@gulu9527/code-trust 0.2.0 → 0.3.0

package/dist/index.js

@@ -1,7 +1,8 @@
 // src/core/engine.ts
+import { createHash } from "crypto";
 import { readFile } from "fs/promises";
-import { readFileSync, existsSync as existsSync3 } from "fs";
-import { resolve as resolve2, dirname as dirname3 } from "path";
+import { readFileSync } from "fs";
+import { resolve as resolve2, dirname as dirname3, relative, sep } from "path";
 import { fileURLToPath } from "url";
 
 // src/parsers/diff.ts
@@ -468,7 +469,7 @@ function detectCodeAfterReturn(context, lines, issues) {
       }
     }
     if (/^(return|throw)\b/.test(trimmed) && !trimmed.includes("=>")) {
-      const endsOpen = /[{(\[,]$/.test(trimmed) || /^(return|throw)\s*$/.test(trimmed);
+      const endsOpen = /[[{(,]$/.test(trimmed) || /^(return|throw)\s*$/.test(trimmed);
       if (endsOpen) continue;
       lastReturnDepth = braceDepth;
       lastReturnLine = i;
@@ -524,6 +525,24 @@ function detectImmediateReassign(context, lines, issues) {
   }
 }
 
+// src/rules/fix-utils.ts
+function lineStartOffset(content, lineNumber) {
+  let offset = 0;
+  const lines = content.split("\n");
+  for (let i = 0; i < lineNumber - 1 && i < lines.length; i++) {
+    offset += lines[i].length + 1;
+  }
+  return offset;
+}
+function lineRange(content, lineNumber) {
+  const lines = content.split("\n");
+  const lineIndex = lineNumber - 1;
+  if (lineIndex < 0 || lineIndex >= lines.length) return [0, 0];
+  const start = lineStartOffset(content, lineNumber);
+  const end = start + lines[lineIndex].length + (lineIndex < lines.length - 1 ? 1 : 0);
+  return [start, end];
+}
+
 // src/parsers/ast.ts
 import { parse, AST_NODE_TYPES } from "@typescript-eslint/typescript-estree";
 
@@ -706,6 +725,19 @@ var unusedVariablesRule = {
   severity: "low",
   title: "Unused variable detected",
   description: "AI-generated code sometimes declares variables that are never used, indicating incomplete or hallucinated logic.",
+  fixable: true,
+  fix(context, issue) {
+    const lines = context.fileContent.split("\n");
+    const lineIndex = issue.startLine - 1;
+    if (lineIndex < 0 || lineIndex >= lines.length) return null;
+    const line = lines[lineIndex].trim();
+    if (/^(const|let|var)\s+\w+\s*[=:;]/.test(line) && !line.includes(",")) {
+      const [start, end] = lineRange(context.fileContent, issue.startLine);
+      if (start === end) return null;
+      return { range: [start, end], text: "" };
+    }
+    return null;
+  },
   check(context) {
     const issues = [];
     let ast;
@@ -872,6 +904,10 @@ function truncate(s, maxLen) {
 }
 
 // src/rules/builtin/security.ts
+var isCommentLine = (trimmed) => trimmed.startsWith("//") || trimmed.startsWith("*");
+var stripQuotedStrings = (line) => line.replace(/'[^'\\]*(?:\\.[^'\\]*)*'/g, "''").replace(/"[^"\\]*(?:\\.[^"\\]*)*"/g, '""').replace(/`[^`\\]*(?:\\.[^`\\]*)*`/g, "``");
+var isPatternDefinitionLine = (line) => /\bpattern\s*:\s*\/.*\/[dgimsuvy]*/.test(line);
+var hasQueryContext = (line) => /\b(query|sql|statement|stmt)\b/i.test(line) || /\.(query|execute|run|prepare)\s*\(/i.test(line);
 var securityRules = [
   {
     id: "security/hardcoded-secret",
@@ -884,7 +920,7 @@ var securityRules = [
       const lines = context.fileContent.split("\n");
       const secretPatterns = [
         // API keys / tokens
-        { pattern: /(?:api[_-]?key|apikey)\s*[:=]\s*['"`][A-Za-z0-9_\-]{16,}['"`]/i, label: "API key" },
+        { pattern: /(?:api[_-]?key|apikey)\s*[:=]\s*['"`][A-Za-z0-9_-]{16,}['"`]/i, label: "API key" },
         { pattern: /(?:secret|token|password|passwd|pwd)\s*[:=]\s*['"`][^'"`]{8,}['"`]/i, label: "secret/password" },
         // AWS
         { pattern: /AKIA[0-9A-Z]{16}/, label: "AWS Access Key" },
@@ -937,15 +973,17 @@ var securityRules = [
       const issues = [];
       const lines = context.fileContent.split("\n");
       for (let i = 0; i < lines.length; i++) {
-        const trimmed = lines[i].trim();
-        if (trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
+        const line = lines[i];
+        const trimmed = line.trim();
+        if (isCommentLine(trimmed) || isPatternDefinitionLine(line)) continue;
+        const sanitizedLine = stripQuotedStrings(line);
         const evalPatterns = [
-          { pattern: /\beval\s*\(/, label: "eval()" },
-          { pattern: /new\s+Function\s*\(/, label: "new Function()" },
-          { pattern: /\b(setTimeout|setInterval)\s*\(\s*['"`]/, label: "setTimeout/setInterval with string" }
+          { pattern: /\beval\s*\(/, label: "eval()", source: sanitizedLine },
+          { pattern: /new\s+Function\s*\(/, label: "new Function()", source: sanitizedLine },
+          { pattern: /\b(setTimeout|setInterval)\s*\(\s*['"`]/, label: "setTimeout/setInterval with string", source: line }
         ];
-        for (const { pattern, label } of evalPatterns) {
-          if (pattern.test(lines[i])) {
+        for (const { pattern, label, source } of evalPatterns) {
+          if (pattern.test(source)) {
             issues.push({
               ruleId: "security/eval-usage",
               severity: "high",
@@ -978,29 +1016,30 @@ var securityRules = [
     check(context) {
       const issues = [];
       const lines = context.fileContent.split("\n");
+      const sqlKeywords = /\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER)\b/i;
       for (let i = 0; i < lines.length; i++) {
-        const trimmed = lines[i].trim();
-        if (trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
-        const sqlKeywords = /\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER)\b/i;
-        if (sqlKeywords.test(lines[i])) {
-          if (/\$\{[^}]+\}/.test(lines[i]) || /['"]\s*\+\s*\w+/.test(lines[i])) {
-            issues.push({
-              ruleId: "security/sql-injection",
-              severity: "high",
-              category: "security",
-              file: context.filePath,
-              startLine: i + 1,
-              endLine: i + 1,
-              message: t(
-                "Potential SQL injection \u2014 string interpolation in SQL query.",
-                "\u6F5C\u5728\u7684 SQL \u6CE8\u5165 \u2014 SQL \u67E5\u8BE2\u4E2D\u4F7F\u7528\u4E86\u5B57\u7B26\u4E32\u63D2\u503C\u3002"
-              ),
-              suggestion: t(
-                "Use parameterized queries or prepared statements instead.",
-                "\u8BF7\u6539\u7528\u53C2\u6570\u5316\u67E5\u8BE2\u6216\u9884\u7F16\u8BD1\u8BED\u53E5\u3002"
-              )
-            });
-          }
+        const line = lines[i];
+        const trimmed = line.trim();
+        if (isCommentLine(trimmed)) continue;
+        const hasSqlKeyword = sqlKeywords.test(line);
+        const hasInterpolation = /\$\{[^}]+\}/.test(line) || /['"]\s*\+\s*\w+/.test(line);
+        if (hasSqlKeyword && hasInterpolation && hasQueryContext(line)) {
+          issues.push({
+            ruleId: "security/sql-injection",
+            severity: "high",
+            category: "security",
+            file: context.filePath,
+            startLine: i + 1,
+            endLine: i + 1,
+            message: t(
+              "Potential SQL injection \u2014 string interpolation in SQL query.",
+              "\u6F5C\u5728\u7684 SQL \u6CE8\u5165 \u2014 SQL \u67E5\u8BE2\u4E2D\u4F7F\u7528\u4E86\u5B57\u7B26\u4E32\u63D2\u503C\u3002"
+            ),
+            suggestion: t(
+              "Use parameterized queries or prepared statements instead.",
+              "\u8BF7\u6539\u7528\u53C2\u6570\u5316\u67E5\u8BE2\u6216\u9884\u7F16\u8BD1\u8BED\u53E5\u3002"
+            )
+          });
         }
       }
       return issues;
@@ -1429,6 +1468,23 @@ var unusedImportRule = {
   severity: "low",
   title: "Unused import",
   description: "AI-generated code often imports modules or identifiers that are never used in the file.",
+  fixable: true,
+  fix(context, issue) {
+    const lines = context.fileContent.split("\n");
+    const lineIndex = issue.startLine - 1;
+    if (lineIndex < 0 || lineIndex >= lines.length) return null;
+    const line = lines[lineIndex].trim();
+    const isSingleDefault = /^import\s+\w+\s+from\s+/.test(line);
+    const isSingleNamed = /^import\s*\{\s*\w+\s*\}\s*from\s+/.test(line);
+    const isSingleTypeNamed = /^import\s+type\s*\{\s*\w+\s*\}\s*from\s+/.test(line);
+    const isSingleTypeDefault = /^import\s+type\s+\w+\s+from\s+/.test(line);
+    if (!isSingleDefault && !isSingleNamed && !isSingleTypeNamed && !isSingleTypeDefault) {
+      return null;
+    }
+    const [start, end] = lineRange(context.fileContent, issue.startLine);
+    if (start === end) return null;
+    return { range: [start, end], text: "" };
+  },
   check(context) {
     const issues = [];
     let ast;
@@ -1666,6 +1722,33 @@ var typeCoercionRule = {
   severity: "medium",
   title: "Loose equality with type coercion",
   description: "AI-generated code often uses == instead of ===, leading to implicit type coercion bugs.",
+  fixable: true,
+  fix(context, issue) {
+    const lines = context.fileContent.split("\n");
+    const lineIndex = issue.startLine - 1;
+    if (lineIndex < 0 || lineIndex >= lines.length) return null;
+    const line = lines[lineIndex];
+    const base = lineStartOffset(context.fileContent, issue.startLine);
+    const isNotEqual = issue.message.includes("!=");
+    const searchOp = isNotEqual ? "!=" : "==";
+    const replaceOp = isNotEqual ? "!==" : "===";
+    let pos = -1;
+    for (let j = 0; j < line.length - 1; j++) {
+      if (line[j] === searchOp[0] && line[j + 1] === "=") {
+        if (line[j + 2] === "=") {
+          j += 2;
+          continue;
+        }
+        if (!isNotEqual && j > 0 && (line[j - 1] === "!" || line[j - 1] === "<" || line[j - 1] === ">")) {
+          continue;
+        }
+        pos = j;
+        break;
+      }
+    }
+    if (pos === -1) return null;
+    return { range: [base + pos, base + pos + searchOp.length], text: replaceOp };
+  },
   check(context) {
     const issues = [];
     const lines = context.fileContent.split("\n");
@@ -1920,6 +2003,12 @@ var noDebuggerRule = {
   severity: "high",
   title: "Debugger statement",
   description: "Debugger statements should never be committed to production code.",
+  fixable: true,
+  fix(context, issue) {
+    const [start, end] = lineRange(context.fileContent, issue.startLine);
+    if (start === end) return null;
+    return { range: [start, end], text: "" };
+  },
   check(context) {
     const issues = [];
     const lines = context.fileContent.split("\n");
@@ -2234,12 +2323,7 @@ var noReassignParamRule = {
         }
       }
       if (paramNames.size === 0) return;
-      let body = null;
-      if (node.type === AST_NODE_TYPES.MethodDefinition) {
-        body = node.value;
-      } else {
-        body = node;
-      }
+      const body = node.type === AST_NODE_TYPES.MethodDefinition ? node.value : node;
       if (!body || !("body" in body)) return;
       const fnBody = body.body;
       if (!fnBody) return;
@@ -2476,15 +2560,33 @@ var RuleEngine = class {
     );
   }
   run(context) {
+    return this.runWithDiagnostics(context).issues;
+  }
+  runWithDiagnostics(context) {
     const allIssues = [];
+    const ruleFailures = [];
+    let rulesExecuted = 0;
+    let rulesFailed = 0;
     for (const rule of this.rules) {
+      rulesExecuted++;
       try {
         const issues = rule.check(context);
         allIssues.push(...issues);
-      } catch (_err) {
+      } catch (err) {
+        rulesFailed++;
+        ruleFailures.push({
+          ruleId: rule.id,
+          file: context.filePath,
+          message: err instanceof Error ? err.message : "Unknown rule execution failure"
+        });
       }
     }
-    return allIssues;
+    return {
+      issues: allIssues,
+      rulesExecuted,
+      rulesFailed,
+      ruleFailures
+    };
   }
   getRules() {
     return [...this.rules];
@@ -2864,6 +2966,8 @@ var PKG_VERSION = (() => {
     return "0.1.0";
   }
 })();
+var REPORT_SCHEMA_VERSION = "1.0.0";
+var FINGERPRINT_VERSION = "1";
 var ScanEngine = class {
   config;
   diffParser;
@@ -2874,80 +2978,198 @@ var ScanEngine = class {
     this.ruleEngine = new RuleEngine(config);
   }
   async scan(options) {
-    const diffFiles = await this.getDiffFiles(options);
+    const selection = await this.getScanCandidates(options);
     const allIssues = [];
-    for (const diffFile of diffFiles) {
-      if (diffFile.status === "deleted") continue;
-      const filePath = resolve2(diffFile.filePath);
-      let fileContent;
-      try {
-        if (existsSync3(filePath)) {
-          fileContent = await readFile(filePath, "utf-8");
-        } else {
-          const content = await this.diffParser.getFileContent(diffFile.filePath);
-          if (!content) continue;
-          fileContent = content;
-        }
-      } catch {
-        continue;
-      }
-      const addedLines = diffFile.hunks.flatMap((hunk) => {
-        const lines = hunk.content.split("\n");
-        const result = [];
-        let currentLine = hunk.newStart;
-        for (const line of lines) {
-          if (line.startsWith("+")) {
-            result.push({ lineNumber: currentLine, content: line.slice(1) });
-            currentLine++;
-          } else if (line.startsWith("-")) {
-          } else {
-            currentLine++;
-          }
-        }
-        return result;
-      });
-      const issues = this.ruleEngine.run({
-        filePath: diffFile.filePath,
-        fileContent,
-        addedLines
-      });
-      allIssues.push(...issues);
-      if (this.isTsJsFile(diffFile.filePath)) {
-        const structureResult = analyzeStructure(fileContent, diffFile.filePath, {
-          maxCyclomaticComplexity: this.config.thresholds["max-cyclomatic-complexity"],
-          maxCognitiveComplexity: this.config.thresholds["max-cognitive-complexity"],
-          maxFunctionLength: this.config.thresholds["max-function-length"],
-          maxNestingDepth: this.config.thresholds["max-nesting-depth"],
-          maxParamCount: this.config.thresholds["max-params"]
-        });
-        allIssues.push(...structureResult.issues);
-        const styleResult = analyzeStyle(fileContent, diffFile.filePath);
-        allIssues.push(...styleResult.issues);
-        const coverageResult = analyzeCoverage(fileContent, diffFile.filePath);
-        allIssues.push(...coverageResult.issues);
-      }
-    }
-    const dimensions = this.groupByDimension(allIssues);
+    const scanErrors = [];
+    const ruleFailures = [];
+    let rulesExecuted = 0;
+    let rulesFailed = 0;
+    let filesScanned = 0;
+    const results = await Promise.all(
+      selection.candidates.map((diffFile) => this.scanFile(diffFile))
+    );
+    for (const result of results) {
+      allIssues.push(...result.issues);
+      ruleFailures.push(...result.ruleFailures);
+      scanErrors.push(...result.scanErrors);
+      rulesExecuted += result.rulesExecuted;
+      rulesFailed += result.rulesFailed;
+      if (result.scanned) {
+        filesScanned++;
+      }
+    }
+    const issuesWithFingerprints = this.attachFingerprints(allIssues);
+    const dimensions = this.groupByDimension(issuesWithFingerprints);
     const overallScore = calculateOverallScore(dimensions, this.config.weights);
     const grade = getGrade(overallScore);
     const commitHash = await this.diffParser.getCurrentCommitHash();
     return {
+      schemaVersion: REPORT_SCHEMA_VERSION,
       version: PKG_VERSION,
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       commit: commitHash,
+      scanMode: selection.scanMode,
       overall: {
         score: overallScore,
         grade,
-        filesScanned: diffFiles.filter((f) => f.status !== "deleted").length,
-        issuesFound: allIssues.length
+        filesScanned,
+        issuesFound: issuesWithFingerprints.length
+      },
+      toolHealth: {
+        rulesExecuted,
+        rulesFailed,
+        filesConsidered: selection.filesConsidered,
+        filesScanned,
+        filesExcluded: selection.filesExcluded,
+        filesSkipped: scanErrors.length,
+        scanErrors,
+        ruleFailures
       },
       dimensions,
-      issues: allIssues.sort((a, b) => {
+      issues: issuesWithFingerprints.sort((a, b) => {
         const severityOrder = { high: 0, medium: 1, low: 2, info: 3 };
         return severityOrder[a.severity] - severityOrder[b.severity];
       })
     };
   }
+  async scanFile(diffFile) {
+    if (diffFile.status === "deleted") {
+      return {
+        issues: [],
+        ruleFailures: [],
+        rulesExecuted: 0,
+        rulesFailed: 0,
+        scanErrors: [
+          {
+            type: "deleted-file",
+            file: diffFile.filePath,
+            message: `Skipped deleted file: ${diffFile.filePath}`
+          }
+        ],
+        scanned: false
+      };
+    }
+    if (!this.isTsJsFile(diffFile.filePath)) {
+      return {
+        issues: [],
+        ruleFailures: [],
+        rulesExecuted: 0,
+        rulesFailed: 0,
+        scanErrors: [
+          {
+            type: "unsupported-file-type",
+            file: diffFile.filePath,
+            message: `Skipped unsupported file type: ${diffFile.filePath}`
+          }
+        ],
+        scanned: false
+      };
+    }
+    const filePath = resolve2(diffFile.filePath);
+    let fileContent;
+    try {
+      fileContent = await readFile(filePath, "utf-8");
+    } catch {
+      const content = await this.diffParser.getFileContent(diffFile.filePath);
+      if (!content) {
+        return {
+          issues: [],
+          ruleFailures: [],
+          rulesExecuted: 0,
+          rulesFailed: 0,
+          scanErrors: [
+            {
+              type: "missing-file-content",
+              file: diffFile.filePath,
+              message: `Unable to read file content for ${diffFile.filePath}`
+            }
+          ],
+          scanned: false
+        };
+      }
+      fileContent = content;
+    }
+    const addedLines = diffFile.hunks.flatMap((hunk) => {
+      const lines = hunk.content.split("\n");
+      const result = [];
+      let currentLine = hunk.newStart;
+      for (const line of lines) {
+        if (line.startsWith("+")) {
+          result.push({ lineNumber: currentLine, content: line.slice(1) });
+          currentLine++;
+        } else if (line.startsWith("-")) {
+        } else {
+          currentLine++;
+        }
+      }
+      return result;
+    });
+    const ruleResult = this.ruleEngine.runWithDiagnostics({
+      filePath: diffFile.filePath,
+      fileContent,
+      addedLines
+    });
+    const issues = [...ruleResult.issues];
+    const structureResult = analyzeStructure(fileContent, diffFile.filePath, {
+      maxCyclomaticComplexity: this.config.thresholds["max-cyclomatic-complexity"],
+      maxCognitiveComplexity: this.config.thresholds["max-cognitive-complexity"],
+      maxFunctionLength: this.config.thresholds["max-function-length"],
+      maxNestingDepth: this.config.thresholds["max-nesting-depth"],
+      maxParamCount: this.config.thresholds["max-params"]
+    });
+    issues.push(...structureResult.issues);
+    const styleResult = analyzeStyle(fileContent, diffFile.filePath);
+    issues.push(...styleResult.issues);
+    const coverageResult = analyzeCoverage(fileContent, diffFile.filePath);
+    issues.push(...coverageResult.issues);
+    return {
+      issues,
+      ruleFailures: ruleResult.ruleFailures,
+      rulesExecuted: ruleResult.rulesExecuted,
+      rulesFailed: ruleResult.rulesFailed,
+      scanErrors: [],
+      scanned: true
+    };
+  }
+  async getScanCandidates(options) {
+    const scanMode = this.getScanMode(options);
+    const candidates = await this.getDiffFiles(options);
+    if (scanMode === "files") {
+      return {
+        scanMode,
+        candidates,
+        filesConsidered: options.files?.length ?? candidates.length,
+        filesExcluded: (options.files?.length ?? candidates.length) - candidates.length
+      };
+    }
+    const filteredCandidates = [];
+    let filesExcluded = 0;
+    for (const candidate of candidates) {
+      if (this.shouldIncludeFile(candidate.filePath)) {
+        filteredCandidates.push(candidate);
+      } else {
+        filesExcluded++;
+      }
+    }
+    return {
+      scanMode,
+      candidates: filteredCandidates,
+      filesConsidered: candidates.length,
+      filesExcluded
+    };
+  }
+  getScanMode(options) {
+    if (options.staged) {
+      return "staged";
+    }
+    if (options.diff) {
+      return "diff";
+    }
+    if (options.files && options.files.length > 0) {
+      return "files";
+    }
+    return "changed";
+  }
   async getDiffFiles(options) {
     if (options.staged) {
       return this.diffParser.getStagedFiles();
@@ -2956,14 +3178,10 @@ var ScanEngine = class {
       return this.diffParser.getDiffFromRef(options.diff);
     }
     if (options.files && options.files.length > 0) {
+      const includedFiles = options.files.filter((filePath) => this.shouldIncludeFile(filePath));
       return Promise.all(
-        options.files.map(async (filePath) => {
-          let content = "";
-          try {
-            content = await readFile(resolve2(filePath), "utf-8");
-          } catch {
-          }
-          return {
+        includedFiles.map(
+          (filePath) => readFile(resolve2(filePath), "utf-8").catch(() => "").then((content) => ({
             filePath,
             status: "modified",
             additions: content.split("\n").length,
@@ -2975,18 +3193,64 @@ var ScanEngine = class {
                 oldLines: 0,
                 newStart: 1,
                 newLines: content.split("\n").length,
-                content: content.split("\n").map((l) => "+" + l).join("\n")
+                content: content.split("\n").map((line) => "+" + line).join("\n")
               }
             ]
-          };
-        })
+          }))
+        )
       );
     }
     return this.diffParser.getChangedFiles();
   }
+  shouldIncludeFile(filePath) {
+    const normalizedPath = filePath.split(sep).join("/");
+    const includePatterns = this.config.include.length > 0 ? this.config.include : ["**/*"];
+    const included = includePatterns.some((pattern) => this.matchesPattern(normalizedPath, pattern));
+    if (!included) {
+      return false;
+    }
+    return !this.config.exclude.some((pattern) => this.matchesPattern(normalizedPath, pattern));
+  }
+  matchesPattern(filePath, pattern) {
+    let regexPattern = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    regexPattern = regexPattern.replace(/\*\*\//g, "::DOUBLE_DIR::");
+    regexPattern = regexPattern.replace(/\*\*/g, "::DOUBLE_STAR::");
+    regexPattern = regexPattern.replace(/\*/g, "[^/]*");
+    regexPattern = regexPattern.replace(/::DOUBLE_DIR::/g, "(?:.*/)?");
+    regexPattern = regexPattern.replace(/::DOUBLE_STAR::/g, ".*");
+    return new RegExp(`^${regexPattern}$`).test(filePath);
+  }
   isTsJsFile(filePath) {
     return /\.(ts|tsx|js|jsx|mts|mjs|cts|cjs)$/.test(filePath);
   }
+  attachFingerprints(issues) {
+    const occurrenceCounts = /* @__PURE__ */ new Map();
+    return issues.map((issue) => {
+      const normalizedFile = this.normalizeRelativePath(issue.file);
+      const locationComponent = `${issue.startLine}:${issue.endLine}`;
+      const baseKey = [
+        issue.ruleId,
+        normalizedFile,
+        issue.category,
+        issue.severity,
+        locationComponent
+      ].join("|");
+      const occurrenceIndex = occurrenceCounts.get(baseKey) ?? 0;
+      occurrenceCounts.set(baseKey, occurrenceIndex + 1);
+      const fingerprint = createHash("sha256").update(`${FINGERPRINT_VERSION}|${baseKey}|${occurrenceIndex}`).digest("hex");
+      return {
+        ...issue,
+        file: normalizedFile,
+        fingerprint,
+        fingerprintVersion: FINGERPRINT_VERSION
+      };
+    });
+  }
+  normalizeRelativePath(filePath) {
+    const absolutePath = resolve2(filePath);
+    const relativePath = relative(process.cwd(), absolutePath) || filePath;
+    return relativePath.split(sep).join("/");
+  }
   groupByDimension(issues) {
     const categories = [
       "security",
@@ -2997,7 +3261,7 @@ var ScanEngine = class {
     ];
     const grouped = {};
     for (const cat of categories) {
-      const catIssues = issues.filter((i) => i.category === cat);
+      const catIssues = issues.filter((issue) => issue.category === cat);
       grouped[cat] = calculateDimensionScore(catIssues);
     }
     return grouped;