Security scan reports "no output" for three different conditions, only one of which is a failure

[alamb-hex]

Summary

The security scan collapses three genuinely different conditions into a single misleading error:

cve-lite produced no output (online OSV query and offline DB scan both failed)

Neither the OSV query nor the offline DB actually failed in any observed case. cve-lite 1.28.0 is correctly installed, OSV is reachable, and the local DB is fresh.

Actual causes observed

6 of 36 projects report this error. The real causes:

Condition	Projects	Reality
Nothing scannable	do868-admin, do868-com, do868-manage, hextrace	cve-lite exits 0 and writes no JSON when it finds no supported lockfile and no exact-pinned deps. Not an error.
Configured path missing	sailbot, sailbot-admin	The path in the project registry does not exist on disk, so the CLI never runs. A config error.
Genuine scan failure	none observed	The only case the current message actually describes.

For the do868 projects the lockfile was relocated by an in-progress monorepo refactor. hextrace is a planning-only repo with no package.json at all.

Evidence

$ cd <project> && node_modules/.bin/cve-lite --verbose .
No supported lockfile was found, so the scanner fell back to package.json.
No scannable packages were found. Supported inputs: bun.lock, npm-shrinkwrap.json,
package-lock.json, pnpm-lock.yaml, yarn.lock, or package.json with exact pinned versions.
Searched under: <project path>
EXIT=0

The cached failure records a duration of ~311ms — far too fast for an OSV query to have been attempted.

Impact

The security page shows 6 projects as failed scans. The correct reading is 2 configuration errors, 1 not-yet-implemented project, and 3 with displaced lockfiles. A missing project directory is silently reported as a network/database problem, which sends debugging in entirely the wrong direction.

override-hygiene shells out to the same binary via override-audit.ts and inherits the identical misclassification.

Location

• src/lib/security/sources/cve-lite.ts — runScanAttempt, ~lines 205-224 and 245-249
• src/lib/security/sources/override-hygiene.ts / src/lib/security/override-audit.ts — same binary, same failure mode
• src/lib/security/types.ts — SourceStatus has no value for "nothing to scan" or "misconfigured"

Proposed fix

Add skipped (nothing scannable — informational, not red) and misconfigured (project path missing) to SourceStatus. Detect a missing project path once in the scan orchestrator rather than per-source. Preserve current semantics for genuine failures. Update all status consumers, including the UI, so skipped does not render as an error.