xploitscan 1.2.2 → 1.3.1

package/dist/index.js

@@ -13,13 +13,15 @@ import {
   getStoredToken,
   incrementUsage,
   isAuthenticated,
+  isVendoredFinding,
   loadCachedProRules,
   runCustomRules,
   scanEntropy,
   storeToken,
   syncUser,
-  uploadScanResults
-} from "./chunk-4OFR3SIS.js";
+  uploadScanResults,
+  vendoredReason
+} from "./chunk-2VDAYFPC.js";
 
 // src/index.ts
 import { Command } from "commander";
@@ -313,6 +315,9 @@ function mergeRcIntoConfig(base, rc) {
         .../* @__PURE__ */ new Set([...merged.extensions ?? [], ...rc.scan.extensions])
       ];
     }
+    if (rc.scan.gradeVendored !== void 0) {
+      merged.gradeVendored = rc.scan.gradeVendored;
+    }
   }
   if (rc.output) {
     if (rc.output.format !== void 0) {
@@ -622,6 +627,14 @@ ${existingFindings.map((f) => `- ${f.file}:${f.line} \u2014 ${f.title}`).join("\
       const response = await client.messages.create({
         model: "claude-sonnet-4-5-20250514",
         max_tokens: 4096,
+        // Pinned for the same reason as the FP filter, and the stakes are
+        // higher here: findings returned by this analyzer are pushed onto
+        // allFindings in commands/scan.ts, which is what calculateGrade()
+        // scores. Left at the API default of 1.0, a user could scan the same
+        // unchanged commit twice and get a different letter grade — with
+        // nothing in the output to explain why. Discovery arguably benefits
+        // from sampling variety; a grade the user is asked to trust does not.
+        temperature: 0,
         messages: [
           {
             role: "user",
@@ -1759,8 +1772,12 @@ var GRADE_COLORS = {
   "D": chalk.red.bold,
   "F": chalk.bgRed.white.bold
 };
-function renderTerminalReport(result, files) {
+function renderTerminalReport(result, files, options = {}) {
   const { findings, filesScanned, duration } = result;
+  const gradeVendored = options.gradeVendored ?? false;
+  const isHeldOut = (f) => !gradeVendored && isVendoredFinding(f);
+  const gradedFindings = findings.filter((f) => !isHeldOut(f));
+  const heldOutFindings = findings.filter(isHeldOut);
   console.log("");
   console.log(chalk.bold.cyan("  xploitscan") + chalk.gray(" \u2014 security scan results"));
   console.log(chalk.gray("  " + "\u2500".repeat(50)));
@@ -1787,11 +1804,18 @@ function renderTerminalReport(result, files) {
     }
   }
   const GRADE_PERCENTILES = { "A+": 98, "A": 90, "B": 70, "C": 45, "D": 20, "F": 5 };
-  const { grade, score, summary } = calculateGrade(findings, filesScanned);
+  const { grade, score, summary } = calculateGrade(findings, filesScanned, { gradeVendored });
   const gradeColor = GRADE_COLORS[grade];
   const percentile = GRADE_PERCENTILES[grade] ?? 50;
   console.log(chalk.gray("  Security Grade: ") + gradeColor(` ${grade} `) + chalk.gray(` (${score}/100) \u2014 ${summary}`));
   console.log(chalk.gray(`  Benchmark: More secure than ${percentile}% of projects scanned`));
+  if (heldOutFindings.length > 0) {
+    console.log(
+      chalk.gray(
+        `  Not graded: ${heldOutFindings.length} finding${heldOutFindings.length === 1 ? "" : "s"} in vendored, generated, or documentation files (listed below, tagged ${chalk.dim("[not graded]")}). Use --grade-vendored to include them.`
+      )
+    );
+  }
   console.log("");
   if (findings.length === 0) {
     console.log(chalk.green.bold("  No vulnerabilities found!"));
@@ -1799,18 +1823,23 @@ function renderTerminalReport(result, files) {
     console.log("");
     return;
   }
-  const sorted = [...findings].sort(
-    (a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity]
-  );
+  const sorted = [...findings].sort((a, b) => {
+    const heldDiff = Number(isHeldOut(a)) - Number(isHeldOut(b));
+    if (heldDiff !== 0) return heldDiff;
+    return SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity];
+  });
   const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
-  for (const f of findings) counts[f.severity]++;
+  for (const f of gradedFindings) counts[f.severity]++;
   const summaryParts = [];
   if (counts.critical > 0) summaryParts.push(chalk.bgRed.white.bold(` ${counts.critical} CRITICAL `));
   if (counts.high > 0) summaryParts.push(chalk.red.bold(`${counts.high} high`));
   if (counts.medium > 0) summaryParts.push(chalk.yellow.bold(`${counts.medium} medium`));
   if (counts.low > 0) summaryParts.push(chalk.blue(`${counts.low} low`));
   if (counts.info > 0) summaryParts.push(chalk.gray(`${counts.info} info`));
-  console.log(`  Found ${chalk.bold(findings.length.toString())} issues: ${summaryParts.join(chalk.gray(" | "))}`);
+  const heldOutSuffix = heldOutFindings.length > 0 ? chalk.gray(` + ${heldOutFindings.length} not graded`) : "";
+  console.log(
+    gradedFindings.length === 0 ? `  ${chalk.green.bold("No issues in your code")}${heldOutSuffix}` : `  Found ${chalk.bold(gradedFindings.length.toString())} issue${gradedFindings.length === 1 ? "" : "s"} in your code: ${summaryParts.join(chalk.gray(" | "))}${heldOutSuffix}`
+  );
   console.log(chalk.gray(`  Scanned ${filesScanned} files in ${(duration / 1e3).toFixed(1)}s`));
   console.log("");
   for (const finding of sorted) {
@@ -1823,8 +1852,12 @@ function renderTerminalReport(result, files) {
       finding.owasp ? chalk.yellow(`[${finding.owasp}]`) : "",
       finding.cwe ? chalk.blue(`[${finding.cwe}]`) : ""
     ].filter(Boolean).join(" ");
-    console.log(`  ${severityLabel}${sourceLabel}${chalk.bold(finding.title)} ${complianceTags}${confidenceLabel}`);
-    console.log(chalk.gray(`  ${finding.file}:${finding.line}`));
+    const heldOutLabel = isHeldOut(finding) ? chalk.dim(" [not graded] ") : "";
+    console.log(`  ${severityLabel}${heldOutLabel}${sourceLabel}${chalk.bold(finding.title)} ${complianceTags}${confidenceLabel}`);
+    const reason = isHeldOut(finding) ? vendoredReason(finding.file) : null;
+    console.log(
+      chalk.gray(`  ${finding.file}:${finding.line}`) + (reason ? chalk.dim(` \u2014 ${reason}, not counted toward the grade`) : "")
+    );
     console.log("");
     console.log(chalk.white(`  ${finding.description}`));
     console.log("");
@@ -1846,7 +1879,7 @@ function renderTerminalReport(result, files) {
     console.log(chalk.gray("  " + "\u2500".repeat(50)));
     console.log("");
   }
-  const owaspFindings = findings.filter((f) => f.owasp);
+  const owaspFindings = gradedFindings.filter((f) => f.owasp);
   if (owaspFindings.length > 0) {
     const owaspCats = {
       "A01:2021": { name: "Broken Access Control", count: 0 },
@@ -1941,6 +1974,14 @@ Suggested fix: ${f.fix}` : `${f.title}: ${f.description}`;
             ruleIndex: ruleIndex.get(f.rule) ?? 0,
             level: SEVERITY_TO_SARIF[f.severity],
             message: { text: messageText },
+            // Vendored/generated/docs findings are reported, not suppressed:
+            // they keep their real `level` so nothing is hidden from a SARIF
+            // consumer, and carry a property so a consumer that wants to
+            // filter them out can. We deliberately don't emit SARIF
+            // `suppressions[]` — that would make GitHub code scanning drop
+            // them from the UI entirely, which is the silent-hiding we're
+            // trying to avoid.
+            ...f.vendored ? { properties: { vendored: true, gradeExcluded: true } } : {},
             locations: [
               {
                 physicalLocation: {
@@ -2336,12 +2377,19 @@ ${isMonthlyCap ? "Monthly" : "Daily"} scan limit reached.`));
       )
     );
   }
+  const gradeVendored = options.gradeVendored ?? config.gradeVendored ?? false;
+  for (const f of dedupedFindings) {
+    if (isVendoredFinding(f)) f.vendored = true;
+    else delete f.vendored;
+  }
+  const ungradedFindings = gradeVendored ? [] : dedupedFindings.filter((f) => isVendoredFinding(f));
   const result = {
     findings: dedupedFindings,
     filesScanned: files.length,
     duration: Date.now() - startTime,
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    directory: dir
+    directory: dir,
+    ungraded: ungradedFindings.length
   };
   const PLATFORM_MARKERS = [
     ".cursorrules",
@@ -2371,7 +2419,7 @@ ${isMonthlyCap ? "Monthly" : "Daily"} scan limit reached.`));
       renderDatadogReport(result);
       break;
     default:
-      renderTerminalReport(result, [...fileContentsForAnalysis, ...platformMarkerFiles]);
+      renderTerminalReport(result, [...fileContentsForAnalysis, ...platformMarkerFiles], { gradeVendored });
       break;
   }
   if (aiReviewed && !isSilent) {
@@ -2414,7 +2462,8 @@ ${isMonthlyCap ? "Monthly" : "Daily"} scan limit reached.`));
       })
     ]);
   }
-  const hasCritical = dedupedFindings.some(
+  const gatedFindings = gradeVendored ? dedupedFindings : dedupedFindings.filter((f) => !isVendoredFinding(f));
+  const hasCritical = gatedFindings.some(
     (f) => f.severity === "critical" || f.severity === "high"
   );
   if (hasCritical) {
@@ -2785,19 +2834,23 @@ async function cursorInstallCommand(opts = {}) {
 var program = new Command();
 program.name("xploitscan").description(
   "AI security scanner for vibe-coded apps. Find vulnerabilities before attackers do."
-).version("1.2.2");
+).version("1.3.1");
 program.command("scan").description("Scan a directory for security vulnerabilities").argument("[directory]", "Directory to scan", ".").option("--no-ai", "Skip AI-powered analysis").option(
   "-f, --format <format>",
   "Output format: terminal, json, sarif, splunk-hec, elastic-ecs, datadog-logs",
   "terminal"
-).option("-v, --verbose", "Show detailed output", false).option("--diff [base]", "Scan only files changed vs base branch (default: main)").option("-w, --watch", "Watch for file changes and re-scan automatically", false).action(async (directory, opts) => {
+).option("-v, --verbose", "Show detailed output", false).option("--diff [base]", "Scan only files changed vs base branch (default: main)").option("-w, --watch", "Watch for file changes and re-scan automatically", false).option(
+  "--grade-vendored",
+  "Count findings in vendored/generated/docs files (components/ui, __generated__, *.md) toward the grade and exit code. Off by default \u2014 those findings are reported either way."
+).action(async (directory, opts) => {
   await scanCommand(directory, {
     directory,
     aiAnalysis: opts.ai,
     format: opts.format,
     verbose: opts.verbose,
     diff: opts.diff,
-    watch: opts.watch
+    watch: opts.watch,
+    gradeVendored: opts.gradeVendored
   });
 });
 var auth = program.command("auth").description("Manage authentication");
@@ -2814,7 +2867,7 @@ cursor.command("install").description("Drop XploitScan security rules into .curs
   await cursorInstallCommand({ force: opts.force, legacyOnly: opts.legacyOnly });
 });
 program.command("upgrade").description("Upgrade to XploitScan Pro for unlimited scans").action(async () => {
-  const { getStoredToken: getStoredToken2, getCheckoutUrl } = await import("./api-MFCSQQ2Y.js");
+  const { getStoredToken: getStoredToken2, getCheckoutUrl } = await import("./api-6FD27EJY.js");
   const chalk6 = (await import("chalk")).default;
   const token = getStoredToken2();
   if (!token) {