@sphior/scan 0.1.2 → 0.1.3

package/dist/cli.js

@@ -17094,16 +17094,58 @@ function buildFixContext(f) {
     remediation_steps: remediationStepsFor(f),
     references: f.references ?? [],
     agent_instructions: agentInstructions(f),
-    data_boundary_note: DATA_BOUNDARY_NOTE
+    data_boundary_note: DATA_BOUNDARY_NOTE,
+    also: []
   };
 }
+var SEV_ORDER = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
 function buildFixContexts(findings) {
-  const order = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
-  return findings.map(buildFixContext).sort((a, b) => order[a.severity] - order[b.severity]);
+  const byLocation = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    const ctx = buildFixContext(f);
+    const key = `${ctx.location.path}:${ctx.location.start_line}:${ctx.location.end_line}`;
+    const bucket = byLocation.get(key);
+    if (bucket) bucket.push(ctx);
+    else byLocation.set(key, [ctx]);
+  }
+  const merged = [];
+  for (const group of byLocation.values()) {
+    group.sort((a, b) => SEV_ORDER[a.severity] - SEV_ORDER[b.severity]);
+    const [primary, ...rest] = group;
+    if (rest.length === 0) {
+      merged.push(primary);
+      continue;
+    }
+    const seen = new Set(primary.remediation_steps);
+    const steps = [...primary.remediation_steps];
+    for (const r of rest) {
+      for (const step of r.remediation_steps) {
+        if (seen.has(step)) continue;
+        seen.add(step);
+        steps.push(step);
+      }
+    }
+    const alsoTitles = rest.map((r) => `${r.title}${r.cwe ? ` (${r.cwe})` : ""}`).join("; ");
+    merged.push({
+      ...primary,
+      // まとめた結果を指示文にも反映する。1 箇所に複数の検出がある事実を伝えないと、
+      // エージェントは主の 1 件だけ直して残りを見落とす
+      agent_instructions: `${primary.agent_instructions} This location has ${group.length} findings \u2014 your single fix must satisfy all of them, not just the first: ${alsoTitles}.`,
+      remediation_steps: steps,
+      references: [.../* @__PURE__ */ new Set([...primary.references, ...rest.flatMap((r) => r.references)])],
+      also: rest.map((r) => ({
+        rule_id: r.rule_id,
+        severity: r.severity,
+        cwe: r.cwe,
+        title: r.title
+      }))
+    });
+  }
+  return merged.sort((a, b) => SEV_ORDER[a.severity] - SEV_ORDER[b.severity]);
 }
 
 // src/engine/cli.ts
-var SEV_ORDER = { info: 0, low: 1, medium: 2, high: 3, critical: 4 };
+var SEV_ORDER2 = { info: 0, low: 1, medium: 2, high: 3, critical: 4 };
 function parseFlags(rest) {
   const flags2 = {};
   for (let i2 = 0; i2 < rest.length; i2++) {
@@ -17140,7 +17182,7 @@ function runCli(argv, ctx = {}) {
   if (flags2["fix-context"]) writeFile(flags2["fix-context"], canonicalJson(buildFixContexts(result.findings)));
   if (!flags2.sarif && !flags2.json && !flags2["fix-context"]) {
     if (ctx.isTty) {
-      const rows = [...result.findings].sort((a, b) => SEV_ORDER[b.severity] - SEV_ORDER[a.severity]).map((f) => ({
+      const rows = [...result.findings].sort((a, b) => SEV_ORDER2[b.severity] - SEV_ORDER2[a.severity]).map((f) => ({
         sev: f.severity,
         loc: `${f.location.path}:${f.location.start_line}`,
         text: `${f.title}${f.cwe ? ` (${f.cwe})` : ""}`
@@ -17170,9 +17212,9 @@ function runCli(argv, ctx = {}) {
   }
   let exitCode = 0;
   const failOn = flags2["fail-on"];
-  if (failOn && SEV_ORDER[failOn] !== void 0) {
-    const threshold = SEV_ORDER[failOn];
-    if (result.findings.some((f) => SEV_ORDER[f.severity] >= threshold)) exitCode = 1;
+  if (failOn && SEV_ORDER2[failOn] !== void 0) {
+    const threshold = SEV_ORDER2[failOn];
+    if (result.findings.some((f) => SEV_ORDER2[f.severity] >= threshold)) exitCode = 1;
   }
   return { exitCode, result, sarifJson };
 }

package/dist/server.cjs

@@ -26098,7 +26098,8 @@ function buildFixContext(f) {
     remediation_steps: remediationStepsFor(f),
     references: f.references ?? [],
     agent_instructions: agentInstructions(f),
-    data_boundary_note: DATA_BOUNDARY_NOTE
+    data_boundary_note: DATA_BOUNDARY_NOTE,
+    also: []
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sphior/scan",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Deterministic source scanner — hardcoded secrets and insecure patterns (CWE) with AST/taint analysis. No AI, no network, no source upload. CLI + LSP for editors and CI.",
   "type": "module",
   "bin": {