pub struct Remediation {
pub target_version: String,
pub command_hint: String,
pub clears: Vec<String>,
pub still_open: Vec<String>,
pub compatibility: Compatibility,
pub screened_at: Option<String>,
pub peer_compatibility_checked: bool,
pub peer_compatibility_note: Option<String>,
}Expand description
CLEANLIB-652 (CX-3) part 3a: structured remediation (mirrors App
verbs::Remediation) — the single upgrade target + a per-ecosystem copy-paste
command. target_version is engine-clean (the composite’s effective fix
version). All-string + #[serde(default)] for tolerant, forward-compat parse.
CLEANLIB-755/745: this struct used to carry ONLY target_version +
command_hint — every other field the App’s verbs::Remediation emits
(screened_at, peer_compatibility_checked/_note, clears,
still_open, compatibility) parsed successfully (serde silently drops
unknown JSON keys with no deny_unknown_fields) but was then LOST on
every re-serialize through this narrower client-side type — the exact
mechanism behind two “already fixed” tickets both reproducing unchanged
via cleanlib verdict --output json/cleanlib fix: 755’s screened_at
and 745’s peer_compatibility_checked/_note disclosure. The App-side
fields were genuinely wired (verified: build_remediation in
cleanlib-app/src/http.rs sets them); the CLI just never had anywhere to
put them. Widened to full parity with the wire shape so this class of
silent-drop can’t recur field-by-field, ticket-by-ticket ([SibSurface]).
Fields§
§target_version: StringThe version to upgrade to (upgrading clears every CVE the composite can).
command_hint: StringPer-ecosystem copy-paste upgrade command for the target.
clears: Vec<String>CVE ids the target clears.
still_open: Vec<String>CVE ids the target does NOT clear (findings with no known fix).
compatibility: CompatibilityCompatibility label for the version jump. Unknown (the safe default,
matching the App’s own “undetermined ≠ same_major” discipline) when
the server omitted it (a pre-702 App build) or the value was absent.
screened_at: Option<String>CLEANLIB-755: the advisory CONSULTATION time the target was screened
against (not the request-compute stamp — see the App-side doc comment
on verbs::Remediation::screened_at). None when nothing was
consulted or the server didn’t set it (omit, never fabricate “now”).
peer_compatibility_checked: boolCLEANLIB-745 (Bug 1): whether target_version was checked against
peerDependencies declared elsewhere in the customer’s tree. This API
surface never receives the customer’s lockfile, so it is false on
every target the App emits today — carried through here so a direct
API/MCP/CLI consumer of verdict/remediation sees the caveat
instead of treating an isolated-safe target as tree-safe.
peer_compatibility_note: Option<String>Companion to peer_compatibility_checked: the reason, when false.
None on a pre-745 App build (omit, don’t fabricate an explanation).
Trait Implementations§
Source§impl Clone for Remediation
impl Clone for Remediation
Source§fn clone(&self) -> Remediation
fn clone(&self) -> Remediation
1.0.0 (const: unstable) · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source. Read more