@pho9ubenaa/siro 0.5.1 → 0.6.1

package/CHANGELOG.md

@@ -1,5 +1,86 @@
 # Changelog
 
+## [0.6.1] — 2026-10-02
+
+- Add `--no-config` to skip executable repository configuration, and
+  `--strict-filesystem` / API `rejectSymlinks` to reject native input-path symlinks.
+  Defaults retain automatic config and symlink resolution; neither option is a sandbox.
+- Add finite scan/output budgets, caller overrides (`limits`, CLI `--max-*`) and
+  `DEFAULT_SCAN_LIMITS` / `ScanLimits` exports. Oversized/deep inputs now fail with
+  exit 2; output overflow exits 70 rather than producing a truncated success report.
+- Omit source excerpts from JSON/YAML/TOML syntax diagnostics. Observed finding
+  values are not secret-redacted.
+- Fix argument-limit failures when inspecting large Deno scoped import mappings.
+- Update locked transitive dependencies to brace-expansion 5.0.12, markdown-it 14.3.1
+  and fast-uri 3.1.8 for upstream security fixes.
+- Correct first-run safety examples to use `npx` without a global install.
+- Separate build/verification from OIDC staging of the verified artifact, with
+  release identity, digest and main-ancestry checks.
+
+Node requirements, direct dependency versions and decoded JSON schema 3 remain unchanged.
+
+## [0.6.0] — 2026-09-29
+
+### Breaking changes and inspection scope
+
+- Discover package.json and strict deno.json recursively by default, independently
+  of PM workspace declarations. Remove `--workspaces` / API `workspaces`, including
+  false; legacy calls receive migration errors. PM exclusions no longer hide
+  fixtures, vendor or dist. Use `exclude: ['test/fixtures', 'vendor', 'dist']`, or
+  `exclude: ['**']` to keep only cwd.
+- Add common exclusions and explicit `installationRoots` (default `['.']`). Arrays
+  replace config values; `[]` disables installation checks, not publication checks.
+  Example: `siro lint . --installation-root . --installation-root tools/standalone`.
+  Additional independent installation projects are not automatically inferred.
+- Resolve PM/version locally: root options stay at cwd, additional roots use their
+  entry/local detection, and other packages use manifest-local evidence. Unknown
+  PMs still receive generic publication checks; unknown availability is not safety.
+- JSON schema 3 adds `inspection`, required finding `directory`, and optional `pm`.
+  Generic publication findings run once per manifest without a synthetic PM.
+- Require injected `FileSystem.readDirectories`; remove `resolveDirectory`. Skip
+  directory symlinks, `.git`, node_modules and explicit exclusions before reads.
+  No implicit vendor/dist/fixture exclusions or native filesystem fallback.
+- `requireConfigKey.defaultSafety` explicitly controls safe-default downgrades;
+  omitted safety is conservative. VersionNote has no policy effect.
+- Reporter calls require scan cwd as a third argument:
+  `await reporter.format(result, io, { cwd })`. Await built-in reporters and direct
+  IO writes, which may now complete asynchronously; handle output rejections.
+  Two-argument custom reporter implementations can ignore the additional context.
+
+### Fixes
+
+- Validate consumed Deno publication metadata before applicability and check exact
+  registry pins in both inline imports and scopes. Reject unrepresentable npmrc age
+  cutoffs rather than treating any positive integer as protection.
+- Respect known pre-12 npm targets when checking npm-shrinkwrap.json; explain removed
+  or unknown-version lockfiles instead of incorrectly reporting that no file exists.
+- GitHub annotations reference the correct absolute file using the supplied scan cwd.
+  API/JSON paths and schema 3 retain their existing meaning.
+- Escape untrusted display controls and workflow markers without changing API paths
+  or parsed JSON values. Observe actual stream writes and preserve exit 70 on output
+  failure. IO may complete asynchronously; synchronous return values remain ignored.
+- Reject Promise/thenable config exports and check results without an unhandled
+  rejection overriding the configuration-error exit. Keep lint synchronous.
+- Deno empty/age-null/exclude-only objects no longer falsely satisfy release age.
+  Valid omitted ages use active local npmrc fallback, retaining zero opt-out and
+  explicit-age precedence. Leaf remedies preserve valid exclusions.
+- npm own publishConfig.provenance overrides npmrc, including false. Validate its
+  consumed boolean type; align finding/remedy with the responsible file and keep
+  both locations' old-target availability guards.
+- Preserve legal POSIX backslash and colon directory names without confusing them
+  with separators or portable user input. Reject malformed/traversing adapter names.
+- Make every remediation operation path relative to scan cwd, including multi-file
+  remedies. Findings without a responsible file remain file-less.
+- Fix Windows package verification for paths with spaces and shell metacharacters.
+- Make one-shot and locally installed usage explicit, restore rule configuration
+  examples, and update moved documentation anchors in findings and the rule reference.
+
+### Inspection limits
+
+Installation checks use local settings, not inherited effective policy. Manifest-only
+children have no provenance-policy checks, and child executable configs are not loaded.
+See [scope and migration](docs/configuration.md) and [schema 3](docs/json-output.md).
+
 ## [0.5.1]
 
 ### Refactoring

package/README.md

@@ -4,115 +4,84 @@
 [![npm](https://img.shields.io/npm/v/@pho9ubenaa/siro)](https://www.npmjs.com/package/@pho9ubenaa/siro)
 [![license](https://img.shields.io/github/license/pHo9UBenaA/siro)](https://github.com/pHo9UBenaA/siro/blob/main/LICENSE)
 
-> Security best-practices linter for the npm ecosystem — npm, pnpm, yarn, bun, deno, [aube](https://github.com/aubepkg/aube).
+A security-configuration linter for npm, pnpm, Yarn, Bun, Deno, and Aube.
+It reports supported dependency-installation and publication policy gaps, such as permissive
+lifecycle scripts, unpinned versions, and missing publication safeguards. It does not install
+packages or change your files.
 
-[Getting started](docs/getting-started.md) ·
-[Rules](docs/rules.md) ·
-[Comparison](docs/comparison.md) ·
-[Configuration](docs/configuration.md)
+| Approach                      | Primary question                              | Typical input                                |
+| ----------------------------- | --------------------------------------------- | -------------------------------------------- |
+| siro: configuration lint      | Are supported install/publish settings risky? | Repository manifests and configuration files |
+| Dependency vulnerability scan | Do dependencies match known advisories?       | Dependency inventory and vulnerability data  |
+| Dependency update automation  | Which dependencies can be updated?            | Manifests, lockfiles, and package registries |
 
-`siro` is **inspired by** the community-maintained [npm security best practices](https://github.com/bodadotsh/npm-security-best-practices)
-and turns those recommendations into something you can run: it **lints** repos for supply-chain risks,
-graded `error` / `warn` / `info`, and emits machine-readable remediation so an editor or agent skill
-can apply the fixes. The rule selection and severities reflect siro's own opinions; it is not
-affiliated with the upstream doc.
+These approaches complement one another; a clean result does not guarantee safety.
+
+## Try it
+
+Requires Node.js `^22.18.0` or `^24.0.0`. From your repository:
 
 ```sh
-npx @pho9ubenaa/siro lint                 # report best-practice violations in the current repo
-npx @pho9ubenaa/siro lint --reporter json # machine-readable remediation (see docs/json-output.md)
+npx @pho9ubenaa/siro lint
 ```
 
-## A concrete example
+siro recursively discovers package.json and strict deno.json below cwd, independently of PM
+workspace declarations. It checks local installation policy at cwd by default; add independent
+projects with `--installation-root`. Exclude intentional fixtures with `--exclude test/fixtures`.
+Discovery does not imply that every package's installation settings were inspected.
 
-For maintainers and CI owners, siro makes package-manager policy gaps visible during review. For example, change an unsafe npm script setting:
+siro detects managers from `packageManager`, lockfiles, and configuration files. If it cannot
+detect one, choose it explicitly, for example `npx @pho9ubenaa/siro lint --pm npm`.
+The CLI may download code through `npx` and imports a repository's `siro.config.*` as executable
+code by default. For an unfamiliar project, use `npx @pho9ubenaa/siro lint --no-config --strict-filesystem`
+in an isolated environment without credentials. These flags do not sandbox npx or
+extensions; see the [threat model](docs/threat-model.md).
 
-```diff
-# .npmrc
--ignore-scripts=false
-+ignore-scripts=true
-```
+## Read findings and add CI
 
-Run `siro lint --pm npm --project-type application` before and after the edit. The `disable-lifecycle-scripts` error clears when this setting is enabled; other findings remain until addressed. Review required build scripts before changing their execution policy.
-
-The CLI reads `siro.config.*` as executable code. Review repository configuration before running it, particularly in CI. See the [threat model](docs/threat-model.md) and [security reporting policy](SECURITY.md).
-
-## Features
-
-- **Rules across six managers.** 28 rules covering lifecycle scripts, version pinning, lockfiles
-  (`commit`/`frozen`), release age, publish provenance, `files`/`publishConfig`, SSL enforcement,
-  checksum verification, exotic subdependency blocking, audit suppression review, store integrity,
-  Bun's security scanner API, and Yarn 4's hardened-mode — each mapped to the right setting per
-  package manager (`.npmrc`, `pnpm-workspace.yaml`, `.yarnrc.yml`, `bunfig.toml`, `deno.json`,
-  `aube-workspace.yaml`, `package.json`).
-- **PM-aware severities.** When a manager's documented default satisfies a rule across every
-  supported version and target environment, the finding is demoted to `info`. Installed versions
-  and CI conditions are not checked, so defaults that depend on either retain the rule's severity.
-- **Machine-readable remediation.** A finding can carry automatic key operations or manual
-  instructions. Review proposed changes and rerun the linter after editing.
-  See [docs/json-output.md](docs/json-output.md).
-- **Target PM versions.** Flag settings introduced after the declared or explicit stable PM
-  version. See [checked settings and sources](docs/rules.md#checked-introduction-versions)
-  for the npm, pnpm, Yarn, Bun, and Deno coverage.
-- **Workspace members.** `--workspaces` adds publication-metadata checks for declared npm,
-  pnpm, Yarn, Bun, Deno, and Aube members, including public packages under a private root.
-  See [workspace inspection](docs/configuration.md#workspace-members) for scope and exclusions.
-- **Lint with severities.** `error` fails CI by default; `--severity warn` tightens the gate.
-- **Reporters.** `pretty` (default), `json` for CI, `github` for PR annotations; register your own.
-- **Configurable.** Drop a `siro.config.ts` to disable rules, override severities, restrict PMs,
-  or plug in custom rules and reporters.
-
-See the [rule reference](docs/rules.md) for what each check does and why, and the
-[comparison matrix](docs/comparison.md) for per-manager support at a glance.
-
-## Versioning policy
-
-siro evaluates the recorded policy snapshot in [docs/policy-sources.md](docs/policy-sources.md).
-It detects package-manager names and reads exact stable targets from `packageManager`,
-`config.pmVersions`, or `--pm-version`. It does not inspect installed binaries. The
-`unsupported-settings` rule checks recorded introduction versions; unlisted settings and
-unknown targets are not evaluated for availability. A version-dependent safe-default annotation prevents an unverified
-severity downgrade; it does not prove that the current version satisfies the rule. See
-[configuration](docs/configuration.md) for defaults, applicability, and limits.
-
-## Usage
+Findings have `error`, `warn`, or `info` severity. Exit `0` means no findings at or above the
+selected threshold; exit `1` means there are findings. Usage/configuration errors exit `2`
+without completing the check; unexpected failures exit `70`. Errors fail CI by default. siro
+suggests fixes but **does not edit files**: review changes and rerun the linter.
 
-```
-siro <lint|check> [path] [options]
-
-  --pm <npm|pnpm|yarn|bun|deno|aube>   Target a specific package manager (auto-detected; required if detection finds nothing)
-  --pm-version <x.y.z>                Exact stable target version (requires --pm)
-  --workspaces                       Also inspect workspace members' publication metadata
-  --project-type <application|package> Select application or published-package policy (default auto)
-  --reporter <pretty|json|github>      Output format (default pretty)
-  --severity <error|warn|info>         Show and fail on findings at or above this level
-  --json                               Shortcut for --reporter json
-  --version, --help
-```
-
-`check` is an alias of `lint` (same flags, same exit codes) — provided so `siro check` reads naturally in CI scripts.
+For regular use, install it with `npm install --save-dev --save-exact @pho9ubenaa/siro`
+and add a package script:
 
-Exit codes: `0` no findings at/above threshold · `1` findings at/above threshold · `2` usage or configuration error · `70` uncaught exception (a siro bug or a throwing reporter/custom rule).
+```json
+{
+  "scripts": { "lint:security": "siro lint" }
+}
+```
 
-## How is this different from `npm audit` / `osv-scanner`?
+After installing dependencies in CI, run `npm run lint:security`. A local install
+makes `siro` available to package scripts, not to every shell or Git hook.
+For exclusions and rule overrides, see the [configuration examples](docs/configuration.md).
 
-Different layer of the supply-chain pipeline; you want both.
+## Common CLI options
 
-| Tool                                                                                   | What it checks                                                                                                                               | Where the data comes from                                                                                                            |
-| -------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
-| `npm audit` · [osv-scanner](https://github.com/google/osv-scanner) · Snyk · Dependabot | **Known CVEs** in your installed dependency tree                                                                                             | GHSA / OSV.dev / vendor feeds                                                                                                        |
-| `siro`                                                                                 | **Your install pipeline's configuration** — postinstall scripts, version ranges, lockfile policy, publish provenance, files allow-list, etc. | Static analysis of `.npmrc`, `pnpm-workspace.yaml`, `.yarnrc.yml`, `bunfig.toml`, `deno.json`, `aube-workspace.yaml`, `package.json` |
+`check` is an alias for `lint`. Run `npx @pho9ubenaa/siro lint --help` for the complete CLI syntax.
 
-`npm audit` reports known vulnerabilities. `siro` reports supported configuration gaps that can increase exposure to malicious dependencies. Neither a clean result nor a cooldown window guarantees safety. Run both in CI.
+| Option                                    | Use                                                                                       |
+| ----------------------------------------- | ----------------------------------------------------------------------------------------- |
+| `--pm <npm\|pnpm\|yarn\|bun\|deno\|aube>` | Select one manager at cwd; additional installation roots retain their own targets.        |
+| `--pm-version <x.y.z>`                    | Supply an exact stable target version (requires `--pm`); it does not run an installed PM. |
+| `--project-type <application\|package>`   | Choose whether publication safeguards apply; omitted means infer from publish metadata.   |
+| `--exclude <pattern>`                     | Prune directories from recursive discovery (repeatable).                                  |
+| `--installation-root <path>`              | Replace the default cwd installation scope (repeatable; include `.` to retain cwd).       |
+| `--severity <error\|warn\|info>`          | Set both the display and CI failure threshold; default failure threshold is `error`.      |
+| `--reporter <pretty\|json\|github>`       | Choose terminal, JSON, or GitHub Actions output; `--json` is a JSON shortcut.             |
 
-## Contributing
+`--no-config` disables executable configuration; `--strict-filesystem` rejects
+symlink input paths in native data reads. Scans also have finite caller-controlled
+[file, tree, nesting, finding and output budgets](docs/configuration.md#strict-filesystem-and-scan-budgets).
+Overflow fails the check rather than silently skipping inputs.
 
-Adding a rule or a package manager is a localized change — see
-[docs/contributing.md](docs/contributing.md).
+For a walkthrough and deeper reference, use these guides:
 
-If siro is useful to you, a [GitHub Star](https://github.com/pHo9UBenaA/siro) would be appreciated.
-Stars help me decide how much time to devote to future features and maintenance.
-Please share feedback from real-world use and feature requests in
-[GitHub Issues](https://github.com/pHo9UBenaA/siro/issues).
+- [Getting started](docs/getting-started.md) walks through findings and CI; [configuration](docs/configuration.md) covers local PM/version selection, discovery and explicit installation scope, executable config, exit codes, and migration from the removed `--workspaces` flag.
+- The [rule reference](docs/rules.md) and [PM comparison](docs/comparison.md) show what is checked for each manager.
+- [JSON output](docs/json-output.md) documents the machine-readable remediation contract.
+- [Contributing](docs/contributing.md) covers development setup, the source map, and verification.
 
 ## License
 

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as SUPPORTED_NODE_RANGE, D as isNodeError, M as UsageError, O as asAbsPath, S as isSupportedNodeVersion, T as assertDirectory, _ as isProjectType, a as DEFAULT_REPORTER_NAME, b as isPM, g as PROJECT_TYPES, i as BUILTIN_REPORTER_NAMES, j as SiroError, o as JSON_REPORTER_NAME, p as loadConfig, r as lintCommand, t as nodeIO, v as PMS, w as version, x as isSeverity, y as SEVERITIES } from "./node-io-BDHg4J2w.mjs";
+import { C as isSeverity, D as asAbsPath, E as version, F as SiroError, I as UsageError, M as DEFAULT_SCAN_LIMITS, N as resolveScanLimits, S as isPM, T as SUPPORTED_NODE_RANGE, _ as PROJECT_TYPES, a as DEFAULT_REPORTER_NAME, b as PMS, i as BUILTIN_REPORTER_NAMES, j as isNodeError, k as assertDirectory, l as safeText, m as loadConfig, o as JSON_REPORTER_NAME, r as lintCommand, t as nodeIO, v as isProjectType, w as isSupportedNodeVersion, x as SEVERITIES, y as isStableVersion } from "./node-io-BpAHyeBG.mjs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";
@@ -31,18 +31,23 @@ const COMMANDS = ["lint", "check"];
 const isCommandName = (value) => COMMANDS.some((cmd) => cmd === value);
 //#endregion
 //#region src/cli/parse-args.ts
+const LIMIT_FLAGS = new Map(Object.keys(DEFAULT_SCAN_LIMITS).map((key) => [key.replace(/[A-Z]/gu, (letter) => `-${letter.toLowerCase()}`), key]));
+const REPEATABLE_FLAGS = new Set(["exclude", "installation-root"]);
 const VALUE_FLAGS = new Set([
 	"pm",
 	"pm-version",
 	"project-type",
 	"reporter",
-	"severity"
+	"severity",
+	...REPEATABLE_FLAGS,
+	...LIMIT_FLAGS.keys()
 ]);
 const BOOLEAN_FLAGS = new Set([
 	"help",
 	"version",
 	"json",
-	"workspaces"
+	"no-config",
+	"strict-filesystem"
 ]);
 const parseCommand = (argv) => {
 	const { tokens } = parseArgs({
@@ -61,6 +66,7 @@ const parseCommand = (argv) => {
 		tokens: true
 	});
 	const flags = /* @__PURE__ */ new Map();
+	const repeated = /* @__PURE__ */ new Map();
 	const positionals = [];
 	let error;
 	for (let index = 0; index < tokens.length; index += 1) {
@@ -76,7 +82,11 @@ const parseCommand = (argv) => {
 		}
 		if (BOOLEAN_FLAGS.has(token.name)) if (token.value !== void 0) error ??= `Flag ${token.rawName} does not accept a value.`;
 		else {
-			if (token.name === "json" && flags.has("json")) error ??= "--json must be specified only once.";
+			if ([
+				"json",
+				"no-config",
+				"strict-filesystem"
+			].includes(token.name) && flags.has(token.name)) error ??= `${token.rawName} must be specified only once.`;
 			flags.set(token.name, true);
 		}
 		else if (VALUE_FLAGS.has(token.name)) {
@@ -87,11 +97,12 @@ const parseCommand = (argv) => {
 				index += 1;
 			}
 			if (value === void 0 || value === "") error ??= `${token.rawName} requires a value.`;
+			else if (REPEATABLE_FLAGS.has(token.name)) repeated.set(token.name, [...repeated.get(token.name) ?? [], value]);
 			else {
 				if (flags.has(token.name)) error ??= `${token.rawName} must be specified only once.`;
 				flags.set(token.name, value);
 			}
-		} else error ??= `Unknown flag: ${token.rawName}`;
+		} else error ??= token.name === "workspaces" ? "The --workspaces flag was removed in 0.6.0; discovery is recursive by default. Use --exclude and --installation-root." : `Unknown flag: ${token.rawName}`;
 	}
 	const [command, cwd, ...extra] = positionals;
 	if (flags.has("help")) return {
@@ -113,14 +124,29 @@ const parseCommand = (argv) => {
 	if (flags.has("reporter") && flags.has("json")) throw new UsageError("Invalid reporter selection: use either --reporter or --json.");
 	const reporter = flags.get("reporter");
 	const pmVersion = flags.get("pm-version");
+	const pm = parsePmFlag(flags.get("pm"));
+	if (pmVersion !== void 0 && (!pm || !isStableVersion(pmVersion))) throw new UsageError("--pm-version requires --pm and an exact stable version.");
+	const limits = {};
+	for (const [flag, key] of LIMIT_FLAGS) {
+		const value = flags.get(flag);
+		if (value !== void 0) {
+			if (typeof value !== "string" || !/^\d+$/u.test(value)) throw new UsageError(`${flag} must be a positive safe integer.`);
+			limits[key] = Number(value);
+		}
+	}
+	resolveScanLimits(limits);
 	return {
 		kind: "lint",
 		cwd: asAbsPath(path.resolve(cwd ?? process.cwd())),
-		pm: parsePmFlag(flags.get("pm")),
+		pm,
 		pmVersion: typeof pmVersion === "string" ? pmVersion : void 0,
-		workspaces: flags.has("workspaces") || void 0,
+		exclude: repeated.get("exclude"),
+		installationRoots: repeated.get("installation-root"),
 		projectType: parseProjectTypeFlag(flags.get("project-type")),
 		severity: parseSeverityFlag(flags.get("severity")),
+		...flags.has("no-config") ? { noConfig: true } : {},
+		...flags.has("strict-filesystem") ? { rejectSymlinks: true } : {},
+		...Object.keys(limits).length ? { limits } : {},
 		reporter: typeof reporter === "string" ? reporter : flags.has("json") ? JSON_REPORTER_NAME : DEFAULT_REPORTER_NAME
 	};
 };
@@ -132,9 +158,11 @@ const PROJECT_TYPES_LIST = PROJECT_TYPES.join("|");
 const SEVERITIES_LIST = SEVERITIES.join("|");
 const FLAG_LINES = {
 	json: "  --json               Shortcut for --reporter json",
+	safety: "  --no-config          Do not probe or execute repository siro.config.*\n  --strict-filesystem  Reject symlink input paths (not a containment sandbox)",
+	limits: "  --max-file-bytes <n>  Bound each input file (default 8388608)\n  --max-total-bytes <n>  Bound all input reads (default 67108864)\n  --max-entries <n>     Bound native directory entries (default 100000)\n  --max-directories <n> Bound discovered directories (default 10000)\n  --max-directory-depth <n> Bound discovery depth (default 128)\n  --max-config-depth <n> Bound configuration nesting (default 128)\n  --max-findings <n>    Bound unfiltered findings (default 50000)\n  --max-output-bytes <n> Bound report output (default 33554432)",
 	pm: `  --pm <name>          Target a specific package manager (${PMS_LIST})`,
 	pmVersion: "  --pm-version <x.y.z>  Target an exact stable PM version (requires --pm)",
-	workspaces: "  --workspaces         Also check workspace members' publication metadata",
+	inspection: "  --exclude <pattern>  Exclude directories from recursive discovery (repeatable)\n  --installation-root <path>  Inspect local install policy here (repeatable; default .)",
 	projectType: `  --project-type <type>  Project type (${PROJECT_TYPES_LIST}; default auto)`,
 	reporter: `  --reporter <name>    Reporter (${REPORTERS_LIST}; additional reporters can be registered via siro.config.ts)`,
 	severity: `  --severity <level>   Show + fail on findings at or above this level (${SEVERITIES_LIST})`
@@ -151,18 +179,21 @@ const HELP_ROOT = [
 	"GLOBAL FLAGS",
 	FLAG_LINES.pm,
 	FLAG_LINES.pmVersion,
-	FLAG_LINES.workspaces,
+	FLAG_LINES.inspection,
 	FLAG_LINES.projectType,
 	"  --version            Print the siro version",
 	"  --help               Show help for siro or a command",
 	"",
 	"LINT FLAGS",
+	FLAG_LINES.safety,
+	FLAG_LINES.limits,
 	FLAG_LINES.reporter,
 	FLAG_LINES.json,
 	FLAG_LINES.severity,
 	"",
 	"EXAMPLES",
 	"  $ siro lint                         # report violations in cwd",
+	"  $ siro lint --no-config --strict-filesystem  # data-only inspection",
 	"  $ siro lint --reporter github       # GitHub Actions annotations",
 	"  $ siro lint --severity warn         # also fail on warnings",
 	"",
@@ -179,9 +210,11 @@ const HELP_LINT = [
 	"  siro check [path] [flags]        (alias)",
 	"",
 	"FLAGS",
+	FLAG_LINES.safety,
+	FLAG_LINES.limits,
 	FLAG_LINES.pm,
 	FLAG_LINES.pmVersion,
-	FLAG_LINES.workspaces,
+	FLAG_LINES.inspection,
 	FLAG_LINES.projectType,
 	FLAG_LINES.reporter,
 	FLAG_LINES.json,
@@ -191,10 +224,11 @@ const HELP_LINT = [
 	"  0  No findings at or above the active threshold",
 	"  1  Findings at or above the threshold (default: error)",
 	"  2  Usage error (bad flag, broken siro.config.ts, unreadable path, …)",
-	"  70 Uncaught exception (a siro bug, or a reporter / custom rule that threw)",
+	"  70 Output failure/limit, or unexpected exception (including trusted extensions)",
 	"",
 	"EXAMPLES",
 	"  $ siro lint                         # default: pretty reporter, fail on errors",
+	"  $ siro lint --no-config --strict-filesystem  # data-only inspection",
 	"  $ siro lint --reporter github       # GitHub Actions annotations",
 	"  $ siro lint --severity warn         # tighten the gate"
 ].join("\n");
@@ -208,34 +242,38 @@ const renderHelp = (target) => {
 const EXIT_SUCCESS = 0;
 const EXIT_USAGE = 2;
 const EXIT_CRASH = 70;
-const dispatch = (cmd, io) => {
+const dispatch = async (cmd, io) => {
 	switch (cmd.kind) {
 		case "version":
-			io.stdout(version);
+			await io.stdout(version);
 			return EXIT_SUCCESS;
 		case "help":
-			io.stdout(renderHelp(cmd.target));
+			await io.stdout(renderHelp(cmd.target));
 			return EXIT_SUCCESS;
 		case "usage":
-			if (cmd.reason) io.stderr(`${cmd.reason}\n`);
-			io.stderr(renderHelp());
+			if (cmd.reason) await io.stderr(`${safeText(cmd.reason)}\n`);
+			await io.stderr(renderHelp());
 			return EXIT_USAGE;
-		case "lint":
+		case "lint": {
 			assertDirectory(cmd.cwd);
-			return loadConfig(cmd.cwd).then((config) => lintCommand({
-				...cmd,
+			const { noConfig, ...options } = cmd;
+			if (noConfig) return lintCommand(options, io);
+			const config = await loadConfig(cmd.cwd);
+			return lintCommand({
+				...options,
 				config
-			}, io));
+			}, io);
+		}
 		default: throw new Error(`Unhandled command kind: ${String(cmd)}`);
 	}
 };
-const handleError = (error, io) => {
+const handleError = async (error, io) => {
 	if (error instanceof SiroError) {
-		io.stderr(error.message);
+		await io.stderr(safeText(error.message));
 		return error.exitCode;
 	}
 	if (isNodeError(error) && "errno" in error && typeof error.errno === "number") {
-		io.stderr(`File system error: ${error.message}`);
+		await io.stderr(safeText(`File system error: ${error.message}`));
 		return EXIT_USAGE;
 	}
 	throw error;
@@ -253,8 +291,10 @@ const runMain = async (argv) => {
 		process.exitCode = await run(argv);
 	} catch (error) {
 		const errStr = error instanceof Error ? error.stack ?? error.message : String(error);
-		process.stderr.write(`${errStr}\n`);
 		process.exitCode = EXIT_CRASH;
+		try {
+			await nodeIO.stderr(safeText(errStr));
+		} catch {}
 	}
 };
 const [, invokedPath] = process.argv;