@gulu9527/code-trust 0.2.1 → 0.3.1

package/dist/cli/index.js

@@ -120,40 +120,72 @@ detection:
 }
 
 // src/core/engine.ts
+import { createHash } from "crypto";
 import { readFile } from "fs/promises";
-import { readFileSync, existsSync as existsSync3 } from "fs";
-import { resolve as resolve2, dirname as dirname3 } from "path";
+import { readFileSync } from "fs";
+import { resolve as resolve2, dirname as dirname3, relative, sep } from "path";
 import { fileURLToPath } from "url";
 
 // src/parsers/diff.ts
 import simpleGit from "simple-git";
+var GIT_DIFF_UNIFIED = "--unified=3";
+var SHORT_HASH_LENGTH = 7;
 var DiffParser = class {
   git;
   constructor(workDir) {
     this.git = simpleGit(workDir);
   }
   async getStagedFiles() {
-    const diffDetail = await this.git.diff(["--cached", "--unified=3"]);
+    const diffDetail = await this.git.diff(["--cached", GIT_DIFF_UNIFIED]);
     return this.parseDiffOutput(diffDetail);
   }
   async getDiffFromRef(ref) {
-    const diffDetail = await this.git.diff([ref, "--unified=3"]);
+    const diffDetail = await this.git.diff([ref, GIT_DIFF_UNIFIED]);
     return this.parseDiffOutput(diffDetail);
   }
   async getChangedFiles() {
-    const diffDetail = await this.git.diff(["--unified=3"]);
-    const stagedDetail = await this.git.diff(["--cached", "--unified=3"]);
-    const allDiff = diffDetail + "\n" + stagedDetail;
-    return this.parseDiffOutput(allDiff);
+    const diffDetail = await this.git.diff([GIT_DIFF_UNIFIED]);
+    const stagedDetail = await this.git.diff(["--cached", GIT_DIFF_UNIFIED]);
+    const unstagedFiles = this.parseDiffOutput(diffDetail);
+    const stagedFiles = this.parseDiffOutput(stagedDetail);
+    return this.mergeDiffFiles(unstagedFiles, stagedFiles);
+  }
+  /**
+   * Merge two sets of diff files, deduplicating by file path.
+   * When a file appears in both, merge their hunks and combine stats.
+   */
+  mergeDiffFiles(unstaged, staged) {
+    const fileMap = /* @__PURE__ */ new Map();
+    for (const file of unstaged) {
+      fileMap.set(file.filePath, file);
+    }
+    for (const file of staged) {
+      const existing = fileMap.get(file.filePath);
+      if (existing) {
+        fileMap.set(file.filePath, {
+          ...existing,
+          // Combine additions/deletions
+          additions: existing.additions + file.additions,
+          deletions: existing.deletions + file.deletions,
+          // Merge hunks (preserve order: staged first, then unstaged)
+          hunks: [...file.hunks, ...existing.hunks],
+          // Status: if either is 'added', treat as added; otherwise keep modified
+          status: existing.status === "added" || file.status === "added" ? "added" : "modified"
+        });
+      } else {
+        fileMap.set(file.filePath, file);
+      }
+    }
+    return Array.from(fileMap.values());
   }
   async getLastCommitDiff() {
-    const diffDetail = await this.git.diff(["HEAD~1", "HEAD", "--unified=3"]);
+    const diffDetail = await this.git.diff(["HEAD~1", "HEAD", GIT_DIFF_UNIFIED]);
     return this.parseDiffOutput(diffDetail);
   }
   async getCurrentCommitHash() {
     try {
       const hash = await this.git.revparse(["HEAD"]);
-      return hash.trim().slice(0, 7);
+      return hash.trim().slice(0, SHORT_HASH_LENGTH);
     } catch {
       return void 0;
     }
@@ -589,7 +621,7 @@ function detectCodeAfterReturn(context, lines, issues) {
       }
     }
     if (/^(return|throw)\b/.test(trimmed) && !trimmed.includes("=>")) {
-      const endsOpen = /[{(\[,]$/.test(trimmed) || /^(return|throw)\s*$/.test(trimmed);
+      const endsOpen = /[[{(,]$/.test(trimmed) || /^(return|throw)\s*$/.test(trimmed);
       if (endsOpen) continue;
       lastReturnDepth = braceDepth;
       lastReturnLine = i;
@@ -780,6 +812,9 @@ function analyzeFunctionNode(node) {
 function calculateCyclomaticComplexity(root) {
   let complexity = 1;
   walkAST(root, (n) => {
+    if (n.type === AST_NODE_TYPES.FunctionDeclaration || n.type === AST_NODE_TYPES.FunctionExpression || n.type === AST_NODE_TYPES.ArrowFunctionExpression || n.type === AST_NODE_TYPES.MethodDefinition) {
+      return false;
+    }
     switch (n.type) {
       case AST_NODE_TYPES.IfStatement:
       case AST_NODE_TYPES.ConditionalExpression:
@@ -808,6 +843,9 @@ function calculateCognitiveComplexity(root) {
   const depthMap = /* @__PURE__ */ new WeakMap();
   depthMap.set(root, 0);
   walkAST(root, (n, parent) => {
+    if (n.type === AST_NODE_TYPES.FunctionDeclaration || n.type === AST_NODE_TYPES.FunctionExpression || n.type === AST_NODE_TYPES.ArrowFunctionExpression || n.type === AST_NODE_TYPES.MethodDefinition) {
+      return false;
+    }
     const parentDepth = parent ? depthMap.get(parent) ?? 0 : 0;
     const isNesting = isNestingNode(n);
     const depth = isNesting ? parentDepth + 1 : parentDepth;
@@ -826,6 +864,9 @@ function calculateMaxNestingDepth(root) {
   const depthMap = /* @__PURE__ */ new WeakMap();
   depthMap.set(root, 0);
   walkAST(root, (n, parent) => {
+    if (n.type === AST_NODE_TYPES.FunctionDeclaration || n.type === AST_NODE_TYPES.FunctionExpression || n.type === AST_NODE_TYPES.ArrowFunctionExpression || n.type === AST_NODE_TYPES.MethodDefinition) {
+      return false;
+    }
     const parentDepth = parent ? depthMap.get(parent) ?? 0 : 0;
     const isNesting = n.type === AST_NODE_TYPES.IfStatement || n.type === AST_NODE_TYPES.ForStatement || n.type === AST_NODE_TYPES.ForInStatement || n.type === AST_NODE_TYPES.ForOfStatement || n.type === AST_NODE_TYPES.WhileStatement || n.type === AST_NODE_TYPES.DoWhileStatement || n.type === AST_NODE_TYPES.SwitchStatement || n.type === AST_NODE_TYPES.TryStatement;
     const currentDepth = isNesting ? parentDepth + 1 : parentDepth;
@@ -1007,14 +1048,19 @@ function stringifyCondition(node) {
     case AST_NODE_TYPES.Literal:
       return String(node.value);
     case AST_NODE_TYPES.BinaryExpression:
+      return `${stringifyCondition(node.left)} ${node.operator} ${stringifyCondition(node.right)}`;
     case AST_NODE_TYPES.LogicalExpression:
       return `${stringifyCondition(node.left)} ${node.operator} ${stringifyCondition(node.right)}`;
     case AST_NODE_TYPES.UnaryExpression:
       return `${node.operator}${stringifyCondition(node.argument)}`;
     case AST_NODE_TYPES.MemberExpression:
       return `${stringifyCondition(node.object)}.${stringifyCondition(node.property)}`;
-    case AST_NODE_TYPES.CallExpression:
-      return `${stringifyCondition(node.callee)}(...)`;
+    case AST_NODE_TYPES.CallExpression: {
+      const args = node.arguments.map((arg) => stringifyCondition(arg)).join(", ");
+      return `${stringifyCondition(node.callee)}(${args})`;
+    }
+    case AST_NODE_TYPES.ConditionalExpression:
+      return `${stringifyCondition(node.test)} ? ${stringifyCondition(node.consequent)} : ${stringifyCondition(node.alternate)}`;
     default:
       return `[${node.type}]`;
   }
@@ -1024,6 +1070,10 @@ function truncate(s, maxLen) {
 }
 
 // src/rules/builtin/security.ts
+var isCommentLine = (trimmed) => trimmed.startsWith("//") || trimmed.startsWith("*");
+var stripQuotedStrings = (line) => line.replace(/'[^'\\]*(?:\\.[^'\\]*)*'/g, "''").replace(/"[^"\\]*(?:\\.[^"\\]*)*"/g, '""').replace(/`[^`\\]*(?:\\.[^`\\]*)*`/g, "``");
+var isPatternDefinitionLine = (line) => /\bpattern\s*:\s*\/.*\/[dgimsuvy]*/.test(line);
+var hasQueryContext = (line) => /\b(query|sql|statement|stmt)\b/i.test(line) || /\.(query|execute|run|prepare)\s*\(/i.test(line);
 var securityRules = [
   {
     id: "security/hardcoded-secret",
@@ -1036,7 +1086,7 @@ var securityRules = [
       const lines = context.fileContent.split("\n");
       const secretPatterns = [
         // API keys / tokens
-        { pattern: /(?:api[_-]?key|apikey)\s*[:=]\s*['"`][A-Za-z0-9_\-]{16,}['"`]/i, label: "API key" },
+        { pattern: /(?:api[_-]?key|apikey)\s*[:=]\s*['"`][A-Za-z0-9_-]{16,}['"`]/i, label: "API key" },
         { pattern: /(?:secret|token|password|passwd|pwd)\s*[:=]\s*['"`][^'"`]{8,}['"`]/i, label: "secret/password" },
         // AWS
         { pattern: /AKIA[0-9A-Z]{16}/, label: "AWS Access Key" },
@@ -1089,15 +1139,17 @@ var securityRules = [
       const issues = [];
       const lines = context.fileContent.split("\n");
       for (let i = 0; i < lines.length; i++) {
-        const trimmed = lines[i].trim();
-        if (trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
+        const line = lines[i];
+        const trimmed = line.trim();
+        if (isCommentLine(trimmed) || isPatternDefinitionLine(line)) continue;
+        const sanitizedLine = stripQuotedStrings(line);
         const evalPatterns = [
-          { pattern: /\beval\s*\(/, label: "eval()" },
-          { pattern: /new\s+Function\s*\(/, label: "new Function()" },
-          { pattern: /\b(setTimeout|setInterval)\s*\(\s*['"`]/, label: "setTimeout/setInterval with string" }
+          { pattern: /\beval\s*\(/, label: "eval()", source: sanitizedLine },
+          { pattern: /new\s+Function\s*\(/, label: "new Function()", source: sanitizedLine },
+          { pattern: /\b(setTimeout|setInterval)\s*\(\s*['"`]/, label: "setTimeout/setInterval with string", source: line }
         ];
-        for (const { pattern, label } of evalPatterns) {
-          if (pattern.test(lines[i])) {
+        for (const { pattern, label, source } of evalPatterns) {
+          if (pattern.test(source)) {
             issues.push({
               ruleId: "security/eval-usage",
               severity: "high",
@@ -1130,29 +1182,30 @@ var securityRules = [
     check(context) {
       const issues = [];
       const lines = context.fileContent.split("\n");
+      const sqlKeywords = /\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER)\b/i;
       for (let i = 0; i < lines.length; i++) {
-        const trimmed = lines[i].trim();
-        if (trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
-        const sqlKeywords = /\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER)\b/i;
-        if (sqlKeywords.test(lines[i])) {
-          if (/\$\{[^}]+\}/.test(lines[i]) || /['"]\s*\+\s*\w+/.test(lines[i])) {
-            issues.push({
-              ruleId: "security/sql-injection",
-              severity: "high",
-              category: "security",
-              file: context.filePath,
-              startLine: i + 1,
-              endLine: i + 1,
-              message: t(
-                "Potential SQL injection \u2014 string interpolation in SQL query.",
-                "\u6F5C\u5728\u7684 SQL \u6CE8\u5165 \u2014 SQL \u67E5\u8BE2\u4E2D\u4F7F\u7528\u4E86\u5B57\u7B26\u4E32\u63D2\u503C\u3002"
-              ),
-              suggestion: t(
-                "Use parameterized queries or prepared statements instead.",
-                "\u8BF7\u6539\u7528\u53C2\u6570\u5316\u67E5\u8BE2\u6216\u9884\u7F16\u8BD1\u8BED\u53E5\u3002"
-              )
-            });
-          }
+        const line = lines[i];
+        const trimmed = line.trim();
+        if (isCommentLine(trimmed)) continue;
+        const hasSqlKeyword = sqlKeywords.test(line);
+        const hasInterpolation = /\$\{[^}]+\}/.test(line) || /['"]\s*\+\s*\w+/.test(line);
+        if (hasSqlKeyword && hasInterpolation && hasQueryContext(line)) {
+          issues.push({
+            ruleId: "security/sql-injection",
+            severity: "high",
+            category: "security",
+            file: context.filePath,
+            startLine: i + 1,
+            endLine: i + 1,
+            message: t(
+              "Potential SQL injection \u2014 string interpolation in SQL query.",
+              "\u6F5C\u5728\u7684 SQL \u6CE8\u5165 \u2014 SQL \u67E5\u8BE2\u4E2D\u4F7F\u7528\u4E86\u5B57\u7B26\u4E32\u63D2\u503C\u3002"
+            ),
+            suggestion: t(
+              "Use parameterized queries or prepared statements instead.",
+              "\u8BF7\u6539\u7528\u53C2\u6570\u5316\u67E5\u8BE2\u6216\u9884\u7F16\u8BD1\u8BED\u53E5\u3002"
+            )
+          });
         }
       }
       return issues;
@@ -1168,9 +1221,11 @@ var securityRules = [
       const issues = [];
       const lines = context.fileContent.split("\n");
       for (let i = 0; i < lines.length; i++) {
-        const trimmed = lines[i].trim();
+        const line = lines[i];
+        const trimmed = line.trim();
         if (trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
-        if (/\.(innerHTML|outerHTML)\s*=/.test(lines[i]) || /dangerouslySetInnerHTML/.test(lines[i])) {
+        const cleaned = line.replace(/(['"`])(?:(?!\1|\\).|\\.)*\1/g, '""').replace(/\/\/.*$/, "").replace(/\/[^/]+\/[dgimsuvy]*/g, '""');
+        if (/\.(innerHTML|outerHTML)\s*=/.test(cleaned) || /dangerouslySetInnerHTML/.test(cleaned)) {
           issues.push({
             ruleId: "security/dangerous-html",
             severity: "medium",
@@ -1698,6 +1753,9 @@ var missingAwaitRule = {
       const body = getFunctionBody(node);
       if (!body) return;
       walkAST(body, (inner, parent) => {
+        if (inner.type === AST_NODE_TYPES.ArrowFunctionExpression) {
+          return;
+        }
         if (inner !== body && isAsyncFunction(inner)) return false;
         if (inner.type !== AST_NODE_TYPES.CallExpression) return;
         if (parent?.type === AST_NODE_TYPES.AwaitExpression) return;
@@ -1707,6 +1765,9 @@ var missingAwaitRule = {
         if (parent?.type === AST_NODE_TYPES.AssignmentExpression) return;
         if (parent?.type === AST_NODE_TYPES.ArrayExpression) return;
         if (parent?.type === AST_NODE_TYPES.CallExpression && parent !== inner) return;
+        if (parent?.type === AST_NODE_TYPES.ArrowFunctionExpression) {
+          return;
+        }
         const callName = getCallName(inner);
         if (!callName) return;
         if (!asyncFuncNames.has(callName)) return;
@@ -1918,9 +1979,28 @@ var typeCoercionRule = {
 var ALLOWED_NUMBERS = /* @__PURE__ */ new Set([
   -1,
   0,
+  0.1,
+  0.1,
+  0.15,
+  0.2,
+  0.2,
+  0.25,
+  0.3,
+  0.3,
+  0.5,
   1,
   2,
+  3,
+  4,
+  5,
   10,
+  15,
+  20,
+  30,
+  40,
+  50,
+  70,
+  90,
   100
 ]);
 var magicNumberRule = {
@@ -1949,6 +2029,7 @@ var magicNumberRule = {
       if (/^\s*(export\s+)?enum\s/.test(line)) continue;
       if (trimmed.startsWith("import ")) continue;
       if (/^\s*return\s+[0-9]+\s*;?\s*$/.test(line)) continue;
+      if (/^\s*['"]?[-\w]+['"]?\s*:\s*-?\d+\.?\d*(?:e[+-]?\d+)?\s*,?\s*$/.test(trimmed)) continue;
       const cleaned = line.replace(/(['"`])(?:(?!\1|\\).|\\.)*\1/g, '""').replace(/\/\/.*$/, "");
       const numRegex = /(?<![.\w])(-?\d+\.?\d*(?:e[+-]?\d+)?)\b/gi;
       let match;
@@ -2045,6 +2126,17 @@ var nestedTernaryRule = {
 // src/rules/builtin/duplicate-string.ts
 var MIN_STRING_LENGTH = 6;
 var MIN_OCCURRENCES = 3;
+var IGNORED_LITERALS = /* @__PURE__ */ new Set([
+  "high",
+  "medium",
+  "low",
+  "info",
+  "logic",
+  "security",
+  "structure",
+  "style",
+  "coverage"
+]);
 var duplicateStringRule = {
   id: "logic/duplicate-string",
   category: "logic",
@@ -2075,6 +2167,7 @@ var duplicateStringRule = {
       while ((match = stringRegex.exec(cleaned)) !== null) {
         const value = match[2];
         if (value.length < MIN_STRING_LENGTH) continue;
+        if (IGNORED_LITERALS.has(value)) continue;
         if (value.includes("${")) continue;
         if (value.startsWith("http") || value.startsWith("/")) continue;
         if (value.startsWith("test") || value.startsWith("mock")) continue;
@@ -2344,13 +2437,28 @@ var promiseVoidRule = {
       /^save/,
       /^load/,
       /^send/,
-      /^delete/,
       /^update/,
       /^create/,
       /^connect/,
       /^disconnect/,
       /^init/
     ];
+    const syncMethods = [
+      "delete",
+      // Map.delete(), Set.delete(), Object.delete() are synchronous
+      "has",
+      // Map.has(), Set.has() are synchronous
+      "get",
+      // Map.get() is synchronous
+      "set",
+      // Map.set() is synchronous (though some consider it potentially async)
+      "keys",
+      // Object.keys() is synchronous
+      "values",
+      // Object.values() is synchronous
+      "entries"
+      // Object.entries() is synchronous
+    ];
     walkAST(ast, (node) => {
       if (node.type !== AST_NODE_TYPES.ExpressionStatement) return;
       const expr = node.expression;
@@ -2361,6 +2469,7 @@ var promiseVoidRule = {
       const isKnownAsync = asyncFnNames.has(fnName);
       const matchesPattern = commonAsyncPatterns.some((p) => p.test(fnName));
       const endsWithAsync = fnName.endsWith("Async") || fnName.endsWith("async");
+      if (syncMethods.includes(fnName)) return;
       if (!isKnownAsync && !matchesPattern && !endsWithAsync) return;
       const line = node.loc?.start.line ?? 0;
       if (line === 0) return;
@@ -2436,12 +2545,7 @@ var noReassignParamRule = {
         }
       }
       if (paramNames.size === 0) return;
-      let body = null;
-      if (node.type === AST_NODE_TYPES.MethodDefinition) {
-        body = node.value;
-      } else {
-        body = node;
-      }
+      const body = node.type === AST_NODE_TYPES.MethodDefinition ? node.value : node;
       if (!body || !("body" in body)) return;
       const fnBody = body.body;
       if (!fnBody) return;
@@ -2678,15 +2782,33 @@ var RuleEngine = class {
     );
   }
   run(context) {
+    return this.runWithDiagnostics(context).issues;
+  }
+  runWithDiagnostics(context) {
     const allIssues = [];
+    const ruleFailures = [];
+    let rulesExecuted = 0;
+    let rulesFailed = 0;
     for (const rule of this.rules) {
+      rulesExecuted++;
       try {
         const issues = rule.check(context);
         allIssues.push(...issues);
-      } catch (_err) {
+      } catch (err) {
+        rulesFailed++;
+        ruleFailures.push({
+          ruleId: rule.id,
+          file: context.filePath,
+          message: err instanceof Error ? err.message : "Unknown rule execution failure"
+        });
       }
     }
-    return allIssues;
+    return {
+      issues: allIssues,
+      rulesExecuted,
+      rulesFailed,
+      ruleFailures
+    };
   }
   getRules() {
     return [...this.rules];
@@ -3066,6 +3188,8 @@ var PKG_VERSION = (() => {
     return "0.1.0";
   }
 })();
+var REPORT_SCHEMA_VERSION = "1.0.0";
+var FINGERPRINT_VERSION = "1";
 var ScanEngine = class {
   config;
   diffParser;
@@ -3076,81 +3200,191 @@ var ScanEngine = class {
     this.ruleEngine = new RuleEngine(config);
   }
   async scan(options) {
-    const diffFiles = await this.getDiffFiles(options);
+    const selection = await this.getScanCandidates(options);
     const allIssues = [];
-    for (const diffFile of diffFiles) {
-      if (diffFile.status === "deleted") continue;
-      const filePath = resolve2(diffFile.filePath);
-      let fileContent;
-      try {
-        if (existsSync3(filePath)) {
-          fileContent = await readFile(filePath, "utf-8");
-        } else {
-          const content = await this.diffParser.getFileContent(diffFile.filePath);
-          if (!content) continue;
-          fileContent = content;
-        }
-      } catch {
-        continue;
-      }
-      const addedLines = diffFile.hunks.flatMap((hunk) => {
-        const lines = hunk.content.split("\n");
-        const result = [];
-        let currentLine = hunk.newStart;
-        for (const line of lines) {
-          if (line.startsWith("+")) {
-            result.push({ lineNumber: currentLine, content: line.slice(1) });
-            currentLine++;
-          } else if (line.startsWith("-")) {
-          } else {
-            currentLine++;
-          }
-        }
-        return result;
-      });
-      const issues = this.ruleEngine.run({
-        filePath: diffFile.filePath,
-        fileContent,
-        addedLines
-      });
-      allIssues.push(...issues);
-      if (this.isTsJsFile(diffFile.filePath)) {
-        const structureResult = analyzeStructure(fileContent, diffFile.filePath, {
-          maxCyclomaticComplexity: this.config.thresholds["max-cyclomatic-complexity"],
-          maxCognitiveComplexity: this.config.thresholds["max-cognitive-complexity"],
-          maxFunctionLength: this.config.thresholds["max-function-length"],
-          maxNestingDepth: this.config.thresholds["max-nesting-depth"],
-          maxParamCount: this.config.thresholds["max-params"]
-        });
-        allIssues.push(...structureResult.issues);
-        const styleResult = analyzeStyle(fileContent, diffFile.filePath);
-        allIssues.push(...styleResult.issues);
-        const coverageResult = analyzeCoverage(fileContent, diffFile.filePath);
-        allIssues.push(...coverageResult.issues);
+    const scanErrors = [];
+    const ruleFailures = [];
+    let rulesExecuted = 0;
+    let rulesFailed = 0;
+    let filesScanned = 0;
+    const results = await Promise.all(
+      selection.candidates.map((diffFile) => this.scanFile(diffFile))
+    );
+    for (const result of results) {
+      allIssues.push(...result.issues);
+      ruleFailures.push(...result.ruleFailures);
+      scanErrors.push(...result.scanErrors);
+      rulesExecuted += result.rulesExecuted;
+      rulesFailed += result.rulesFailed;
+      if (result.scanned) {
+        filesScanned++;
       }
     }
-    const dimensions = this.groupByDimension(allIssues);
+    const issuesWithFingerprints = this.attachFingerprints(allIssues);
+    const baseline = await this.loadBaseline(options.baseline);
+    const issuesWithLifecycle = this.attachLifecycle(issuesWithFingerprints, baseline);
+    const fixedIssues = this.getFixedIssues(issuesWithLifecycle, baseline);
+    const lifecycle = this.buildLifecycleSummary(issuesWithLifecycle, fixedIssues, baseline);
+    const dimensions = this.groupByDimension(issuesWithLifecycle);
     const overallScore = calculateOverallScore(dimensions, this.config.weights);
     const grade = getGrade(overallScore);
     const commitHash = await this.diffParser.getCurrentCommitHash();
     return {
+      schemaVersion: REPORT_SCHEMA_VERSION,
       version: PKG_VERSION,
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       commit: commitHash,
+      scanMode: selection.scanMode,
       overall: {
         score: overallScore,
         grade,
-        filesScanned: diffFiles.filter((f) => f.status !== "deleted").length,
-        issuesFound: allIssues.length
+        filesScanned,
+        issuesFound: issuesWithLifecycle.length
+      },
+      toolHealth: {
+        rulesExecuted,
+        rulesFailed,
+        filesConsidered: selection.filesConsidered,
+        filesScanned,
+        filesExcluded: selection.filesExcluded,
+        filesSkipped: scanErrors.length,
+        scanErrors,
+        ruleFailures
       },
       dimensions,
-      issues: allIssues.sort((a, b) => {
+      issues: issuesWithLifecycle.sort((a, b) => {
         const severityOrder = { high: 0, medium: 1, low: 2, info: 3 };
         return severityOrder[a.severity] - severityOrder[b.severity];
-      })
+      }),
+      lifecycle,
+      fixedIssues
     };
   }
-  async getDiffFiles(options) {
+  async scanFile(diffFile) {
+    if (diffFile.status === "deleted") {
+      return this.createSkippedResult(diffFile, "deleted-file", `Skipped deleted file: ${diffFile.filePath}`);
+    }
+    if (!this.isTsJsFile(diffFile.filePath)) {
+      return this.createSkippedResult(diffFile, "unsupported-file-type", `Skipped unsupported file type: ${diffFile.filePath}`);
+    }
+    const fileContent = await this.readFileContent(diffFile);
+    if (!fileContent) {
+      return this.createErrorResult(diffFile, "missing-file-content", `Unable to read file content for ${diffFile.filePath}`);
+    }
+    const addedLines = this.extractAddedLines(diffFile);
+    const ruleResult = this.ruleEngine.runWithDiagnostics({
+      filePath: diffFile.filePath,
+      fileContent,
+      addedLines
+    });
+    const issues = [...ruleResult.issues];
+    issues.push(...this.runStructureAnalysis(fileContent, diffFile.filePath));
+    issues.push(...analyzeStyle(fileContent, diffFile.filePath).issues);
+    issues.push(...analyzeCoverage(fileContent, diffFile.filePath).issues);
+    return {
+      issues,
+      ruleFailures: ruleResult.ruleFailures,
+      rulesExecuted: ruleResult.rulesExecuted,
+      rulesFailed: ruleResult.rulesFailed,
+      scanErrors: [],
+      scanned: true
+    };
+  }
+  createSkippedResult(diffFile, type, message) {
+    return {
+      issues: [],
+      ruleFailures: [],
+      rulesExecuted: 0,
+      rulesFailed: 0,
+      scanErrors: [{ type, file: diffFile.filePath, message }],
+      scanned: false
+    };
+  }
+  createErrorResult(diffFile, type, message) {
+    return {
+      issues: [],
+      ruleFailures: [],
+      rulesExecuted: 0,
+      rulesFailed: 0,
+      scanErrors: [{ type, file: diffFile.filePath, message }],
+      scanned: false
+    };
+  }
+  async readFileContent(diffFile) {
+    const filePath = resolve2(diffFile.filePath);
+    try {
+      return await readFile(filePath, "utf-8");
+    } catch {
+      const content = await this.diffParser.getFileContent(diffFile.filePath);
+      return content ?? null;
+    }
+  }
+  extractAddedLines(diffFile) {
+    return diffFile.hunks.flatMap((hunk) => {
+      const lines = hunk.content.split("\n");
+      const result = [];
+      let currentLine = hunk.newStart;
+      for (const line of lines) {
+        if (line.startsWith("+")) {
+          result.push({ lineNumber: currentLine, content: line.slice(1) });
+          currentLine++;
+        } else if (line.startsWith("-")) {
+        } else {
+          currentLine++;
+        }
+      }
+      return result;
+    });
+  }
+  runStructureAnalysis(fileContent, filePath) {
+    return analyzeStructure(fileContent, filePath, {
+      maxCyclomaticComplexity: this.config.thresholds["max-cyclomatic-complexity"],
+      maxCognitiveComplexity: this.config.thresholds["max-cognitive-complexity"],
+      maxFunctionLength: this.config.thresholds["max-function-length"],
+      maxNestingDepth: this.config.thresholds["max-nesting-depth"],
+      maxParamCount: this.config.thresholds["max-params"]
+    }).issues;
+  }
+  async getScanCandidates(options) {
+    const scanMode = this.getScanMode(options);
+    const candidates = await this.getDiffFiles(options);
+    if (scanMode === "files") {
+      return {
+        scanMode,
+        candidates,
+        filesConsidered: options.files?.length ?? candidates.length,
+        filesExcluded: (options.files?.length ?? candidates.length) - candidates.length
+      };
+    }
+    const filteredCandidates = [];
+    let filesExcluded = 0;
+    for (const candidate of candidates) {
+      if (this.shouldIncludeFile(candidate.filePath)) {
+        filteredCandidates.push(candidate);
+      } else {
+        filesExcluded++;
+      }
+    }
+    return {
+      scanMode,
+      candidates: filteredCandidates,
+      filesConsidered: candidates.length,
+      filesExcluded
+    };
+  }
+  getScanMode(options) {
+    if (options.staged) {
+      return "staged";
+    }
+    if (options.diff) {
+      return "diff";
+    }
+    if (options.files && options.files.length > 0) {
+      return "files";
+    }
+    return "changed";
+  }
+  getDiffFiles(options) {
     if (options.staged) {
       return this.diffParser.getStagedFiles();
     }
@@ -3158,14 +3392,10 @@ var ScanEngine = class {
       return this.diffParser.getDiffFromRef(options.diff);
     }
     if (options.files && options.files.length > 0) {
+      const includedFiles = options.files.filter((filePath) => this.shouldIncludeFile(filePath));
       return Promise.all(
-        options.files.map(async (filePath) => {
-          let content = "";
-          try {
-            content = await readFile(resolve2(filePath), "utf-8");
-          } catch {
-          }
-          return {
+        includedFiles.map(
+          (filePath) => readFile(resolve2(filePath), "utf-8").catch(() => "").then((content) => ({
             filePath,
             status: "modified",
             additions: content.split("\n").length,
@@ -3177,18 +3407,154 @@ var ScanEngine = class {
                 oldLines: 0,
                 newStart: 1,
                 newLines: content.split("\n").length,
-                content: content.split("\n").map((l) => "+" + l).join("\n")
+                content: content.split("\n").map((line) => "+" + line).join("\n")
               }
             ]
-          };
-        })
+          }))
+        )
       );
     }
     return this.diffParser.getChangedFiles();
   }
+  shouldIncludeFile(filePath) {
+    const normalizedPath = filePath.split(sep).join("/");
+    const includePatterns = this.config.include.length > 0 ? this.config.include : ["**/*"];
+    const included = includePatterns.some((pattern) => this.matchesPattern(normalizedPath, pattern));
+    if (!included) {
+      return false;
+    }
+    return !this.config.exclude.some((pattern) => this.matchesPattern(normalizedPath, pattern));
+  }
+  matchesPattern(filePath, pattern) {
+    let regexPattern = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    regexPattern = regexPattern.replace(/\*\*\//g, "::DOUBLE_DIR::");
+    regexPattern = regexPattern.replace(/\*\*/g, "::DOUBLE_STAR::");
+    regexPattern = regexPattern.replace(/\*/g, "[^/]*");
+    regexPattern = regexPattern.replace(/::DOUBLE_DIR::/g, "(?:.*/)?");
+    regexPattern = regexPattern.replace(/::DOUBLE_STAR::/g, ".*");
+    return new RegExp(`^${regexPattern}$`).test(filePath);
+  }
   isTsJsFile(filePath) {
     return /\.(ts|tsx|js|jsx|mts|mjs|cts|cjs)$/.test(filePath);
   }
+  attachFingerprints(issues) {
+    const occurrenceCounts = /* @__PURE__ */ new Map();
+    return issues.map((issue) => {
+      const normalizedFile = this.normalizeRelativePath(issue.file);
+      const locationComponent = `${issue.startLine}:${issue.endLine}`;
+      const baseKey = [
+        issue.ruleId,
+        normalizedFile,
+        issue.category,
+        issue.severity,
+        locationComponent
+      ].join("|");
+      const occurrenceIndex = occurrenceCounts.get(baseKey) ?? 0;
+      occurrenceCounts.set(baseKey, occurrenceIndex + 1);
+      const fingerprint = createHash("sha256").update(`${FINGERPRINT_VERSION}|${baseKey}|${occurrenceIndex}`).digest("hex");
+      return {
+        ...issue,
+        file: normalizedFile,
+        fingerprint,
+        fingerprintVersion: FINGERPRINT_VERSION
+      };
+    });
+  }
+  normalizeRelativePath(filePath) {
+    const absolutePath = resolve2(filePath);
+    const relativePath = relative(process.cwd(), absolutePath) || filePath;
+    return relativePath.split(sep).join("/");
+  }
+  async loadBaseline(baselinePath) {
+    if (!baselinePath) {
+      return void 0;
+    }
+    const baselineContent = await readFile(resolve2(baselinePath), "utf-8");
+    const parsed = JSON.parse(baselineContent);
+    const issues = this.parseBaselineIssues(parsed.issues);
+    return {
+      issues,
+      fingerprintSet: new Set(issues.map((issue) => issue.fingerprint)),
+      commit: typeof parsed.commit === "string" ? parsed.commit : void 0,
+      timestamp: typeof parsed.timestamp === "string" ? parsed.timestamp : void 0
+    };
+  }
+  parseBaselineIssues(input) {
+    if (!Array.isArray(input)) {
+      return [];
+    }
+    return input.flatMap((item) => {
+      const issue = this.parseBaselineIssue(item);
+      return issue ? [issue] : [];
+    });
+  }
+  parseBaselineIssue(input) {
+    if (!input || typeof input !== "object") {
+      return void 0;
+    }
+    const issue = input;
+    if (!this.isValidBaselineIssue(issue)) {
+      return void 0;
+    }
+    return {
+      ruleId: issue.ruleId,
+      severity: issue.severity,
+      category: issue.category,
+      file: issue.file,
+      startLine: issue.startLine,
+      endLine: issue.endLine,
+      message: issue.message,
+      fingerprint: issue.fingerprint,
+      fingerprintVersion: typeof issue.fingerprintVersion === "string" ? issue.fingerprintVersion : void 0
+    };
+  }
+  isValidBaselineIssue(issue) {
+    return typeof issue.ruleId === "string" && this.isSeverity(issue.severity) && this.isRuleCategory(issue.category) && typeof issue.file === "string" && typeof issue.startLine === "number" && typeof issue.endLine === "number" && typeof issue.message === "string" && typeof issue.fingerprint === "string";
+  }
+  attachLifecycle(issues, baseline) {
+    if (!baseline) {
+      return issues;
+    }
+    return issues.map((issue) => ({
+      ...issue,
+      lifecycle: baseline.fingerprintSet.has(issue.fingerprint) ? "existing" : "new"
+    }));
+  }
+  getFixedIssues(issues, baseline) {
+    if (!baseline) {
+      return [];
+    }
+    const currentFingerprints = new Set(issues.map((issue) => issue.fingerprint));
+    return baseline.issues.filter((issue) => !currentFingerprints.has(issue.fingerprint));
+  }
+  buildLifecycleSummary(issues, fixedIssues, baseline) {
+    if (!baseline) {
+      return void 0;
+    }
+    let newIssues = 0;
+    let existingIssues = 0;
+    for (const issue of issues) {
+      if (issue.lifecycle === "existing") {
+        existingIssues++;
+      } else {
+        newIssues++;
+      }
+    }
+    return {
+      newIssues,
+      existingIssues,
+      fixedIssues: fixedIssues.length,
+      baselineUsed: true,
+      baselineCommit: baseline.commit,
+      baselineTimestamp: baseline.timestamp
+    };
+  }
+  isSeverity(value) {
+    return value === "high" || value === "medium" || value === "low" || value === "info";
+  }
+  isRuleCategory(value) {
+    return ["security", "logic", "structure", "style", "coverage"].includes(value);
+  }
   groupByDimension(issues) {
     const categories = [
       "security",
@@ -3199,7 +3565,7 @@ var ScanEngine = class {
     ];
     const grouped = {};
     for (const cat of categories) {
-      const catIssues = issues.filter((i) => i.category === cat);
+      const catIssues = issues.filter((issue) => issue.category === cat);
       grouped[cat] = calculateDimensionScore(catIssues);
     }
     return grouped;
@@ -3219,7 +3585,13 @@ var en = {
   issuesFound: "{{count}} issue(s) found",
   issuesHeader: "Issues ({{count}}):",
   noIssuesFound: "No issues found! \u{1F389}",
-  scanned: "Scanned {{count}} file(s)"
+  scanned: "Scanned {{count}} file(s)",
+  healthHeader: "Tool Health",
+  rulesFailed: "Failed rules: {{count}}",
+  filesSkipped: "Skipped files: {{count}}",
+  filesExcluded: "Excluded files: {{count}}",
+  lifecycleHeader: "Lifecycle",
+  lifecycleSummary: "New: {{new}}  Existing: {{existing}}  Fixed: {{fixed}}"
 };
 var zh = {
   reportTitle: "\u{1F4CA} CodeTrust \u62A5\u544A",
@@ -3231,7 +3603,13 @@ var zh = {
   issuesFound: "\u53D1\u73B0 {{count}} \u4E2A\u95EE\u9898",
   issuesHeader: "\u95EE\u9898\u5217\u8868 ({{count}}):",
   noIssuesFound: "\u672A\u53D1\u73B0\u95EE\u9898! \u{1F389}",
-  scanned: "\u626B\u63CF\u4E86 {{count}} \u4E2A\u6587\u4EF6"
+  scanned: "\u626B\u63CF\u4E86 {{count}} \u4E2A\u6587\u4EF6",
+  healthHeader: "\u5DE5\u5177\u5065\u5EB7\u5EA6",
+  rulesFailed: "\u5931\u8D25\u89C4\u5219\u6570\uFF1A{{count}}",
+  filesSkipped: "\u8DF3\u8FC7\u6587\u4EF6\u6570\uFF1A{{count}}",
+  filesExcluded: "\u6392\u9664\u6587\u4EF6\u6570\uFF1A{{count}}",
+  lifecycleHeader: "\u751F\u547D\u5468\u671F",
+  lifecycleSummary: "\u65B0\u589E\uFF1A{{new}}  \u5DF2\u5B58\u5728\uFF1A{{existing}}  \u5DF2\u4FEE\u590D\uFF1A{{fixed}}"
 };
 function renderTerminalReport(report) {
   const isZh = isZhLocale();
@@ -3273,19 +3651,37 @@ function renderTerminalReport(report) {
   };
   const dims = ["security", "logic", "structure", "style", "coverage"];
   for (const dim of dims) {
-    const d = report.dimensions[dim];
-    const dimEmoji = d.score >= 80 ? "\u2705" : d.score >= 60 ? "\u26A0\uFE0F" : "\u274C";
-    const color = getScoreColor(d.score);
-    const issueCount = d.issues.length;
+    const dimension = report.dimensions[dim];
+    const dimEmoji = dimension.score >= 80 ? "\u2705" : dimension.score >= 60 ? "\u26A0\uFE0F" : "\u274C";
+    const color = getScoreColor(dimension.score);
+    const issueCount = dimension.issues.length;
     const detail = issueCount === 0 ? pc.green(t2.noIssues) : t2.issuesFound.replace("{{count}}", String(issueCount));
     table.push([
       `${dimEmoji} ${dimLabels[dim]}`,
-      color(String(d.score)),
+      color(String(dimension.score)),
       detail
     ]);
   }
   lines.push(table.toString());
   lines.push("");
+  if (report.toolHealth.rulesFailed > 0 || report.toolHealth.filesSkipped > 0 || report.toolHealth.filesExcluded > 0) {
+    lines.push(pc.bold(t2.healthHeader));
+    if (report.toolHealth.rulesFailed > 0) {
+      lines.push(pc.yellow(`  ${t2.rulesFailed.replace("{{count}}", String(report.toolHealth.rulesFailed))}`));
+    }
+    if (report.toolHealth.filesSkipped > 0) {
+      lines.push(pc.yellow(`  ${t2.filesSkipped.replace("{{count}}", String(report.toolHealth.filesSkipped))}`));
+    }
+    if (report.toolHealth.filesExcluded > 0) {
+      lines.push(pc.dim(`  ${t2.filesExcluded.replace("{{count}}", String(report.toolHealth.filesExcluded))}`));
+    }
+    lines.push("");
+  }
+  if (report.lifecycle) {
+    lines.push(pc.bold(t2.lifecycleHeader));
+    lines.push(`  ${t2.lifecycleSummary.replace("{{new}}", String(report.lifecycle.newIssues)).replace("{{existing}}", String(report.lifecycle.existingIssues)).replace("{{fixed}}", String(report.lifecycle.fixedIssues))}`);
+    lines.push("");
+  }
   if (report.issues.length > 0) {
     lines.push(pc.bold(t2.issuesHeader.replace("{{count}}", String(report.issues.length))));
     lines.push("");
@@ -3349,12 +3745,25 @@ function getScoreColor(score) {
 
 // src/cli/output/json.ts
 function renderJsonReport(report) {
-  return JSON.stringify(report, null, 2);
+  const payload = {
+    schemaVersion: report.schemaVersion,
+    version: report.version,
+    timestamp: report.timestamp,
+    commit: report.commit,
+    scanMode: report.scanMode,
+    overall: report.overall,
+    toolHealth: report.toolHealth,
+    dimensions: report.dimensions,
+    issues: report.issues,
+    lifecycle: report.lifecycle,
+    fixedIssues: report.fixedIssues
+  };
+  return JSON.stringify(payload, null, 2);
 }
 
 // src/cli/commands/scan.ts
 function createScanCommand() {
-  const cmd = new Command("scan").description("Scan code changes for trust issues").argument("[files...]", "Specific files to scan").option("--staged", "Scan only git staged files").option("--diff <ref>", "Scan diff against a git ref (e.g. HEAD~1, origin/main)").option("--format <format>", "Output format: terminal, json", "terminal").option("--min-score <score>", "Minimum trust score threshold", "0").action(async (files, opts) => {
+  const cmd = new Command("scan").description("Run the primary live trust analysis command").argument("[files...]", "Specific files to scan").option("--staged", "Scan only git staged files").option("--diff <ref>", "Scan diff against a git ref (e.g. HEAD~1, origin/main)").option("--format <format>", "Output format: terminal, json", "terminal").option("--min-score <score>", "Minimum trust score threshold", "0").option("--baseline <path>", "Compare current findings against a prior CodeTrust JSON report").action(async (files, opts) => {
     try {
       const config = await loadConfig();
       const engine = new ScanEngine(config);
@@ -3363,7 +3772,8 @@ function createScanCommand() {
         diff: opts.diff,
         files: files.length > 0 ? files : void 0,
         format: opts.format,
-        minScore: parseInt(opts.minScore, 10)
+        minScore: parseInt(opts.minScore, 10),
+        baseline: opts.baseline
       };
       const report = await engine.scan(scanOptions);
       if (opts.format === "json") {
@@ -3389,7 +3799,7 @@ function createScanCommand() {
 // src/cli/commands/report.ts
 import { Command as Command2 } from "commander";
 function createReportCommand() {
-  const cmd = new Command2("report").description("Generate a trust report for recent changes").option("--json", "Output as JSON").option("--diff <ref>", "Diff against a git ref", "HEAD~1").action(async (opts) => {
+  const cmd = new Command2("report").description("Render a report for a diff-based scan (transitional wrapper around scan)").option("--json", "Output as JSON").option("--diff <ref>", "Diff against a git ref for report presentation", "HEAD~1").action(async (opts) => {
     try {
       const config = await loadConfig();
       const engine = new ScanEngine(config);
@@ -3413,14 +3823,14 @@ function createReportCommand() {
 
 // src/cli/commands/init.ts
 import { writeFile } from "fs/promises";
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync3 } from "fs";
 import { resolve as resolve3 } from "path";
 import { Command as Command3 } from "commander";
 import pc2 from "picocolors";
 function createInitCommand() {
   const cmd = new Command3("init").description("Initialize CodeTrust configuration file").action(async () => {
     const configPath = resolve3(".codetrust.yml");
-    if (existsSync4(configPath)) {
+    if (existsSync3(configPath)) {
       console.log(pc2.yellow("\u26A0\uFE0F  .codetrust.yml already exists. Skipping."));
       return;
     }
@@ -3494,7 +3904,7 @@ function formatSeverity2(severity) {
 
 // src/cli/commands/hook.ts
 import { writeFile as writeFile2, chmod, mkdir } from "fs/promises";
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { resolve as resolve4, join as join2 } from "path";
 import { Command as Command5 } from "commander";
 import pc4 from "picocolors";
@@ -3511,17 +3921,17 @@ function createHookCommand() {
   const cmd = new Command5("hook").description("Manage git hooks");
   cmd.command("install").description("Install pre-commit hook").action(async () => {
     const gitDir = resolve4(".git");
-    if (!existsSync5(gitDir)) {
+    if (!existsSync4(gitDir)) {
       console.error(pc4.red("Error: Not a git repository."));
       process.exit(1);
     }
     const hooksDir = join2(gitDir, "hooks");
     const hookPath = join2(hooksDir, "pre-commit");
     try {
-      if (!existsSync5(hooksDir)) {
+      if (!existsSync4(hooksDir)) {
         await mkdir(hooksDir, { recursive: true });
       }
-      if (existsSync5(hookPath)) {
+      if (existsSync4(hookPath)) {
         console.log(pc4.yellow("\u26A0\uFE0F  pre-commit hook already exists. Skipping."));
         console.log(pc4.dim("   Remove .git/hooks/pre-commit to reinstall."));
         return;