verimu 0.0.6 → 0.0.7

package/dist/cli.mjs

@@ -1654,20 +1654,21 @@ async function uploadToVerimu(report, config) {
     projectCreated: upsertRes.created,
     totalDependencies: scanRes.summary.total_dependencies,
     vulnerableDependencies: scanRes.summary.vulnerable_dependencies,
-    dashboardUrl: `https://app.verimu.com/dashboard/projects/${projectId}`
+    dashboardUrl: `https://app.verimu.com/dashboard/projects/${projectId}`,
+    scanResponse: scanRes
   };
 }
 function shouldFailCi(report, threshold) {
-  const severityOrder2 = {
+  const severityOrder3 = {
     CRITICAL: 0,
     HIGH: 1,
     MEDIUM: 2,
     LOW: 3,
     UNKNOWN: 4
   };
-  const thresholdLevel = severityOrder2[threshold] ?? 4;
+  const thresholdLevel = severityOrder3[threshold] ?? 4;
   return report.cveCheck.vulnerabilities.some(
-    (v) => severityOrder2[v.severity] <= thresholdLevel
+    (v) => severityOrder3[v.severity] <= thresholdLevel
   );
 }
 
@@ -1693,6 +1694,92 @@ function logWarn(msg) {
 function logError(msg) {
   console.error(`  \u2717 ${msg}`);
 }
+function renderPlatformScan(projectPath, result) {
+  const lines = [];
+  const vulns = result.scanResponse.scan_results.flatMap(
+    (scanResult) => scanResult.vulnerabilities.map((vuln) => ({
+      dependencyName: scanResult.dependency_name,
+      version: scanResult.version,
+      cveId: vuln.cve_id,
+      severity: normalizeSeverity(vuln.severity),
+      summary: vuln.summary,
+      fixedVersion: vuln.fixed_version
+    }))
+  );
+  const summary = summarizeBySeverity(vulns.map((vuln) => vuln.severity));
+  lines.push("");
+  lines.push("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510");
+  lines.push("\u2502         VERIMU PLATFORM SCAN RESULTS        \u2502");
+  lines.push("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518");
+  lines.push("");
+  lines.push(`  Project:      ${projectPath}`);
+  lines.push("  Source:       Verimu platform backend");
+  lines.push(`  Dependencies: ${result.totalDependencies}`);
+  lines.push("");
+  if (vulns.length === 0) {
+    lines.push("  \u2713 No platform vulnerabilities found");
+  } else {
+    lines.push(`  \u26A0 ${vulns.length} backend vulnerabilit${vulns.length === 1 ? "y" : "ies"} found:`);
+    lines.push("");
+    const sorted = [...vulns].sort((a, b) => severityOrder2(a.severity) - severityOrder2(b.severity));
+    for (const vuln of sorted) {
+      const fix = vuln.fixedVersion ? ` \u2192 fix: ${vuln.fixedVersion}` : "";
+      lines.push(`    ${severityBadge2(vuln.severity)}  ${vuln.cveId}`);
+      lines.push(`           ${vuln.dependencyName}@${vuln.version}${fix}`);
+      lines.push(`           ${vuln.summary.slice(0, 100)}`);
+      lines.push("");
+    }
+  }
+  lines.push("  \u2500\u2500\u2500 Summary \u2500\u2500\u2500");
+  lines.push(`  Total: ${vulns.length}  |  Critical: ${summary.CRITICAL}  |  High: ${summary.HIGH}  |  Medium: ${summary.MEDIUM}  |  Low: ${summary.LOW}`);
+  lines.push("");
+  return lines.join("\n");
+}
+function normalizeSeverity(severity) {
+  const value = severity.trim().toUpperCase();
+  switch (value) {
+    case "CRITICAL":
+    case "HIGH":
+    case "MEDIUM":
+    case "LOW":
+      return value;
+    default:
+      return "UNKNOWN";
+  }
+}
+function summarizeBySeverity(severities) {
+  const summary = {
+    CRITICAL: 0,
+    HIGH: 0,
+    MEDIUM: 0,
+    LOW: 0,
+    UNKNOWN: 0
+  };
+  for (const severity of severities) {
+    summary[severity] += 1;
+  }
+  return summary;
+}
+function severityOrder2(severity) {
+  const order = {
+    CRITICAL: 0,
+    HIGH: 1,
+    MEDIUM: 2,
+    LOW: 3,
+    UNKNOWN: 4
+  };
+  return order[severity] ?? 5;
+}
+function severityBadge2(severity) {
+  const badges = {
+    CRITICAL: "[CRIT]",
+    HIGH: "[HIGH]",
+    MEDIUM: "[MED] ",
+    LOW: "[LOW] ",
+    UNKNOWN: "[???] "
+  };
+  return badges[severity] ?? "[???] ";
+}
 function parseArgs(argv) {
   const args = argv.slice(2);
   const result = {
@@ -1786,9 +1873,7 @@ async function main() {
         logSuccess(`Project created: ${report.project.path}`);
       }
       logSuccess(`${result.totalDependencies} dependencies tracked`);
-      if (result.vulnerableDependencies > 0) {
-        logWarn(`${result.vulnerableDependencies} vulnerable dependencies flagged`);
-      }
+      console.log(renderPlatformScan(report.project.path, result));
       logSuccess(`Dashboard: ${result.dashboardUrl}`);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);