@sphior/scan 0.1.0 → 0.1.2

package/README.md

@@ -1,10 +1,11 @@
 # @sphior/scan
 
-Deterministic security scanner for source code — **secrets**, **insecure patterns (CWE)** and
-**vulnerable dependencies** — with no AI and no source upload.
+Deterministic security scanner for source code — **hardcoded secrets** and
+**insecure patterns (CWE)** — with no AI, no network and no source upload.
 
-Detection is 100% deterministic (regex + entropy + AST/taint analysis + OSV lookups), so the
-same code always produces the same findings. Your source never leaves the machine it runs on.
+Detection is 100% deterministic (regex + entropy + AST/taint analysis), so the same code always
+produces the same findings. The scan makes no network requests at all: your source never leaves
+the machine it runs on, and it works offline.
 
 ```bash
 npx @sphior/scan run ./src
@@ -61,7 +62,10 @@ which is what you want in CI.
 |---|---|
 | Hardcoded secrets | Provider-specific patterns + entropy analysis. Well-known documentation placeholders are excluded, so example keys don't create noise. |
 | Insecure patterns (CWE) | AST-based, including taint tracking from untrusted sources to dangerous sinks (SQL injection, XSS, command injection and similar). |
-| Vulnerable dependencies | Lockfile parsing across ecosystems, resolved against the OSV database. |
+
+Dependency (SCA) scanning is **not** part of this CLI. The engine accepts SCA input, but the
+`run` command only analyses source files. Dependency vulnerabilities are surfaced by SPHIOR CODE
+on GitHub, which resolves lockfiles against the OSV database.
 
 Findings carry a rule id, severity, CWE where applicable, and the exact file and line.
 
@@ -79,10 +83,8 @@ analysed locally — nothing is sent anywhere.
 
 ## Privacy
 
-The scanner reads your files and reports what it found. It does not upload source code,
-does not call a language model, and does not require an account. Dependency checks send
-package names and versions (never source) to the OSV database to look up known
-vulnerabilities.
+The scanner reads your files and reports what it found. It makes no network requests: no source
+upload, no telemetry, no language model, no account. It runs correctly with networking disabled.
 
 ## Links
 

package/dist/cli.js

@@ -17013,7 +17013,7 @@ function collectSourceFiles(rootDir, opts = {}) {
 }
 
 // src/engine/cli.ts
-import { writeFileSync } from "node:fs";
+import { existsSync, statSync as statSync2, writeFileSync } from "node:fs";
 
 // src/engine/mcp/fix-context.ts
 var DATA_BOUNDARY_NOTE = "SPHIOR does not transmit your source code. This payload contains only finding metadata and deterministic remediation guidance. Read the actual code from your local workspace.";
@@ -17119,27 +17119,55 @@ function parseFlags(rest) {
 function runCli(argv, ctx = {}) {
   const log = ctx.log ?? (() => {
   });
+  const logErr = ctx.logErr ?? log;
   const writeFile = ctx.writeFile ?? ((p, d) => writeFileSync(p, d));
   const [cmd, dir, ...rest] = argv;
   if (cmd !== "run" || !dir) {
-    log("usage: sphior-scan run <dir> [--sarif out.sarif] [--json out.json] [--fix-context out.json] [--fail-on high]");
+    logErr("usage: sphior-scan run <dir> [--sarif out.sarif] [--json out.json] [--fix-context out.json] [--fail-on high]");
     return { exitCode: 2, error: "bad_args" };
   }
   const flags2 = parseFlags(rest);
+  if (!existsSync(dir) || !statSync2(dir).isDirectory()) {
+    logErr(`error: \u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093: ${dir}`);
+    logErr("  \u8D70\u67FB\u3057\u3066\u3044\u306A\u3044\u305F\u3081\u300C\u554F\u984C\u306A\u3057\u300D\u3068\u306F\u5831\u544A\u3057\u307E\u305B\u3093\u3002\u30D1\u30B9\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002");
+    return { exitCode: 2, error: "dir_not_found" };
+  }
   const files = collectSourceFiles(dir);
   const result = runScan({ files });
   const sarifJson = canonicalJson(result.sarif);
   if (flags2.sarif) writeFile(flags2.sarif, sarifJson);
   if (flags2.json) writeFile(flags2.json, canonicalJson(result.findings));
   if (flags2["fix-context"]) writeFile(flags2["fix-context"], canonicalJson(buildFixContexts(result.findings)));
-  if (!flags2.sarif && !flags2.json && !flags2["fix-context"]) log(sarifJson);
+  if (!flags2.sarif && !flags2.json && !flags2["fix-context"]) {
+    if (ctx.isTty) {
+      const rows = [...result.findings].sort((a, b) => SEV_ORDER[b.severity] - SEV_ORDER[a.severity]).map((f) => ({
+        sev: f.severity,
+        loc: `${f.location.path}:${f.location.start_line}`,
+        text: `${f.title}${f.cwe ? ` (${f.cwe})` : ""}`
+      }));
+      const locW = Math.max(0, ...rows.map((r) => r.loc.length));
+      for (const r of rows) logErr(`  ${r.sev.padEnd(8)} ${r.loc.padEnd(locW)}  ${r.text}`);
+      if (rows.length > 0) logErr("");
+    } else {
+      log(sarifJson);
+    }
+  }
+  if (files.length === 0) {
+    logErr(`warning: ${dir} \u306B\u8D70\u67FB\u5BFE\u8C61\u306E\u30D5\u30A1\u30A4\u30EB\u304C\u3042\u308A\u307E\u305B\u3093\u3067\u3057\u305F\uFF080 \u4EF6\u8D70\u67FB\uFF09\u3002`);
+  }
   const counts = result.findings.reduce((acc, f) => {
     acc[f.severity] = (acc[f.severity] ?? 0) + 1;
     return acc;
   }, {});
-  log(
+  logErr(
     `SPHIOR CODE: ${result.findings.length} findings (critical=${counts.critical ?? 0} high=${counts.high ?? 0} medium=${counts.medium ?? 0} low=${counts.low ?? 0}) engine=${result.engine_version} ruleset=${result.ruleset_version}`
   );
+  if (ctx.isTty && !flags2.sarif && !flags2.json && !flags2["fix-context"]) {
+    logErr("");
+    logErr("  --fix-context fc.json   AI \u30A8\u30FC\u30B8\u30A7\u30F3\u30C8\u306B\u6E21\u3057\u3066\u4FEE\u6B63\u3055\u305B\u308B");
+    logErr("  --sarif out.sarif       GitHub code scanning / CI \u30C0\u30C3\u30B7\u30E5\u30DC\u30FC\u30C9\u3078");
+    logErr("  --fail-on high          \u6307\u5B9A\u4EE5\u4E0A\u306E\u91CD\u5927\u5EA6\u304C\u3042\u308C\u3070 exit 1\uFF08CI \u7528\uFF09");
+  }
   let exitCode = 0;
   const failOn = flags2["fail-on"];
   if (failOn && SEV_ORDER[failOn] !== void 0) {
@@ -23959,7 +23987,12 @@ async function main() {
   })));
   const res = runCli(process.argv.slice(2), {
     cwd: process.cwd(),
-    log: (m) => console.log(m)
+    log: (m) => console.log(m),
+    // データ（SARIF）
+    logErr: (m) => console.error(m),
+    // 診断（サマリ・警告・ヒント）
+    // 端末なら人が読む形、パイプ/リダイレクトなら SARIF（`| jq` を壊さない）
+    isTty: Boolean(process.stdout.isTTY)
   });
   process.exit(res.exitCode);
 }

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@sphior/scan",
-  "version": "0.1.0",
-  "description": "SPHIOR CODE deterministic scan engine — secrets + insecure-pattern (CWE) + SCA detection with tamper-evident evidence. One engine shared by CLI, LSP (VS Code / JetBrains) and CI.",
+  "version": "0.1.2",
+  "description": "Deterministic source scanner — hardcoded secrets and insecure patterns (CWE) with AST/taint analysis. No AI, no network, no source upload. CLI + LSP for editors and CI.",
   "type": "module",
   "bin": {
-    "sphior-scan": "./dist/cli.js"
+    "sphior-scan": "dist/cli.js"
   },
   "files": [
     "dist",
@@ -12,7 +12,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "https://github.com/Toraastrta/Sphior.git",
+    "url": "git+https://github.com/Toraastrta/Sphior.git",
     "directory": "ige-web/packages/sphior-scan"
   },
   "homepage": "https://sphior.com/code",