@sphior/scan 0.1.1 → 0.1.2

package/dist/cli.js

@@ -17013,7 +17013,7 @@ function collectSourceFiles(rootDir, opts = {}) {
 }
 
 // src/engine/cli.ts
-import { writeFileSync } from "node:fs";
+import { existsSync, statSync as statSync2, writeFileSync } from "node:fs";
 
 // src/engine/mcp/fix-context.ts
 var DATA_BOUNDARY_NOTE = "SPHIOR does not transmit your source code. This payload contains only finding metadata and deterministic remediation guidance. Read the actual code from your local workspace.";
@@ -17119,27 +17119,55 @@ function parseFlags(rest) {
 function runCli(argv, ctx = {}) {
   const log = ctx.log ?? (() => {
   });
+  const logErr = ctx.logErr ?? log;
   const writeFile = ctx.writeFile ?? ((p, d) => writeFileSync(p, d));
   const [cmd, dir, ...rest] = argv;
   if (cmd !== "run" || !dir) {
-    log("usage: sphior-scan run <dir> [--sarif out.sarif] [--json out.json] [--fix-context out.json] [--fail-on high]");
+    logErr("usage: sphior-scan run <dir> [--sarif out.sarif] [--json out.json] [--fix-context out.json] [--fail-on high]");
     return { exitCode: 2, error: "bad_args" };
   }
   const flags2 = parseFlags(rest);
+  if (!existsSync(dir) || !statSync2(dir).isDirectory()) {
+    logErr(`error: \u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093: ${dir}`);
+    logErr("  \u8D70\u67FB\u3057\u3066\u3044\u306A\u3044\u305F\u3081\u300C\u554F\u984C\u306A\u3057\u300D\u3068\u306F\u5831\u544A\u3057\u307E\u305B\u3093\u3002\u30D1\u30B9\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002");
+    return { exitCode: 2, error: "dir_not_found" };
+  }
   const files = collectSourceFiles(dir);
   const result = runScan({ files });
   const sarifJson = canonicalJson(result.sarif);
   if (flags2.sarif) writeFile(flags2.sarif, sarifJson);
   if (flags2.json) writeFile(flags2.json, canonicalJson(result.findings));
   if (flags2["fix-context"]) writeFile(flags2["fix-context"], canonicalJson(buildFixContexts(result.findings)));
-  if (!flags2.sarif && !flags2.json && !flags2["fix-context"]) log(sarifJson);
+  if (!flags2.sarif && !flags2.json && !flags2["fix-context"]) {
+    if (ctx.isTty) {
+      const rows = [...result.findings].sort((a, b) => SEV_ORDER[b.severity] - SEV_ORDER[a.severity]).map((f) => ({
+        sev: f.severity,
+        loc: `${f.location.path}:${f.location.start_line}`,
+        text: `${f.title}${f.cwe ? ` (${f.cwe})` : ""}`
+      }));
+      const locW = Math.max(0, ...rows.map((r) => r.loc.length));
+      for (const r of rows) logErr(`  ${r.sev.padEnd(8)} ${r.loc.padEnd(locW)}  ${r.text}`);
+      if (rows.length > 0) logErr("");
+    } else {
+      log(sarifJson);
+    }
+  }
+  if (files.length === 0) {
+    logErr(`warning: ${dir} \u306B\u8D70\u67FB\u5BFE\u8C61\u306E\u30D5\u30A1\u30A4\u30EB\u304C\u3042\u308A\u307E\u305B\u3093\u3067\u3057\u305F\uFF080 \u4EF6\u8D70\u67FB\uFF09\u3002`);
+  }
   const counts = result.findings.reduce((acc, f) => {
     acc[f.severity] = (acc[f.severity] ?? 0) + 1;
     return acc;
   }, {});
-  log(
+  logErr(
     `SPHIOR CODE: ${result.findings.length} findings (critical=${counts.critical ?? 0} high=${counts.high ?? 0} medium=${counts.medium ?? 0} low=${counts.low ?? 0}) engine=${result.engine_version} ruleset=${result.ruleset_version}`
   );
+  if (ctx.isTty && !flags2.sarif && !flags2.json && !flags2["fix-context"]) {
+    logErr("");
+    logErr("  --fix-context fc.json   AI \u30A8\u30FC\u30B8\u30A7\u30F3\u30C8\u306B\u6E21\u3057\u3066\u4FEE\u6B63\u3055\u305B\u308B");
+    logErr("  --sarif out.sarif       GitHub code scanning / CI \u30C0\u30C3\u30B7\u30E5\u30DC\u30FC\u30C9\u3078");
+    logErr("  --fail-on high          \u6307\u5B9A\u4EE5\u4E0A\u306E\u91CD\u5927\u5EA6\u304C\u3042\u308C\u3070 exit 1\uFF08CI \u7528\uFF09");
+  }
   let exitCode = 0;
   const failOn = flags2["fail-on"];
   if (failOn && SEV_ORDER[failOn] !== void 0) {
@@ -23959,7 +23987,12 @@ async function main() {
   })));
   const res = runCli(process.argv.slice(2), {
     cwd: process.cwd(),
-    log: (m) => console.log(m)
+    log: (m) => console.log(m),
+    // データ（SARIF）
+    logErr: (m) => console.error(m),
+    // 診断（サマリ・警告・ヒント）
+    // 端末なら人が読む形、パイプ/リダイレクトなら SARIF（`| jq` を壊さない）
+    isTty: Boolean(process.stdout.isTTY)
   });
   process.exit(res.exitCode);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sphior/scan",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Deterministic source scanner — hardcoded secrets and insecure patterns (CWE) with AST/taint analysis. No AI, no network, no source upload. CLI + LSP for editors and CI.",
   "type": "module",
   "bin": {