nayan-ai 1.0.0-beta.3 → 1.0.0-beta.5

package/dist/scan/command.js

@@ -0,0 +1,700 @@
+import chalk from 'chalk';
+import ora from 'ora';
+import { execSync } from 'child_process';
+import * as fs from 'fs';
+import * as path from 'path';
+import { cloneRepoForScan, parseRepoReference } from '../common/github.js';
+import { analyzeWithCodex } from '../common/codex.js';
+import { analyzeWithClaude } from '../common/claude.js';
+import { getScanPrompt } from './prompt.js';
+import { VALID_LLM_PROVIDERS, checkLLMAvailability } from '../common/utils.js';
+import { fixVulnerabilities, runFixWorkflow } from './fixer.js';
+const PROJECT_MARKERS = {
+    npm: { manifest: 'package.json', lockFiles: ['package-lock.json', 'yarn.lock', 'pnpm-lock.yaml', 'bun.lockb'] },
+    python: { manifest: 'requirements.txt', lockFiles: ['Pipfile.lock', 'poetry.lock'] },
+    go: { manifest: 'go.mod', lockFiles: ['go.sum'] },
+    rust: { manifest: 'Cargo.toml', lockFiles: ['Cargo.lock'] },
+    ruby: { manifest: 'Gemfile', lockFiles: ['Gemfile.lock'] },
+    php: { manifest: 'composer.json', lockFiles: ['composer.lock'] },
+    java: { manifest: 'pom.xml', lockFiles: [] },
+    dotnet: { manifest: '*.csproj', lockFiles: ['packages.lock.json'] },
+};
+export const scanCommand = async (repoUrl, options) => {
+    try {
+        if (!VALID_LLM_PROVIDERS.includes(options.llm)) {
+            console.error(chalk.red(`Error: Invalid LLM provider '${options.llm}'. Valid options: ${VALID_LLM_PROVIDERS.join(', ')}`));
+            process.exit(1);
+        }
+        checkLLMAvailability(options.llm);
+        const repoInfo = parseRepoReference(repoUrl);
+        console.log(chalk.bold.blue('\n🤖 Nayan AI - Vulnerability Scanner'));
+        console.log('━'.repeat(40));
+        console.log(`  Repository: ${chalk.cyan(`${repoInfo.owner}/${repoInfo.repo}`)}`);
+        console.log(`  LLM:        ${chalk.cyan(options.llm === 'claude' ? 'Claude Code' : 'Codex')}`);
+        if (repoInfo.githubUrl)
+            console.log(`  GitHub:     ${chalk.cyan(repoInfo.githubUrl)}`);
+        if (options.paths)
+            console.log(`  Paths:      ${chalk.cyan(options.paths)}`);
+        if (options.fix)
+            console.log(`  Mode:       ${chalk.green('Auto-fix enabled (will create PR)')}`);
+        console.log('━'.repeat(40) + '\n');
+        // Clone repository
+        let spinner = ora('Cloning repository...').start();
+        const repo = await cloneRepoForScan(repoInfo, options.token);
+        spinner.succeed('Repository cloned');
+        const targetPath = repo.path;
+        let projects;
+        try {
+            if (options.paths) {
+                // User specified paths to scan for projects
+                const scanPaths = options.paths.split(',').map(p => p.trim());
+                projects = [];
+                for (const scanPath of scanPaths) {
+                    const fullPath = path.join(targetPath, scanPath);
+                    spinner = ora(`Detecting projects in ${scanPath}...`).start();
+                    const detected = detectProjects(fullPath);
+                    if (detected.length > 0) {
+                        projects.push(...detected);
+                        spinner.succeed(`Found ${detected.length} project(s) in ${scanPath}`);
+                    }
+                    else {
+                        spinner.warn(`No supported projects found in ${scanPath}`);
+                    }
+                }
+            }
+            else {
+                // Auto-detect all projects in repo root
+                spinner = ora('Detecting projects...').start();
+                projects = detectProjects(targetPath);
+                spinner.succeed(`Found ${projects.length} project(s)`);
+            }
+            if (projects.length === 0) {
+                console.log(chalk.yellow('\nNo supported projects found.'));
+                console.log(chalk.gray('Supported: npm, Python, Go, Rust, Ruby, PHP, Java (Maven), .NET'));
+                return;
+            }
+            const results = [];
+            for (const project of projects) {
+                const relativePath = path.relative(targetPath, project.path) || '.';
+                spinner = ora(`Scanning ${chalk.cyan(project.type)} project: ${relativePath}`).start();
+                try {
+                    // Native scanner is the primary source of truth for consistent CVE detection
+                    const nativeVulns = await scanProjectNative(project);
+                    spinner.succeed(`Native scan complete for ${project.type} (${relativePath}) - ${nativeVulns.length} vulnerabilities`);
+                    // Use native results as the base - AI adds supplementary analysis
+                    let allVulns = [...nativeVulns];
+                    // Always run AI analysis:
+                    // - If native found vulns: AI verifies and adds context
+                    // - If native found nothing: AI may find vulns that native missed (e.g., no lock file)
+                    const llmName = options.llm === 'claude' ? 'Claude Code' : 'Codex';
+                    console.log(chalk.cyan(`  Running AI analysis with ${llmName}...\n`));
+                    try {
+                        const aiVulns = await scanProjectWithAI(project, options, nativeVulns);
+                        if (nativeVulns.length > 0) {
+                            // Native found vulns - only add NEW AI findings
+                            const newAiVulns = aiVulns.filter(av => !nativeVulns.some(nv => nv.package === av.package && nv.version === av.version));
+                            if (newAiVulns.length > 0) {
+                                console.log(chalk.gray(`  AI found ${newAiVulns.length} additional potential issues`));
+                                allVulns = [...nativeVulns, ...newAiVulns];
+                            }
+                        }
+                        else {
+                            // Native found nothing - use AI results as primary
+                            allVulns = aiVulns;
+                            if (aiVulns.length > 0) {
+                                console.log(chalk.gray(`  AI detected ${aiVulns.length} vulnerabilities`));
+                            }
+                        }
+                    }
+                    catch (aiError) {
+                        // AI failure should not affect native results
+                        console.log(chalk.gray(`  AI analysis skipped: ${aiError instanceof Error ? aiError.message : String(aiError)}`));
+                    }
+                    results.push({
+                        projectPath: project.path,
+                        projectType: project.type,
+                        vulnerabilities: allVulns,
+                    });
+                    if (allVulns.length === 0) {
+                        console.log(chalk.green(`  ✔ ${project.type} (${relativePath}): No vulnerabilities found`));
+                    }
+                    else {
+                        console.log(chalk.yellow(`  ⚠ ${project.type} (${relativePath}): ${allVulns.length} vulnerabilities found`));
+                    }
+                }
+                catch (error) {
+                    console.log(chalk.red(`  ✖ ${project.type} (${relativePath}): Scan failed`));
+                    console.log(chalk.gray(`    ${error instanceof Error ? error.message : String(error)}`));
+                }
+            }
+            // Display results
+            console.log(chalk.bold('\n📋 Scan Summary'));
+            console.log('─'.repeat(41));
+            if (options.format === 'json') {
+                console.log(JSON.stringify(results, null, 2));
+            }
+            else {
+                printScanResults(results, targetPath);
+            }
+            const totalVulns = results.reduce((sum, r) => sum + r.vulnerabilities.length, 0);
+            if (totalVulns > 0) {
+                console.log(chalk.yellow(`\n⚠ Found ${totalVulns} total vulnerabilities across ${results.length} project(s)`));
+                // Generate fixes and show in summary
+                console.log(chalk.bold.blue('\n🔧 Suggested Fixes'));
+                console.log('─'.repeat(41));
+                const fixResults = [];
+                for (const result of results) {
+                    if (result.vulnerabilities.length === 0)
+                        continue;
+                    const project = projects.find(p => p.path === result.projectPath);
+                    if (!project)
+                        continue;
+                    const relativePath = path.relative(targetPath, result.projectPath) || '.';
+                    console.log(chalk.cyan(`\n  Generating fixes for ${project.type} (${relativePath})...`));
+                    const fixResult = await fixVulnerabilities(project, result.vulnerabilities, options);
+                    if (fixResult) {
+                        fixResults.push(fixResult);
+                        console.log(chalk.green(`  ✔ Generated ${fixResult.fixes.length} fixes`));
+                        // Show fix details in summary
+                        printFixSummary(fixResult);
+                        if (fixResult.breakingChanges.length > 0) {
+                            console.log(chalk.yellow(`\n    ⚠ Potential breaking changes:`));
+                            fixResult.breakingChanges.forEach(c => console.log(chalk.yellow(`      - ${c}`)));
+                        }
+                    }
+                }
+                // Only create PR if --fix flag is used
+                if (options.fix && fixResults.length > 0) {
+                    console.log(chalk.bold('\n📤 Creating Pull Request'));
+                    console.log('─'.repeat(41));
+                    await runFixWorkflow(targetPath, repoInfo, fixResults, options);
+                }
+                else if (fixResults.length > 0) {
+                    console.log(chalk.gray('\n  💡 Use --fix flag to automatically create a PR with these fixes'));
+                }
+                else {
+                    console.log(chalk.yellow('\n  No fixes could be generated'));
+                }
+            }
+            else {
+                console.log(chalk.green('\n✅ No vulnerabilities found!\n'));
+            }
+        }
+        finally {
+            await repo.cleanup();
+        }
+    }
+    catch (error) {
+        console.error(chalk.red('\nError:'), error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    }
+};
+function detectProjects(rootPath, maxDepth = 5) {
+    const projects = [];
+    function scan(dir, depth) {
+        if (depth > maxDepth)
+            return;
+        try {
+            const entries = fs.readdirSync(dir, { withFileTypes: true });
+            // Check for project markers in current directory
+            for (const [type, markers] of Object.entries(PROJECT_MARKERS)) {
+                const manifestPattern = markers.manifest;
+                let hasManifest = false;
+                if (manifestPattern.includes('*')) {
+                    // Glob pattern (e.g., *.csproj)
+                    const ext = manifestPattern.replace('*', '');
+                    hasManifest = entries.some(e => e.isFile() && e.name.endsWith(ext));
+                }
+                else {
+                    hasManifest = entries.some(e => e.isFile() && e.name === manifestPattern);
+                }
+                if (hasManifest) {
+                    const lockFile = markers.lockFiles.find(lf => entries.some(e => e.isFile() && e.name === lf));
+                    projects.push({
+                        path: dir,
+                        type,
+                        lockFile: lockFile ? path.join(dir, lockFile) : undefined,
+                    });
+                }
+            }
+            // Recurse into subdirectories (skip node_modules, vendor, etc.)
+            const skipDirs = ['node_modules', 'vendor', '.git', 'dist', 'build', '__pycache__', 'venv', '.venv', 'target'];
+            for (const entry of entries) {
+                if (entry.isDirectory() && !skipDirs.includes(entry.name)) {
+                    scan(path.join(dir, entry.name), depth + 1);
+                }
+            }
+        }
+        catch {
+            // Permission denied or other error, skip
+        }
+    }
+    scan(rootPath, 0);
+    return projects;
+}
+function detectProjectType(projectPath) {
+    if (!fs.existsSync(projectPath))
+        return null;
+    const stat = fs.statSync(projectPath);
+    const dir = stat.isDirectory() ? projectPath : path.dirname(projectPath);
+    try {
+        const entries = fs.readdirSync(dir);
+        for (const [type, markers] of Object.entries(PROJECT_MARKERS)) {
+            const manifestPattern = markers.manifest;
+            let hasManifest = false;
+            if (manifestPattern.includes('*')) {
+                const ext = manifestPattern.replace('*', '');
+                hasManifest = entries.some(e => e.endsWith(ext));
+            }
+            else {
+                hasManifest = entries.includes(manifestPattern);
+            }
+            if (hasManifest) {
+                const lockFile = markers.lockFiles.find(lf => entries.includes(lf));
+                return {
+                    path: dir,
+                    type,
+                    lockFile: lockFile ? path.join(dir, lockFile) : undefined,
+                };
+            }
+        }
+    }
+    catch {
+        // Permission denied or other error
+    }
+    return null;
+}
+const scanProjectNative = async (project) => {
+    switch (project.type) {
+        case 'npm': return scanNpm(project.path);
+        case 'python': return scanPython(project.path);
+        case 'go': return scanGo(project.path);
+        case 'rust': return scanRust(project.path);
+        case 'ruby': return scanRuby(project.path);
+        case 'php': return scanPhp(project.path);
+        case 'java': return scanJava(project.path);
+        case 'dotnet': return scanDotnet(project.path);
+        default: return [];
+    }
+};
+const getManifestContent = (project) => {
+    const manifestFiles = {
+        npm: 'package.json',
+        python: 'requirements.txt',
+        go: 'go.mod',
+        rust: 'Cargo.toml',
+        ruby: 'Gemfile',
+        php: 'composer.json',
+        java: 'pom.xml',
+        dotnet: '*.csproj',
+    };
+    const manifestName = manifestFiles[project.type];
+    if (manifestName.includes('*')) {
+        const ext = manifestName.replace('*', '');
+        const files = fs.readdirSync(project.path);
+        const match = files.find(f => f.endsWith(ext));
+        if (match) {
+            return fs.readFileSync(path.join(project.path, match), 'utf-8');
+        }
+        return '';
+    }
+    const manifestPath = path.join(project.path, manifestName);
+    if (fs.existsSync(manifestPath)) {
+        return fs.readFileSync(manifestPath, 'utf-8');
+    }
+    if (project.lockFile && fs.existsSync(project.lockFile)) {
+        return fs.readFileSync(project.lockFile, 'utf-8');
+    }
+    return '';
+};
+const scanProjectWithAI = async (project, options, nativeVulns = []) => {
+    const manifestContent = getManifestContent(project);
+    if (!manifestContent)
+        return [];
+    const prompt = getScanPrompt(project.type, manifestContent.slice(0, 10000), nativeVulns);
+    const llmOptions = { verbose: options.verbose };
+    try {
+        const issues = options.llm === 'claude'
+            ? await analyzeWithClaude(project.path, prompt, llmOptions)
+            : await analyzeWithCodex(project.path, prompt, llmOptions);
+        return issues
+            .filter((issue) => issue.package || issue.filename)
+            .map((issue) => ({
+            package: issue.package || issue.filename || 'unknown',
+            version: issue.version || 'unknown',
+            severity: mapSeverity(issue.severity || 'medium'),
+            title: issue.title || issue.message || 'AI-detected vulnerability',
+            description: issue.description || issue.suggestion,
+            fixedIn: issue.fixedIn,
+            cve: issue.cve,
+        }));
+    }
+    catch (error) {
+        console.log(chalk.gray(`    AI analysis failed: ${error instanceof Error ? error.message : String(error)}`));
+        return [];
+    }
+};
+const mergeVulnerabilities = (native, ai) => {
+    const seen = new Set(native.map(v => `${v.package}@${v.version}`));
+    const unique = ai.filter(v => !seen.has(`${v.package}@${v.version}`));
+    return [...native, ...unique];
+};
+function scanNpm(projectPath) {
+    try {
+        // Check if package-lock.json exists, generate if missing
+        const lockPath = path.join(projectPath, 'package-lock.json');
+        const yarnLockPath = path.join(projectPath, 'yarn.lock');
+        const pnpmLockPath = path.join(projectPath, 'pnpm-lock.yaml');
+        if (!fs.existsSync(lockPath) && !fs.existsSync(yarnLockPath) && !fs.existsSync(pnpmLockPath)) {
+            console.log(chalk.gray('    No lock file found, skipping native audit (AI will analyze package.json)'));
+            // Skip npm install - it can hang on private registries or slow networks
+            // AI analysis will still work by reading package.json directly
+            return [];
+        }
+        const result = execSync('npm audit --json 2>&1 || true', {
+            cwd: projectPath,
+            encoding: 'utf-8',
+            maxBuffer: 10 * 1024 * 1024,
+        });
+        // Parse result - handle both success and error cases
+        let audit = {};
+        try {
+            audit = JSON.parse(result);
+        }
+        catch {
+            // npm audit may return non-JSON on error
+            return [];
+        }
+        const vulnerabilities = [];
+        const seenPackages = new Set();
+        if (audit.vulnerabilities) {
+            for (const [pkg, data] of Object.entries(audit.vulnerabilities)) {
+                // Skip if we've already processed this package
+                if (seenPackages.has(pkg))
+                    continue;
+                seenPackages.add(pkg);
+                const via = data.via?.[0];
+                // Extract CVE from via object - only use name if it looks like a CVE ID
+                let cve;
+                if (typeof via === 'object') {
+                    if (via.cve) {
+                        cve = via.cve;
+                    }
+                    else if (via.name && /^CVE-\d{4}-\d+$/.test(via.name)) {
+                        cve = via.name;
+                    }
+                    else if (via.url) {
+                        const match = via.url.match(/CVE-\d{4}-\d+/);
+                        cve = match ? match[0] : undefined;
+                    }
+                }
+                // Get the actual installed version from nodes if available
+                const installedVersion = audit.metadata?.dependencies?.[pkg]?.version || data.range || 'unknown';
+                vulnerabilities.push({
+                    package: pkg,
+                    version: installedVersion,
+                    severity: mapSeverity(data.severity),
+                    title: typeof via === 'object' ? (via.title || 'Vulnerability found') : (via || 'Vulnerability found'),
+                    description: typeof via === 'object' ? via.url : undefined,
+                    fixedIn: data.fixAvailable?.version,
+                    cve: cve,
+                });
+            }
+        }
+        return vulnerabilities;
+    }
+    catch {
+        return [];
+    }
+}
+function scanPython(projectPath) {
+    try {
+        // Try pip-audit first
+        const result = execSync('pip-audit --format json 2>/dev/null || python -m pip_audit --format json 2>/dev/null || true', {
+            cwd: projectPath,
+            encoding: 'utf-8',
+            maxBuffer: 10 * 1024 * 1024,
+        });
+        if (!result.trim())
+            return [];
+        const audit = JSON.parse(result);
+        return audit.map((v) => ({
+            package: v.name,
+            version: v.version,
+            severity: mapSeverity(v.vulns?.[0]?.fix_versions ? 'high' : 'medium'),
+            title: v.vulns?.[0]?.id || 'Vulnerability found',
+            description: v.vulns?.[0]?.description,
+            fixedIn: v.vulns?.[0]?.fix_versions?.[0],
+            cve: v.vulns?.[0]?.id,
+        }));
+    }
+    catch {
+        return [];
+    }
+}
+function scanGo(projectPath) {
+    try {
+        const result = execSync('govulncheck -json ./... 2>/dev/null || true', {
+            cwd: projectPath,
+            encoding: 'utf-8',
+            maxBuffer: 10 * 1024 * 1024,
+        });
+        if (!result.trim())
+            return [];
+        const vulnerabilities = [];
+        const lines = result.split('\n').filter(l => l.trim());
+        for (const line of lines) {
+            try {
+                const entry = JSON.parse(line);
+                if (entry.vulnerability) {
+                    vulnerabilities.push({
+                        package: entry.vulnerability.module_path || 'unknown',
+                        version: entry.vulnerability.package_version || 'unknown',
+                        severity: mapSeverity('high'),
+                        title: entry.vulnerability.id || 'Vulnerability found',
+                        description: entry.vulnerability.details,
+                        cve: entry.vulnerability.id,
+                    });
+                }
+            }
+            catch {
+                // Skip non-JSON lines
+            }
+        }
+        return vulnerabilities;
+    }
+    catch {
+        return [];
+    }
+}
+function scanRust(projectPath) {
+    try {
+        const result = execSync('cargo audit --json 2>/dev/null || true', {
+            cwd: projectPath,
+            encoding: 'utf-8',
+            maxBuffer: 10 * 1024 * 1024,
+        });
+        if (!result.trim())
+            return [];
+        const audit = JSON.parse(result);
+        const vulnerabilities = [];
+        if (audit.vulnerabilities?.list) {
+            for (const v of audit.vulnerabilities.list) {
+                vulnerabilities.push({
+                    package: v.package?.name || 'unknown',
+                    version: v.package?.version || 'unknown',
+                    severity: mapSeverity(v.advisory?.severity || 'medium'),
+                    title: v.advisory?.title || 'Vulnerability found',
+                    description: v.advisory?.description,
+                    fixedIn: v.versions?.patched?.[0],
+                    cve: v.advisory?.id,
+                });
+            }
+        }
+        return vulnerabilities;
+    }
+    catch {
+        return [];
+    }
+}
+function scanRuby(projectPath) {
+    try {
+        const result = execSync('bundle audit check --format json 2>/dev/null || true', {
+            cwd: projectPath,
+            encoding: 'utf-8',
+            maxBuffer: 10 * 1024 * 1024,
+        });
+        if (!result.trim())
+            return [];
+        const audit = JSON.parse(result);
+        return (audit.results || []).map((v) => ({
+            package: v.gem?.name || 'unknown',
+            version: v.gem?.version || 'unknown',
+            severity: mapSeverity(v.advisory?.criticality || 'medium'),
+            title: v.advisory?.title || 'Vulnerability found',
+            description: v.advisory?.description,
+            fixedIn: v.advisory?.patched_versions?.[0],
+            cve: v.advisory?.cve,
+        }));
+    }
+    catch {
+        return [];
+    }
+}
+function scanPhp(projectPath) {
+    try {
+        const result = execSync('composer audit --format json 2>/dev/null || true', {
+            cwd: projectPath,
+            encoding: 'utf-8',
+            maxBuffer: 10 * 1024 * 1024,
+        });
+        if (!result.trim())
+            return [];
+        const audit = JSON.parse(result);
+        const vulnerabilities = [];
+        if (audit.advisories) {
+            for (const [pkg, advisories] of Object.entries(audit.advisories)) {
+                for (const adv of advisories) {
+                    vulnerabilities.push({
+                        package: pkg,
+                        version: adv.affectedVersions || 'unknown',
+                        severity: mapSeverity('high'),
+                        title: adv.title || 'Vulnerability found',
+                        description: adv.link,
+                        cve: adv.cve,
+                    });
+                }
+            }
+        }
+        return vulnerabilities;
+    }
+    catch {
+        return [];
+    }
+}
+function scanJava(projectPath) {
+    try {
+        // Try OWASP dependency-check if available
+        execSync('mvn org.owasp:dependency-check-maven:check -Dformat=JSON 2>/dev/null || true', {
+            cwd: projectPath,
+            encoding: 'utf-8',
+            maxBuffer: 10 * 1024 * 1024,
+            timeout: 300000, // 5 minutes
+        });
+        // Parse dependency-check report if it exists
+        const reportPath = path.join(projectPath, 'target', 'dependency-check-report.json');
+        if (fs.existsSync(reportPath)) {
+            const report = JSON.parse(fs.readFileSync(reportPath, 'utf-8'));
+            const vulnerabilities = [];
+            for (const dep of report.dependencies || []) {
+                for (const vuln of dep.vulnerabilities || []) {
+                    vulnerabilities.push({
+                        package: dep.fileName || 'unknown',
+                        version: dep.version || 'unknown',
+                        severity: mapSeverity(vuln.severity?.toLowerCase() || 'medium'),
+                        title: vuln.name || 'Vulnerability found',
+                        description: vuln.description,
+                        cve: vuln.name,
+                    });
+                }
+            }
+            return vulnerabilities;
+        }
+        return [];
+    }
+    catch {
+        return [];
+    }
+}
+function scanDotnet(projectPath) {
+    try {
+        const result = execSync('dotnet list package --vulnerable --format json 2>/dev/null || true', {
+            cwd: projectPath,
+            encoding: 'utf-8',
+            maxBuffer: 10 * 1024 * 1024,
+        });
+        if (!result.trim())
+            return [];
+        const audit = JSON.parse(result);
+        const vulnerabilities = [];
+        for (const project of audit.projects || []) {
+            for (const framework of project.frameworks || []) {
+                for (const pkg of framework.topLevelPackages || []) {
+                    for (const vuln of pkg.vulnerabilities || []) {
+                        vulnerabilities.push({
+                            package: pkg.id || 'unknown',
+                            version: pkg.resolvedVersion || 'unknown',
+                            severity: mapSeverity(vuln.severity?.toLowerCase() || 'medium'),
+                            title: vuln.advisoryurl || 'Vulnerability found',
+                            description: vuln.advisoryurl,
+                        });
+                    }
+                }
+            }
+        }
+        return vulnerabilities;
+    }
+    catch {
+        return [];
+    }
+}
+function mapSeverity(severity) {
+    const s = severity?.toLowerCase() || 'medium';
+    if (s === 'critical')
+        return 'critical';
+    if (s === 'high')
+        return 'high';
+    if (s === 'moderate' || s === 'medium')
+        return 'medium';
+    return 'low';
+}
+const printScanResults = (results, rootPath) => {
+    const totalVulns = results.reduce((sum, r) => sum + r.vulnerabilities.length, 0);
+    if (totalVulns === 0) {
+        console.log(chalk.green('  No vulnerabilities found in any project.'));
+        return;
+    }
+    // Print per-project details
+    for (const result of results) {
+        if (result.vulnerabilities.length === 0)
+            continue;
+        const relativePath = path.relative(rootPath, result.projectPath) || '.';
+        console.log(chalk.bold(`\n  📦 ${result.projectType.toUpperCase()} - ${relativePath}`));
+        console.log('  ' + '─'.repeat(38));
+        const bySeverity = {
+            critical: result.vulnerabilities.filter(v => v.severity === 'critical'),
+            high: result.vulnerabilities.filter(v => v.severity === 'high'),
+            medium: result.vulnerabilities.filter(v => v.severity === 'medium'),
+            low: result.vulnerabilities.filter(v => v.severity === 'low'),
+        };
+        if (bySeverity.critical.length > 0) {
+            console.log(chalk.red.bold(`\n    🔴 Critical (${bySeverity.critical.length}):`));
+            bySeverity.critical.forEach(printVulnerability);
+        }
+        if (bySeverity.high.length > 0) {
+            console.log(chalk.red(`\n    🟠 High (${bySeverity.high.length}):`));
+            bySeverity.high.forEach(printVulnerability);
+        }
+        if (bySeverity.medium.length > 0) {
+            console.log(chalk.yellow(`\n    🟡 Medium (${bySeverity.medium.length}):`));
+            bySeverity.medium.forEach(printVulnerability);
+        }
+        if (bySeverity.low.length > 0) {
+            console.log(chalk.blue(`\n    🔵 Low (${bySeverity.low.length}):`));
+            bySeverity.low.forEach(printVulnerability);
+        }
+    }
+};
+const printVulnerability = (vuln) => {
+    console.log(`      ${chalk.bold(vuln.package)}@${vuln.version}`);
+    console.log(chalk.gray(`        ${vuln.title}`));
+    if (vuln.description && vuln.description !== vuln.title) {
+        const desc = vuln.description.length > 80 ? vuln.description.slice(0, 77) + '...' : vuln.description;
+        console.log(chalk.dim(`        ${desc}`));
+    }
+    if (vuln.cve) {
+        console.log(chalk.cyan(`        CVE: ${vuln.cve}`));
+    }
+    if (vuln.fixedIn) {
+        console.log(chalk.green(`        💡 Fix: upgrade to ${vuln.fixedIn}`));
+    }
+};
+const printFixSummary = (fixResult) => {
+    console.log(chalk.bold(`\n    📝 ${fixResult.summary}`));
+    if (fixResult.fixes.length === 0) {
+        console.log(chalk.gray('      No specific fixes generated'));
+        return;
+    }
+    console.log();
+    for (const fix of fixResult.fixes) {
+        const icon = fix.type === 'update' ? '⬆️' : fix.type === 'remove' ? '🗑️' : '➕';
+        const change = fix.type === 'update'
+            ? `${fix.from} → ${fix.to}`
+            : fix.type === 'add'
+                ? fix.version
+                : 'removed';
+        console.log(`      ${icon} ${chalk.bold(fix.package)}: ${chalk.cyan(change)}`);
+        console.log(chalk.gray(`         ${fix.reason}`));
+    }
+};
+//# sourceMappingURL=command.js.map