xploitscan 1.0.11 → 1.0.12

package/dist/index.js

@@ -1983,8 +1983,8 @@ function parseReviewResponse(text) {
   }
 }
 async function filterFalsePositives(findings, fileContents) {
-  if (!process.env.ANTHROPIC_API_KEY) return findings;
-  if (findings.length === 0) return findings;
+  if (!process.env.ANTHROPIC_API_KEY) return { findings, aiReviewed: false, removedCount: 0 };
+  if (findings.length === 0) return { findings, aiReviewed: false, removedCount: 0 };
   const toReview = findings.slice(0, MAX_TOTAL_FINDINGS);
   const overflow = findings.slice(MAX_TOTAL_FINDINGS);
   const byFile = /* @__PURE__ */ new Map();
@@ -1997,7 +1997,7 @@ async function filterFalsePositives(findings, fileContents) {
   try {
     client = new Anthropic2();
   } catch {
-    return findings;
+    return { findings, aiReviewed: false, removedCount: 0 };
   }
   const fpIndices = /* @__PURE__ */ new Set();
   for (const [file, fileFindings] of byFile) {
@@ -2027,7 +2027,8 @@ async function filterFalsePositives(findings, fileContents) {
     }
   }
   const filtered = toReview.filter((_, i) => !fpIndices.has(i));
-  return [...filtered, ...overflow];
+  const result = [...filtered, ...overflow];
+  return { findings: result, aiReviewed: true, removedCount: fpIndices.size };
 }
 
 // src/scanners/ast-analyzer.ts
@@ -3626,6 +3627,8 @@ async function scanCommand(directory, options) {
       chalk2.gray("Tip: Set ANTHROPIC_API_KEY for AI-powered contextual analysis")
     );
   }
+  let aiReviewed = false;
+  let aiRemovedCount = 0;
   if (process.env.ANTHROPIC_API_KEY && allFindings.length > 0) {
     spinner.text = "AI reviewing findings for false positives...";
     spinner.color = "cyan";
@@ -3637,15 +3640,12 @@ async function scanCommand(directory, options) {
           if (content) fileContentsMap.set(f.file, content);
         }
       }
-      const beforeCount = allFindings.length;
-      const filtered = await filterFalsePositives(allFindings, fileContentsMap);
-      const removed = beforeCount - filtered.length;
-      if (removed > 0) {
+      const result2 = await filterFalsePositives(allFindings, fileContentsMap);
+      aiReviewed = result2.aiReviewed;
+      aiRemovedCount = result2.removedCount;
+      if (result2.removedCount > 0) {
         allFindings.length = 0;
-        allFindings.push(...filtered);
-      }
-      if (removed > 0 && verbose) {
-        spinner.info(`AI review removed ${removed} false positive${removed !== 1 ? "s" : ""}`);
+        allFindings.push(...result2.findings);
       }
     } catch {
     }
@@ -3676,6 +3676,11 @@ async function scanCommand(directory, options) {
       renderTerminalReport(result, fileContentsForAnalysis);
       break;
   }
+  if (aiReviewed && !isSilent) {
+    const msg = aiRemovedCount > 0 ? `  AI review: ${aiRemovedCount} false positive${aiRemovedCount !== 1 ? "s" : ""} removed, ${dedupedFindings.length} verified finding${dedupedFindings.length !== 1 ? "s" : ""} remain` : `  AI review: all ${dedupedFindings.length} finding${dedupedFindings.length !== 1 ? "s" : ""} verified`;
+    console.log("");
+    console.log(chalk2.cyan("\u{1F916} ") + chalk2.gray(msg));
+  }
   if (tier === "free" && !isSilent) {
     console.log("");
     if (userPlan === "anonymous") {