project-athena 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## 0.5.0 — 2026-10-03
+
+Unified findings: every security check (secrets, dependency audits, review checks) now reports into one findings model with value-free fingerprints, an honest coverage record, and a quality gate driven by an optional committed policy, baseline and triage. New `athena scan` writes text, JSON, Markdown, GitHub annotations or SARIF 2.1.0 for code scanning, and `--policy-from <base>` keeps a pull request from quietly weakening the gate. Static analysis rules arrive in 0.6.0; until then reports say plainly that SAST and IaC are not covered.
+
+### `athena scan` and friends
+
+- New `athena scan`: runs the secret scanner and dependency audits over the whole project, or with `--base <ref>` / `--staged` / `--changed` over a change (adding the review checks), then applies the policy, baseline, triage and inline suppressions and evaluates the quality gate. Exit 1 when the gate fails (`--no-fail` to report only), 2 when Git can't compute the requested change. `--only secrets,deps,review`, `--format text|json|markdown|github|sarif`, `-o <file>`, gate overrides `--fail-on`, `--min-confidence`, `--unrated`, plus `--no-baseline`, `--policy-from <ref>` and `--offline` (audits are skipped and reported as skipped). Full-project scans are saved to `.athena/findings.json`.
+- New `athena baseline show|create|update|prune`, `athena findings list|show|triage` (fingerprint prefixes of 6+ characters; a reason is required and committed) and `athena explain <ruleId>` / `athena scan --list-rules`.
+- New MCP tool `findings`: a read-only summary of the last scan (gate, ratings, coverage gaps, active findings with fingerprints), fenced as untrusted data and never containing secret values. It never starts a scan.
+- `athena security` keeps its flags, output and `--json` shape; it now also writes `.athena/findings.json`.
+
+### Unified findings: secrets, dependencies and review checks
+
+- New `.athena/findings.json` (gitignored): every security check now reports into one findings model with stable, value-free fingerprints, severity (`critical`…`info`, plus `unrated`), confidence, a FACT/DETECTED/INFERRED label, CWE, location or package, the engine that reported it, and a coverage record per engine (files scanned and skipped, tools unavailable/failed/timed out/skipped offline).
+- Secrets: one `secret/<pattern>` finding per match with file, line and column. Private keys and AWS/GCP/Azure credentials are `critical`, other known token formats `high`, keyword heuristics `medium` and marked *potential* (low confidence). Fingerprints hash the line with the matched value masked, so they survive rotating the value and reveal nothing about it; no secret value is ever written.
+- Dependency audits: one `dependency/vulnerable-package` finding per package and advisory (FACT, attributed to `npm-audit`, `pnpm-audit`, `pip-audit`, `govulncheck`, `cargo-audit` or `composer-audit`), with version, lockfile/target, advisory ids, vulnerable range, fixed version and CWE where the tool reports them. `moderate` is now `medium`; a missing severity stays `unrated`. npm packages that are only vulnerable through another reported package are not counted twice.
+- `athena review --json` gains a `scan` object (`scan.findings`, `scan.coverage`) with the checks as `review/<check>` findings (blocker → high, warning → medium, info → info) and added secrets as `secret/*` findings at the exact line. The existing `findings` list, human output and exit codes are unchanged.
+- `athena security` runs on the new scanners and writes both `.athena/findings.json` and the legacy `.athena/security-scan.json` (still used by the web UI and `security.md`). Flags, output, `--fail-on` and `--unrated` behave as before; `--json` keeps the v1 shape — the unified shape will be `athena scan --format json`.
+- A project that only has a `security-scan.json` from an older version is read as findings (its secret count becomes a coverage note, since v1 recorded no lines).
+
+### Policy, baseline, triage and quality gate
+
+- `.athena/policy.json` (optional, committed; `schemaVersion: 1`): `gate` (`failOn` severity, default `high`; `minConfidence`, default `medium`; `unrated: fail|warn`, default `fail`; `scope: new|all`, default `new`; gated `categories`, default secret, dependency, sast, iac, review), per-rule `rules` (`"off"` or a `severity`/`confidence` override; exact ids or `family/*` prefixes), `paths.exclude`/`paths.tests` globs, `licenses.deny`/`warn`, and `external` engines (`semgrep`, `gitleaks`, `trivy`, `osv-scanner`: `auto|off`; `network: allow|deny`). A missing file means defaults. An invalid file, including an unknown key, is an error that names the offending path. It is never silently ignored.
+- `.athena/baseline.json` (committed): records findings that already exist so that only new ones fail the gate (scope `new`). Baselined findings stay visible and still count in ratings. Entries hold only value-free fingerprints, rule ids and files. Pruning needs a full scan and keeps entries of any category whose engine failed or did not run, because a broken engine reports nothing and that must not read as "fixed".
+- `.athena/triage.json` (committed): a reviewed decision per finding (`safe`, `false-positive`, `accepted-risk`, `fixed`, `to-review`), similar to SonarQube's hotspot review. Every decision needs a reason (at most 500 characters). A reason that looks like it contains a secret is refused, and the value is never echoed. `to-review` keeps the finding open.
+- Inline suppressions: `athena-ignore <ruleId> -- <reason>` in a `//`, `#`, `/* */`, `<!-- -->` or `--` comment on the finding's line or the line above. Each comment names one exact rule. A suppression without a reason is ignored and reported as an `info` finding (`review/suppression-without-reason`). A comment with no valid rule id is reported as `review/invalid-suppression`.
+- Every finding gets a status on each run (never stored): `open`, `baselined`, `suppressed`, `triaged:<safe|false-positive|accepted-risk|fixed>` or `excluded`.
+- Quality gate: fails on active findings in gated categories at or above `failOn` with at least `minConfidence` confidence. Unrated findings follow `gate.unrated`. With scope `new`, baselined findings are skipped. The gate also fails when an engine for a gated category failed or timed out, and the result says so explicitly, because an engine that broke checked nothing. Unavailable or skipped engines, and gated categories that nothing scanned, are listed as warnings.
+- Ratings A–E per category, based on the worst active finding: A none, B low/info, C medium, D high, E critical. Unrated counts as D, or C under `unrated: warn`. Each rating comes with a basis ("N rules across <languages>; X files not covered") and no numeric score. A category is not rated when no engine ran for it or one of its engines failed.
+- Anti-tamper for CI (`policyFrom: <ref>`): the gate uses the policy, baseline and triage committed at the base ref (missing there means defaults). Every change to them since `merge-base(ref, HEAD)`, and every added `athena-ignore` comment (tracked or untracked), is reported as `review/policy-weakened`. Severity is `high` when the change relaxes the gate (a higher `failOn` or `minConfidence`, rules turned off or downgraded, new excludes, fewer gated categories, engines turned off, added baseline entries, new closing triage decisions, added suppressions); other changes are `info`. A base-branch policy can downgrade this rule if a team prefers review notes over a failing check.
+
 ## 0.4.0 — 2026-10-03
 
 Agent memory: coding agents can now record what they learn — decisions and why, gotchas, bug root causes, conventions — and later sessions recall it. Memory lives in `.athena/memory/` as plain Markdown you commit and review like code. Anything an agent writes is `unreviewed` (INFERRED) until you confirm it (`athena memory review`, or the Memory page in `athena open`); entries turn `stale` when the files they describe change. Secrets are refused, and text that looks like it is trying to instruct the agent is flagged and kept out of recall.

package/README.md

@@ -62,6 +62,10 @@ Generated content sits between `athena:generated` markers. Anything outside the
 | `athena rules` | `list`, `add "<rule>" --section <name>`, `edit`, `enable`, `disable`, `remove` |
 | `athena agents` | `list`, `add <claude-code\|cursor\|codex\|copilot\|gemini-cli\|antigravity\|windsurf\|cline\|agents-md\|all>`, `remove` |
 | `athena activity` | Show AI agent activity observed through hooks (`-n`, `--agent`) |
+| `athena scan` | Unified scan: secrets, dependency audits and (on a change) review checks, with policy, baseline, triage and a quality gate (`--base`, `--staged`, `--changed`, `--only`, `-f text\|json\|markdown\|github\|sarif`, `-o`, `--fail-on`, `--policy-from`, `--offline`, `--list-rules`) |
+| `athena baseline` | `show`, `create`, `update`, `prune` — record existing findings so only new ones fail the gate |
+| `athena findings` | `list`, `show <fingerprint>`, `triage <fingerprint> <safe\|false-positive\|accepted-risk\|fixed\|to-review\|clear> --reason …` |
+| `athena explain <ruleId>` | What a rule detects and what to do about it |
 | `athena security` | Audit dependencies with the tools installed for this project, and report secret findings (`--fail-on`, `--last`, `--no-audit`) |
 | `athena review` | Check the current diff for facts worth reviewing, and list your rules and checklist (`--base`, `--no-fail`) |
 | `athena git-hook` | `install` (`--review`), `uninstall`, `status` — a Git pre-commit hook that blocks commits when knowledge is out of date |
@@ -170,6 +174,10 @@ $ athena activity
 ## Security and review
 
 ```bash
+athena scan                       # secrets + dependency audits, policy and quality gate
+athena scan --base origin/main -f sarif -o athena.sarif --policy-from origin/main   # in CI
+athena baseline create            # accept today's findings; only new ones fail the gate
+athena findings triage 5f65caf9 false-positive --reason "test fixture"
 athena security          # audit dependencies + report secret findings
 athena security --fail-on high   # exit 1 in CI
 athena review                     # check the current diff before you commit
@@ -177,6 +185,8 @@ athena review                     # check the current diff before you commit
 
 **`athena security`** runs the audit tools your project's ecosystems provide (`npm audit`, `pnpm audit`, `pip-audit`, `govulncheck`, `cargo audit`, `composer audit`) and reports what they find, attributed to the tool. Athena has no vulnerability database of its own: a tool that isn't installed is reported as **unknown**, never as "no problems". Results are stored in `.athena/security-scan.json` and recorded in `security.md` on the next `athena sync`.
 
+**`athena scan`** puts every check into one findings model. Each finding has a rule id, severity (`unrated` when the tool gave none — never treated as low), confidence, a FACT/DETECTED/INFERRED label, CWE, a location or package, and a fingerprint that never depends on a secret's value. Every report lists what was *not* covered (tools not installed, engines that failed, categories nothing scanned), and a failed engine fails the gate — it checked nothing. Optional committed files tune it: `.athena/policy.json` (gate thresholds, rule overrides, path excludes), `.athena/baseline.json`, `.athena/triage.json`, and inline `athena-ignore <ruleId> -- <reason>` comments (a reason is required). In CI, `--policy-from <base>` evaluates with the base branch's policy and reports any change to it on the branch as `review/policy-weakened`. Output formats: text, JSON, Markdown, GitHub annotations and SARIF 2.1.0 (for code scanning). Ratings A–E per category come with their basis; there is no numeric score.
+
 **`athena review`** checks facts about your current diff: secrets in added lines (a blocker, exit 1), committed env files, new dependencies, source changed without tests, API/schema/auth touchpoints, large files, debug leftovers, and whether Athena knowledge is stale. It then lists your enabled rules and the project's review checklist for you or your agent to apply — Athena does not claim to judge whether they are met, and it runs no AI.
 
 ## Use in CI and git hooks

package/dist/{activity-BKW7G4I5.js → activity-XCHKBZTG.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   listAgents
-} from "./chunk-QLW657NT.js";
+} from "./chunk-RQKGT2EK.js";
 import {
   readRecentEvents,
   summarizeSessions
-} from "./chunk-65TSRDQ3.js";
+} from "./chunk-P4TRQMES.js";
 import {
   c,
   dim,
@@ -20,7 +20,7 @@ import {
   requireProjectRoot
 } from "./chunk-XFN7UZCS.js";
 import "./chunk-KBO7XRBW.js";
-import "./chunk-JCGDR4UV.js";
+import "./chunk-WWQ5NKEC.js";
 import "./chunk-YRIS7ZS6.js";
 import "./chunk-GHFRQAYT.js";
 import "./chunk-INT3IGMQ.js";
@@ -74,4 +74,4 @@ async function activityCommand(opts) {
 export {
   activityCommand
 };
-//# sourceMappingURL=activity-BKW7G4I5.js.map
+//# sourceMappingURL=activity-XCHKBZTG.js.map

package/dist/{agents-DFSNEOP5.js → agents-HUJ4JXIB.js}

@@ -3,8 +3,8 @@ import {
   configureAgents,
   listAgents,
   removeAgents
-} from "./chunk-QLW657NT.js";
-import "./chunk-65TSRDQ3.js";
+} from "./chunk-RQKGT2EK.js";
+import "./chunk-P4TRQMES.js";
 import {
   c,
   dim,
@@ -19,7 +19,7 @@ import {
   requireProjectRoot
 } from "./chunk-XFN7UZCS.js";
 import "./chunk-KBO7XRBW.js";
-import "./chunk-JCGDR4UV.js";
+import "./chunk-WWQ5NKEC.js";
 import "./chunk-YRIS7ZS6.js";
 import "./chunk-GHFRQAYT.js";
 import "./chunk-INT3IGMQ.js";
@@ -66,4 +66,4 @@ export {
   agentsListCommand,
   agentsRemoveCommand
 };
-//# sourceMappingURL=agents-DFSNEOP5.js.map
+//# sourceMappingURL=agents-HUJ4JXIB.js.map

package/dist/{ai-ASL4FFQ7.js → ai-LGTLQKL4.js}

@@ -3,7 +3,7 @@ import {
   aiStatus,
   buildEnrichPayload,
   enrich
-} from "./chunk-RXNRMIZP.js";
+} from "./chunk-WUIC65QO.js";
 import {
   c,
   dim,
@@ -20,7 +20,7 @@ import {
 } from "./chunk-XFN7UZCS.js";
 import "./chunk-KBO7XRBW.js";
 import "./chunk-PVCIGUIT.js";
-import "./chunk-JCGDR4UV.js";
+import "./chunk-WWQ5NKEC.js";
 import "./chunk-FQEGEVLY.js";
 import "./chunk-2DY4PUR4.js";
 import "./chunk-IQQBAWSM.js";
@@ -93,4 +93,4 @@ export {
   aiEnrichCommand,
   aiStatusCommand
 };
-//# sourceMappingURL=ai-ASL4FFQ7.js.map
+//# sourceMappingURL=ai-LGTLQKL4.js.map

package/dist/{analyze-ZY3MXBOI.js → analyze-AP4XJT7D.js}

@@ -4,7 +4,7 @@ import {
   printSummary,
   runWithProgress,
   summarize
-} from "./chunk-XDCKZ5TV.js";
+} from "./chunk-R5AX7VST.js";
 import {
   printHeader
 } from "./chunk-SHKXELUX.js";
@@ -16,14 +16,14 @@ import {
   requireProjectRoot
 } from "./chunk-XFN7UZCS.js";
 import "./chunk-KBO7XRBW.js";
-import "./chunk-GGXPG6OE.js";
-import "./chunk-MPG3IEGB.js";
-import "./chunk-ELKFRTZT.js";
+import "./chunk-4FETKOY3.js";
 import "./chunk-2R6PXY6Z.js";
+import "./chunk-44EGCEB2.js";
 import "./chunk-PVCIGUIT.js";
-import "./chunk-OLPSEQS5.js";
+import "./chunk-ELKFRTZT.js";
+import "./chunk-AKOI4VTD.js";
 import "./chunk-QCC4VJUH.js";
-import "./chunk-JCGDR4UV.js";
+import "./chunk-WWQ5NKEC.js";
 import "./chunk-YRIS7ZS6.js";
 import "./chunk-GHFRQAYT.js";
 import "./chunk-INT3IGMQ.js";
@@ -47,4 +47,4 @@ async function analyzeCommand(opts) {
 export {
   analyzeCommand
 };
-//# sourceMappingURL=analyze-ZY3MXBOI.js.map
+//# sourceMappingURL=analyze-AP4XJT7D.js.map

package/dist/{chunk-ZB7LC6FP.js → chunk-3KFOI2X4.js}

@@ -13,7 +13,7 @@ import {
   git,
   statusV2,
   workingChanges
-} from "./chunk-OLPSEQS5.js";
+} from "./chunk-AKOI4VTD.js";
 import {
   isBlockModified,
   parseBlocks
@@ -218,4 +218,4 @@ async function buildStatus(root, signal, opts = {}) {
 export {
   buildStatus
 };
-//# sourceMappingURL=chunk-ZB7LC6FP.js.map
+//# sourceMappingURL=chunk-3KFOI2X4.js.map

package/dist/{chunk-MPG3IEGB.js → chunk-44EGCEB2.js}

@@ -1,4 +1,9 @@
 #!/usr/bin/env node
+import {
+  getOrCreateSalt,
+  keyedFingerprint,
+  readLocalConfig
+} from "./chunk-PVCIGUIT.js";
 import {
   IgnoreMatcher,
   SOURCE_FILE,
@@ -8,14 +13,9 @@ import {
   sniffBinary,
   walkProject
 } from "./chunk-ELKFRTZT.js";
-import {
-  getOrCreateSalt,
-  keyedFingerprint,
-  readLocalConfig
-} from "./chunk-PVCIGUIT.js";
 import {
   gitInfo
-} from "./chunk-OLPSEQS5.js";
+} from "./chunk-AKOI4VTD.js";
 import {
   ProjectModel,
   detected,
@@ -28,7 +28,7 @@ import {
   isSecretLikeName,
   redact,
   scanText
-} from "./chunk-JCGDR4UV.js";
+} from "./chunk-WWQ5NKEC.js";
 import {
   FactsCache,
   athenaDir,
@@ -2379,9 +2379,6 @@ import path4 from "path";
 import crypto2 from "crypto";
 var SKIP = /(^|\/)(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lock|poetry\.lock|uv\.lock|Cargo\.lock|go\.sum|composer\.lock|Gemfile\.lock|pubspec\.lock)$|\.(min\.js|map|svg|snap)$/;
 var MAX_SECRET_FINDINGS = 500;
-async function secretFingerprinter(root) {
-  return (await secretFingerprintKey(root)).fingerprint;
-}
 async function secretFingerprintKey(root, saltOverride) {
   try {
     let salt = saltOverride;
@@ -2398,12 +2395,20 @@ async function secretFingerprintKey(root, saltOverride) {
   }
   return { fingerprint: ephemeralFingerprint, fingerprintKeyId: null };
 }
+var MINIFIED = /\.(min\.js|map)$/;
 async function scanFilesForSecrets(files, read, opts) {
   const findings = opts.into ?? [];
   const max = opts.max ?? MAX_SECRET_FINDINGS;
   const stats = { skippedLongLines: 0 };
+  const counts = { scanned: 0, binary: 0, tooLarge: 0, minified: 0, excluded: 0, unreadable: 0 };
   let truncated = false;
   for (const f of files) {
+    if (f.binary) counts.binary++;
+    else if (f.large) counts.tooLarge++;
+    else if (SKIP.test(f.path)) {
+      if (MINIFIED.test(f.path)) counts.minified++;
+      else counts.excluded++;
+    }
     if (f.binary || f.large || SKIP.test(f.path)) continue;
     if (findings.length >= max) {
       truncated = true;
@@ -2411,10 +2416,14 @@ async function scanFilesForSecrets(files, read, opts) {
     }
     opts.signal?.throwIfAborted();
     const text = await read(f.path);
+    if (text === null) counts.unreadable++;
+    else counts.scanned++;
     if (!text) continue;
-    for (const m of scanText(text, { fingerprint: opts.fingerprint, stats })) findings.push({ type: m.type, file: f.path, line: m.line, fingerprint: m.fingerprint });
+    const matches = scanText(text, { fingerprint: opts.fingerprint, stats });
+    for (const m of matches) findings.push({ type: m.type, file: f.path, line: m.line, fingerprint: m.fingerprint });
+    if (matches.length) opts.onFile?.(f.path, text, matches);
   }
-  return { findings, truncated, skippedLongLines: stats.skippedLongLines };
+  return { findings, truncated, skippedLongLines: stats.skippedLongLines, files: counts };
 }
 var secretsFact = {
   id: "secrets",
@@ -2673,7 +2682,7 @@ export {
   readExclude,
   manifestDependencyNames,
   REAL_ENV_NAMES,
-  secretFingerprinter,
+  MAX_SECRET_FINDINGS,
   scanFilesForSecrets,
   analyzeProject,
   persistAnalysisCache,
@@ -2688,4 +2697,4 @@ export {
   unratedFindings,
   meetsThreshold
 };
-//# sourceMappingURL=chunk-MPG3IEGB.js.map
+//# sourceMappingURL=chunk-44EGCEB2.js.map

package/dist/{chunk-GGXPG6OE.js → chunk-4FETKOY3.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
+import {
+  ATHENA_VERSION
+} from "./chunk-2R6PXY6Z.js";
 import {
   analyzeProject,
   loadScanFromDir,
   persistAnalysisCache
-} from "./chunk-MPG3IEGB.js";
-import {
-  ATHENA_VERSION
-} from "./chunk-2R6PXY6Z.js";
+} from "./chunk-44EGCEB2.js";
 import {
   LOCAL_CONFIG_FILE
 } from "./chunk-PVCIGUIT.js";
 import {
   redact
-} from "./chunk-JCGDR4UV.js";
+} from "./chunk-WWQ5NKEC.js";
 import {
   ADAPTERS,
   applyChanges
@@ -752,6 +752,7 @@ var ATHENA_GITIGNORE = [
   "model.json",
   "graph.json",
   "security-scan.json",
+  "findings.json",
   "ai-suggestions.md",
   ".backup/",
   ".server.json",
@@ -764,7 +765,7 @@ var ATHENA_GITIGNORE = [
   "local.json",
   ""
 ].join("\n");
-var GITIGNORE_ENTRIES = ["state.json", "model.json", "graph.json", "security-scan.json", "ai-suggestions.md", ".backup/", ".server.json", ".sync-ignore.json", ".agent-events.jsonl", ".agent-events.1.jsonl", ".agent-events.rotate.lock", "cache/", "local.json"];
+var GITIGNORE_ENTRIES = ["state.json", "model.json", "graph.json", "security-scan.json", "findings.json", "ai-suggestions.md", ".backup/", ".server.json", ".sync-ignore.json", ".agent-events.jsonl", ".agent-events.1.jsonl", ".agent-events.rotate.lock", "cache/", "local.json"];
 async function ensureGitignoreEntries(file) {
   const existing = await readTextIfExists(file);
   if (existing === null) {
@@ -901,4 +902,4 @@ export {
   composeState,
   runPipeline
 };
-//# sourceMappingURL=chunk-GGXPG6OE.js.map
+//# sourceMappingURL=chunk-4FETKOY3.js.map

package/dist/chunk-4IIBVTBS.js

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+import {
+  auditDependencies,
+  legacyToolResult,
+  saveFindings
+} from "./chunk-IDODPGTX.js";
+import {
+  Coverage,
+  Finding,
+  dedupeFindings,
+  scanSecrets
+} from "./chunk-Y6SDMZET.js";
+import {
+  saveScan
+} from "./chunk-44EGCEB2.js";
+import {
+  walkProject
+} from "./chunk-ELKFRTZT.js";
+import {
+  loadConfig
+} from "./chunk-2DY4PUR4.js";
+
+// src/services/security.ts
+var resultsByScan = /* @__PURE__ */ new WeakMap();
+async function runSecurityScanWithFindings(root, model, opts = {}) {
+  const started = Date.now();
+  const { config } = await loadConfig(root);
+  const walk = await walkProject(root, { config, signal: opts.signal });
+  const ctx = { root, config, mode: "all", signal: opts.signal };
+  const deps = opts.skipAudit ? null : await auditDependencies(ctx, { model, walk: walk.files, timeoutMs: opts.timeoutMs, onTool: opts.onTool });
+  const tools = (deps?.runs ?? []).map(legacyToolResult);
+  const counts = { critical: 0, high: 0, moderate: 0, low: 0, unrated: 0 };
+  for (const t of tools) for (const f of t.findings) counts[f.severity]++;
+  const secrets = await scanSecrets(ctx, { walk: walk.files });
+  const scannedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const durationMs = Date.now() - started;
+  const scan = {
+    schemaVersion: 1,
+    scannedAt,
+    durationMs,
+    tools,
+    counts,
+    secrets: {
+      count: secrets.summary.count,
+      files: secrets.summary.files.slice(0, 50),
+      skippedLongLines: secrets.summary.skippedLongLines,
+      ...secrets.summary.truncated ? { truncated: true } : {}
+    }
+  };
+  const outputs = [secrets, ...deps ? [deps] : []];
+  const result = {
+    schemaVersion: 1,
+    scannedAt,
+    durationMs,
+    scope: { mode: "all" },
+    findings: dedupeFindings(outputs.flatMap((o) => o.findings.map((f) => Finding.parse(f)))),
+    coverage: [...deps?.coverage ?? [], ...secrets.coverage].map((c) => Coverage.parse(c))
+  };
+  resultsByScan.set(scan, result);
+  return { scan, result };
+}
+async function runSecurityScan(root, model, opts = {}) {
+  return (await runSecurityScanWithFindings(root, model, opts)).scan;
+}
+async function saveScan2(root, scan) {
+  await saveScan(root, scan);
+  const result = resultsByScan.get(scan);
+  if (result) await saveFindings(root, result);
+}
+
+export {
+  runSecurityScanWithFindings,
+  runSecurityScan,
+  saveScan2 as saveScan
+};
+//# sourceMappingURL=chunk-4IIBVTBS.js.map

package/dist/{chunk-LEMPCNAY.js → chunk-56EXAGTM.js}

@@ -9,10 +9,10 @@ import {
 } from "./chunk-3IS2X2Z7.js";
 import {
   git
-} from "./chunk-OLPSEQS5.js";
+} from "./chunk-AKOI4VTD.js";
 import {
   scanText
-} from "./chunk-JCGDR4UV.js";
+} from "./chunk-WWQ5NKEC.js";
 import {
   isBlockModified,
   parseBlocks
@@ -206,4 +206,4 @@ export {
   rulesUpdate,
   rulesRemove
 };
-//# sourceMappingURL=chunk-LEMPCNAY.js.map
+//# sourceMappingURL=chunk-56EXAGTM.js.map

package/dist/{chunk-DZDI2HRT.js → chunk-6OSQMXUP.js}

@@ -1,21 +1,21 @@
 #!/usr/bin/env node
 import {
   AnalysisScheduler
-} from "./chunk-RVTNSNGK.js";
+} from "./chunk-X7EYOAEX.js";
 import {
   applySync,
   needsIndexRefreshOnly
-} from "./chunk-KHMBNT66.js";
+} from "./chunk-PZPMWCXS.js";
 import {
   readExclude
-} from "./chunk-MPG3IEGB.js";
+} from "./chunk-44EGCEB2.js";
 import {
   IgnoreMatcher,
   factsConfigHash
 } from "./chunk-ELKFRTZT.js";
 import {
   git
-} from "./chunk-OLPSEQS5.js";
+} from "./chunk-AKOI4VTD.js";
 import {
   loadConfig
 } from "./chunk-2DY4PUR4.js";
@@ -166,4 +166,4 @@ async function watchProject(root, opts) {
 export {
   watchProject
 };
-//# sourceMappingURL=chunk-DZDI2HRT.js.map
+//# sourceMappingURL=chunk-6OSQMXUP.js.map

package/dist/{chunk-OLPSEQS5.js → chunk-AKOI4VTD.js}

@@ -184,6 +184,14 @@ function stripPrefix(files, prefix) {
   if (!prefix) return files;
   return files.filter((f) => f.path.startsWith(prefix)).map((f) => ({ ...f, path: f.path.slice(prefix.length), from: f.from?.startsWith(prefix) ? f.from.slice(prefix.length) : f.from }));
 }
+async function changesSince(cwd, fromRef, opts = {}) {
+  if (!isSafeRef(fromRef)) return null;
+  const mb = await git(cwd, ["merge-base", fromRef, "HEAD"], { signal: opts.signal });
+  if (!mb.ok || !mb.stdout.trim()) return null;
+  const r = await git(cwd, ["diff", "--name-status", "-M", "-z", "--relative", "--no-color", mb.stdout.trim(), "HEAD", "--", "."], { signal: opts.signal });
+  if (!r.ok) return null;
+  return parseNameStatusZ(r.stdout);
+}
 function parseNameStatusZ(stdout) {
   const out = [];
   const parts = stdout.split("\0").filter(Boolean);
@@ -256,9 +264,10 @@ export {
   isGitRepo,
   gitInfo,
   workingChanges,
+  changesSince,
   parseNameStatusZ,
   isSafeRef,
   headMovement,
   statusV2
 };
-//# sourceMappingURL=chunk-OLPSEQS5.js.map
+//# sourceMappingURL=chunk-AKOI4VTD.js.map