sentinello 3.3.1 → 3.4.0

package/README.md

@@ -3,7 +3,7 @@
 <!-- Absolute URLs throughout: npm does not resolve relative links, and this file ships in the package. -->
 <p>
   <a href="https://github.com/walkofcode/sentinello/actions/workflows/ci.yml"><img src="https://github.com/walkofcode/sentinello/actions/workflows/ci.yml/badge.svg" alt="CI status" /></a>
-  <a href="https://github.com/walkofcode/sentinello/blob/main/CONTRIBUTING.md#tests"><img src="https://img.shields.io/badge/coverage-99%25-brightgreen" alt="Statement coverage 99%, enforced by CI" /></a>
+  <a href="https://github.com/walkofcode/sentinello/blob/main/CONTRIBUTING.md#tests"><img src="https://img.shields.io/badge/coverage-100%25-brightgreen" alt="100% statement, branch, function and line coverage, enforced by CI" /></a>
   <img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT licensed" />
 </p>
 

package/dist/cli.cjs

@@ -1525,14 +1525,14 @@ var require_min_version = __commonJS({
 var require_valid2 = __commonJS({
   "../../node_modules/.pnpm/semver@7.7.4/node_modules/semver/ranges/valid.js"(exports2, module2) {
     var Range2 = require_range();
-    var validRange2 = (range, options) => {
+    var validRange3 = (range, options) => {
       try {
         return new Range2(range, options).range || "*";
       } catch (er) {
         return null;
       }
     };
-    module2.exports = validRange2;
+    module2.exports = validRange3;
   }
 });
 
@@ -1882,7 +1882,7 @@ var require_semver2 = __commonJS({
     var maxSatisfying = require_max_satisfying();
     var minSatisfying = require_min_satisfying();
     var minVersion = require_min_version();
-    var validRange2 = require_valid2();
+    var validRange3 = require_valid2();
     var outside = require_outside();
     var gtr = require_gtr();
     var ltr = require_ltr();
@@ -1920,7 +1920,7 @@ var require_semver2 = __commonJS({
       maxSatisfying,
       minSatisfying,
       minVersion,
-      validRange: validRange2,
+      validRange: validRange3,
       outside,
       gtr,
       ltr,
@@ -13152,9 +13152,19 @@ function isSourceUnavailableReason(code) {
   return SOURCE_UNAVAILABLE_REASON_CODES.includes(code);
 }
 
+// ../../packages/core/src/errors.ts
+function errText(err) {
+  if (err instanceof Error) return err.message || String(err);
+  return String(err);
+}
+function asError(err) {
+  if (err instanceof Error) return err;
+  return new Error(String(err));
+}
+
 // ../../packages/core/src/advisory-rows.ts
-var OSV_NORMALIZER_VERSION = 4;
-var GEMNASIUM_NORMALIZER_VERSION = 5;
+var OSV_NORMALIZER_VERSION = 6;
+var GEMNASIUM_NORMALIZER_VERSION = 7;
 
 // ../../packages/core/src/advisory-export.ts
 var DEFAULT_EXPORT_PROMPT = `You are helping a development team triage and fix the vulnerabilities listed at the bottom of this document. Treat this as a remediation work list, not a checklist to rubber-stamp. Work in a planning posture from the start: if your tooling has a read-only planning mode (Claude Code's plan mode, for example), enter it now and stay in it until the human has approved the triage below. Nothing in this document authorises you to edit a file before then.
@@ -13421,10 +13431,14 @@ function getEcosystem(id) {
   }
   return null;
 }
+function cacheEcosystemKey(ecosystem) {
+  const def = getEcosystem(ecosystem);
+  return def ? def.osvEcosystem : ecosystem;
+}
 var GEMNASIUM_SEED_DOWNLOAD_BYTES = 52 * 1024 * 1024;
 
 // ../../packages/scanners/src/lockfile-cross-check.ts
-var import_semver5 = __toESM(require_semver2());
+var import_semver7 = __toESM(require_semver2());
 
 // ../../packages/versions/src/range.ts
 function isZeroVersion(version2) {
@@ -13468,7 +13482,7 @@ function aboveLowerBound(installed, range, comparator) {
 }
 
 // ../../packages/versions/src/compare.ts
-__toESM(require_semver2());
+var import_semver2 = __toESM(require_semver2());
 
 // ../../packages/versions/src/comparators/semver.ts
 var import_semver = __toESM(require_semver2());
@@ -13498,6 +13512,63 @@ var semverComparator = {
   }
 };
 
+// ../../packages/versions/src/compare.ts
+function compareVersions(a, b) {
+  const left = normalizeSemver(a);
+  const right = normalizeSemver(b);
+  if (left === null || right === null) {
+    if (left === null && right === null) return a < b ? -1 : a > b ? 1 : 0;
+    return left === null ? -1 : 1;
+  }
+  if ((0, import_semver2.lt)(left, right)) return -1;
+  if ((0, import_semver2.gt)(left, right)) return 1;
+  return 0;
+}
+function highestVersion(versions) {
+  let best = null;
+  for (const candidate of versions) {
+    if (best === null || compareVersions(candidate, best) > 0) best = candidate;
+  }
+  return best;
+}
+
+// ../../packages/versions/src/dialect.ts
+var import_semver4 = __toESM(require_semver2());
+function canonicaliseRange(raw, dialect) {
+  if (dialect !== "npm") return raw;
+  const trimmed = raw.trim();
+  if (!/[0-9]/.test(trimmed)) return null;
+  if (ZERO_EXCLUSIVE_LOWER.test(trimmed)) return raw;
+  const canonical = (0, import_semver4.validRange)(trimmed);
+  if (canonical === null) return raw;
+  if (canonical === "*" || canonical.length === 0) return ">=0";
+  return stripSynthesisedPrereleaseMarker(canonical, raw);
+}
+var ZERO_EXCLUSIVE_LOWER = /^>\s*v?0(\.0)*$/i;
+var SYNTHESISED_PRERELEASE_MARKER = /<([0-9][0-9A-Za-z.+-]*)-0(?![0-9A-Za-z.-])/g;
+var EXPLICIT_PRERELEASE_ZERO = /[0-9][0-9A-Za-z.+-]*-0(?![0-9A-Za-z.-])/g;
+function stripSynthesisedPrereleaseMarker(canonical, raw) {
+  const explicit = new Set(raw.match(EXPLICIT_PRERELEASE_ZERO) ?? []);
+  return canonical.replace(SYNTHESISED_PRERELEASE_MARKER, function keepExplicit(whole, base) {
+    return explicit.has(base + "-0") ? whole : "<" + base;
+  });
+}
+function canMatchSomething(range) {
+  const inclusiveUpper = range.lastAffected ?? null;
+  const upper = inclusiveUpper !== null ? inclusiveUpper : range.fixed;
+  if (upper === null) return true;
+  if (upper === range.introduced) return inclusiveUpper !== null && range.introducedExclusive !== true;
+  if (inclusiveUpper === null && isZeroVersion(range.introduced) && isZeroVersion(upper)) return false;
+  if (range.type !== "SEMVER") return true;
+  const normalizedUpper = normalizeSemver(upper);
+  const normalizedIntroduced = normalizeSemver(range.introduced);
+  if (normalizedUpper === null || normalizedIntroduced === null) return true;
+  if (normalizedUpper === normalizedIntroduced) {
+    return inclusiveUpper !== null && range.introducedExclusive !== true;
+  }
+  return (0, import_semver4.gt)(normalizedUpper, normalizedIntroduced);
+}
+
 // ../../packages/versions/src/comparators/pep440.ts
 var PRE_RANK = { a: 0, b: 1, rc: 2 };
 var PEP440_RE = new RegExp(
@@ -13515,13 +13586,9 @@ function parsePep440(raw) {
   const m = PEP440_RE.exec(raw.trim());
   if (!m || !m.groups) return null;
   const g = m.groups;
-  if (!g.release) return null;
   const release = g.release.split(".").map(function toInt(s) {
     return parseInt(s, 10);
   });
-  if (release.some(function bad(n) {
-    return Number.isNaN(n);
-  })) return null;
   let pre = null;
   if (g.preL) {
     pre = { letter: foldPreLetter(g.preL), n: g.preN ? parseInt(g.preN, 10) : 0 };
@@ -13577,8 +13644,8 @@ function cmpPre(a, b) {
   const kb = preKind(b);
   if (ka !== kb) return ka < kb ? -1 : 1;
   if (ka !== 0 || !a.pre || !b.pre) return 0;
-  const la = PRE_RANK[a.pre.letter] ?? 0;
-  const lb = PRE_RANK[b.pre.letter] ?? 0;
+  const la = PRE_RANK[a.pre.letter];
+  const lb = PRE_RANK[b.pre.letter];
   if (la !== lb) return la < lb ? -1 : 1;
   if (a.pre.n !== b.pre.n) return a.pre.n < b.pre.n ? -1 : 1;
   return 0;
@@ -13675,7 +13742,7 @@ function shouldKeep(finding) {
   const installed = finding.installedVersion.trim();
   const range = finding.vulnerableRange.trim();
   if (!installed || !range) return true;
-  if ((0, import_semver5.validRange)(range) === null) return true;
+  if ((0, import_semver7.validRange)(range) === null) return true;
   const candidates = installed.split(/,\s*/).map(function trim(s) {
     return s.trim();
   }).filter(Boolean);
@@ -13683,7 +13750,7 @@ function shouldKeep(finding) {
   for (const candidate of candidates) {
     const cleaned = normalizeVersion(candidate);
     if (cleaned === null) return true;
-    if ((0, import_semver5.satisfies)(cleaned, range, { includePrerelease: true })) return true;
+    if ((0, import_semver7.satisfies)(cleaned, range, { includePrerelease: true })) return true;
   }
   return false;
 }
@@ -28172,7 +28239,7 @@ function date4(params) {
 config(en_default());
 
 // ../../packages/scanners/src/version-fix.ts
-var import_semver6 = __toESM(require_semver2());
+var import_semver8 = __toESM(require_semver2());
 var VERSION_LITERAL_RE = /\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?/g;
 function parseRangeSafely(input) {
   if (!input) return null;
@@ -28180,7 +28247,7 @@ function parseRangeSafely(input) {
   if (!trimmed) return null;
   if (trimmed === "<0.0.0") return null;
   try {
-    return new import_semver6.Range(trimmed, { includePrerelease: false });
+    return new import_semver8.Range(trimmed, { includePrerelease: false });
   } catch {
     return null;
   }
@@ -28191,13 +28258,12 @@ function extractLiteralCandidates(input) {
   if (!matches) return [];
   const out = [];
   for (const m of matches) {
-    if ((0, import_semver6.valid)(m)) out.push(m);
+    if ((0, import_semver8.valid)(m)) out.push(m);
   }
   return out;
 }
 function bumpPatch(v) {
-  const sv = (0, import_semver6.coerce)(v);
-  if (!sv) return null;
+  const sv = (0, import_semver8.coerce)(v);
   return sv.major + "." + sv.minor + "." + (sv.patch + 1);
 }
 function extractRangeLowerBounds(range) {
@@ -28207,13 +28273,12 @@ function extractRangeLowerBounds(range) {
     for (const c of conjuncts) {
       if (!c.semver || !c.semver.version) continue;
       const v = c.semver.version;
-      if (!(0, import_semver6.valid)(v)) continue;
       const op = c.operator;
       if (op === ">=" || op === "=" || op === "") {
-        if (!candidate || (0, import_semver6.gt)(v, candidate)) candidate = v;
+        if (!candidate || (0, import_semver8.gt)(v, candidate)) candidate = v;
       } else if (op === ">") {
         const inc = bumpPatch(v);
-        if (inc && (!candidate || (0, import_semver6.gt)(inc, candidate))) candidate = inc;
+        if (!candidate || (0, import_semver8.gt)(inc, candidate)) candidate = inc;
       }
     }
     if (candidate) out.push(candidate);
@@ -28226,13 +28291,11 @@ function extractRangeUpperBoundsBeyond(range) {
     for (const c of conjuncts) {
       if (!c.semver || !c.semver.version) continue;
       const v = c.semver.version;
-      if (!(0, import_semver6.valid)(v)) continue;
       const op = c.operator;
       if (op === "<") {
         out.push(v);
       } else if (op === "<=") {
-        const inc = bumpPatch(v);
-        if (inc) out.push(inc);
+        out.push(bumpPatch(v));
       }
     }
   }
@@ -28245,8 +28308,8 @@ function pickHighestInstalled(installed) {
   for (const raw of parts) {
     const part = raw.trim();
     if (!part) continue;
-    if (!(0, import_semver6.valid)(part)) continue;
-    if (!highest || (0, import_semver6.gt)(part, highest)) highest = part;
+    if (!(0, import_semver8.valid)(part)) continue;
+    if (!highest || (0, import_semver8.gt)(part, highest)) highest = part;
   }
   return highest;
 }
@@ -28268,10 +28331,10 @@ function pickSafeFixVersion(args) {
   if (candidates.size === 0) return null;
   let best = null;
   for (const v of candidates) {
-    if (patchedRange && !(0, import_semver6.satisfies)(v, patchedRange)) continue;
-    if (vulnRange && (0, import_semver6.satisfies)(v, vulnRange)) continue;
-    if (installedFloor && !(0, import_semver6.gte)(v, installedFloor)) continue;
-    if (!best || (0, import_semver6.gt)(best, v)) best = v;
+    if (patchedRange && !(0, import_semver8.satisfies)(v, patchedRange)) continue;
+    if (vulnRange && (0, import_semver8.satisfies)(v, vulnRange)) continue;
+    if (installedFloor && !(0, import_semver8.gte)(v, installedFloor)) continue;
+    if (!best || (0, import_semver8.gt)(best, v)) best = v;
   }
   return best;
 }
@@ -28390,17 +28453,15 @@ function classifyPackageManagerNotFound(stderr, packageManager) {
   return re1.test(stderr) || re2.test(stderr);
 }
 function pickAuditCommand(lockfile) {
-  if (lockfile.packageManager === "pnpm") return "pnpm audit --json";
-  if (lockfile.packageManager === "npm") return "npm audit --json";
-  return "yarn npm audit --json";
+  if (lockfile.packageManager === "pnpm") return ["pnpm", "audit", "--json"];
+  if (lockfile.packageManager === "npm") return ["npm", "audit", "--json"];
+  return ["yarn", "npm", "audit", "--json"];
 }
 function parseYarnMajor(value) {
   if (typeof value !== "string") return null;
   const match = value.trim().match(/^yarn@(\d+)(?:\.|$)/);
   if (!match || !match[1]) return null;
-  const parsed = parseInt(match[1], 10);
-  if (Number.isNaN(parsed)) return null;
-  return parsed;
+  return parseInt(match[1], 10);
 }
 function unauditableResult(reasonCode, reason, startedAt, rawJson) {
   return {
@@ -28544,9 +28605,7 @@ function normalizeAuditOutput(parsed, installedVersions, classifier) {
   const findings = [];
   let hadVulnerabilityWithoutConcreteAdvisory = false;
   const vulns = parsed.vulnerabilities ?? {};
-  for (const packageName of Object.keys(vulns)) {
-    const vuln = vulns[packageName];
-    if (!vuln) continue;
+  for (const [packageName, vuln] of Object.entries(vulns)) {
     if (!vuln.via || vuln.via.length === 0) {
       hadVulnerabilityWithoutConcreteAdvisory = true;
       continue;
@@ -28694,10 +28753,8 @@ async function loadLockfileSnapshot(projectPath, lockfile) {
   if (!validation.success) return empty;
   const installedVersions = /* @__PURE__ */ new Map();
   const packages = validation.data.packages || {};
-  for (const nodePath of Object.keys(packages)) {
+  for (const [nodePath, entry] of Object.entries(packages)) {
     if (!nodePath) continue;
-    const entry = packages[nodePath];
-    if (!entry) continue;
     if (entry.version) {
       installedVersions.set(nodePath, entry.version);
     }
@@ -28849,9 +28906,6 @@ function executeSpawnAndCapture(input, resolve5) {
   child.stderr.on("data", onSpawnStderrData.bind(null, state));
   child.on("error", onSpawnError.bind(null, ctx));
   child.on("close", onSpawnClose.bind(null, ctx));
-  if (input.opts.stdin && child.stdin) {
-    child.stdin.end(input.opts.stdin);
-  }
 }
 function spawnAndCapture(deps, cmd, args, opts) {
   return new Promise(executeSpawnAndCapture.bind(null, { deps, cmd, args, opts }));
@@ -28911,17 +28965,13 @@ async function runNpmAudit(projectPath, ctx, deps = REAL_DEPS) {
   let execCmd;
   let execArgs;
   if (wrapWithNvm) {
-    const wrapped = buildBashWrappedCommand(rawCmd);
+    const wrapped = buildBashWrappedCommand(rawCmd.join(" "));
     execCmd = wrapped.cmd;
     execArgs = wrapped.args;
   } else {
-    const parts = rawCmd.split(" ");
-    const head = parts[0];
-    if (!head) {
-      return errorResult("audit_unknown_failure", "failed to construct audit command", startedAt, "");
-    }
+    const [head, ...rest] = rawCmd;
     execCmd = head;
-    execArgs = parts.slice(1);
+    execArgs = rest;
   }
   const spawnResult = await spawnAndCapture(deps, execCmd, execArgs, {
     cwd: projectPath,
@@ -28967,11 +29017,7 @@ async function runNpmAudit(projectPath, ctx, deps = REAL_DEPS) {
   try {
     parsedJson = JSON.parse(rawText);
   } catch (err) {
-    let reason = "audit JSON parse failed";
-    if (err instanceof Error) {
-      reason = `audit JSON parse failed: ${err.message}`;
-    }
-    return errorResult("audit_parse_error", reason, startedAt, rawText);
+    return errorResult("audit_parse_error", `audit JSON parse failed: ${errText(err)}`, startedAt, rawText);
   }
   if (lockfile.packageManager === "pnpm") {
     const pnpmValidation = pnpmAuditSchema.safeParse(parsedJson);
@@ -29035,9 +29081,7 @@ function reachableFrom(roots, adjacency) {
       stack.push(root);
     }
   }
-  while (stack.length > 0) {
-    const node = stack.pop();
-    if (node === void 0) break;
+  for (let node = stack.pop(); node !== void 0; node = stack.pop()) {
     const children = adjacency.get(node);
     if (!children) continue;
     for (const child of children) {
@@ -32387,7 +32431,7 @@ function parsePnpmV9(root) {
       if (isProd) existing.scope.isProd = true;
       if (isDev) existing.scope.isDev = true;
       if (!isOptional) existing.scope.isOptional = false;
-      if (!existing.depPaths.includes(key)) existing.depPaths.push(key);
+      existing.depPaths.push(key);
     } else {
       byId.set(id, {
         ecosystem: NPM_ECOSYSTEM2,
@@ -32409,7 +32453,6 @@ function parsePnpmLegacy(root) {
     const parsed = parseDepKey(key);
     if (!parsed) continue;
     const version2 = entry.version || parsed.version;
-    if (!version2) continue;
     const isDev = entry.dev === true;
     out.push({
       ecosystem: NPM_ECOSYSTEM2,
@@ -32809,7 +32852,6 @@ function classifySkip(absolutePath, rootPath, layers, excludeMatcher, hasExclude
   for (let i = layers.length - 1; i >= 0; i--) {
     const layer = layers[i];
     const rel = path.relative(layer.baseDir, absolutePath);
-    if (!rel || rel.startsWith("..")) continue;
     if (!layer.matcher.ignores(rel) && !layer.matcher.ignores(rel + "/")) continue;
     if (layer.hasSentinelloIgnore && !layer.hasGitignore) return "sentinelloignore";
     if (layer.hasGitignore && !layer.hasSentinelloIgnore) return "gitignore";
@@ -32886,9 +32928,7 @@ function detectPackageManager(dir) {
   return "unknown";
 }
 function basenameOf(dir) {
-  const abs = path.resolve(dir);
-  const parts = abs.split("/");
-  return parts[parts.length - 1] || abs;
+  return path.basename(path.resolve(dir));
 }
 function readNvmrcVersion(dir) {
   const nvmrcPath = path.join(dir, ".nvmrc");
@@ -32906,7 +32946,7 @@ function readGitBranch(dir, rootPath) {
   try {
     const head = fs.readFileSync(path.join(gitDir, "HEAD"), "utf8").trim();
     const ref = head.match(/^ref:\s*refs\/heads\/(.+)$/);
-    if (ref && ref[1]) return ref[1].trim() || null;
+    if (ref && ref[1]) return ref[1].trim();
     if (/^[0-9a-f]{40}$/i.test(head)) return head.slice(0, 7);
     return null;
   } catch {
@@ -33057,7 +33097,7 @@ function rangesToDisplay(ranges, exactVersions) {
   const parts = [];
   for (const v of exactVersions) parts.push("=" + v);
   for (const range of ranges) parts.push(formatRange(range, DISPLAY_FORMAT));
-  return parts.length > 0 ? parts.join(" || ") : "*";
+  return parts.join(" || ");
 }
 function vulnerableRangeForFix(ranges) {
   return formatRanges(ranges, SEMVER_FORMAT);
@@ -33109,7 +33149,6 @@ function matchPackages(packages, lookup, isSeeded2, isEnabled) {
     if (!comparator) continue;
     const acceptedRangeTypes = acceptedRangeTypesForEcosystem(ecosystem) ?? [];
     const names = uniqueNames(pkgs);
-    if (names.length === 0) continue;
     const byPackageRaw = lookup(ecosystem, names);
     const byPackage = /* @__PURE__ */ new Map();
     for (const [name, advisories] of byPackageRaw.entries()) {
@@ -33216,7 +33255,6 @@ function matchPackages2(packages, lookup, isEnabled) {
     const comparator = comparatorForEcosystem(ecosystem);
     if (!comparator) continue;
     const names = uniqueNames2(pkgs);
-    if (names.length === 0) continue;
     const byPackageRaw = lookup(ecosystem, names);
     const byPackage = /* @__PURE__ */ new Map();
     for (const [name, advisories] of byPackageRaw.entries()) {
@@ -33345,10 +33383,6 @@ function signalFor(options, fallbackTimeoutMs) {
   if (options && options.abortSignal) return AbortSignal.any([options.abortSignal, timeout]);
   return timeout;
 }
-function errText(err) {
-  if (err instanceof Error) return err.message;
-  return String(err);
-}
 function isFastTransientStatus(status) {
   if (status === 408 || status === 425 || status === 429) return true;
   return status >= 500 && status < 600;
@@ -33535,7 +33569,7 @@ function normalizeOsvRecord(record2, ecosystem) {
     if (!pkg2 || pkg2.ecosystem !== ecosystem) continue;
     const packageName = typeof pkg2.name === "string" ? pkg2.name : null;
     if (!packageName) continue;
-    const ranges = extractRanges(affected.ranges);
+    const ranges = extractRanges(affected.ranges, affected.database_specific?.last_known_affected_version_range, ecosystem);
     const versions = extractVersions(affected.versions);
     const existing = byPackage.get(packageName);
     if (existing) {
@@ -33571,7 +33605,7 @@ function extractVersions(versions) {
   }
   return out;
 }
-function extractRanges(ranges) {
+function extractRanges(ranges, lastKnownAffected, ecosystem) {
   if (!Array.isArray(ranges)) return [];
   const out = [];
   for (const range of ranges) {
@@ -33584,18 +33618,20 @@ function extractRanges(ranges) {
       if (typeof event.introduced === "string") {
         if (introduced !== null) {
           out.push({ type: type2, introduced, fixed: null, lastAffected });
-          lastAffected = null;
         }
-        introduced = event.introduced;
+        lastAffected = null;
+        introduced = !usesSemver(type2, ecosystem) || normalizeSemver(event.introduced) !== null ? event.introduced : null;
         continue;
       }
       if (typeof event.fixed === "string" && introduced !== null) {
+        if (usesSemver(type2, ecosystem) && normalizeSemver(event.fixed) === null) continue;
         out.push({ type: type2, introduced, fixed: event.fixed, lastAffected: null });
         introduced = null;
         lastAffected = null;
         continue;
       }
       if (typeof event.last_affected === "string" && introduced !== null) {
+        if (usesSemver(type2, ecosystem) && normalizeSemver(event.last_affected) === null) continue;
         lastAffected = event.last_affected;
       }
     }
@@ -33603,7 +33639,32 @@ function extractRanges(ranges) {
       out.push({ type: type2, introduced, fixed: null, lastAffected });
     }
   }
-  return out;
+  const matchable = [];
+  for (const range of out) {
+    if (canRangeMatch(range, ecosystem)) matchable.push(range);
+  }
+  return boundOpenEndedRange(matchable, lastKnownAffected, ecosystem);
+}
+function usesSemver(type2, ecosystem) {
+  if (type2 === "SEMVER") return true;
+  return type2 === "ECOSYSTEM" && getEcosystem(ecosystem)?.comparator === "semver";
+}
+function canRangeMatch(range, ecosystem) {
+  return canMatchSomething(usesSemver(range.type, ecosystem) ? { ...range, type: "SEMVER" } : range);
+}
+function boundOpenEndedRange(ranges, lastKnownAffected, ecosystem) {
+  if (ranges.length !== 1 || typeof lastKnownAffected !== "string") return ranges;
+  const text = lastKnownAffected.trim();
+  const inclusive = text.startsWith("<=");
+  if (!inclusive && !text.startsWith("<")) return ranges;
+  const version2 = text.slice(inclusive ? 2 : 1).trim();
+  if (version2.length === 0 || /[\s,|]/.test(version2)) return ranges;
+  const range = ranges[0];
+  const open = range.fixed === null && range.lastAffected === null;
+  if (!open) return ranges;
+  if (usesSemver(range.type, ecosystem) && normalizeSemver(version2) === null) return ranges;
+  const bounded = { ...range, fixed: inclusive ? null : version2, lastAffected: inclusive ? version2 : null };
+  return canRangeMatch(bounded, ecosystem) ? [bounded] : ranges;
 }
 function pickSeverity2(r) {
   const ds = r.database_specific && r.database_specific.severity;
@@ -33846,7 +33907,7 @@ function normalizeGemnasiumRecord(record2, ecosystem, slugPrefix) {
   const advisoryId = typeof r.identifier === "string" && r.identifier.length > 0 ? r.identifier : identifiers[0] ?? null;
   if (!advisoryId) return [];
   const fixedVersions = stringArray(r.fixed_versions);
-  const parsed = parseAffectedRange(typeof r.affected_range === "string" ? r.affected_range : "", fixedVersions);
+  const parsed = parseAffectedRange(typeof r.affected_range === "string" ? r.affected_range : "", fixedVersions, ecosystem);
   if (parsed.ranges.length === 0 && parsed.versions.length === 0) return [];
   const severity = severityFromCvss(
     typeof r.cvss_v3 === "string" ? r.cvss_v3 : null,
@@ -33891,13 +33952,15 @@ function isRetractedUpstream(record2) {
     return description.includes(phrase);
   });
 }
-function parseAffectedRange(affectedRange, fixedVersions) {
+function parseAffectedRange(affectedRange, fixedVersions, ecosystem) {
   const ranges = [];
   const versions = [];
   const trimmed = affectedRange.trim();
-  const disjuncts = trimmed.length > 0 ? trimmed.split("||").map(trimToken).filter(nonEmpty) : [];
+  const disjuncts = (trimmed.length > 0 ? trimmed.split("||").map(trimToken).filter(nonEmpty) : []).map(function canonical(disjunct) {
+    return canonicaliseRange(disjunct, ecosystem);
+  }).filter(isNotNull).map(trimToken).filter(nonEmpty);
   for (const disjunct of disjuncts) {
-    const interval = parseDisjunct(disjunct);
+    const interval = parseDisjunct(disjunct, ecosystem);
     if (!interval) continue;
     if (interval.exact !== null) {
       versions.push(interval.exact);
@@ -33905,31 +33968,29 @@ function parseAffectedRange(affectedRange, fixedVersions) {
       ranges.push(toRange(interval.introduced, interval.introducedExclusive, interval.fixed, interval.lastAffected));
     }
   }
-  if (versions.length === 0 && ranges.every(isEmptyInterval)) return { ranges: [], versions: [] };
+  if (versions.length === 0 && !ranges.some(canMatchSomething)) return { ranges: [], versions: [] };
   const only = ranges[0];
   const authoritativeFixed = fixedVersions[0];
-  if (ranges.length === 1 && versions.length === 0 && only && fixedVersions.length === 1 && authoritativeFixed !== void 0) {
+  if (ranges.length === 1 && versions.length === 0 && only && fixedVersions.length === 1 && authoritativeFixed !== void 0 && compareVersions(authoritativeFixed, only.introduced) > 0) {
     ranges[0] = toRange(only.introduced, only.introducedExclusive === true, authoritativeFixed, null);
   }
-  return { ranges, versions };
+  const highestFixed = highestVersion(fixedVersions);
+  const bounded = [];
+  for (const range of ranges) {
+    const openEnded = range.fixed === null && range.lastAffected === null;
+    bounded.push(highestFixed !== null && openEnded && compareVersions(highestFixed, range.introduced) > 0 ? toRange(range.introduced, range.introducedExclusive === true, highestFixed, null) : range);
+  }
+  return { ranges: bounded, versions };
 }
 function toRange(introduced, introducedExclusive, fixed, lastAffected) {
   const range = { introduced, fixed, lastAffected };
   if (introducedExclusive) range.introducedExclusive = true;
   return range;
 }
-function isEmptyInterval(range) {
-  if (range.lastAffected !== null) {
-    return range.introducedExclusive === true && range.lastAffected === range.introduced;
-  }
-  if (range.fixed === null) return false;
-  if (range.fixed === range.introduced) return true;
-  return isZeroVersion(range.introduced) && isZeroVersion(range.fixed);
-}
-function parseDisjunct(disjunct) {
+function parseDisjunct(disjunct, ecosystem) {
   const first = disjunct[0];
   if (first === "(" || first === "[") return parseIntervalNotation(disjunct);
-  return parseComparatorForm(disjunct);
+  return parseComparatorForm(disjunct, ecosystem);
 }
 function parseIntervalNotation(disjunct) {
   const open = disjunct[0];
@@ -33944,6 +34005,7 @@ function parseIntervalNotation(disjunct) {
   const lo = inner.slice(0, comma).trim();
   const hi = inner.slice(comma + 1).trim();
   const hasUpper = hi.length > 0;
+  if (lo.length === 0 && !hasUpper) return null;
   return {
     introduced: lo.length > 0 ? lo : "0",
     // An open "(" excludes the lower bound — but only when one was actually given; "(,2.0.0)" has no
@@ -33954,17 +34016,18 @@ function parseIntervalNotation(disjunct) {
     exact: null
   };
 }
-function parseComparatorForm(disjunct) {
-  const tokens = disjunct.split(/\s+/).filter(nonEmpty);
-  if (tokens.length === 0) return null;
+function parseComparatorForm(disjunct, ecosystem) {
+  const tokens = bindOperators(disjunct.split(/[\s,]+/).filter(nonEmpty));
+  if (!tokens || tokens.length === 0) return null;
   let introduced = "0";
   let introducedExclusive = false;
   let fixed = null;
   let lastAffected = null;
   for (const token of tokens) {
-    const op = readOperator(token);
+    const op = readOperator(token, ecosystem);
     if (!op) return null;
     if (op.operator === "=") {
+      if (tokens.length > 1) return null;
       return { introduced: "0", introducedExclusive: false, fixed: null, lastAffected: null, exact: op.version };
     }
     if (op.operator === ">=" || op.operator === ">") {
@@ -33980,16 +34043,37 @@ function parseComparatorForm(disjunct) {
   }
   return { introduced, introducedExclusive, fixed, lastAffected, exact: null };
 }
+var NAKED_OPERATOR = /^(>=|<=|>|<|=)$/;
+function bindOperators(tokens) {
+  const bound = [];
+  let pending = null;
+  for (const token of tokens) {
+    if (pending !== null) {
+      bound.push(pending + token);
+      pending = null;
+    } else if (NAKED_OPERATOR.test(token)) {
+      pending = token;
+    } else {
+      bound.push(token);
+    }
+  }
+  return pending === null ? bound : null;
+}
 var BARE_VERSION = /^[0-9]+(\.[0-9]+)*([-+][0-9A-Za-z.-]*)?$/;
-function readOperator(token) {
-  if (token.startsWith(">=")) return { operator: ">=", version: stripV(token.slice(2)) };
-  if (token.startsWith("<=")) return { operator: "<=", version: stripV(token.slice(2)) };
-  if (token.startsWith(">")) return { operator: ">", version: stripV(token.slice(1)) };
-  if (token.startsWith("<")) return { operator: "<", version: stripV(token.slice(1)) };
-  if (token.startsWith("=")) return { operator: "=", version: stripV(token.slice(1)) };
+function readOperator(token, ecosystem) {
+  if (token.startsWith(">=")) return buildOperator(">=", token.slice(2), ecosystem);
+  if (token.startsWith("<=")) return buildOperator("<=", token.slice(2), ecosystem);
+  if (token.startsWith(">")) return buildOperator(">", token.slice(1), ecosystem);
+  if (token.startsWith("<")) return buildOperator("<", token.slice(1), ecosystem);
+  if (token.startsWith("=")) return buildOperator("=", token.slice(1), ecosystem);
   const bare = stripV(token);
   return BARE_VERSION.test(bare) ? { operator: "=", version: bare } : null;
 }
+function buildOperator(operator, rawVersion, ecosystem) {
+  const version2 = stripV(rawVersion);
+  if (getEcosystem(ecosystem)?.comparator === "semver" && !BARE_VERSION.test(version2)) return null;
+  return { operator, version: version2 };
+}
 function stripV(raw) {
   const t = raw.trim();
   return t.startsWith("v") || t.startsWith("V") ? t.slice(1) : t;
@@ -34012,6 +34096,9 @@ function trimToken(s) {
 function nonEmpty(s) {
   return s.length > 0;
 }
+function isNotNull(value) {
+  return value !== null;
+}
 
 // ../../packages/feeds/src/gemnasium/feed.ts
 var DEFAULT_API_BASE = "https://gitlab.com/api/v4/projects/gitlab-org%2Fsecurity-products%2Fgemnasium-db";
@@ -34106,8 +34193,7 @@ function advisoryIdFromPath(path) {
   const file2 = segments[segments.length - 1];
   if (!file2) return null;
   const dot = file2.lastIndexOf(".");
-  const id = dot > 0 ? file2.slice(0, dot) : file2;
-  return id.length > 0 ? id : null;
+  return dot > 0 ? file2.slice(0, dot) : file2;
 }
 async function* streamGemnasiumArchive(ref, onProgress, options) {
   const download = await openDownloadStream(archiveUrl(ref), onProgress, options);
@@ -34255,7 +34341,7 @@ function createRowWriter(path) {
   let rowCount = 0;
   let failed = null;
   done.catch(function capture(err) {
-    failed = err instanceof Error ? err : new Error(String(err));
+    failed = asError(err);
   });
   async function push(chunk, added) {
     if (failed) throw failed;
@@ -34403,10 +34489,6 @@ async function loadCacheForPackages(cacheDir, ecosystem, packageNames, sources)
   }
   return { osv, gemnasium };
 }
-function cacheEcosystemKey(ecosystem) {
-  const def = getEcosystem(ecosystem);
-  return def ? def.osvEcosystem : ecosystem;
-}
 function toOsvAdvisory(row) {
   return {
     advisoryId: row.advisoryId,
@@ -34651,15 +34733,18 @@ async function seedGemnasium(options, meta3, item) {
 }
 async function refreshGemnasium(options, meta3, item) {
   const state = getSourceState(meta3, "gemnasium", item.ecosystem);
-  const storedSha = state && state.headSha ? state.headSha : null;
-  const headSha = await fetchGemnasiumHeadSha(fetchOptionsFor(options, item));
-  if (headSha && storedSha === headSha) {
-    touch(meta3, "gemnasium", item.ecosystem);
-    return { source: "gemnasium", ecosystem: item.ecosystem, status: "unchanged", rowCount: state?.recordCount ?? 0, message: null };
+  if (!state || !state.headSha) {
+    return await seedGemnasium(options, meta3, { ...item, kind: "seed" });
   }
-  if (!headSha || !storedSha) {
+  const storedSha = state.headSha;
+  const headSha = await fetchGemnasiumHeadSha(fetchOptionsFor(options, item));
+  if (!headSha) {
     return await seedGemnasium(options, meta3, { ...item, kind: "seed" });
   }
+  if (storedSha === headSha) {
+    touch(meta3, "gemnasium", item.ecosystem);
+    return { source: "gemnasium", ecosystem: item.ecosystem, status: "unchanged", rowCount: state.recordCount, message: null };
+  }
   const changed = await fetchGemnasiumChangedPaths(storedSha, headSha, fetchOptionsFor(options, item));
   if (changed.status === "unavailable") {
     return await seedGemnasium(options, meta3, { ...item, kind: "seed" });
@@ -34671,8 +34756,8 @@ async function refreshGemnasium(options, meta3, item) {
     return pathEcosystemMatches(path, item.ecosystem);
   });
   if (relevant.length === 0 && removed.length === 0) {
-    touchGemnasiumSha(meta3, item.ecosystem, headSha);
-    return { source: "gemnasium", ecosystem: item.ecosystem, status: "unchanged", rowCount: state?.recordCount ?? 0, message: null };
+    touchGemnasiumSha(state, headSha);
+    return { source: "gemnasium", ecosystem: item.ecosystem, status: "unchanged", rowCount: state.recordCount, message: null };
   }
   const dropAdvisoryIds = /* @__PURE__ */ new Set();
   for (const path of removed.concat(relevant)) {
@@ -34713,9 +34798,7 @@ function touch(meta3, source, ecosystem, etag) {
   state.refreshedAt = Date.now();
   if (etag !== void 0) state.etag = etag;
 }
-function touchGemnasiumSha(meta3, ecosystem, headSha) {
-  const state = getSourceState(meta3, "gemnasium", ecosystem);
-  if (!state) return;
+function touchGemnasiumSha(state, headSha) {
   state.refreshedAt = Date.now();
   state.headSha = headSha;
 }
@@ -34944,7 +35027,7 @@ async function applyConfigFile(options, explicitFlags) {
   try {
     parsed = JSON.parse(text);
   } catch (err) {
-    return "sentinello.config.json is not valid JSON: " + (err instanceof Error && err.message || String(err));
+    return "sentinello.config.json is not valid JSON: " + errText(err);
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return "sentinello.config.json must contain an object";
   const config2 = parsed;
@@ -35535,8 +35618,8 @@ function createUi(options) {
 
 // src/help.ts
 var CLI_VERSION = (function resolveVersion() {
-  if ("3.3.1".length > 0) {
-    return "3.3.1";
+  if ("3.4.0".length > 0) {
+    return "3.4.0";
   }
   const fromEnv = process.env.SENTINELLO_VERSION;
   if (fromEnv && fromEnv.trim().length > 0) return fromEnv.trim();
@@ -35814,7 +35897,7 @@ async function runScan(options, cacheDir, ui) {
   try {
     prompt = await resolvePrompt(options);
   } catch (err) {
-    ui.error("could not read prompt file: " + (err instanceof Error && err.message || String(err)));
+    ui.error("could not read prompt file: " + errText(err));
     return EXIT_ERROR;
   }
   const document2 = options.json ? renderJson(summary, options, generatedAt) : renderMarkdown(summary, options, prompt, generatedAt);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sentinello",
-    "version": "3.3.1",
+    "version": "3.4.0",
     "license": "MIT",
     "description": "Scan the projects in a folder for vulnerable dependencies and write an advisory an agent can act on.",
     "keywords": [