fix(core): fall back to humanized title for unmapped alert types

[Eric Hibbs (flowstate)]

Fixes CE-207. Webflow's CI was blocking on is-typed-array@1.1.15 via Socket CLI 2.2.86, but the Alert column for that row rendered blank. The API returns a single gptDidYouMean alert; the bundled socketdev SDK had no class for that type, so alert.title was empty and the table rendered nothing for that row.

Root Cause

socket-python-cli resolves alert titles via the socketdev SDK's AllIssues registry. When the API emits an alert type that has no corresponding class on AllIssues — gptDidYouMean being the case Webflow hit — alert.title is empty and every downstream consumer (the CLI's console table, SARIF report, PR/security comments) renders blank. There was no fallback.

The upstream cause is that socket-sdk-python's AllIssues is hand-maintained and never got gptDidYouMean added. That's tracked in CE-206 (in progress) and is the proper long-term fix.

Fix

Title resolution in Core.add_package_alerts_to_collection is now a four-step ladder:

1. SDK-provided title (props.title) if non-empty
2. Explicit override map (_ALERT_TYPE_TITLE_OVERRIDES) — currently maps gptDidYouMean → "Possible typosquat attack (GPT)"
3. Existing licenseSpdxDisj special-case (unchanged)
4. Generic camelCase humanizer (_humanize_alert_type) — any future unknown alert type at least renders something legible instead of blank

Purely additive: every alert type already covered by the SDK's AllIssues keeps its current title.

The override map is load-bearing until CE-206 ships. Once gptDidYouMean lands in socketdev/core/issues.py and the CLI's socketdev floor is bumped to include it, the override entry can be removed in a follow-up. The generic humanizer fallback stays as belt-and-suspenders for any future unknown alert types.

Test plan:

• pytest tests/ — green; 8 new tests cover gptDidYouMean, an arbitrary unknown type, a regression guard for licenseSpdxDisj, and the humanizer helper (camelCase, PascalCase, single-word, empty input, acronym preservation). Original test count on author's machine at handoff time: 201 passed, 2 skipped (the two skips are pre-existing gitlab tests on main).
• Manual: rendered the console alert table against a synthesized gptDidYouMean alert; Alert column reads "Possible typosquat attack (GPT)" instead of blank.

Public Changelog

CLI now falls back to a humanized alert label for any alert type without an SDK-provided title, so the Alert column never renders blank. Adds an explicit label for gptDidYouMean ("Possible typosquat attack (GPT)") which previously rendered empty for customers on socketdev SDK versions without that alert class.

[github-actions]

🚀 Preview package published!

Install with:

pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple socketsecurity==2.2.92.dev2

Docker image: socketdev/cli:pr-208