fix: Fail scan when --matchers contains unknown slugs

README.md

@@ -1,6 +1,6 @@
 # deepsec
 
-`deepsec` an agent-powered vulnerability scanner that you can run in your own infrastructure, optimized to perform on-demand review of all code in existing 
+`deepsec` is an agent-powered vulnerability scanner that you can run in your own infrastructure, optimized to perform on-demand review of all code in existing 
 large-scale repos.
 
 `deepsec` is designed to surface hard-to-find issues that have been lurking in applications for a long time. It is configured to use the best models at maximum thinking levels, meaning scans can cost thousands or even tens-of-thousands of dollars for large codebases. Our customers have found the cost worth it for how quickly they were able to patch vulnerabilities that would have otherwise gone unfixed.

e2e/scan.test.ts

@@ -86,4 +86,14 @@ describe("scan e2e", () => {
     const meta = JSON.parse(fs.readFileSync(runPath, "utf-8"));
     expect(meta.scannerConfig.matcherSlugs).toEqual(["xss", "rce"]);
   });
+
+  it("throws when matcher filter includes an unknown slug", async () => {
+    await expect(
+      scan({
+        projectId: PROJECT_ID,
+        root: FIXTURES,
+        matcherSlugs: ["xss", "does-not-exist"],
+      }),
+    ).rejects.toThrow(/Unknown matcher slug\(s\): does-not-exist/);
+  });
 });

packages/scanner/src/matcher-registry.ts

@@ -16,9 +16,11 @@ export class MatcherRegistry {
   }
 
   getBySlugs(slugs: string[]): MatcherPlugin[] {
-    return slugs
-      .map((s) => this.matchers.get(s))
-      .filter((m): m is MatcherPlugin => m !== undefined);
+    const missing = slugs.filter((slug) => !this.matchers.has(slug));
+    if (missing.length > 0) {
+      throw new Error(`Unknown matcher slug(s): ${missing.join(", ")}`);
+    }
+    return slugs.map((slug) => this.matchers.get(slug)!);
   }
 
   slugs(): string[] {