? "?";
+        const score = row.staleness_score ?? 0;
+        const months = row.latest_published ? Math.round((Date.now() - row.latest_published) / (1e3 * 60 * 60 * 24 * 30)) : null;
+        const bar = "\u2588".repeat(Math.round(score * 10)) + "\u2591".repeat(10 - Math.round(score * 10));
+        const monthsStr = months !== null ? `, ${months}mo since latest` : "";
+        lines.push(`${row.package_name} (${row.ecosystem}): ${resolved} \u2192 ${latest}${monthsStr}`);
+        lines.push(`  ${bar} ${score.toFixed(2)}`);
+      }
+      const totalCount = rawDb.get(`SELECT COUNT(*) as count FROM sec_dependencies`) ?? { count: 0 };
+      lines.push("", `${rows.length} of ${totalCount.count} dependencies are stale (score >= ${threshold})`);
+      return (0, import_utils.truncate)(lines.join("\n"));
+    }
+    case "kirograph_licenses": {
+      const { loadConfig } = await Promise.resolve().then(() => require("../../config.js"));
+      const projectRoot = cg.getProjectRoot();
+      const config = await loadConfig(projectRoot);
+      if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
+      const db = cg.getDatabase();
+      db.applySecuritySchema();
+      const rawDb = db.getRawDb();
+      const deps = rawDb.all(
+        `SELECT package_name, ecosystem, license FROM sec_dependencies ORDER BY ecosystem, package_name`
+      );
+      const { checkLicensePolicy } = await Promise.resolve().then(() => require("../../security/license.js"));
+      const policy = config.securityLicensePolicy;
+      const violations = checkLicensePolicy(deps, policy);
+      if (args.policy === true) {
+        if (violations.length === 0) {
+          return "No license policy violations found.";
+        }
+        const lines2 = ["# License Policy Violations\n"];
+        for (const v of violations) {
+          lines2.push(`${v.severity.toUpperCase()}  ${v.packageName} [${v.ecosystem}]  ${v.license}`);
+        }
+        const denyCount2 = violations.filter((v) => v.severity === "deny").length;
+        const warnCount2 = violations.filter((v) => v.severity === "warn").length;
+        lines2.push("");
+        if (denyCount2 > 0) lines2.push(`${denyCount2} denied license${denyCount2 !== 1 ? "s" : ""}`);
+        if (warnCount2 > 0) lines2.push(`${warnCount2} license warning${warnCount2 !== 1 ? "s" : ""}`);
+        return (0, import_utils.truncate)(lines2.join("\n"));
+      }
+      if (deps.length === 0) {
+        return "No dependencies found. Run kirograph index first.";
+      }
+      const violationMap = /* @__PURE__ */ new Map();
+      for (const v of violations) {
+        violationMap.set(`${v.ecosystem}:${v.packageName}`, v.severity);
+      }
+      const lines = [`# License Report (${deps.length} dependencies)
+`];
+      if (violations.length > 0) {
+        lines.push("## Policy Violations\n");
+        for (const v of violations) {
+          lines.push(`${v.severity.toUpperCase()}  ${v.packageName} [${v.ecosystem}]  ${v.license}`);
+        }
+        lines.push("");
+      }
+      lines.push("## All Dependencies\n");
+      lines.push("package | ecosystem | license | status");
+      lines.push("------- | --------- | ------- | ------");
+      for (const dep of deps) {
+        const key = `${dep.ecosystem}:${dep.package_name}`;
+        const violation = violationMap.get(key);
+        const license = dep.license ?? "(unknown)";
+        const status = violation ?? (dep.license ? "ok" : "unknown");
+        lines.push(`${dep.package_name} | ${dep.ecosystem} | ${license} | ${status}`);
+      }
+      const denyCount = violations.filter((v) => v.severity === "deny").length;
+      const warnCount = violations.filter((v) => v.severity === "warn").length;
+      const unknownCount = deps.filter((d) => !d.license).length;
+      lines.push("");
+      if (denyCount > 0) lines.push(`${denyCount} denied license${denyCount !== 1 ? "s" : ""}`);
+      if (warnCount > 0) lines.push(`${warnCount} license warning${warnCount !== 1 ? "s" : ""}`);
+      if (unknownCount > 0) lines.push(`${unknownCount} unknown license${unknownCount !== 1 ? "s" : ""}`);
+      if (denyCount === 0 && warnCount === 0) lines.push("No policy violations");
+      return (0, import_utils.truncate)(lines.join("\n"));
+    }
+    case "kirograph_attack_surface": {
+      const { loadConfig } = await Promise.resolve().then(() => require("../../config.js"));
+      const projectRoot = cg.getProjectRoot();
+      const config = await loadConfig(projectRoot);
+      if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
+      const db = cg.getDatabase();
+      db.applySecuritySchema();
+      const { AttackSurfaceAnalyzer } = await Promise.resolve().then(() => require("../../security/attack-surface.js"));
+      const analyzer = new AttackSurfaceAnalyzer(db);
+      const result = await analyzer.analyze();
+      if (result.totalRoutes === 0) {
+        return "No route nodes found in the graph. Ensure the project has been indexed with architecture analysis enabled.";
+      }
+      const limit = (0, import_utils.clampLimit)(args.limit, 20);
+      const routes = args.publicOnly === true ? result.criticalPaths.filter((r) => r.exposureLevel === "public") : result.criticalPaths;
+      const lines = [
+        "# Attack Surface",
+        "",
+        `Total routes: ${result.totalRoutes}  Public: ${result.publicRoutes}  Authenticated: ${result.authenticatedRoutes}  Routes with vulns: ${result.routesWithVulns}`,
+        ""
+      ];
+      const displayed = routes.slice(0, limit);
+      if (displayed.length === 0) {
+        lines.push(args.publicOnly === true ? "No public routes with vulnerable dependencies found." : "No routes with vulnerable dependencies found.");
+      } else {
+        for (const entry of displayed) {
+          const authTag = entry.isAuthenticated ? "[auth]" : "[public]";
+          const riskTag = entry.riskScore > 0 ? ` risk=${entry.riskScore.toFixed(1)}` : "";
+          lines.push(`${authTag} ${entry.route} (${entry.exposureLevel})${riskTag}  ${entry.filePath}`);
+          for (const dep of entry.vulnerableDeps.slice(0, 3)) {
+            lines.push(`  \u2514 ${dep.cveId} via ${dep.packageName} (${dep.hopCount} hop${dep.hopCount !== 1 ? "s" : ""}${dep.verdict ? `, ${dep.verdict}` : ""})`);
+          }
+          if (entry.vulnerableDeps.length > 3) {
+            lines.push(`  \u2514 \u2026and ${entry.vulnerableDeps.length - 3} more vulns`);
+          }
+        }
+        if (routes.length > limit) {
+          lines.push("", `\u2026and ${routes.length - limit} more routes (increase limit to see all)`);
+        }
+      }
+      return (0, import_utils.truncate)(lines.join("\n"));
+    }
+    case "kirograph_secrets": {
+      const { loadConfig } = await Promise.resolve().then(() => require("../../config.js"));
+      const projectRoot = cg.getProjectRoot();
+      const config = await loadConfig(projectRoot);
+      if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
+      const db = cg.getDatabase();
+      db.applySecuritySchema();
+      const { SecretsScanner } = await Promise.resolve().then(() => require("../../security/secrets.js"));
+      const scanner = new SecretsScanner(db, projectRoot);
+      const result = await scanner.scan({ includeTests: args.includeTests === true });
+      if (result.totalFindings === 0) {
+        return `No secrets found. Scanned ${result.filesScanned} file${result.filesScanned !== 1 ? "s" : ""}.`;
+      }
+      let findings = result.findings;
+      if (args.severity) {
+        findings = findings.filter((f) => f.severity === args.severity);
+      }
+      if (findings.length === 0) {
+        return `No secrets found matching severity "${args.severity}". Total findings (all severities): ${result.totalFindings}.`;
+      }
+      const lines = [
+        `# Secrets Scan (${result.filesScanned} files scanned)`,
+        "",
+        `Found: ${result.totalFindings}  Critical: ${result.criticalCount}  High: ${result.highCount}`,
+        ""
+      ];
+      for (const f of findings) {
+        lines.push(`${f.severity.toUpperCase()}  ${f.type}`);
+        lines.push(`  ${f.filePath}:${f.line}:${f.column}  snippet: ${f.snippet}`);
+        if (f.nodeName) {
+          lines.push(`  in function: ${f.nodeName}`);
+        }
+        if (f.entryPointCount > 0) {
+          lines.push(`  reachable from ${f.entryPointCount} entry point${f.entryPointCount !== 1 ? "s" : ""}`);
+        }
+      }
+      return (0, import_utils.truncate)(lines.join("\n"));
+    }
+    case "kirograph_security_flows": {
+      const { loadConfig } = await Promise.resolve().then(() => require("../../config.js"));
+      const projectRoot = cg.getProjectRoot();
+      const config = await loadConfig(projectRoot);
+      if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
+      const db = cg.getDatabase();
+      db.applySecuritySchema();
+      const { DataFlowAnalyzer } = await Promise.resolve().then(() => require("../../security/data-flows.js"));
+      const analyzer = new DataFlowAnalyzer(db);
+      let findings = await analyzer.analyze();
+      const typeFilter = args.type ?? "all";
+      const TYPE_MAP = {
+        sql: "sql-injection",
+        eval: "dangerous-eval",
+        deserialize: "unsafe-deserialize",
+        path: "path-traversal",
+        crypto: "hardcoded-crypto"
+      };
+      if (typeFilter !== "all") {
+        const mapped = TYPE_MAP[typeFilter];
+        if (!mapped) return `Invalid type filter "${typeFilter}". Use: sql, eval, deserialize, path, crypto, all`;
+        findings = findings.filter((f) => f.type === mapped);
+      }
+      if (findings.length === 0) {
+        return typeFilter === "all" ? "No dangerous data flows detected." : `No "${typeFilter}" findings detected.`;
+      }
+      const lines = [
+        `# Security Flows (${findings.length} finding${findings.length !== 1 ? "s" : ""})`,
+        ""
+      ];
+      for (const f of findings) {
+        lines.push(`${f.severity.toUpperCase()}  [${f.owaspCategory}]  ${f.type}`);
+        lines.push(`  ${f.filePath}:${f.line}  symbol: ${f.symbol}`);
+        lines.push(`  ${f.description}`);
+        lines.push(`  Fix: ${f.recommendation}`);
+        lines.push("");
+      }
+      return (0, import_utils.truncate)(lines.join("\n"));
+    }
+    case "kirograph_supply_chain": {
+      const { loadConfig } = await Promise.resolve().then(() => require("../../config.js"));
+      const projectRoot = cg.getProjectRoot();
+      const config = await loadConfig(projectRoot);
+      if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
+      const db = cg.getDatabase();
+      db.applySecuritySchema();
+      const { SupplyChainChecker } = await Promise.resolve().then(() => require("../../security/supply-chain.js"));
+      const checker = new SupplyChainChecker(db);
+      const { results, errors } = await checker.checkAll();
+      const RISK_ORDER = { critical: 0, high: 1, medium: 2, low: 3, unknown: 4 };
+      const thresholdArg = args.threshold;
+      const thresholdOrder = thresholdArg ? RISK_ORDER[thresholdArg] ?? 4 : 2;
+      const filtered = results.filter((r) => (RISK_ORDER[r.riskLevel] ?? 4) <= thresholdOrder).sort((a, b) => (RISK_ORDER[a.riskLevel] ?? 4) - (RISK_ORDER[b.riskLevel] ?? 4));
+      if (filtered.length === 0) {
+        return `No supply chain risks found at threshold "${thresholdArg ?? "medium"}" or above. Checked ${results.length} dependencies.`;
+      }
+      const lines = [
+        `# Supply Chain Health (${filtered.length} risks, threshold: ${thresholdArg ?? "medium"})`,
+        ""
+      ];
+      for (const r of filtered) {
+        const scoreStr = r.scorecardScore !== null ? ` scorecard=${r.scorecardScore.toFixed(1)}/10` : "";
+        const maintainerStr = r.maintainerCount !== null ? ` maintainers=${r.maintainerCount}` : "";
+        lines.push(`${r.riskLevel.toUpperCase()}  ${r.packageName} (${r.ecosystem})${scoreStr}${maintainerStr}`);
+        for (const reason of r.riskReasons) {
+          lines.push(`  \u2022 ${reason}`);
+        }
+      }
+      if (errors.length > 0) {
+        lines.push("", `\u26A0 ${errors.length} package${errors.length !== 1 ? "s" : ""} could not be checked (network errors)`);
+      }
+      return (0, import_utils.truncate)(lines.join("\n"));
+    }
+    case "kirograph_dep_confusion": {
+      const { loadConfig } = await Promise.resolve().then(() => require("../../config.js"));
+      const projectRoot = cg.getProjectRoot();
+      const config = await loadConfig(projectRoot);
+      if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
+      const db = cg.getDatabase();
+      db.applySecuritySchema();
+      const { DepConfusionChecker } = await Promise.resolve().then(() => require("../../security/dep-confusion.js"));
+      const checker = new DepConfusionChecker(db);
+      const findings = await checker.check();
+      if (findings.length === 0) {
+        return "No dependency confusion vulnerabilities detected.";
+      }
+      const RISK_ORDER = { critical: 0, high: 1, medium: 2 };
+      const sorted = [...findings].sort((a, b) => (RISK_ORDER[a.riskLevel] ?? 3) - (RISK_ORDER[b.riskLevel] ?? 3));
+      const lines = [
+        `# Dependency Confusion (${findings.length} finding${findings.length !== 1 ? "s" : ""})`,
+        ""
+      ];
+      for (const f of sorted) {
+        lines.push(`${f.riskLevel.toUpperCase()}  ${f.packageName} (${f.ecosystem})`);
+        lines.push(`  ${f.explanation}`);
+        if (f.publicExists && f.publicVersion) {
+          lines.push(`  Public version: ${f.publicVersion}${f.publicPublishedAt ? `  published: ${f.publicPublishedAt}` : ""}`);
+        }
+      }
+      return (0, import_utils.truncate)(lines.join("\n"));
+    }
+    case "kirograph_remediation": {
+      const { loadConfig } = await Promise.resolve().then(() => require("../../config.js"));
+      const projectRoot = cg.getProjectRoot();
+      const config = await loadConfig(projectRoot);
+      if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
+      const db = cg.getDatabase();
+      db.applySecuritySchema();
+      const { RemediationTracker } = await Promise.resolve().then(() => require("../../security/remediation.js"));
+      const tracker = new RemediationTracker(db);
+      let statuses = tracker.getStatus();
+      if (args.overdueOnly === true) {
+        statuses = statuses.filter((s) => s.isOverdue);
+      }
+      if (statuses.length === 0) {
+        return args.overdueOnly === true ? "No overdue vulnerabilities found." : "No open vulnerabilities with SLA tracking data found.";
+      }
+      const SLA_ORDER = { overdue: 0, warning: 1, no_fix: 2, ok: 3 };
+      statuses.sort((a, b) => {
+        const slaA = SLA_ORDER[a.slaStatus] ?? 3;
+        const slaB = SLA_ORDER[b.slaStatus] ?? 3;
+        if (slaA !== slaB) return slaA - slaB;
+        return (b.severity ?? 0) - (a.severity ?? 0);
+      });
+      const overdueCount = statuses.filter((s) => s.isOverdue).length;
+      const warningCount = statuses.filter((s) => s.slaStatus === "warning").length;
+      const lines = [
+        `# Remediation SLA (${statuses.length} open${overdueCount > 0 ? `, ${overdueCount} overdue` : ""}${warningCount > 0 ? `, ${warningCount} warning` : ""})`,
+        ""
+      ];
+      for (const s of statuses) {
+        const severityLabel = s.severity == null ? "UNKNOWN" : s.severity >= 9 ? "CRITICAL" : s.severity >= 7 ? "HIGH" : s.severity >= 4 ? "MEDIUM" : "LOW";
+        const slaTag = s.slaStatus === "overdue" ? "[OVERDUE]" : s.slaStatus === "warning" ? "[WARNING]" : s.slaStatus === "no_fix" ? "[NO_FIX]" : "[OK]";
+        lines.push(`${slaTag}  ${severityLabel}  ${s.cveId}  ${s.packageName}`);
+        if (s.daysOpen !== null) lines.push(`  Open for ${s.daysOpen} day${s.daysOpen !== 1 ? "s" : ""}`);
+        if (s.daysWithFixAvailable !== null) lines.push(`  Fix available for ${s.daysWithFixAvailable} day${s.daysWithFixAvailable !== 1 ? "s" : ""}`);
+        if (s.slaDeadline !== null) {
+          const deadlineDate = new Date(s.slaDeadline).toISOString().slice(0, 10);
+          lines.push(`  SLA deadline: ${deadlineDate}`);
+        }
+      }
+      return (0, import_utils.truncate)(lines.join("\n"));
+    }
+    default:
+      return `Unknown tool: ${toolName}`;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  handleSecurity
+});
+//# sourceMappingURL=security.js.map