@sphior/scan 0.1.1 → 0.1.3

package/dist/cli.js

@@ -17013,7 +17013,7 @@ function collectSourceFiles(rootDir, opts = {}) {
 }
 
 // src/engine/cli.ts
-import { writeFileSync } from "node:fs";
+import { existsSync, statSync as statSync2, writeFileSync } from "node:fs";
 
 // src/engine/mcp/fix-context.ts
 var DATA_BOUNDARY_NOTE = "SPHIOR does not transmit your source code. This payload contains only finding metadata and deterministic remediation guidance. Read the actual code from your local workspace.";
@@ -17094,16 +17094,58 @@ function buildFixContext(f) {
     remediation_steps: remediationStepsFor(f),
     references: f.references ?? [],
     agent_instructions: agentInstructions(f),
-    data_boundary_note: DATA_BOUNDARY_NOTE
+    data_boundary_note: DATA_BOUNDARY_NOTE,
+    also: []
   };
 }
+var SEV_ORDER = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
 function buildFixContexts(findings) {
-  const order = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
-  return findings.map(buildFixContext).sort((a, b) => order[a.severity] - order[b.severity]);
+  const byLocation = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    const ctx = buildFixContext(f);
+    const key = `${ctx.location.path}:${ctx.location.start_line}:${ctx.location.end_line}`;
+    const bucket = byLocation.get(key);
+    if (bucket) bucket.push(ctx);
+    else byLocation.set(key, [ctx]);
+  }
+  const merged = [];
+  for (const group of byLocation.values()) {
+    group.sort((a, b) => SEV_ORDER[a.severity] - SEV_ORDER[b.severity]);
+    const [primary, ...rest] = group;
+    if (rest.length === 0) {
+      merged.push(primary);
+      continue;
+    }
+    const seen = new Set(primary.remediation_steps);
+    const steps = [...primary.remediation_steps];
+    for (const r of rest) {
+      for (const step of r.remediation_steps) {
+        if (seen.has(step)) continue;
+        seen.add(step);
+        steps.push(step);
+      }
+    }
+    const alsoTitles = rest.map((r) => `${r.title}${r.cwe ? ` (${r.cwe})` : ""}`).join("; ");
+    merged.push({
+      ...primary,
+      // まとめた結果を指示文にも反映する。1 箇所に複数の検出がある事実を伝えないと、
+      // エージェントは主の 1 件だけ直して残りを見落とす
+      agent_instructions: `${primary.agent_instructions} This location has ${group.length} findings \u2014 your single fix must satisfy all of them, not just the first: ${alsoTitles}.`,
+      remediation_steps: steps,
+      references: [.../* @__PURE__ */ new Set([...primary.references, ...rest.flatMap((r) => r.references)])],
+      also: rest.map((r) => ({
+        rule_id: r.rule_id,
+        severity: r.severity,
+        cwe: r.cwe,
+        title: r.title
+      }))
+    });
+  }
+  return merged.sort((a, b) => SEV_ORDER[a.severity] - SEV_ORDER[b.severity]);
 }
 
 // src/engine/cli.ts
-var SEV_ORDER = { info: 0, low: 1, medium: 2, high: 3, critical: 4 };
+var SEV_ORDER2 = { info: 0, low: 1, medium: 2, high: 3, critical: 4 };
 function parseFlags(rest) {
   const flags2 = {};
   for (let i2 = 0; i2 < rest.length; i2++) {
@@ -17119,32 +17161,60 @@ function parseFlags(rest) {
 function runCli(argv, ctx = {}) {
   const log = ctx.log ?? (() => {
   });
+  const logErr = ctx.logErr ?? log;
   const writeFile = ctx.writeFile ?? ((p, d) => writeFileSync(p, d));
   const [cmd, dir, ...rest] = argv;
   if (cmd !== "run" || !dir) {
-    log("usage: sphior-scan run <dir> [--sarif out.sarif] [--json out.json] [--fix-context out.json] [--fail-on high]");
+    logErr("usage: sphior-scan run <dir> [--sarif out.sarif] [--json out.json] [--fix-context out.json] [--fail-on high]");
     return { exitCode: 2, error: "bad_args" };
   }
   const flags2 = parseFlags(rest);
+  if (!existsSync(dir) || !statSync2(dir).isDirectory()) {
+    logErr(`error: \u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093: ${dir}`);
+    logErr("  \u8D70\u67FB\u3057\u3066\u3044\u306A\u3044\u305F\u3081\u300C\u554F\u984C\u306A\u3057\u300D\u3068\u306F\u5831\u544A\u3057\u307E\u305B\u3093\u3002\u30D1\u30B9\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002");
+    return { exitCode: 2, error: "dir_not_found" };
+  }
   const files = collectSourceFiles(dir);
   const result = runScan({ files });
   const sarifJson = canonicalJson(result.sarif);
   if (flags2.sarif) writeFile(flags2.sarif, sarifJson);
   if (flags2.json) writeFile(flags2.json, canonicalJson(result.findings));
   if (flags2["fix-context"]) writeFile(flags2["fix-context"], canonicalJson(buildFixContexts(result.findings)));
-  if (!flags2.sarif && !flags2.json && !flags2["fix-context"]) log(sarifJson);
+  if (!flags2.sarif && !flags2.json && !flags2["fix-context"]) {
+    if (ctx.isTty) {
+      const rows = [...result.findings].sort((a, b) => SEV_ORDER2[b.severity] - SEV_ORDER2[a.severity]).map((f) => ({
+        sev: f.severity,
+        loc: `${f.location.path}:${f.location.start_line}`,
+        text: `${f.title}${f.cwe ? ` (${f.cwe})` : ""}`
+      }));
+      const locW = Math.max(0, ...rows.map((r) => r.loc.length));
+      for (const r of rows) logErr(`  ${r.sev.padEnd(8)} ${r.loc.padEnd(locW)}  ${r.text}`);
+      if (rows.length > 0) logErr("");
+    } else {
+      log(sarifJson);
+    }
+  }
+  if (files.length === 0) {
+    logErr(`warning: ${dir} \u306B\u8D70\u67FB\u5BFE\u8C61\u306E\u30D5\u30A1\u30A4\u30EB\u304C\u3042\u308A\u307E\u305B\u3093\u3067\u3057\u305F\uFF080 \u4EF6\u8D70\u67FB\uFF09\u3002`);
+  }
   const counts = result.findings.reduce((acc, f) => {
     acc[f.severity] = (acc[f.severity] ?? 0) + 1;
     return acc;
   }, {});
-  log(
+  logErr(
     `SPHIOR CODE: ${result.findings.length} findings (critical=${counts.critical ?? 0} high=${counts.high ?? 0} medium=${counts.medium ?? 0} low=${counts.low ?? 0}) engine=${result.engine_version} ruleset=${result.ruleset_version}`
   );
+  if (ctx.isTty && !flags2.sarif && !flags2.json && !flags2["fix-context"]) {
+    logErr("");
+    logErr("  --fix-context fc.json   AI \u30A8\u30FC\u30B8\u30A7\u30F3\u30C8\u306B\u6E21\u3057\u3066\u4FEE\u6B63\u3055\u305B\u308B");
+    logErr("  --sarif out.sarif       GitHub code scanning / CI \u30C0\u30C3\u30B7\u30E5\u30DC\u30FC\u30C9\u3078");
+    logErr("  --fail-on high          \u6307\u5B9A\u4EE5\u4E0A\u306E\u91CD\u5927\u5EA6\u304C\u3042\u308C\u3070 exit 1\uFF08CI \u7528\uFF09");
+  }
   let exitCode = 0;
   const failOn = flags2["fail-on"];
-  if (failOn && SEV_ORDER[failOn] !== void 0) {
-    const threshold = SEV_ORDER[failOn];
-    if (result.findings.some((f) => SEV_ORDER[f.severity] >= threshold)) exitCode = 1;
+  if (failOn && SEV_ORDER2[failOn] !== void 0) {
+    const threshold = SEV_ORDER2[failOn];
+    if (result.findings.some((f) => SEV_ORDER2[f.severity] >= threshold)) exitCode = 1;
   }
   return { exitCode, result, sarifJson };
 }
@@ -23959,7 +24029,12 @@ async function main() {
   })));
   const res = runCli(process.argv.slice(2), {
     cwd: process.cwd(),
-    log: (m) => console.log(m)
+    log: (m) => console.log(m),
+    // データ（SARIF）
+    logErr: (m) => console.error(m),
+    // 診断（サマリ・警告・ヒント）
+    // 端末なら人が読む形、パイプ/リダイレクトなら SARIF（`| jq` を壊さない）
+    isTty: Boolean(process.stdout.isTTY)
   });
   process.exit(res.exitCode);
 }

package/dist/server.cjs

@@ -26098,7 +26098,8 @@ function buildFixContext(f) {
     remediation_steps: remediationStepsFor(f),
     references: f.references ?? [],
     agent_instructions: agentInstructions(f),
-    data_boundary_note: DATA_BOUNDARY_NOTE
+    data_boundary_note: DATA_BOUNDARY_NOTE,
+    also: []
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sphior/scan",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Deterministic source scanner — hardcoded secrets and insecure patterns (CWE) with AST/taint analysis. No AI, no network, no source upload. CLI + LSP for editors and CI.",
   "type": "module",
   "bin": {