sentinello 3.2.0 → 3.3.0

package/dist/cli.cjs

@@ -526,11 +526,11 @@ var require_parse = __commonJS({
 var require_valid = __commonJS({
   "../../node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/valid.js"(exports2, module2) {
     var parse3 = require_parse();
-    var valid4 = (version2, options) => {
+    var valid3 = (version2, options) => {
       const v = parse3(version2, options);
       return v ? v.version : null;
     };
-    module2.exports = valid4;
+    module2.exports = valid3;
   }
 });
 
@@ -772,7 +772,7 @@ var require_cmp = __commonJS({
     var gte2 = require_gte();
     var lt = require_lt();
     var lte = require_lte();
-    var cmp = (a, op, b, loose) => {
+    var cmp2 = (a, op, b, loose) => {
       switch (op) {
         case "===":
           if (typeof a === "object") {
@@ -808,7 +808,7 @@ var require_cmp = __commonJS({
           throw new TypeError(`Invalid operator: ${op}`);
       }
     };
-    module2.exports = cmp;
+    module2.exports = cmp2;
   }
 });
 
@@ -818,7 +818,7 @@ var require_coerce = __commonJS({
     var SemVer = require_semver();
     var parse3 = require_parse();
     var { safeRe: re, t } = require_re();
-    var coerce4 = (version2, options) => {
+    var coerce3 = (version2, options) => {
       if (version2 instanceof SemVer) {
         return version2;
       }
@@ -853,7 +853,7 @@ var require_coerce = __commonJS({
       const build = options.includePrerelease && match[6] ? `+${match[6]}` : "";
       return parse3(`${major}.${minor}.${patch}${prerelease}${build}`, options);
     };
-    module2.exports = coerce4;
+    module2.exports = coerce3;
   }
 });
 
@@ -1330,7 +1330,7 @@ var require_comparator = __commonJS({
             return false;
           }
         }
-        return cmp(version2, this.operator, this.semver, this.options);
+        return cmp2(version2, this.operator, this.semver, this.options);
       }
       intersects(comp, options) {
         if (!(comp instanceof _Comparator)) {
@@ -1363,10 +1363,10 @@ var require_comparator = __commonJS({
         if (this.semver.version === comp.semver.version && this.operator.includes("=") && comp.operator.includes("=")) {
           return true;
         }
-        if (cmp(this.semver, "<", comp.semver, options) && this.operator.startsWith(">") && comp.operator.startsWith("<")) {
+        if (cmp2(this.semver, "<", comp.semver, options) && this.operator.startsWith(">") && comp.operator.startsWith("<")) {
           return true;
         }
-        if (cmp(this.semver, ">", comp.semver, options) && this.operator.startsWith("<") && comp.operator.startsWith(">")) {
+        if (cmp2(this.semver, ">", comp.semver, options) && this.operator.startsWith("<") && comp.operator.startsWith(">")) {
           return true;
         }
         return false;
@@ -1375,7 +1375,7 @@ var require_comparator = __commonJS({
     module2.exports = Comparator;
     var parseOptions = require_parse_options();
     var { safeRe: re, t } = require_re();
-    var cmp = require_cmp();
+    var cmp2 = require_cmp();
     var debug = require_debug();
     var SemVer = require_semver();
     var Range2 = require_range();
@@ -1853,7 +1853,7 @@ var require_semver2 = __commonJS({
     var SemVer = require_semver();
     var identifiers = require_identifiers();
     var parse3 = require_parse();
-    var valid4 = require_valid();
+    var valid3 = require_valid();
     var clean = require_clean();
     var inc = require_inc();
     var diff = require_diff();
@@ -1873,8 +1873,8 @@ var require_semver2 = __commonJS({
     var neq = require_neq();
     var gte2 = require_gte();
     var lte = require_lte();
-    var cmp = require_cmp();
-    var coerce4 = require_coerce();
+    var cmp2 = require_cmp();
+    var coerce3 = require_coerce();
     var Comparator = require_comparator();
     var Range2 = require_range();
     var satisfies3 = require_satisfies();
@@ -1891,7 +1891,7 @@ var require_semver2 = __commonJS({
     var subset = require_subset();
     module2.exports = {
       parse: parse3,
-      valid: valid4,
+      valid: valid3,
       clean,
       inc,
       diff,
@@ -1911,8 +1911,8 @@ var require_semver2 = __commonJS({
       neq,
       gte: gte2,
       lte,
-      cmp,
-      coerce: coerce4,
+      cmp: cmp2,
+      coerce: coerce3,
       Comparator,
       Range: Range2,
       satisfies: satisfies3,
@@ -3411,7 +3411,7 @@ var require_stream_writable = __commonJS({
       pna.nextTick(cb, er);
     }
     function validChunk(stream, state, chunk, cb) {
-      var valid4 = true;
+      var valid3 = true;
       var er = false;
       if (chunk === null) {
         er = new TypeError("May not write null values to stream");
@@ -3421,9 +3421,9 @@ var require_stream_writable = __commonJS({
       if (er) {
         stream.emit("error", er);
         pna.nextTick(cb, er);
-        valid4 = false;
+        valid3 = false;
       }
-      return valid4;
+      return valid3;
     }
     Writable.prototype.write = function(chunk, encoding, cb) {
       var state = this._writableState;
@@ -13136,6 +13136,12 @@ function maxSeverity(severities) {
   }
   return best;
 }
+function escalatedSeverity(own, corroborations) {
+  if (corroborations.length === 0) return own;
+  return maxSeverity([own, ...corroborations.map(function grade(c) {
+    return c.severity;
+  })]);
+}
 var SOURCE_UNAVAILABLE_REASON_CODES = [
   "osv_db_not_seeded",
   "osv_db_unavailable",
@@ -13148,7 +13154,7 @@ function isSourceUnavailableReason(code) {
 
 // ../../packages/core/src/advisory-rows.ts
 var OSV_NORMALIZER_VERSION = 4;
-var GEMNASIUM_NORMALIZER_VERSION = 4;
+var GEMNASIUM_NORMALIZER_VERSION = 5;
 
 // ../../packages/core/src/advisory-export.ts
 var DEFAULT_EXPORT_PROMPT = `You are helping a development team triage and fix the vulnerabilities listed at the bottom of this document. Treat this as a remediation work list, not a checklist to rubber-stamp. Work in a planning posture from the start: if your tooling has a read-only planning mode (Claude Code's plan mode, for example), enter it now and stay in it until the human has approved the triage below. Nothing in this document authorises you to edit a file before then.
@@ -13365,7 +13371,10 @@ var ECOSYSTEMS = [
   {
     id: "npm",
     language: "javascript",
-    displayName: "JavaScript",
+    // The registry ecosystem is npm and the toolchain is Node — 'JavaScript' overclaimed, naming a
+    // language rather than the package ecosystem actually scanned.
+    displayName: "Node.js",
+    status: "stable",
     osvEcosystem: "npm",
     gemnasiumPackageType: "npm",
     resolverKinds: ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"],
@@ -13375,6 +13384,7 @@ var ECOSYSTEMS = [
     id: "PyPI",
     language: "python",
     displayName: "Python",
+    status: "preview",
     osvEcosystem: "PyPI",
     gemnasiumPackageType: "pypi",
     resolverKinds: ["poetry.lock", "Pipfile.lock", "requirements.txt", "uv.lock"],
@@ -13384,6 +13394,7 @@ var ECOSYSTEMS = [
     id: "Go",
     language: "go",
     displayName: "Go",
+    status: "preview",
     osvEcosystem: "Go",
     gemnasiumPackageType: "go",
     resolverKinds: ["go.mod", "go.sum"],
@@ -13393,6 +13404,7 @@ var ECOSYSTEMS = [
     id: "crates.io",
     language: "rust",
     displayName: "Rust",
+    status: "preview",
     osvEcosystem: "crates.io",
     gemnasiumPackageType: "cargo",
     resolverKinds: ["Cargo.lock"],
@@ -13400,6 +13412,9 @@ var ECOSYSTEMS = [
   }
 ];
 var DEFAULT_ECOSYSTEM = "npm";
+var STABLE_ECOSYSTEMS = ECOSYSTEMS.filter(function stable(eco) {
+  return eco.status === "stable";
+});
 function getEcosystem(id) {
   for (const eco of ECOSYSTEMS) {
     if (eco.id === id) return eco;
@@ -13409,7 +13424,241 @@ function getEcosystem(id) {
 var GEMNASIUM_SEED_DOWNLOAD_BYTES = 52 * 1024 * 1024;
 
 // ../../packages/scanners/src/lockfile-cross-check.ts
+var import_semver5 = __toESM(require_semver2());
+
+// ../../packages/versions/src/range.ts
+function isZeroVersion(version2) {
+  return /^0(\.0)*$/.test(version2.trim());
+}
+function formatRange(range, options) {
+  const lo = range.introduced === "0" ? options.zero : range.introduced;
+  const lower = (range.introducedExclusive === true ? ">" : ">=") + lo;
+  if (range.fixed !== null && range.fixed !== void 0) return lower + " <" + range.fixed;
+  const lastAffected = range.lastAffected;
+  if (lastAffected !== null && lastAffected !== void 0) return lower + " <=" + lastAffected;
+  return lower;
+}
+function formatRanges(ranges, options) {
+  return ranges.map(function one(range) {
+    return formatRange(range, options);
+  }).join(" || ");
+}
+
+// ../../packages/versions/src/match.ts
+function versionInRange(version2, range, comparator) {
+  const installed = comparator.normalize(version2);
+  if (installed === null) return false;
+  if (!aboveLowerBound(installed, range, comparator)) return false;
+  if (range.fixed !== null && range.fixed !== void 0) {
+    const fixed = comparator.normalize(range.fixed);
+    return fixed !== null && comparator.lt(installed, fixed);
+  }
+  const lastAffectedRaw = range.lastAffected;
+  if (lastAffectedRaw !== null && lastAffectedRaw !== void 0) {
+    const lastAffected = comparator.normalize(lastAffectedRaw);
+    return lastAffected !== null && comparator.lte(installed, lastAffected);
+  }
+  return true;
+}
+function aboveLowerBound(installed, range, comparator) {
+  if (range.introducedExclusive !== true && isZeroVersion(range.introduced)) return true;
+  const introduced = comparator.normalize(range.introduced);
+  if (introduced === null) return false;
+  return range.introducedExclusive === true ? comparator.gt(installed, introduced) : comparator.gte(installed, introduced);
+}
+
+// ../../packages/versions/src/compare.ts
+__toESM(require_semver2());
+
+// ../../packages/versions/src/comparators/semver.ts
 var import_semver = __toESM(require_semver2());
+var MEANING_CHANGING_RANGE_SYNTAX = /[<>^~|*]|\s-\s|(^|\.)[xX](\.|$)/;
+function normalizeSemver(raw) {
+  const strict = (0, import_semver.valid)(raw);
+  if (strict !== null) return strict;
+  if (MEANING_CHANGING_RANGE_SYNTAX.test(raw)) return null;
+  const coerced = (0, import_semver.coerce)(raw);
+  return coerced === null ? null : coerced.version;
+}
+var semverComparator = {
+  normalize(raw) {
+    return normalizeSemver(raw);
+  },
+  gt(a, b) {
+    return (0, import_semver.gt)(a, b);
+  },
+  gte(a, b) {
+    return (0, import_semver.gte)(a, b);
+  },
+  lt(a, b) {
+    return (0, import_semver.lt)(a, b);
+  },
+  lte(a, b) {
+    return (0, import_semver.lte)(a, b);
+  }
+};
+
+// ../../packages/versions/src/comparators/pep440.ts
+var PRE_RANK = { a: 0, b: 1, rc: 2 };
+var PEP440_RE = new RegExp(
+  "^\\s*v?(?:(?<epoch>[0-9]+)!)?(?<release>[0-9]+(?:\\.[0-9]+)*)(?:[-_.]?(?<preL>a|b|c|rc|alpha|beta|pre|preview)[-_.]?(?<preN>[0-9]+)?)?(?:(?:-(?<postN1>[0-9]+))|(?:[-_.]?(?<postL>post|rev|r)[-_.]?(?<postN2>[0-9]+)?))?(?:[-_.]?(?<devL>dev)[-_.]?(?<devN>[0-9]+)?)?(?:\\+(?<local>[a-z0-9]+(?:[-_.][a-z0-9]+)*))?\\s*$",
+  "i"
+);
+function foldPreLetter(raw) {
+  const l = raw.toLowerCase();
+  if (l === "alpha") return "a";
+  if (l === "beta") return "b";
+  if (l === "c" || l === "pre" || l === "preview" || l === "rc") return "rc";
+  return l;
+}
+function parsePep440(raw) {
+  const m = PEP440_RE.exec(raw.trim());
+  if (!m || !m.groups) return null;
+  const g = m.groups;
+  if (!g.release) return null;
+  const release = g.release.split(".").map(function toInt(s) {
+    return parseInt(s, 10);
+  });
+  if (release.some(function bad(n) {
+    return Number.isNaN(n);
+  })) return null;
+  let pre = null;
+  if (g.preL) {
+    pre = { letter: foldPreLetter(g.preL), n: g.preN ? parseInt(g.preN, 10) : 0 };
+  }
+  let post = null;
+  if (g.postN1 !== void 0) {
+    post = parseInt(g.postN1, 10);
+  } else if (g.postL) {
+    post = g.postN2 ? parseInt(g.postN2, 10) : 0;
+  }
+  const dev = g.devL ? g.devN ? parseInt(g.devN, 10) : 0 : null;
+  let local = null;
+  if (g.local) {
+    local = g.local.toLowerCase().split(/[-_.]/).map(function part(seg) {
+      return /^[0-9]+$/.test(seg) ? parseInt(seg, 10) : seg;
+    });
+  }
+  return { epoch: g.epoch ? parseInt(g.epoch, 10) : 0, release, pre, post, dev, local };
+}
+function stripTrailingZeros(release) {
+  let end = release.length;
+  while (end > 1 && release[end - 1] === 0) end--;
+  return release.slice(0, end);
+}
+function canonicalPep440(v) {
+  const parts = [];
+  if (v.epoch > 0) parts.push(v.epoch.toString() + "!");
+  parts.push(stripTrailingZeros(v.release).join("."));
+  if (v.pre) parts.push(v.pre.letter + v.pre.n.toString());
+  if (v.post !== null) parts.push(".post" + v.post.toString());
+  if (v.dev !== null) parts.push(".dev" + v.dev.toString());
+  if (v.local) parts.push("+" + v.local.join("."));
+  return parts.join("");
+}
+function cmpRelease(a, b) {
+  const ra = stripTrailingZeros(a);
+  const rb = stripTrailingZeros(b);
+  const len = Math.max(ra.length, rb.length);
+  for (let i = 0; i < len; i++) {
+    const x = ra[i] ?? 0;
+    const y = rb[i] ?? 0;
+    if (x !== y) return x < y ? -1 : 1;
+  }
+  return 0;
+}
+function preKind(v) {
+  if (v.pre !== null) return 0;
+  if (v.post === null && v.dev !== null) return -1;
+  return 1;
+}
+function cmpPre(a, b) {
+  const ka = preKind(a);
+  const kb = preKind(b);
+  if (ka !== kb) return ka < kb ? -1 : 1;
+  if (ka !== 0 || !a.pre || !b.pre) return 0;
+  const la = PRE_RANK[a.pre.letter] ?? 0;
+  const lb = PRE_RANK[b.pre.letter] ?? 0;
+  if (la !== lb) return la < lb ? -1 : 1;
+  if (a.pre.n !== b.pre.n) return a.pre.n < b.pre.n ? -1 : 1;
+  return 0;
+}
+function cmpPost(a, b) {
+  if (a === null && b === null) return 0;
+  if (a === null) return -1;
+  if (b === null) return 1;
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function cmpDev(a, b) {
+  if (a === null && b === null) return 0;
+  if (a === null) return 1;
+  if (b === null) return -1;
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function cmpLocal(a, b) {
+  if (a === null && b === null) return 0;
+  if (a === null) return -1;
+  if (b === null) return 1;
+  const len = Math.max(a.length, b.length);
+  for (let i = 0; i < len; i++) {
+    if (i >= a.length) return -1;
+    if (i >= b.length) return 1;
+    const x = a[i];
+    const y = b[i];
+    const xNum = typeof x === "number";
+    const yNum = typeof y === "number";
+    if (xNum && yNum) {
+      if (x !== y) return x < y ? -1 : 1;
+    } else if (xNum !== yNum) {
+      return xNum ? 1 : -1;
+    } else if (x !== y) {
+      return x < y ? -1 : 1;
+    }
+  }
+  return 0;
+}
+function comparePep440(a, b) {
+  if (a.epoch !== b.epoch) return a.epoch < b.epoch ? -1 : 1;
+  const r = cmpRelease(a.release, b.release);
+  if (r !== 0) return r;
+  const p = cmpPre(a, b);
+  if (p !== 0) return p;
+  const po = cmpPost(a.post, b.post);
+  if (po !== 0) return po;
+  const d = cmpDev(a.dev, b.dev);
+  if (d !== 0) return d;
+  return cmpLocal(a.local, b.local);
+}
+function cmp(a, b) {
+  const pa = parsePep440(a);
+  const pb = parsePep440(b);
+  if (!pa || !pb) return null;
+  return comparePep440(pa, pb);
+}
+var pep440Comparator = {
+  normalize(raw) {
+    const parsed = parsePep440(raw);
+    return parsed === null ? null : canonicalPep440(parsed);
+  },
+  gt(a, b) {
+    const r = cmp(a, b);
+    return r !== null && r > 0;
+  },
+  gte(a, b) {
+    const r = cmp(a, b);
+    return r !== null && r >= 0;
+  },
+  lt(a, b) {
+    const r = cmp(a, b);
+    return r !== null && r < 0;
+  },
+  lte(a, b) {
+    const r = cmp(a, b);
+    return r !== null && r <= 0;
+  }
+};
+
+// ../../packages/scanners/src/lockfile-cross-check.ts
 function filterFindingsByLockfileResolution(findings) {
   const kept = [];
   const droppedAdvisoryIds = [];
@@ -13426,7 +13675,7 @@ function shouldKeep(finding) {
   const installed = finding.installedVersion.trim();
   const range = finding.vulnerableRange.trim();
   if (!installed || !range) return true;
-  if ((0, import_semver.validRange)(range) === null) return true;
+  if ((0, import_semver5.validRange)(range) === null) return true;
   const candidates = installed.split(/,\s*/).map(function trim(s) {
     return s.trim();
   }).filter(Boolean);
@@ -13434,19 +13683,11 @@ function shouldKeep(finding) {
   for (const candidate of candidates) {
     const cleaned = normalizeVersion(candidate);
     if (cleaned === null) return true;
-    if ((0, import_semver.satisfies)(cleaned, range, { includePrerelease: true })) return true;
+    if ((0, import_semver5.satisfies)(cleaned, range, { includePrerelease: true })) return true;
   }
   return false;
 }
-var RANGE_SYNTAX = /[<>=^~|*]|\s-\s|(^|\.)[xX](\.|$)/;
-function normalizeVersion(raw) {
-  const strict = (0, import_semver.valid)(raw);
-  if (strict !== null) return strict;
-  if (RANGE_SYNTAX.test(raw)) return null;
-  const coerced = (0, import_semver.coerce)(raw);
-  if (coerced === null) return null;
-  return coerced.version;
-}
+var normalizeVersion = normalizeSemver;
 
 // ../../node_modules/.pnpm/zod@4.4.1/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -27931,7 +28172,7 @@ function date4(params) {
 config(en_default());
 
 // ../../packages/scanners/src/version-fix.ts
-var import_semver2 = __toESM(require_semver2());
+var import_semver6 = __toESM(require_semver2());
 var VERSION_LITERAL_RE = /\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?/g;
 function parseRangeSafely(input) {
   if (!input) return null;
@@ -27939,7 +28180,7 @@ function parseRangeSafely(input) {
   if (!trimmed) return null;
   if (trimmed === "<0.0.0") return null;
   try {
-    return new import_semver2.Range(trimmed, { includePrerelease: false });
+    return new import_semver6.Range(trimmed, { includePrerelease: false });
   } catch {
     return null;
   }
@@ -27950,12 +28191,12 @@ function extractLiteralCandidates(input) {
   if (!matches) return [];
   const out = [];
   for (const m of matches) {
-    if ((0, import_semver2.valid)(m)) out.push(m);
+    if ((0, import_semver6.valid)(m)) out.push(m);
   }
   return out;
 }
 function bumpPatch(v) {
-  const sv = (0, import_semver2.coerce)(v);
+  const sv = (0, import_semver6.coerce)(v);
   if (!sv) return null;
   return sv.major + "." + sv.minor + "." + (sv.patch + 1);
 }
@@ -27966,13 +28207,13 @@ function extractRangeLowerBounds(range) {
     for (const c of conjuncts) {
       if (!c.semver || !c.semver.version) continue;
       const v = c.semver.version;
-      if (!(0, import_semver2.valid)(v)) continue;
+      if (!(0, import_semver6.valid)(v)) continue;
       const op = c.operator;
       if (op === ">=" || op === "=" || op === "") {
-        if (!candidate || (0, import_semver2.gt)(v, candidate)) candidate = v;
+        if (!candidate || (0, import_semver6.gt)(v, candidate)) candidate = v;
       } else if (op === ">") {
         const inc = bumpPatch(v);
-        if (inc && (!candidate || (0, import_semver2.gt)(inc, candidate))) candidate = inc;
+        if (inc && (!candidate || (0, import_semver6.gt)(inc, candidate))) candidate = inc;
       }
     }
     if (candidate) out.push(candidate);
@@ -27985,7 +28226,7 @@ function extractRangeUpperBoundsBeyond(range) {
     for (const c of conjuncts) {
       if (!c.semver || !c.semver.version) continue;
       const v = c.semver.version;
-      if (!(0, import_semver2.valid)(v)) continue;
+      if (!(0, import_semver6.valid)(v)) continue;
       const op = c.operator;
       if (op === "<") {
         out.push(v);
@@ -28004,8 +28245,8 @@ function pickHighestInstalled(installed) {
   for (const raw of parts) {
     const part = raw.trim();
     if (!part) continue;
-    if (!(0, import_semver2.valid)(part)) continue;
-    if (!highest || (0, import_semver2.gt)(part, highest)) highest = part;
+    if (!(0, import_semver6.valid)(part)) continue;
+    if (!highest || (0, import_semver6.gt)(part, highest)) highest = part;
   }
   return highest;
 }
@@ -28027,17 +28268,17 @@ function pickSafeFixVersion(args) {
   if (candidates.size === 0) return null;
   let best = null;
   for (const v of candidates) {
-    if (patchedRange && !(0, import_semver2.satisfies)(v, patchedRange)) continue;
-    if (vulnRange && (0, import_semver2.satisfies)(v, vulnRange)) continue;
-    if (installedFloor && !(0, import_semver2.gte)(v, installedFloor)) continue;
-    if (!best || (0, import_semver2.gt)(best, v)) best = v;
+    if (patchedRange && !(0, import_semver6.satisfies)(v, patchedRange)) continue;
+    if (vulnRange && (0, import_semver6.satisfies)(v, vulnRange)) continue;
+    if (installedFloor && !(0, import_semver6.gte)(v, installedFloor)) continue;
+    if (!best || (0, import_semver6.gt)(best, v)) best = v;
   }
   return best;
 }
 
 // ../../packages/scanners/src/npm-audit-parse.ts
 var SEVERITY_VALUES = ["critical", "high", "moderate", "low", "info"];
-var severitySchema = external_exports.enum(SEVERITY_VALUES);
+var severitySchema = external_exports.enum(SEVERITY_VALUES).catch("moderate");
 var viaObjectSchema = external_exports.object({
   source: external_exports.number().int().optional(),
   name: external_exports.string().optional(),
@@ -28214,10 +28455,17 @@ function pickAdvisoryId(via) {
   if (via.source == null && !via.url && !via.title) return null;
   return fallbackAdvisoryHash(via);
 }
+function pickAdvisoryAliases(advisoryId, url2, githubAdvisoryId) {
+  const explicit = typeof githubAdvisoryId === "string" && githubAdvisoryId.length > 0 && githubAdvisoryId;
+  const ghsa = explicit || pickGhsaIdFromUrl(url2);
+  if (!ghsa) return [];
+  if (ghsa.toLowerCase() === advisoryId.toLowerCase()) return [];
+  return [ghsa];
+}
 function pickSeverity(via, vuln) {
   if (via.severity) return via.severity;
   if (vuln.severity) return vuln.severity;
-  return "info";
+  return "moderate";
 }
 function pickFixAvailability(fix) {
   if (fix === void 0) return { fixAvailable: false, fixVersion: null };
@@ -28275,6 +28523,7 @@ function normalizeOneVulnerability(vuln, packageName, installedVersions, classif
     const cls = classifier.classify(packageName, installedVersion);
     const finding = {
       advisoryId,
+      aliases: pickAdvisoryAliases(advisoryId, via.url),
       advisoryTitle: via.title || null,
       advisoryUrl: via.url || null,
       packageName,
@@ -28331,12 +28580,13 @@ function normalizePnpmAuditOutput(parsed, classifier) {
     const adv = advisories[idKey];
     if (!adv) continue;
     const advisoryId = pickPnpmAdvisoryId(adv, idKey);
-    const severity = adv.severity || "info";
+    const severity = adv.severity || "moderate";
     const patched = adv.patched_versions || null;
     const recommendation = adv.recommendation || null;
     const vulnRange = adv.vulnerable_versions || "";
     const advisoryTitle = adv.title || null;
     const advisoryUrl = adv.url || null;
+    const aliases = pickAdvisoryAliases(advisoryId, adv.url ?? void 0, adv.github_advisory_id);
     const packageName = adv.module_name;
     const findings = adv.findings || [];
     if (findings.length === 0) {
@@ -28344,6 +28594,7 @@ function normalizePnpmAuditOutput(parsed, classifier) {
       const cls = classifier.classify(packageName, null);
       out.push({
         advisoryId,
+        aliases,
         advisoryTitle,
         advisoryUrl,
         packageName,
@@ -28367,6 +28618,7 @@ function normalizePnpmAuditOutput(parsed, classifier) {
         const cls = classifier.classify(packageName, f.version || null);
         out.push({
           advisoryId,
+          aliases,
           advisoryTitle,
           advisoryUrl,
           packageName,
@@ -28386,6 +28638,7 @@ function normalizePnpmAuditOutput(parsed, classifier) {
         const cls = classifier.classify(packageName, f.version || null);
         out.push({
           advisoryId,
+          aliases,
           advisoryTitle,
           advisoryUrl,
           packageName,
@@ -28969,15 +29222,11 @@ async function parseNpmLock(projectPath, absolutePath) {
     if (!entry || !entry.version) continue;
     const name = entry.name || nameFromNodePath(nodePath);
     if (!name) continue;
-    let isDev = entry.dev === true || entry.devOptional === true;
-    let isProd = !isDev;
-    if (direct.prod.has(name)) {
-      isProd = true;
-    }
-    if (direct.dev.has(name) && !direct.prod.has(name)) {
-      isDev = true;
-      isProd = false;
-    }
+    const lockSaysDevOnly = entry.dev === true || entry.devOptional === true;
+    let isProd = !lockSaysDevOnly;
+    let isDev = lockSaysDevOnly;
+    if (direct.prod.has(name)) isProd = true;
+    if (direct.dev.has(name)) isDev = true;
     out.push({
       ecosystem: NPM_ECOSYSTEM,
       name,
@@ -32435,7 +32684,7 @@ function stripComment3(line) {
 // ../../packages/scanners/src/resolver/index.ts
 async function detectManifests(projectPath) {
   const out = [];
-  for (const eco of ECOSYSTEMS) {
+  for (const eco of STABLE_ECOSYSTEMS) {
     for (const kind of eco.resolverKinds) {
       const absolutePath = path.join(projectPath, kind);
       if (await fileExists2(absolutePath)) {
@@ -32613,7 +32862,7 @@ function detectProject(rootPath, dir) {
 }
 function detectEcosystems(dir) {
   const out = [];
-  for (const eco of ECOSYSTEMS) {
+  for (const eco of STABLE_ECOSYSTEMS) {
     if (eco.id === "npm") {
       if (existsFile(path.join(dir, "package.json"))) out.push(eco.id);
       continue;
@@ -32699,162 +32948,6 @@ function isFile(path) {
   }
 }
 
-// ../../packages/scanners/src/engine/comparators/pep440.ts
-var PRE_RANK = { a: 0, b: 1, rc: 2 };
-var PEP440_RE = new RegExp(
-  "^\\s*v?(?:(?<epoch>[0-9]+)!)?(?<release>[0-9]+(?:\\.[0-9]+)*)(?:[-_.]?(?<preL>a|b|c|rc|alpha|beta|pre|preview)[-_.]?(?<preN>[0-9]+)?)?(?:(?:-(?<postN1>[0-9]+))|(?:[-_.]?(?<postL>post|rev|r)[-_.]?(?<postN2>[0-9]+)?))?(?:[-_.]?(?<devL>dev)[-_.]?(?<devN>[0-9]+)?)?(?:\\+(?<local>[a-z0-9]+(?:[-_.][a-z0-9]+)*))?\\s*$",
-  "i"
-);
-function foldPreLetter(raw) {
-  const l = raw.toLowerCase();
-  if (l === "alpha") return "a";
-  if (l === "beta") return "b";
-  if (l === "c" || l === "pre" || l === "preview" || l === "rc") return "rc";
-  return l;
-}
-function parsePep440(raw) {
-  const m = PEP440_RE.exec(raw.trim());
-  if (!m || !m.groups) return null;
-  const g = m.groups;
-  if (!g.release) return null;
-  const release = g.release.split(".").map(function toInt(s) {
-    return parseInt(s, 10);
-  });
-  if (release.some(function bad(n) {
-    return Number.isNaN(n);
-  })) return null;
-  let pre = null;
-  if (g.preL) {
-    pre = { letter: foldPreLetter(g.preL), n: g.preN ? parseInt(g.preN, 10) : 0 };
-  }
-  let post = null;
-  if (g.postN1 !== void 0) {
-    post = parseInt(g.postN1, 10);
-  } else if (g.postL) {
-    post = g.postN2 ? parseInt(g.postN2, 10) : 0;
-  }
-  const dev = g.devL ? g.devN ? parseInt(g.devN, 10) : 0 : null;
-  let local = null;
-  if (g.local) {
-    local = g.local.toLowerCase().split(/[-_.]/).map(function part(seg) {
-      return /^[0-9]+$/.test(seg) ? parseInt(seg, 10) : seg;
-    });
-  }
-  return { epoch: g.epoch ? parseInt(g.epoch, 10) : 0, release, pre, post, dev, local };
-}
-function stripTrailingZeros(release) {
-  let end = release.length;
-  while (end > 1 && release[end - 1] === 0) end--;
-  return release.slice(0, end);
-}
-function cmpRelease(a, b) {
-  const ra = stripTrailingZeros(a);
-  const rb = stripTrailingZeros(b);
-  const len = Math.max(ra.length, rb.length);
-  for (let i = 0; i < len; i++) {
-    const x = ra[i] ?? 0;
-    const y = rb[i] ?? 0;
-    if (x !== y) return x < y ? -1 : 1;
-  }
-  return 0;
-}
-function preKind(v) {
-  if (v.pre !== null) return 0;
-  if (v.post === null && v.dev !== null) return -1;
-  return 1;
-}
-function cmpPre(a, b) {
-  const ka = preKind(a);
-  const kb = preKind(b);
-  if (ka !== kb) return ka < kb ? -1 : 1;
-  if (ka !== 0 || !a.pre || !b.pre) return 0;
-  const la = PRE_RANK[a.pre.letter] ?? 0;
-  const lb = PRE_RANK[b.pre.letter] ?? 0;
-  if (la !== lb) return la < lb ? -1 : 1;
-  if (a.pre.n !== b.pre.n) return a.pre.n < b.pre.n ? -1 : 1;
-  return 0;
-}
-function cmpPost(a, b) {
-  if (a === null && b === null) return 0;
-  if (a === null) return -1;
-  if (b === null) return 1;
-  return a < b ? -1 : a > b ? 1 : 0;
-}
-function cmpDev(a, b) {
-  if (a === null && b === null) return 0;
-  if (a === null) return 1;
-  if (b === null) return -1;
-  return a < b ? -1 : a > b ? 1 : 0;
-}
-function cmpLocal(a, b) {
-  if (a === null && b === null) return 0;
-  if (a === null) return -1;
-  if (b === null) return 1;
-  const len = Math.max(a.length, b.length);
-  for (let i = 0; i < len; i++) {
-    if (i >= a.length) return -1;
-    if (i >= b.length) return 1;
-    const x = a[i];
-    const y = b[i];
-    const xNum = typeof x === "number";
-    const yNum = typeof y === "number";
-    if (xNum && yNum) {
-      if (x !== y) return x < y ? -1 : 1;
-    } else if (xNum !== yNum) {
-      return xNum ? 1 : -1;
-    } else if (x !== y) {
-      return x < y ? -1 : 1;
-    }
-  }
-  return 0;
-}
-function comparePep440(a, b) {
-  if (a.epoch !== b.epoch) return a.epoch < b.epoch ? -1 : 1;
-  const r = cmpRelease(a.release, b.release);
-  if (r !== 0) return r;
-  const p = cmpPre(a, b);
-  if (p !== 0) return p;
-  const po = cmpPost(a.post, b.post);
-  if (po !== 0) return po;
-  const d = cmpDev(a.dev, b.dev);
-  if (d !== 0) return d;
-  return cmpLocal(a.local, b.local);
-}
-var pep440Comparator = {
-  normalize(raw) {
-    return parsePep440(raw) === null ? null : raw.trim();
-  },
-  gte(a, b) {
-    const pa = parsePep440(a);
-    const pb = parsePep440(b);
-    if (!pa || !pb) return false;
-    return comparePep440(pa, pb) >= 0;
-  },
-  lt(a, b) {
-    const pa = parsePep440(a);
-    const pb = parsePep440(b);
-    if (!pa || !pb) return false;
-    return comparePep440(pa, pb) < 0;
-  }
-};
-
-// ../../packages/scanners/src/engine/comparators/semver.ts
-var import_semver3 = __toESM(require_semver2());
-var semverComparator = {
-  normalize(raw) {
-    const strict = (0, import_semver3.valid)(raw);
-    if (strict !== null) return strict;
-    const coerced = (0, import_semver3.coerce)(raw);
-    return coerced === null ? null : coerced.version;
-  },
-  gte(a, b) {
-    return (0, import_semver3.gte)(a, b);
-  },
-  lt(a, b) {
-    return (0, import_semver3.lt)(a, b);
-  }
-};
-
 // ../../packages/scanners/src/engine/comparators/index.ts
 var COMPARATORS = {
   semver: semverComparator,
@@ -32876,6 +32969,8 @@ function acceptedRangeTypesForEcosystem(ecosystem) {
 }
 
 // ../../packages/scanners/src/engine/matcher.ts
+var DISPLAY_FORMAT = { zero: "0" };
+var SEMVER_FORMAT = { zero: "0.0.0" };
 function matchAdvisories(packages, byPackage, comparator, acceptedRangeTypes) {
   const findings = [];
   for (const pkg2 of packages) {
@@ -32900,6 +32995,7 @@ function applicableRanges(ranges, acceptedRangeTypes) {
   });
 }
 function matchOne(pkg2, advisory, comparator, acceptedRangeTypes) {
+  if (advisory.withdrawn !== null) return null;
   const ranges = applicableRanges(advisory.affected.ranges, acceptedRangeTypes);
   const exactVersions = advisory.affected.exactVersions;
   const hasVersionData = ranges.length > 0 || exactVersions.length > 0;
@@ -32929,25 +33025,12 @@ function isAffected(installedRaw, ranges, exactVersions, comparator) {
   let affected = false;
   let firstFixed = null;
   for (const range of ranges) {
-    const introduced = range.introduced === "0" ? "0.0.0" : comparator.normalize(range.introduced);
-    if (introduced === null) continue;
-    if (!comparator.gte(installed, introduced)) continue;
+    if (!versionInRange(installedRaw, range, comparator)) continue;
+    affected = true;
     const fixed = range.fixed ? comparator.normalize(range.fixed) : null;
-    if (fixed !== null) {
-      if (comparator.lt(installed, fixed)) {
-        affected = true;
-        if (firstFixed === null || comparator.lt(fixed, firstFixed)) {
-          firstFixed = fixed;
-        }
-      }
-      continue;
-    }
-    const lastAffected = range.lastAffected ? comparator.normalize(range.lastAffected) : null;
-    if (lastAffected !== null) {
-      if (comparator.gte(lastAffected, installed)) affected = true;
-      continue;
+    if (fixed !== null && (firstFixed === null || comparator.lt(fixed, firstFixed))) {
+      firstFixed = fixed;
     }
-    affected = true;
   }
   return { affected, firstFixed };
 }
@@ -32973,29 +33056,11 @@ function buildFinding(pkg2, advisory, severity, fixVersion, vulnerableRange) {
 function rangesToDisplay(ranges, exactVersions) {
   const parts = [];
   for (const v of exactVersions) parts.push("=" + v);
-  for (const range of ranges) {
-    const lo = range.introduced === "0" ? "0" : range.introduced;
-    if (range.fixed) {
-      parts.push(">=" + lo + " <" + range.fixed);
-    } else if (range.lastAffected) {
-      parts.push(">=" + lo + " <=" + range.lastAffected);
-    } else {
-      parts.push(">=" + lo);
-    }
-  }
+  for (const range of ranges) parts.push(formatRange(range, DISPLAY_FORMAT));
   return parts.length > 0 ? parts.join(" || ") : "*";
 }
 function vulnerableRangeForFix(ranges) {
-  const parts = [];
-  for (const range of ranges) {
-    const lo = range.introduced === "0" ? "0.0.0" : range.introduced;
-    if (range.fixed) {
-      parts.push(">=" + lo + " <" + range.fixed);
-    } else {
-      parts.push(">=" + lo);
-    }
-  }
-  return parts.join(" || ");
+  return formatRanges(ranges, SEMVER_FORMAT);
 }
 function mapSeverity(severity) {
   if (!severity) return "moderate";
@@ -33071,7 +33136,7 @@ function toCanonicalAdvisory(packageName, ecosystem, advisory) {
     severity: advisory.severity,
     summary: advisory.summary,
     url: advisory.url,
-    withdrawn: null
+    withdrawn: advisory.withdrawn
   };
 }
 function groupByEcosystem(packages) {
@@ -33257,12 +33322,6 @@ function firstReported(existing, keys) {
   }
   return null;
 }
-function escalatedSeverity(own, corroborations) {
-  if (corroborations.length === 0) return own;
-  return maxSeverity([own, ...corroborations.map(function grade(c) {
-    return c.severity;
-  })]);
-}
 
 // ../../packages/scanners/src/index.ts
 var registry2 = /* @__PURE__ */ new Map();
@@ -33746,7 +33805,7 @@ function roundUpV3(value) {
   return (Math.floor(intInput / 1e4) + 1) / 10;
 }
 function bucketV3(score) {
-  if (score === 0) return "none";
+  if (score === 0) return "info";
   if (score < 4) return "low";
   if (score < 7) return "moderate";
   if (score < 9) return "high";
@@ -33843,44 +33902,55 @@ function parseAffectedRange(affectedRange, fixedVersions) {
     if (interval.exact !== null) {
       versions.push(interval.exact);
     } else {
-      ranges.push({ introduced: interval.introduced, fixed: interval.fixed });
+      ranges.push(toRange(interval.introduced, interval.introducedExclusive, interval.fixed, interval.lastAffected));
     }
   }
   if (versions.length === 0 && ranges.every(isEmptyInterval)) return { ranges: [], versions: [] };
   const only = ranges[0];
   const authoritativeFixed = fixedVersions[0];
   if (ranges.length === 1 && versions.length === 0 && only && fixedVersions.length === 1 && authoritativeFixed !== void 0) {
-    ranges[0] = { introduced: only.introduced, fixed: authoritativeFixed };
+    ranges[0] = toRange(only.introduced, only.introducedExclusive === true, authoritativeFixed, null);
   }
   return { ranges, versions };
 }
+function toRange(introduced, introducedExclusive, fixed, lastAffected) {
+  const range = { introduced, fixed, lastAffected };
+  if (introducedExclusive) range.introducedExclusive = true;
+  return range;
+}
 function isEmptyInterval(range) {
+  if (range.lastAffected !== null) {
+    return range.introducedExclusive === true && range.lastAffected === range.introduced;
+  }
   if (range.fixed === null) return false;
   if (range.fixed === range.introduced) return true;
   return isZeroVersion(range.introduced) && isZeroVersion(range.fixed);
 }
-function isZeroVersion(version2) {
-  return /^0(\.0)*$/.test(version2);
-}
 function parseDisjunct(disjunct) {
   const first = disjunct[0];
   if (first === "(" || first === "[") return parseIntervalNotation(disjunct);
   return parseComparatorForm(disjunct);
 }
 function parseIntervalNotation(disjunct) {
+  const open = disjunct[0];
   const close = disjunct[disjunct.length - 1];
   if (close !== ")" && close !== "]") return null;
   const inner = disjunct.slice(1, -1);
   const comma = inner.indexOf(",");
   if (comma < 0) {
     const exact = inner.trim();
-    return exact.length > 0 ? { introduced: "0", fixed: null, exact } : null;
+    return exact.length > 0 ? { introduced: "0", introducedExclusive: false, fixed: null, lastAffected: null, exact } : null;
   }
   const lo = inner.slice(0, comma).trim();
   const hi = inner.slice(comma + 1).trim();
+  const hasUpper = hi.length > 0;
   return {
     introduced: lo.length > 0 ? lo : "0",
-    fixed: hi.length > 0 ? hi : null,
+    // An open "(" excludes the lower bound — but only when one was actually given; "(,2.0.0)" has no
+    // lower bound at all and starts from the bottom of the version space inclusively.
+    introducedExclusive: open === "(" && lo.length > 0,
+    fixed: hasUpper && close === ")" ? hi : null,
+    lastAffected: hasUpper && close === "]" ? hi : null,
     exact: null
   };
 }
@@ -33888,23 +33958,29 @@ function parseComparatorForm(disjunct) {
   const tokens = disjunct.split(/\s+/).filter(nonEmpty);
   if (tokens.length === 0) return null;
   let introduced = "0";
+  let introducedExclusive = false;
   let fixed = null;
+  let lastAffected = null;
   for (const token of tokens) {
     const op = readOperator(token);
-    if (!op) continue;
+    if (!op) return null;
     if (op.operator === "=") {
-      return { introduced: "0", fixed: null, exact: op.version };
+      return { introduced: "0", introducedExclusive: false, fixed: null, lastAffected: null, exact: op.version };
     }
     if (op.operator === ">=" || op.operator === ">") {
       introduced = op.version;
+      introducedExclusive = op.operator === ">";
     } else if (op.operator === "<") {
       fixed = op.version;
-    } else if (op.operator === "<=") {
-      fixed = op.version;
+      lastAffected = null;
+    } else {
+      lastAffected = op.version;
+      fixed = null;
     }
   }
-  return { introduced, fixed, exact: null };
+  return { introduced, introducedExclusive, fixed, lastAffected, exact: null };
 }
+var BARE_VERSION = /^[0-9]+(\.[0-9]+)*([-+][0-9A-Za-z.-]*)?$/;
 function readOperator(token) {
   if (token.startsWith(">=")) return { operator: ">=", version: stripV(token.slice(2)) };
   if (token.startsWith("<=")) return { operator: "<=", version: stripV(token.slice(2)) };
@@ -33912,7 +33988,7 @@ function readOperator(token) {
   if (token.startsWith("<")) return { operator: "<", version: stripV(token.slice(1)) };
   if (token.startsWith("=")) return { operator: "=", version: stripV(token.slice(1)) };
   const bare = stripV(token);
-  return bare.length > 0 ? { operator: "=", version: bare } : null;
+  return BARE_VERSION.test(bare) ? { operator: "=", version: bare } : null;
 }
 function stripV(raw) {
   const t = raw.trim();
@@ -34340,7 +34416,8 @@ function toOsvAdvisory(row) {
     severity: row.severity,
     summary: row.summary,
     url: row.url,
-    malicious: row.malicious
+    malicious: row.malicious,
+    withdrawn: row.withdrawn
   };
 }
 function toGemnasiumAdvisory(row) {
@@ -34512,23 +34589,32 @@ async function refreshOsv(options, meta3, item) {
     return { source: "osv", ecosystem: item.ecosystem, status: "unchanged", rowCount: state?.recordCount ?? 0, message: null };
   }
   const append = [];
+  const replaced = /* @__PURE__ */ new Set();
+  let skipped = 0;
   for (const id of changed.ids) {
-    if (options.abortSignal && options.abortSignal.aborted) break;
+    if (options.abortSignal && options.abortSignal.aborted) {
+      skipped += 1;
+      break;
+    }
     try {
       const rows = await fetchOsvAdvisoryRows(id, item.ecosystem, fetchOptionsFor(options, item));
       for (const row of rows) append.push(row);
+      replaced.add(id);
     } catch {
+      skipped += 1;
       continue;
     }
   }
   const path = advisoryFilePath(options.cacheDir, "osv", item.ecosystem);
-  const rowCount = await rewriteRows(path, { dropAdvisoryIds: new Set(changed.ids), append });
+  const rowCount = await rewriteRows(path, { dropAdvisoryIds: replaced, append });
+  const complete = skipped === 0;
+  const previousCursor = state?.cursorIso ?? null;
   setSourceState(meta3, "osv", item.ecosystem, {
     normalizerVersion: OSV_NORMALIZER_VERSION,
     recordCount: rowCount,
     refreshedAt: Date.now(),
-    cursorIso: changed.newestIso ?? state?.cursorIso ?? null,
-    etag: changed.etag
+    cursorIso: complete ? changed.newestIso ?? previousCursor : previousCursor,
+    etag: complete ? changed.etag : null
   });
   return {
     source: "osv",
@@ -34910,7 +34996,7 @@ function emptyCounts() {
 function matchesDepType(finding, depType) {
   if (depType === "all") return true;
   if (depType === "prod") return finding.isProd;
-  return finding.isDev;
+  return finding.isDev && !finding.isProd;
 }
 function summarize(results, options) {
   const projects = [];
@@ -35449,8 +35535,8 @@ function createUi(options) {
 
 // src/help.ts
 var CLI_VERSION = (function resolveVersion() {
-  if ("3.2.0".length > 0) {
-    return "3.2.0";
+  if ("3.3.0".length > 0) {
+    return "3.3.0";
   }
   const fromEnv = process.env.SENTINELLO_VERSION;
   if (fromEnv && fromEnv.trim().length > 0) return fromEnv.trim();

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sentinello",
-    "version": "3.2.0",
+    "version": "3.3.0",
     "license": "MIT",
     "description": "Scan the projects in a folder for vulnerable dependencies and write an advisory an agent can act on.",
     "keywords": [
@@ -41,7 +41,6 @@
     },
     "scripts": {
         "build": "tsup",
-        "dev": "tsx src/cli.ts",
         "lint": "eslint . --max-warnings 0",
         "typecheck": "tsc -p tsconfig.json --noEmit"
     },