shadowcat 2.2.1__tar.gz → 2.2.2__tar.gz

{shadowcat-2.2.1 → shadowcat-2.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: shadowcat
-Version: 2.2.1
+Version: 2.2.2
 Summary: AI-powered autonomous web security scanner with real-time streaming — enterprise DAST platform
 Project-URL: Homepage, https://github.com/shadowcat-dast/shadowcat
 Project-URL: Repository, https://github.com/shadowcat-dast/shadowcat

{shadowcat-2.2.1 → shadowcat-2.2.2}/backend/reporting/generator.py

@@ -122,6 +122,7 @@ h3 { font-size: 1rem; color: #334155; margin-bottom: 8px; }
           padding:2px 8px; font-size:0.8rem; font-family:monospace; }
 .verdict { padding:6px 12px; border-radius:6px; font-size:0.85rem; margin-top:10px; display:inline-block; }
 .verdict-confirmed    { background:#dcfce7; color:#16a34a; }
+.verdict-likely       { background:#fef3c7; color:#b45309; }
 .verdict-inconclusive { background:#ffedd5; color:#c2410c; }
 .verdict-refuted      { background:#f1f5f9; color:#64748b; }
 .verdict-pending      { background:#fef9c3; color:#92400e; }
@@ -165,12 +166,17 @@ def _render_finding(idx: int, finding: dict[str, Any], verdicts: dict[str, Any])
     elif reproduced is False:
         repro_badge = ' <span class="req-id" title="Did not reproduce on a clean-session replay">⚠ did not reproduce</span>'
     # The oracle's ruling vocabulary is exactly confirmed / refuted / inconclusive
-    # (see idor_oracle.py, general_oracle.py). A finding with no verdict entry at
-    # all hasn't been through the oracle yet — that's the only true "pending" case.
+    # (see idor_oracle.py, general_oracle.py) plus GeneralOracle's "likely" tier
+    # (a suggestive but context-blind signal — worth attention, not proof). A
+    # finding with no verdict entry at all hasn't been through the oracle yet —
+    # that's the only true "pending" case.
     verdict_label = verdict_info.get("status")
     if verdict_label == "confirmed":
         vc = "verdict-confirmed"
         vt = "Confirmed"
+    elif verdict_label == "likely":
+        vc = "verdict-likely"
+        vt = "Likely"
     elif verdict_label == "refuted":
         vc = "verdict-refuted"
         vt = "Refuted"

{shadowcat-2.2.1 → shadowcat-2.2.2}/frontend/src/components/StatusChip.tsx

@@ -1,8 +1,8 @@
 import { Chip } from "@heroui/react";
 
 // Covers both scan RunStatus (queued/running/verifying/completed/failed/cancelled)
-// and the oracle's verdict vocabulary (confirmed/refuted/inconclusive — see
-// backend/verification/{idor,general}_oracle.py). Anything else (e.g. a
+// and the oracle's verdict vocabulary (confirmed/likely/refuted/inconclusive —
+// see backend/verification/{idor,general}_oracle.py). Anything else (e.g. a
 // finding's own "pending_verification" lifecycle field) falls back to default.
 const COLOR: Record<string, "accent" | "success" | "danger" | "warning" | "default"> = {
   queued: "accent",
@@ -10,6 +10,7 @@ const COLOR: Record<string, "accent" | "success" | "danger" | "warning" | "defau
   verifying: "accent",
   completed: "success",
   confirmed: "success",
+  likely: "warning",
   failed: "danger",
   error: "danger",
   cancelled: "default",

{shadowcat-2.2.1 → shadowcat-2.2.2}/frontend/src/lib/severity.ts

@@ -23,12 +23,19 @@ export function severityOf(finding: Finding): Severity {
   return (cwe && SEVERITY_BY_CWE[cwe]) || "medium";
 }
 
-export type Verdict = "confirmed" | "refuted" | "inconclusive";
+export type Verdict = "confirmed" | "likely" | "refuted" | "inconclusive";
 
-/** The oracle's ruling vocabulary is exactly these three (see
- * backend/verification/{idor,general}_oracle.py) — anything else means the
- * finding hasn't been verified yet. */
+/** The oracle's ruling vocabulary — confirmed/refuted/inconclusive from both
+ * oracles, plus GeneralOracle's "likely" tier (a suggestive but context-blind
+ * signal — worth attention, not proof; see backend/verification/general_oracle.py).
+ * Anything else means the finding hasn't been verified yet. */
 export function normalizeVerdict(status: string | undefined): Verdict | "pending" {
-  if (status === "confirmed" || status === "refuted" || status === "inconclusive") return status;
+  if (
+    status === "confirmed" ||
+    status === "likely" ||
+    status === "refuted" ||
+    status === "inconclusive"
+  )
+    return status;
   return "pending";
 }

{shadowcat-2.2.1 → shadowcat-2.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "shadowcat"
-version = "2.2.1"
+version = "2.2.2"
 description = "AI-powered autonomous web security scanner with real-time streaming — enterprise DAST platform"
 authors = [{ name = "ShadowCat Team" }]
 readme = "README.md"