Kjell Tore Guttormsen
e3b044a476
New orchestrated scanner output-style-scanner.mjs — first new family since SKL. Three findings, each pinned to a CONFIRMED V-row of the steering-model plan + re-verified against code.claude.com/docs/en/output-styles: - CA-OST-001 (medium, V10): user/project custom style missing keep-coding-instructions:true (default false) → silently strips built-in software-engineering instructions when active. Scoped to user/project. - CA-OST-002 (low, V11): plugin style with force-for-plugin:true overrides the user's selected outputStyle. Verifiseringsplikt correction — the plan bullet said "project/user style," but force-for-plugin is plugin-styles-only per the docs, so the check keys on source==='plugin'. - CA-OST-003 (medium): settings outputStyle matching no built-in (Default/Explanatory/Learning/Proactive, case-insensitive) nor discovered custom style → dead config. Byte-stability — a scanner addition, not a field addition. Growing the scanners array + scanners_ok cannot be hidden by a field strip, but re-seeding frozen v5.0.0 (the SKL precedent) would now bake in B2's hotspot triple + claudeMd drift. So, per the B2 lesson, frozen v5.0.0 snapshots are PRESERVED and the OST entry is stripped at compare time via new tests/helpers/strip-added-scanner.mjs (wired into json/raw-backcompat + the Step 5/6 humanizer tests); only SC-5 default-output is regenerated (additive OST entry, diff reviewed). OST is fixture-gated (no output styles on marketplace-medium / hermetic HOME → silent). Wiring: orchestrator; humanizer (OST→Configuration mistake) + humanizer-data OST family (title-coupled); scoring (OST→Settings, keeps 10 areas). Suite 1012→1023 (+11). Badges: scanners 14, tests 1023, TRANSLATIONS families 15. Lore swept: README, CLAUDE.md, scanner-internals, humanizer.md. self-audit A/A. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
62 lines
2.3 KiB
JavaScript
62 lines
2.3 KiB
JavaScript
/**
|
|
* v5.6 C added the OST (Output-Style Validation) scanner — a 14th orchestrated
|
|
* scanner. The frozen v5.0.0 byte-equal baselines predate it (13 scanners), so
|
|
* this strips the additive OST scanner entry before comparison, the same way
|
|
* strip-hotspot-load-pattern.mjs handles B2's additive hotspot fields. Stripping
|
|
* (rather than re-seeding the frozen snapshots) keeps the strongest invariant:
|
|
* the ORIGINAL 13 scanners still emit byte-identical output, and the frozen
|
|
* snapshots stay free of post-v5.0.0 drift (the hotspot triple, ancestor token
|
|
* counts) that re-seeding would bake in.
|
|
*
|
|
* Removing a zero-finding scanner entry only moves `aggregate.scanners_ok`
|
|
* (OST is always status 'ok' and emits nothing on the deterministic fixture, so
|
|
* total_findings / counts / risk_score / verdict are unchanged). The strip
|
|
* decrements scanners_ok to match.
|
|
*
|
|
* Mutates in place and returns the payload for chaining inside a normalizer:
|
|
* return stripAddedScanners(stripHotspotLoadPattern(out));
|
|
*/
|
|
|
|
const ADDED_SCANNERS = new Set(['OST']);
|
|
|
|
function stripFromEnvelope(env) {
|
|
if (!env || typeof env !== 'object' || !Array.isArray(env.scanners)) return;
|
|
let removedOk = 0;
|
|
const kept = [];
|
|
for (const s of env.scanners) {
|
|
if (ADDED_SCANNERS.has(s.scanner)) {
|
|
if (s.status === 'ok') removedOk++;
|
|
continue;
|
|
}
|
|
kept.push(s);
|
|
}
|
|
env.scanners = kept;
|
|
if (env.aggregate && typeof env.aggregate.scanners_ok === 'number') {
|
|
env.aggregate.scanners_ok -= removedOk;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Strip added (post-v5.0.0) scanner entries from a CLI payload / envelope —
|
|
* both top-level (`scanners`) and nested (`scannerEnvelope.scanners`).
|
|
* @template T
|
|
* @param {T} payload
|
|
* @returns {T}
|
|
*/
|
|
export function stripAddedScanners(payload) {
|
|
if (!payload || typeof payload !== 'object') return payload;
|
|
stripFromEnvelope(payload);
|
|
if (payload.scannerEnvelope) stripFromEnvelope(payload.scannerEnvelope);
|
|
return payload;
|
|
}
|
|
|
|
/**
|
|
* Remove `[OST] …` per-scanner progress lines from a captured stderr scorecard,
|
|
* so a 14-scanner live run matches the frozen 13-scanner stderr snapshot.
|
|
* @param {string} text
|
|
* @returns {string}
|
|
*/
|
|
export function stripAddedScannerStderr(text) {
|
|
if (typeof text !== 'string') return text;
|
|
return text.replace(/^[ \t]*\[OST\][^\n]*\n/gm, '');
|
|
}
|