xploitscan 1.3.0 → 1.3.1

package/dist/index.js

@@ -21,7 +21,7 @@ import {
   syncUser,
   uploadScanResults,
   vendoredReason
-} from "./chunk-LWX7UPO5.js";
+} from "./chunk-2VDAYFPC.js";
 
 // src/index.ts
 import { Command } from "commander";
@@ -627,6 +627,14 @@ ${existingFindings.map((f) => `- ${f.file}:${f.line} \u2014 ${f.title}`).join("\
       const response = await client.messages.create({
         model: "claude-sonnet-4-5-20250514",
         max_tokens: 4096,
+        // Pinned for the same reason as the FP filter, and the stakes are
+        // higher here: findings returned by this analyzer are pushed onto
+        // allFindings in commands/scan.ts, which is what calculateGrade()
+        // scores. Left at the API default of 1.0, a user could scan the same
+        // unchanged commit twice and get a different letter grade — with
+        // nothing in the output to explain why. Discovery arguably benefits
+        // from sampling variety; a grade the user is asked to trust does not.
+        temperature: 0,
         messages: [
           {
             role: "user",
@@ -2826,7 +2834,7 @@ async function cursorInstallCommand(opts = {}) {
 var program = new Command();
 program.name("xploitscan").description(
   "AI security scanner for vibe-coded apps. Find vulnerabilities before attackers do."
-).version("1.3.0");
+).version("1.3.1");
 program.command("scan").description("Scan a directory for security vulnerabilities").argument("[directory]", "Directory to scan", ".").option("--no-ai", "Skip AI-powered analysis").option(
   "-f, --format <format>",
   "Output format: terminal, json, sarif, splunk-hec, elastic-ecs, datadog-logs",
@@ -2859,7 +2867,7 @@ cursor.command("install").description("Drop XploitScan security rules into .curs
   await cursorInstallCommand({ force: opts.force, legacyOnly: opts.legacyOnly });
 });
 program.command("upgrade").description("Upgrade to XploitScan Pro for unlimited scans").action(async () => {
-  const { getStoredToken: getStoredToken2, getCheckoutUrl } = await import("./api-AX6R4QAD.js");
+  const { getStoredToken: getStoredToken2, getCheckoutUrl } = await import("./api-6FD27EJY.js");
   const chalk6 = (await import("chalk")).default;
   const token = getStoredToken2();
   if (!token) {