open/config-audit
1
0
Fork 0
Code Issues Releases 1 Activity

fix(scanners): a moved-finding pair is humanized on both sides, not flattened into one

Browse source 
drift-cli ran the flat-finding humanizer directly over movedFindings, an array
of {from, to} pairs. humanizeFinding builds a new object from named finding
fields only, so from/to were silently dropped and the report's m.from.severity
crashed on undefined — exit 3, no output file, every time a drift diff had a
moved finding in default (non-JSON) mode.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CjJAbZp4beBu6xM3RrGK5j
This commit is contained in:
Kjell Tore Guttormsen 2026-08-14 21:33:10 +02:00
commit adcf44fe4e
1 changed files with 10 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
scanners/drift-cli.mjs
View file

@ -17,7 +17,7 @@ import { requireTargetDir } from './lib/require-target-dir.mjs';
import { runAllScanners } from './scan-orchestrator.mjs'; import { runAllScanners } from './scan-orchestrator.mjs';
import { diffEnvelopes, formatDiffReport } from './lib/diff-engine.mjs'; import { diffEnvelopes, formatDiffReport } from './lib/diff-engine.mjs';
import { saveBaseline, loadBaseline, listBaselines } from './lib/baseline.mjs'; import { saveBaseline, loadBaseline, listBaselines } from './lib/baseline.mjs';
import { humanizeFindings } from './lib/humanizer.mjs'; import { humanizeFindings, humanizeFinding } from './lib/humanizer.mjs';
const BOOL_FLAGS = ['--save', '--list', '--json', '--raw', '--global']; const BOOL_FLAGS = ['--save', '--list', '--json', '--raw', '--global'];
const VALUE_FLAGS = ['--name', '--baseline', '--output-file']; const VALUE_FLAGS = ['--name', '--baseline', '--output-file'];
@ -171,13 +171,21 @@ async function main() {
// `_baselineAnchor` rides here and NOT in the raw shape: commands/drift.md runs // `_baselineAnchor` rides here and NOT in the raw shape: commands/drift.md runs
// the CLI under `2>/dev/null`, so the stderr warning above never reaches the // the CLI under `2>/dev/null`, so the stderr warning above never reaches the
// caller that has to act on it. --json/--raw stay v5.0.0-shaped. // caller that has to act on it. --json/--raw stay v5.0.0-shaped.
//
// movedFindings holds {from, to} PAIRS, not flat findings — humanizeFindings()
// builds a brand-new object from named finding fields only, so running it
// directly over the pairs silently drops `from`/`to` and formatDiffReport's
// `m.from.severity` crashes on undefined. Humanize each side of the pair.
const humanizedDiff = { const humanizedDiff = {
...diff, ...diff,
_baselineAnchor: { matches: anchorMatches, baselineTarget, currentTarget }, _baselineAnchor: { matches: anchorMatches, baselineTarget, currentTarget },
newFindings: humanizeFindings(diff.newFindings || []), newFindings: humanizeFindings(diff.newFindings || []),
resolvedFindings: humanizeFindings(diff.resolvedFindings || []), resolvedFindings: humanizeFindings(diff.resolvedFindings || []),
unchangedFindings: humanizeFindings(diff.unchangedFindings || []), unchangedFindings: humanizeFindings(diff.unchangedFindings || []),
movedFindings: humanizeFindings(diff.movedFindings || []), movedFindings: (diff.movedFindings || []).map((m) => ({
from: humanizeFinding(m.from),
to: humanizeFinding(m.to),
})),
}; };
if (jsonMode || rawMode) { if (jsonMode || rawMode) {