project-athena 0.4.0 → 0.5.0

package/dist/chunk-KJYSNZXS.js

@@ -0,0 +1,934 @@
+#!/usr/bin/env node
+import {
+  CATEGORIES,
+  CONFIDENCES,
+  CONFIDENCE_RANK,
+  Finding,
+  SEVERITIES,
+  SEVERITY_RANK,
+  codeFingerprint,
+  compareFindings,
+  dedupeFindings,
+  fileFingerprint,
+  normalizeLine,
+  occurrenceCounter
+} from "./chunk-Y6SDMZET.js";
+import {
+  GitCommandError,
+  git,
+  isSafeRef
+} from "./chunk-AKOI4VTD.js";
+import {
+  scanText
+} from "./chunk-WWQ5NKEC.js";
+import {
+  readTextIfExists,
+  readTextInsideRoot,
+  writeFileAtomic
+} from "./chunk-IQQBAWSM.js";
+import {
+  AthenaError,
+  EXIT
+} from "./chunk-AD4OZCU2.js";
+import {
+  ATHENA_DIR
+} from "./chunk-EUPETUWA.js";
+
+// src/core/policy/policy.ts
+import path from "path";
+import ignoreFactory from "ignore";
+import { z } from "zod";
+var POLICY_FILE = `${ATHENA_DIR}/policy.json`;
+var GATE_SEVERITIES = ["critical", "high", "medium", "low", "info"];
+var DEFAULT_GATE_CATEGORIES = ["secret", "dependency", "sast", "iac", "review"];
+var RuleKey = z.string().regex(/^[a-z0-9][a-z0-9._/-]{1,120}(\/\*)?$/, 'expected a rule id such as "secret/stripe-key" or a prefix such as "sast/js/*"');
+var Glob = z.string().min(1).max(500);
+var RuleSetting = z.union([
+  z.literal("off"),
+  z.strictObject({
+    severity: z.enum(SEVERITIES).optional(),
+    confidence: z.enum(CONFIDENCES).optional()
+  })
+]);
+var Policy = z.strictObject({
+  schemaVersion: z.literal(1).default(1),
+  gate: z.strictObject({
+    failOn: z.enum(GATE_SEVERITIES).default("high"),
+    minConfidence: z.enum(CONFIDENCES).default("medium"),
+    unrated: z.enum(["fail", "warn"]).default("fail"),
+    scope: z.enum(["new", "all"]).default("new"),
+    categories: z.array(z.enum(CATEGORIES)).default([...DEFAULT_GATE_CATEGORIES])
+  }).prefault({}),
+  rules: z.record(RuleKey, RuleSetting).default({}),
+  paths: z.strictObject({
+    exclude: z.array(Glob).default([]),
+    tests: z.array(Glob).default([])
+  }).prefault({}),
+  licenses: z.strictObject({
+    deny: z.array(z.string().min(1)).default([]),
+    warn: z.array(z.string().min(1)).default([])
+  }).prefault({}),
+  external: z.strictObject({
+    semgrep: z.enum(["auto", "off"]).default("auto"),
+    gitleaks: z.enum(["auto", "off"]).default("auto"),
+    trivy: z.enum(["auto", "off"]).default("auto"),
+    "osv-scanner": z.enum(["auto", "off"]).default("auto"),
+    network: z.enum(["allow", "deny"]).default("allow")
+  }).prefault({})
+});
+var DEFAULT_POLICY = Policy.parse({});
+var PolicyError = class extends Error {
+  constructor(message, hint) {
+    super(message);
+    this.hint = hint;
+    this.name = "PolicyError";
+  }
+  hint;
+};
+function zodProblem(source, error) {
+  const issue = error.issues[0];
+  const where = issue && issue.path.length ? issue.path.map(String).join(".") : "(root)";
+  return `${source} is invalid at ${where}: ${issue?.message ?? "invalid"}`;
+}
+function parseCommittedJson(schema, text, source) {
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch (err) {
+    throw new PolicyError(`${source} is not valid JSON (${err.message}).`, `Fix or delete ${source}.`);
+  }
+  const parsed = schema.safeParse(json);
+  if (!parsed.success) throw new PolicyError(zodProblem(source, parsed.error), `Fix ${source}; see the policy documentation for the format.`);
+  return parsed.data;
+}
+function parsePolicy(text, source = POLICY_FILE) {
+  return parseCommittedJson(Policy, text, source);
+}
+async function loadPolicy(root) {
+  const raw = await readTextIfExists(path.join(root, POLICY_FILE));
+  return raw === null ? DEFAULT_POLICY : parsePolicy(raw);
+}
+function ruleSetting(policy, ruleId) {
+  const exact = policy.rules[ruleId];
+  if (exact !== void 0) return exact;
+  let best;
+  for (const [key, setting] of Object.entries(policy.rules)) {
+    if (!key.endsWith("/*")) continue;
+    const prefix = key.slice(0, -1);
+    if (ruleId.startsWith(prefix) && (!best || prefix.length > best.len)) best = { len: prefix.length, setting };
+  }
+  return best?.setting;
+}
+var PolicyPaths = class _PolicyPaths {
+  exclude;
+  tests;
+  constructor(policy) {
+    this.exclude = policy.paths.exclude.length ? ignoreFactory().add(policy.paths.exclude) : null;
+    this.tests = policy.paths.tests.length ? ignoreFactory().add(policy.paths.tests) : null;
+  }
+  static test(m, file) {
+    if (!m) return false;
+    const rel = file.replace(/\\/g, "/").replace(/^\.\//, "");
+    if (!rel || !ignoreFactory.isPathValid(rel)) return false;
+    return m.ignores(rel);
+  }
+  isExcluded(file) {
+    return _PolicyPaths.test(this.exclude, file);
+  }
+  isTest(file) {
+    return _PolicyPaths.test(this.tests, file);
+  }
+};
+function findingPath(f) {
+  return f.location?.file ?? f.package?.manifest;
+}
+function applyRuleOverrides(policy, findings) {
+  return findings.map((f) => {
+    const s = ruleSetting(policy, f.ruleId);
+    if (!s || s === "off" || !s.severity && !s.confidence) return f;
+    return { ...f, ...s.severity ? { severity: s.severity } : {}, ...s.confidence ? { confidence: s.confidence } : {} };
+  });
+}
+
+// src/core/findings/triage.ts
+import path2 from "path";
+import { z as z2 } from "zod";
+var TRIAGE_FILE = `${ATHENA_DIR}/triage.json`;
+var TRIAGE_STATUSES = ["safe", "false-positive", "accepted-risk", "fixed", "to-review"];
+var CLOSING_TRIAGE = /* @__PURE__ */ new Set(["safe", "false-positive", "accepted-risk", "fixed"]);
+var MAX_REASON_CHARS = 500;
+var TriageEntry = z2.strictObject({
+  status: z2.enum(TRIAGE_STATUSES),
+  reason: z2.string().trim().min(1, "a reason is required").max(MAX_REASON_CHARS),
+  by: z2.string().max(200).optional(),
+  at: z2.string()
+});
+var Triage = z2.strictObject({
+  schemaVersion: z2.literal(1),
+  entries: z2.record(z2.string().regex(/^[a-f0-9]{32}$/, "keys must be finding fingerprints (32 hex)"), TriageEntry)
+});
+function emptyTriage() {
+  return { schemaVersion: 1, entries: {} };
+}
+function parseTriage(text, source = TRIAGE_FILE) {
+  return parseCommittedJson(Triage, text, source);
+}
+async function loadTriage(root) {
+  const raw = await readTextIfExists(path2.join(root, TRIAGE_FILE));
+  return raw === null ? null : parseTriage(raw);
+}
+function serializeTriage(t) {
+  const entries = Object.fromEntries(Object.entries(t.entries).sort(([a], [b]) => a.localeCompare(b)));
+  return `${JSON.stringify({ schemaVersion: 1, entries }, null, 2)}
+`;
+}
+async function saveTriage(root, t) {
+  await writeFileAtomic(path2.join(root, TRIAGE_FILE), serializeTriage(Triage.parse(t)));
+}
+function assertNoSecret(text, what) {
+  const hits = scanText(text);
+  if (hits.length) {
+    throw new PolicyError(`The ${what} looks like it contains a secret (${hits[0].type}); it was not saved.`, `Describe the decision without including credentials.`);
+  }
+}
+function setTriage(t, fingerprint, input) {
+  if (!/^[a-f0-9]{32}$/.test(fingerprint)) throw new PolicyError(`Not a finding fingerprint: ${fingerprint.slice(0, 64)}`);
+  const reason = input.reason.trim();
+  if (!reason) throw new PolicyError("A triage decision needs a reason.", 'Say why, e.g. "input is validated by the router schema".');
+  if (reason.length > MAX_REASON_CHARS) throw new PolicyError(`The reason is too long (${reason.length} > ${MAX_REASON_CHARS} characters).`);
+  assertNoSecret(reason, "triage reason");
+  if (input.by) assertNoSecret(input.by, "triage author");
+  const entry = TriageEntry.parse({ status: input.status, reason, ...input.by ? { by: input.by } : {}, at: (input.now ?? /* @__PURE__ */ new Date()).toISOString() });
+  return { ...t, entries: { ...t.entries, [fingerprint]: entry } };
+}
+function removeTriage(t, fingerprint) {
+  const { [fingerprint]: _removed, ...rest } = t.entries;
+  return { ...t, entries: rest };
+}
+
+// src/core/findings/baseline.ts
+import path3 from "path";
+import { z as z3 } from "zod";
+var BASELINE_FILE = `${ATHENA_DIR}/baseline.json`;
+var BaselineEntry = z3.strictObject({
+  fingerprint: z3.string().regex(/^[a-f0-9]{32}$/),
+  ruleId: z3.string().min(1).max(200),
+  file: z3.string().max(1e3).optional(),
+  addedAt: z3.string(),
+  reason: z3.string().max(500).optional()
+});
+var Baseline = z3.strictObject({
+  schemaVersion: z3.literal(1),
+  createdAt: z3.string(),
+  entries: z3.array(BaselineEntry)
+});
+function emptyBaseline(now = /* @__PURE__ */ new Date()) {
+  return { schemaVersion: 1, createdAt: now.toISOString(), entries: [] };
+}
+function parseBaseline(text, source = BASELINE_FILE) {
+  const b = parseCommittedJson(Baseline, text, source);
+  const seen = /* @__PURE__ */ new Set();
+  for (const e of b.entries) {
+    if (seen.has(e.fingerprint)) throw new PolicyError(`${source} lists fingerprint ${e.fingerprint} more than once.`, `Remove the duplicate entry from ${source}.`);
+    seen.add(e.fingerprint);
+  }
+  return b;
+}
+async function loadBaseline(root) {
+  const raw = await readTextIfExists(path3.join(root, BASELINE_FILE));
+  return raw === null ? null : parseBaseline(raw);
+}
+function serializeBaseline(b) {
+  const entries = [...b.entries].sort(
+    (x, y) => x.ruleId.localeCompare(y.ruleId) || (x.file ?? "").localeCompare(y.file ?? "") || x.fingerprint.localeCompare(y.fingerprint)
+  );
+  return `${JSON.stringify({ schemaVersion: 1, createdAt: b.createdAt, entries }, null, 2)}
+`;
+}
+async function saveBaseline(root, b) {
+  await writeFileAtomic(path3.join(root, BASELINE_FILE), serializeBaseline(Baseline.parse(b)));
+}
+function baselineFingerprints(b) {
+  return new Set(b?.entries.map((e) => e.fingerprint) ?? []);
+}
+function entryFor(f, now, reason) {
+  const file = f.location?.file ?? f.package?.manifest;
+  return { fingerprint: f.fingerprint, ruleId: f.ruleId, ...file ? { file } : {}, addedAt: now.toISOString(), ...reason ? { reason } : {} };
+}
+function updateBaseline(b, findings, opts = {}) {
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  if (opts.reason !== void 0) {
+    if (opts.reason.length > 500) throw new PolicyError(`The baseline reason is too long (${opts.reason.length} > 500 characters).`);
+    assertNoSecret(opts.reason, "baseline reason");
+  }
+  const have = baselineFingerprints(b);
+  const added = [];
+  for (const f of findings) {
+    if (have.has(f.fingerprint)) continue;
+    have.add(f.fingerprint);
+    added.push(entryFor(f, now, opts.reason));
+  }
+  return { baseline: { ...b, entries: [...b.entries, ...added] }, added };
+}
+var categoryOf = (ruleId) => {
+  const head = ruleId.split("/")[0];
+  return CATEGORIES.includes(head ?? "") ? head : void 0;
+};
+function pruneBaseline(b, result) {
+  if (result.scope.mode !== "all") {
+    throw new PolicyError(`Can't prune the baseline from a partial scan (${result.scope.mode}).`, "Run a full scan first, then prune.");
+  }
+  const present = new Set(result.findings.map((f) => f.fingerprint));
+  const verified = /* @__PURE__ */ new Set();
+  const broken = /* @__PURE__ */ new Set();
+  for (const c of result.coverage) {
+    if (c.status === "ok") verified.add(c.category);
+    if (c.status === "failed" || c.status === "timeout") broken.add(c.category);
+  }
+  const kept = [];
+  const removed = [];
+  const keptUnverified = [];
+  for (const e of b.entries) {
+    if (present.has(e.fingerprint)) {
+      kept.push(e);
+      continue;
+    }
+    const cat = categoryOf(e.ruleId);
+    if (!cat || !verified.has(cat) || broken.has(cat)) {
+      kept.push(e);
+      keptUnverified.push(e);
+      continue;
+    }
+    removed.push(e);
+  }
+  return { baseline: { ...b, entries: kept }, removed, keptUnverified };
+}
+
+// src/core/policy/tamper.ts
+import path5 from "path";
+
+// src/core/findings/suppress.ts
+import path4 from "path";
+var SUPPRESSION_WITHOUT_REASON = "review/suppression-without-reason";
+var INVALID_SUPPRESSION = "review/invalid-suppression";
+var UNSUPPRESSIBLE_RULES = /* @__PURE__ */ new Set(["review/policy-weakened", SUPPRESSION_WITHOUT_REASON, INVALID_SUPPRESSION]);
+var DEFAULT_SUPPRESSION_MAX_BYTES = 2 * 1024 * 1024;
+var RULE_ID = /^[a-z0-9][a-z0-9._/-]{1,120}$/;
+var MARKER = /(?<=^|[\s;])(?:\/\/|#|\/\*|<!--|--)[ \t]*athena-ignore(?![\w-])(.*)$/;
+function parseSuppressionLine(text, line) {
+  if (!text.includes("athena-ignore")) return null;
+  const m = MARKER.exec(text);
+  if (!m) return null;
+  const rest = m[1].replace(/\s*(?:\*\/|-->)\s*$/, "").trim();
+  const first = rest.split(/\s+/)[0] ?? "";
+  const after = rest.slice(first.length).trim();
+  if (!first || first === "--" || !RULE_ID.test(first)) return { line, problem: "missing-rule", lineText: text };
+  const reason = after.startsWith("--") ? after.slice(2).trim() : "";
+  return reason ? { line, ruleId: first, reason, lineText: text } : { line, ruleId: first, problem: "missing-reason", lineText: text };
+}
+function findSuppressions(fileText) {
+  const out = [];
+  const lines = fileText.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const s = parseSuppressionLine(lines[i], i + 1);
+    if (s) out.push(s);
+  }
+  return out;
+}
+function suppressionFor(suppressions, ruleId, line) {
+  if (UNSUPPRESSIBLE_RULES.has(ruleId)) return void 0;
+  return suppressions.find((s) => !s.problem && s.ruleId === ruleId && (s.line === line || s.line === line - 1));
+}
+function problemFinding(file, s, occurrence) {
+  const missingRule = s.problem === "missing-rule";
+  const ruleId = missingRule ? INVALID_SUPPRESSION : SUPPRESSION_WITHOUT_REASON;
+  return Finding.parse({
+    fingerprint: codeFingerprint({ ruleId, file, lineText: s.lineText, occurrence }),
+    ruleId,
+    category: "review",
+    severity: "info",
+    confidence: "high",
+    label: "DETECTED",
+    title: missingRule ? "Suppression without a rule id" : "Suppression without a reason",
+    message: missingRule ? `This athena-ignore comment names no valid rule id, so it suppresses nothing. Write \`athena-ignore <ruleId> -- <reason>\`.` : `\`athena-ignore ${s.ruleId}\` has no reason, so it is ignored. Add \`-- <why this is safe>\` after the rule id.`,
+    location: { file, startLine: s.line },
+    engine: { id: "athena" }
+  });
+}
+async function applySuppressions(root, findings, opts = {}) {
+  const maxBytes = opts.maxBytes ?? DEFAULT_SUPPRESSION_MAX_BYTES;
+  const byFile = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    if (!f.location?.file || !f.location.startLine || UNSUPPRESSIBLE_RULES.has(f.ruleId)) continue;
+    const list = byFile.get(f.location.file) ?? [];
+    list.push(f);
+    byFile.set(f.location.file, list);
+  }
+  const out = { suppressed: /* @__PURE__ */ new Map(), findings: [], skippedFiles: [] };
+  for (const file of [...byFile.keys()].sort()) {
+    const norm = path4.posix.normalize(file.replace(/\\/g, "/"));
+    if (path4.isAbsolute(file) || path4.posix.isAbsolute(norm) || norm === ".." || norm.startsWith("../")) {
+      out.skippedFiles.push({ file, reason: "outside-root" });
+      continue;
+    }
+    const read = await readTextInsideRoot(root, file, maxBytes);
+    if (!read.ok) {
+      out.skippedFiles.push({ file, reason: read.reason });
+      continue;
+    }
+    const all = findSuppressions(read.text);
+    if (!all.length) continue;
+    const occ = occurrenceCounter();
+    for (const s of all) {
+      if (s.problem) {
+        const rule = s.problem === "missing-rule" ? INVALID_SUPPRESSION : SUPPRESSION_WITHOUT_REASON;
+        out.findings.push(problemFinding(file, s, occ(rule, file, normalizeLine(s.lineText))));
+      }
+    }
+    for (const f of byFile.get(file)) {
+      const s = suppressionFor(all, f.ruleId, f.location.startLine);
+      if (s) out.suppressed.set(f.fingerprint, { file, line: s.line, ruleId: s.ruleId, reason: s.reason });
+    }
+  }
+  return out;
+}
+
+// src/core/policy/tamper.ts
+var POLICY_WEAKENED = "review/policy-weakened";
+var GIT_TIMEOUT_MS = 6e4;
+async function gitText(root, args, opts) {
+  const r = await git(root, args, { timeoutMs: GIT_TIMEOUT_MS, ...opts });
+  if (r.aborted) throw opts.signal?.reason ?? new Error("Aborted");
+  return r;
+}
+async function readFileAtCommit(root, commit, rel, opts = {}) {
+  const spec = `${commit}:./${rel}`;
+  const exists = await gitText(root, ["cat-file", "-e", spec], opts);
+  if (!exists.ok) return null;
+  const r = await gitText(root, ["show", "--no-textconv", spec], { ...opts, maxBytes: 8 * 1024 * 1024 });
+  if (!r.ok) throw new PolicyError(`Couldn't read ${rel} at ${commit.slice(0, 12)}: ${r.stderr.trim().split("\n").pop()?.slice(0, 200) ?? "git show failed"}`);
+  return r.stdout;
+}
+function parseState(raw, where) {
+  return {
+    policy: raw.policy === null ? DEFAULT_POLICY : parsePolicy(raw.policy, `${POLICY_FILE} at ${where}`),
+    baseline: raw.baseline === null ? null : parseBaseline(raw.baseline, `${BASELINE_FILE} at ${where}`),
+    triage: raw.triage === null ? null : parseTriage(raw.triage, `${TRIAGE_FILE} at ${where}`)
+  };
+}
+async function rawAtCommit(root, commit, opts) {
+  const [policy, baseline, triage] = await Promise.all([POLICY_FILE, BASELINE_FILE, TRIAGE_FILE].map((f) => readFileAtCommit(root, commit, f, opts)));
+  return { policy, baseline, triage };
+}
+async function rawWorkingTree(root) {
+  const [policy, baseline, triage] = await Promise.all([POLICY_FILE, BASELINE_FILE, TRIAGE_FILE].map((f) => readTextIfExists(path5.join(root, f))));
+  return { policy, baseline, triage };
+}
+async function readPolicyStateAt(root, commit, opts = {}) {
+  return parseState(await rawAtCommit(root, commit, opts), commit.slice(0, 12));
+}
+function ruleChangeRelaxes(b, h) {
+  if (h === "off") return true;
+  if (b === "off") return false;
+  const sevOk = h?.severity === void 0 ? b?.severity === void 0 : h.severity === "critical" || b?.severity !== void 0 && SEVERITY_RANK[h.severity] >= SEVERITY_RANK[b.severity];
+  const confOk = h?.confidence === void 0 ? b?.confidence === void 0 : h.confidence === "high" || b?.confidence !== void 0 && CONFIDENCE_RANK[h.confidence] >= CONFIDENCE_RANK[b.confidence];
+  return !(sevOk && confOk);
+}
+var show = (s) => s === void 0 ? "default" : s === "off" ? "off" : JSON.stringify(s);
+function comparePolicies(base, head) {
+  const out = [];
+  const bg = base.gate;
+  const hg = head.gate;
+  if (bg.failOn !== hg.failOn) out.push({ key: "gate.failOn", text: `gate.failOn ${bg.failOn} \u2192 ${hg.failOn}`, relaxes: SEVERITY_RANK[hg.failOn] > SEVERITY_RANK[bg.failOn] });
+  if (bg.minConfidence !== hg.minConfidence) {
+    out.push({ key: "gate.minConfidence", text: `gate.minConfidence ${bg.minConfidence} \u2192 ${hg.minConfidence}`, relaxes: CONFIDENCE_RANK[hg.minConfidence] > CONFIDENCE_RANK[bg.minConfidence] });
+  }
+  if (bg.unrated !== hg.unrated) out.push({ key: "gate.unrated", text: `gate.unrated ${bg.unrated} \u2192 ${hg.unrated}`, relaxes: hg.unrated === "warn" });
+  if (bg.scope !== hg.scope) out.push({ key: "gate.scope", text: `gate.scope ${bg.scope} \u2192 ${hg.scope}`, relaxes: hg.scope === "new" });
+  const removedCats = bg.categories.filter((c) => !hg.categories.includes(c));
+  const addedCats = hg.categories.filter((c) => !bg.categories.includes(c));
+  if (removedCats.length) out.push({ key: "gate.categories", text: `gate.categories no longer include ${removedCats.join(", ")}`, relaxes: true });
+  if (addedCats.length) out.push({ key: "gate.categories+", text: `gate.categories now include ${addedCats.join(", ")}`, relaxes: false });
+  for (const key of [.../* @__PURE__ */ new Set([...Object.keys(base.rules), ...Object.keys(head.rules)])].sort()) {
+    const b = base.rules[key];
+    const h = head.rules[key];
+    if (JSON.stringify(b) === JSON.stringify(h)) continue;
+    out.push({ key: `rules.${key}`, text: `rules["${key}"] ${show(b)} \u2192 ${show(h)}`, relaxes: ruleChangeRelaxes(b, h) });
+  }
+  const listDiff = (key, b, h, addRelaxes) => {
+    const added = h.filter((x) => !b.includes(x));
+    const removed = b.filter((x) => !h.includes(x));
+    if (added.length) out.push({ key: `${key}+`, text: `${key} added ${added.map((x) => JSON.stringify(x)).join(", ")}`, relaxes: addRelaxes });
+    if (removed.length) out.push({ key: `${key}-`, text: `${key} removed ${removed.map((x) => JSON.stringify(x)).join(", ")}`, relaxes: !addRelaxes });
+  };
+  listDiff("paths.exclude", base.paths.exclude, head.paths.exclude, true);
+  if (JSON.stringify(base.paths.tests) !== JSON.stringify(head.paths.tests)) out.push({ key: "paths.tests", text: "paths.tests changed", relaxes: false });
+  listDiff("licenses.deny", base.licenses.deny, head.licenses.deny, false);
+  if (JSON.stringify(base.licenses.warn) !== JSON.stringify(head.licenses.warn)) out.push({ key: "licenses.warn", text: "licenses.warn changed", relaxes: false });
+  for (const e of ["semgrep", "gitleaks", "trivy", "osv-scanner"]) {
+    if (base.external[e] !== head.external[e]) out.push({ key: `external.${e}`, text: `external.${e} ${base.external[e]} \u2192 ${head.external[e]}`, relaxes: head.external[e] === "off" });
+  }
+  if (base.external.network !== head.external.network) {
+    out.push({ key: "external.network", text: `external.network ${base.external.network} \u2192 ${head.external.network}`, relaxes: head.external.network === "deny" });
+  }
+  return out;
+}
+function compareBaselines(base, head) {
+  const b = new Map((base?.entries ?? []).map((e) => [e.fingerprint, e]));
+  const h = new Map((head?.entries ?? []).map((e) => [e.fingerprint, e]));
+  const added = [...h.values()].filter((e) => !b.has(e.fingerprint));
+  const removed = [...b.values()].filter((e) => !h.has(e.fingerprint));
+  const out = [];
+  if (added.length) {
+    const rules = [...new Set(added.map((e) => e.ruleId))].sort();
+    out.push({ key: "baseline+", text: `${added.length} baseline entr${added.length === 1 ? "y" : "ies"} added (${rules.slice(0, 5).join(", ")}${rules.length > 5 ? ", \u2026" : ""})`, relaxes: true });
+  }
+  if (removed.length) out.push({ key: "baseline-", text: `${removed.length} baseline entr${removed.length === 1 ? "y" : "ies"} removed`, relaxes: false });
+  return out;
+}
+function compareTriage(base, head) {
+  const b = base?.entries ?? {};
+  const h = head?.entries ?? {};
+  let closedNew = 0;
+  let otherChanges = 0;
+  let removed = 0;
+  for (const [fp, he] of Object.entries(h)) {
+    const be = b[fp];
+    const closes = CLOSING_TRIAGE.has(he.status);
+    if (!be) {
+      if (closes) closedNew++;
+      else otherChanges++;
+    } else if (be.status !== he.status || be.reason !== he.reason) {
+      if (closes && !CLOSING_TRIAGE.has(be.status)) closedNew++;
+      else otherChanges++;
+    }
+  }
+  for (const fp of Object.keys(b)) if (!(fp in h)) removed++;
+  const out = [];
+  if (closedNew) out.push({ key: "triage+", text: `${closedNew} finding${closedNew === 1 ? "" : "s"} newly triaged as not needing a fix (safe / false-positive / accepted-risk / fixed)`, relaxes: true });
+  if (otherChanges) out.push({ key: "triage~", text: `${otherChanges} other triage change${otherChanges === 1 ? "" : "s"}`, relaxes: false });
+  if (removed) out.push({ key: "triage-", text: `${removed} triage entr${removed === 1 ? "y" : "ies"} removed`, relaxes: false });
+  return out;
+}
+function addedSuppressionsInDiff(diff) {
+  const out = [];
+  let file = null;
+  let inHeader = false;
+  let line = 0;
+  for (const raw of diff.split("\n")) {
+    if (raw.startsWith("diff --git ")) {
+      inHeader = true;
+      file = null;
+      continue;
+    }
+    if (inHeader) {
+      if (!raw.startsWith("@@")) {
+        if (raw.startsWith("+++ ")) file = unquotePath(raw.slice(4));
+        continue;
+      }
+      inHeader = false;
+    }
+    if (raw.startsWith("@@")) {
+      const m = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(raw);
+      line = m ? Number(m[1]) : 0;
+      continue;
+    }
+    if (raw.startsWith("+")) {
+      const text = raw.slice(1).replace(/\r$/, "");
+      const s = file && file !== "/dev/null" ? parseSuppressionLine(text, line) : null;
+      if (s && !s.problem) out.push({ file, line, ruleId: s.ruleId, reason: s.reason, lineText: text });
+      line++;
+    } else if (raw.startsWith(" ")) line++;
+  }
+  return out;
+}
+function unquotePath(p) {
+  if (p.startsWith('"') && p.endsWith('"')) {
+    try {
+      return Buffer.from(
+        p.slice(1, -1).replace(/\\([0-7]{3})|\\(.)/g, (_m, oct, ch) => {
+          if (oct) return String.fromCharCode(parseInt(oct, 8));
+          return ch === "n" ? "\n" : ch === "t" ? "	" : ch ?? "";
+        }),
+        "latin1"
+      ).toString("utf8");
+    } catch {
+      return p;
+    }
+  }
+  return p;
+}
+function weakenedFinding(file, changes, ref) {
+  const relaxes = changes.some((c) => c.relaxes);
+  const list = changes.map((c) => `${c.relaxes ? "[relaxes] " : ""}${c.text}`).join("; ");
+  return Finding.parse({
+    fingerprint: fileFingerprint({ ruleId: POLICY_WEAKENED, file, key: changes.map((c) => c.key).sort().join(",") }),
+    ruleId: POLICY_WEAKENED,
+    category: "review",
+    severity: relaxes ? "high" : "info",
+    confidence: "high",
+    label: "FACT",
+    title: relaxes ? `${file} relaxed in this change` : `${file} changed in this change`,
+    message: `${file} differs from ${ref}: ${list}. The gate used the version from ${ref}; a maintainer should review this change on its own.`,
+    location: { file },
+    engine: { id: "athena" }
+  });
+}
+function invalidHeadFinding(file, problem, ref) {
+  return Finding.parse({
+    fingerprint: fileFingerprint({ ruleId: POLICY_WEAKENED, file, key: "invalid" }),
+    ruleId: POLICY_WEAKENED,
+    category: "review",
+    severity: "high",
+    confidence: "high",
+    label: "FACT",
+    title: `${file} is invalid in this change`,
+    message: `${problem}. The gate used the version from ${ref}.`,
+    location: { file },
+    engine: { id: "athena" }
+  });
+}
+async function checkPolicyFrom(root, ref, opts = {}) {
+  if (!isSafeRef(ref)) throw new PolicyError(`Invalid ref for --policy-from: ${ref.slice(0, 120)}`);
+  const runOpts = { signal: opts.signal };
+  const FETCH = "Fetch the base branch with enough history (e.g. `git fetch --depth=200 origin main`, or `fetch-depth: 0` in actions/checkout).";
+  const c = await gitText(root, ["rev-parse", "--verify", "-q", `${ref}^{commit}`], runOpts);
+  if (!c.ok || !c.stdout.trim()) throw new PolicyError(`Can't read the policy from ${ref}: it is not a commit in this repository.`, FETCH);
+  const commit = c.stdout.trim();
+  const mb = await gitText(root, ["merge-base", commit, "HEAD"], runOpts);
+  if (!mb.ok || !mb.stdout.trim()) throw new PolicyError(`Can't compare with ${ref}: no common ancestor with HEAD (the clone may be shallow).`, FETCH);
+  const mergeBase = mb.stdout.trim();
+  const base = await readPolicyStateAt(root, commit, runOpts);
+  const [rawMb, rawHead] = await Promise.all([rawAtCommit(root, mergeBase, runOpts), rawWorkingTree(root)]);
+  const findings = [];
+  const changes = { policy: [], baseline: [], triage: [] };
+  const compare = (file, mbText, headText, parse, fallback, diff) => {
+    if (mbText === headText) return [];
+    let b;
+    try {
+      b = mbText === null ? fallback : parse(mbText);
+    } catch {
+      b = fallback;
+    }
+    let h;
+    try {
+      h = headText === null ? fallback : parse(headText);
+    } catch (err) {
+      findings.push(invalidHeadFinding(file, err.message, ref));
+      return [];
+    }
+    let list = diff(b, h);
+    if (!list.length) list = [{ key: "edited", text: "edited without an effective change", relaxes: false }];
+    findings.push(weakenedFinding(file, list, ref));
+    return list;
+  };
+  changes.policy = compare(POLICY_FILE, rawMb.policy, rawHead.policy, (t) => parsePolicy(t), DEFAULT_POLICY, comparePolicies);
+  changes.baseline = compare(BASELINE_FILE, rawMb.baseline, rawHead.baseline, (t) => parseBaseline(t), null, compareBaselines);
+  changes.triage = compare(TRIAGE_FILE, rawMb.triage, rawHead.triage, (t) => parseTriage(t), null, compareTriage);
+  const addedSuppressions = await suppressionsAddedSince(root, mergeBase, runOpts);
+  const occ = occurrenceCounter();
+  for (const s of addedSuppressions) {
+    findings.push(
+      Finding.parse({
+        fingerprint: codeFingerprint({ ruleId: POLICY_WEAKENED, file: s.file, lineText: s.lineText, occurrence: occ(POLICY_WEAKENED, s.file, normalizeLine(s.lineText)) }),
+        ruleId: POLICY_WEAKENED,
+        category: "review",
+        severity: "high",
+        confidence: "high",
+        label: "FACT",
+        title: `Suppression added for ${s.ruleId}`,
+        message: `An \`athena-ignore ${s.ruleId}\` comment was added in this change (reason: "${s.reason.slice(0, 200)}"). It hides a finding from the gate; a maintainer should confirm it.`,
+        location: { file: s.file, startLine: s.line },
+        engine: { id: "athena" }
+      })
+    );
+  }
+  return { ref, commit, mergeBase, base, changes, addedSuppressions, findings };
+}
+async function suppressionsAddedSince(root, mergeBase, opts) {
+  const d = await gitText(root, ["-c", "core.quotePath=false", "diff", "-U0", "--no-color", "--no-ext-diff", "--no-textconv", "--relative", "--no-renames", "--no-prefix", mergeBase, "--", "."], opts);
+  if (!d.ok) throw new PolicyError(`Couldn't diff against the merge base: ${d.stderr.trim().split("\n").pop()?.slice(0, 200) ?? "git diff failed"}`);
+  const out = addedSuppressionsInDiff(d.stdout);
+  const u = await gitText(root, ["-c", "core.quotePath=false", "ls-files", "--others", "--exclude-standard", "-z", "--", "."], opts);
+  if (u.ok) {
+    for (const file of u.stdout.split("\0").filter(Boolean).sort()) {
+      const r = await readTextInsideRoot(root, file, DEFAULT_SUPPRESSION_MAX_BYTES);
+      if (!r.ok) continue;
+      for (const s of findSuppressions(r.text)) if (!s.problem) out.push({ file, line: s.line, ruleId: s.ruleId, reason: s.reason, lineText: s.lineText });
+    }
+  }
+  return out;
+}
+
+// src/core/findings/gate.ts
+var plural = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
+function evaluateGate(result, ctx) {
+  const g = ctx.policy.gate;
+  const gated = new Set(g.categories);
+  const counted = {
+    total: result.findings.length,
+    considered: 0,
+    failing: 0,
+    unratedWarnings: 0,
+    baselinedSkipped: 0,
+    notActive: 0,
+    outOfCategory: 0,
+    belowConfidence: 0,
+    belowSeverity: 0,
+    brokenEngines: 0
+  };
+  const failing = [];
+  const warned = [];
+  for (const f of result.findings) {
+    const st = ctx.statuses.get(f.fingerprint);
+    const active = st ? st.active : true;
+    if (!active) {
+      counted.notActive++;
+      continue;
+    }
+    if (!gated.has(f.category)) {
+      counted.outOfCategory++;
+      continue;
+    }
+    if (g.scope === "new" && st?.baselined) {
+      counted.baselinedSkipped++;
+      continue;
+    }
+    counted.considered++;
+    if (CONFIDENCE_RANK[f.confidence] < CONFIDENCE_RANK[g.minConfidence]) {
+      counted.belowConfidence++;
+      continue;
+    }
+    if (f.severity === "unrated") {
+      if (g.unrated === "fail") failing.push(f);
+      else warned.push(f);
+      continue;
+    }
+    if (SEVERITY_RANK[f.severity] < SEVERITY_RANK[g.failOn]) {
+      counted.belowSeverity++;
+      continue;
+    }
+    failing.push(f);
+  }
+  failing.sort(compareFindings);
+  warned.sort(compareFindings);
+  counted.failing = failing.length;
+  counted.unratedWarnings = warned.length;
+  const reasons = [];
+  const warnings = [];
+  if (failing.length) {
+    const scope = g.scope === "new" ? "new " : "";
+    const unrated = failing.filter((f) => f.severity === "unrated").length;
+    reasons.push(
+      `${plural(failing.length, `${scope}finding`)} at or above ${g.failOn} severity with ${g.minConfidence}+ confidence` + (unrated ? ` (${unrated} unrated, which the policy treats as failing)` : "")
+    );
+  }
+  const seenCategory = /* @__PURE__ */ new Set();
+  for (const c of result.coverage) {
+    if (!gated.has(c.category)) continue;
+    if (c.status === "ok") seenCategory.add(c.category);
+    if (c.status === "failed" || c.status === "timeout") {
+      seenCategory.add(c.category);
+      counted.brokenEngines++;
+      const what = c.target ? ` on ${c.target}` : "";
+      reasons.push(`${c.engine} (${c.category})${what} ${c.status === "timeout" ? "timed out" : "failed"}${c.reason ? `: ${c.reason}` : ""} \u2014 it checked nothing, so the gate can't pass`);
+    } else if (c.status === "unavailable" || c.status === "skipped") {
+      warnings.push(`${c.engine} (${c.category}) ${c.status}${c.reason ? `: ${c.reason}` : ""}`);
+    }
+  }
+  const unscanned = g.categories.filter((cat) => !seenCategory.has(cat));
+  if (unscanned.length) warnings.push(`no engine scanned ${unscanned.join(", ")} \u2014 the gate says nothing about ${unscanned.length === 1 ? "it" : "them"}`);
+  if (warned.length) warnings.push(`${plural(warned.length, "unrated finding")} (the policy only warns on unrated findings)`);
+  return {
+    passed: reasons.length === 0,
+    reasons,
+    warnings,
+    counted,
+    failingFindings: failing.map((f) => f.fingerprint),
+    warningFindings: warned.map((f) => f.fingerprint)
+  };
+}
+
+// src/core/findings/rating.ts
+var GRADE = { critical: "E", high: "D", medium: "C", low: "B", info: "B", unrated: "D" };
+var ORDER = ["A", "B", "C", "D", "E"];
+function gradeFor(severity, policy) {
+  if (severity === "unrated" && policy.gate.unrated === "warn") return "C";
+  return GRADE[severity];
+}
+function rateCategories(result, ctx) {
+  const cats = /* @__PURE__ */ new Set();
+  for (const c of result.coverage) cats.add(c.category);
+  for (const f of result.findings) cats.add(f.category);
+  const out = [];
+  for (const category of [...cats].sort()) {
+    const cov = result.coverage.filter((c) => c.category === category);
+    const ran = cov.filter((c) => c.status === "ok");
+    const active = result.findings.filter((f) => f.category === category && (ctx.statuses.get(f.fingerprint)?.active ?? true));
+    let worstIdx = -1;
+    let worst;
+    for (const f of active) {
+      const idx = ORDER.indexOf(gradeFor(f.severity, ctx.policy));
+      if (idx > worstIdx || idx === worstIdx && worst && SEVERITY_RANK[f.severity] > SEVERITY_RANK[worst]) {
+        worstIdx = idx;
+        worst = f.severity;
+      }
+    }
+    const grade = worstIdx >= 0 ? ORDER[worstIdx] : "A";
+    const broken = cov.some((c) => c.status === "failed" || c.status === "timeout");
+    const rating = active.length ? grade : ran.length && !broken ? "A" : null;
+    out.push({ category, rating, ...worst ? { worst } : {}, active: active.length, basis: basisText(cov, ran, ctx) });
+  }
+  return out;
+}
+function basisText(cov, ran, ctx) {
+  if (!ran.length) {
+    const why = cov.map((c) => `${c.engine} ${c.status}`).join(", ");
+    return `not scanned${why ? ` (${why})` : ""}`;
+  }
+  const engines = [...new Set(ran.map((c) => c.engine))].sort();
+  const known = engines.every((e) => ctx.rulesByEngine?.[e] !== void 0);
+  const what = known ? `${engines.reduce((n, e) => n + ctx.rulesByEngine[e], 0)} rules` : `${engines.length} engine${engines.length === 1 ? "" : "s"} (${engines.join(", ")})`;
+  const langs = [...new Set(ran.flatMap((c) => c.languages))].sort();
+  let notCovered = 0;
+  for (const c of ran) {
+    const s = c.filesSkipped;
+    if (s) notCovered += s.tooLarge + s.binary + s.minified + s.unreadable + s.unsupported;
+  }
+  const broken = cov.filter((c) => c.status === "failed" || c.status === "timeout").map((c) => c.engine);
+  return `${what} across ${langs.length ? langs.join(", ") : "all files"}; ${notCovered} file${notCovered === 1 ? "" : "s"} not covered${broken.length ? `; ${broken.join(", ")} failed` : ""}`;
+}
+
+// src/core/findings/status.ts
+function deriveStatuses(findings, ctx) {
+  const paths = new PolicyPaths(ctx.policy);
+  const baselined = new Set(ctx.baseline?.entries.map((e) => e.fingerprint) ?? []);
+  const out = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    const file = findingPath(f);
+    const inBaseline = baselined.has(f.fingerprint);
+    const inTests = file ? paths.isTest(file) : false;
+    const base = { baselined: inBaseline, inTests };
+    if (ruleSetting(ctx.policy, f.ruleId) === "off") {
+      out.set(f.fingerprint, { ...base, status: "excluded", active: false, reason: `rule ${f.ruleId} is off in the policy` });
+      continue;
+    }
+    if (file && paths.isExcluded(file)) {
+      out.set(f.fingerprint, { ...base, status: "excluded", active: false, reason: `${file} matches policy paths.exclude` });
+      continue;
+    }
+    const sup = ctx.suppressed.get(f.fingerprint);
+    if (sup) {
+      out.set(f.fingerprint, { ...base, status: "suppressed", active: false, reason: `athena-ignore at ${sup.file}:${sup.line}: ${sup.reason}` });
+      continue;
+    }
+    const t = ctx.triage?.entries[f.fingerprint];
+    if (t && CLOSING_TRIAGE.has(t.status)) {
+      out.set(f.fingerprint, { ...base, status: `triaged:${t.status}`, active: false, triage: t.status, reason: t.reason });
+      continue;
+    }
+    out.set(f.fingerprint, { ...base, status: inBaseline ? "baselined" : "open", active: true, ...t ? { triage: t.status, reason: `to review: ${t.reason}` } : {} });
+  }
+  return out;
+}
+
+// src/services/findings.ts
+function rethrow(err) {
+  if (err instanceof PolicyError) throw new AthenaError(err.message, err.hint);
+  if (err instanceof GitCommandError) throw new AthenaError(err.message, void 0, EXIT.NOT_AVAILABLE);
+  throw err;
+}
+async function evaluateFindings(root, result, opts = {}) {
+  try {
+    let policy;
+    let baseline;
+    let triage;
+    let policySource = { kind: "working-tree" };
+    let tamper;
+    if (opts.policyFrom !== void 0) {
+      tamper = await checkPolicyFrom(root, opts.policyFrom, { signal: opts.signal });
+      ({ policy, baseline, triage } = tamper.base);
+      policySource = { kind: "ref", ref: tamper.ref, commit: tamper.commit, mergeBase: tamper.mergeBase };
+    } else {
+      [policy, baseline, triage] = await Promise.all([loadPolicy(root), loadBaseline(root), loadTriage(root)]);
+    }
+    opts.signal?.throwIfAborted();
+    if (opts.noBaseline) baseline = null;
+    if (opts.gate) policy = { ...policy, gate: { ...policy.gate, ...Object.fromEntries(Object.entries(opts.gate).filter(([, v]) => v !== void 0)) } };
+    const scanned = applyRuleOverrides(policy, result.findings);
+    const sup = await applySuppressions(root, scanned, { maxBytes: opts.maxFileBytes });
+    const extra = applyRuleOverrides(policy, [...sup.findings, ...tamper?.findings ?? []]);
+    const findings = dedupeFindings([...scanned, ...extra]);
+    const statuses = deriveStatuses(findings, { policy, baseline, triage, suppressed: sup.suppressed });
+    const view = { findings, coverage: result.coverage };
+    const gate = evaluateGate(view, { policy, statuses });
+    const ratings = rateCategories(view, { policy, statuses, rulesByEngine: opts.rulesByEngine });
+    return {
+      findings,
+      statuses: Object.fromEntries(statuses),
+      notes: Object.fromEntries([...statuses].filter(([, s]) => s.reason).map(([fp, s]) => [fp, s.reason])),
+      gate,
+      ratings,
+      policy,
+      policySource,
+      suppressions: { applied: [...sup.suppressed.keys()].filter((fp) => statuses.get(fp)?.status === "suppressed").length, skippedFiles: sup.skippedFiles },
+      ...tamper ? { tamper: { changes: tamper.changes, addedSuppressions: tamper.addedSuppressions } } : {}
+    };
+  } catch (err) {
+    rethrow(err);
+  }
+}
+var NEVER_BASELINED = /* @__PURE__ */ new Set(["review/policy-weakened", "review/suppression-without-reason", "review/invalid-suppression"]);
+async function baselineFindings(root, result, opts = {}) {
+  try {
+    const existing = await loadBaseline(root);
+    const eligible = result.findings.filter((f) => !NEVER_BASELINED.has(f.ruleId));
+    const { baseline, added } = updateBaseline(existing ?? emptyBaseline(opts.now), eligible, opts);
+    await saveBaseline(root, baseline);
+    return { added, total: baseline.entries.length, created: existing === null };
+  } catch (err) {
+    rethrow(err);
+  }
+}
+async function pruneBaselineFile(root, result) {
+  try {
+    const existing = await loadBaseline(root);
+    if (!existing) return { removed: [], keptUnverified: [], total: 0 };
+    const r = pruneBaseline(existing, result);
+    if (r.removed.length) await saveBaseline(root, r.baseline);
+    return { removed: r.removed, keptUnverified: r.keptUnverified, total: r.baseline.entries.length };
+  } catch (err) {
+    rethrow(err);
+  }
+}
+async function triageFinding(root, fingerprint, input) {
+  try {
+    const t = setTriage(await loadTriage(root) ?? emptyTriage(), fingerprint, input);
+    await saveTriage(root, t);
+    return t;
+  } catch (err) {
+    rethrow(err);
+  }
+}
+async function untriageFinding(root, fingerprint) {
+  try {
+    const t = await loadTriage(root);
+    if (!t || !(fingerprint in t.entries)) return false;
+    await saveTriage(root, removeTriage(t, fingerprint));
+    return true;
+  } catch (err) {
+    rethrow(err);
+  }
+}
+
+export {
+  GATE_SEVERITIES,
+  TRIAGE_STATUSES,
+  loadBaseline,
+  evaluateFindings,
+  baselineFindings,
+  pruneBaselineFile,
+  triageFinding,
+  untriageFinding
+};
+//# sourceMappingURL=chunk-KJYSNZXS.js.map