@sphior/scan 0.1.2 → 0.1.4

package/dist/cli.js

@@ -17094,16 +17094,58 @@ function buildFixContext(f) {
     remediation_steps: remediationStepsFor(f),
     references: f.references ?? [],
     agent_instructions: agentInstructions(f),
-    data_boundary_note: DATA_BOUNDARY_NOTE
+    data_boundary_note: DATA_BOUNDARY_NOTE,
+    also: []
   };
 }
+var SEV_ORDER = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
 function buildFixContexts(findings) {
-  const order = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
-  return findings.map(buildFixContext).sort((a, b) => order[a.severity] - order[b.severity]);
+  const byLocation = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    const ctx = buildFixContext(f);
+    const key = `${ctx.location.path}:${ctx.location.start_line}:${ctx.location.end_line}`;
+    const bucket = byLocation.get(key);
+    if (bucket) bucket.push(ctx);
+    else byLocation.set(key, [ctx]);
+  }
+  const merged = [];
+  for (const group of byLocation.values()) {
+    group.sort((a, b) => SEV_ORDER[a.severity] - SEV_ORDER[b.severity]);
+    const [primary, ...rest] = group;
+    if (rest.length === 0) {
+      merged.push(primary);
+      continue;
+    }
+    const seen = new Set(primary.remediation_steps);
+    const steps = [...primary.remediation_steps];
+    for (const r of rest) {
+      for (const step of r.remediation_steps) {
+        if (seen.has(step)) continue;
+        seen.add(step);
+        steps.push(step);
+      }
+    }
+    const alsoTitles = rest.map((r) => `${r.title}${r.cwe ? ` (${r.cwe})` : ""}`).join("; ");
+    merged.push({
+      ...primary,
+      // まとめた結果を指示文にも反映する。1 箇所に複数の検出がある事実を伝えないと、
+      // エージェントは主の 1 件だけ直して残りを見落とす
+      agent_instructions: `${primary.agent_instructions} This location has ${group.length} findings \u2014 your single fix must satisfy all of them, not just the first: ${alsoTitles}.`,
+      remediation_steps: steps,
+      references: [.../* @__PURE__ */ new Set([...primary.references, ...rest.flatMap((r) => r.references)])],
+      also: rest.map((r) => ({
+        rule_id: r.rule_id,
+        severity: r.severity,
+        cwe: r.cwe,
+        title: r.title
+      }))
+    });
+  }
+  return merged.sort((a, b) => SEV_ORDER[a.severity] - SEV_ORDER[b.severity]);
 }
 
 // src/engine/cli.ts
-var SEV_ORDER = { info: 0, low: 1, medium: 2, high: 3, critical: 4 };
+var SEV_ORDER2 = { info: 0, low: 1, medium: 2, high: 3, critical: 4 };
 function parseFlags(rest) {
   const flags2 = {};
   for (let i2 = 0; i2 < rest.length; i2++) {
@@ -17128,8 +17170,8 @@ function runCli(argv, ctx = {}) {
   }
   const flags2 = parseFlags(rest);
   if (!existsSync(dir) || !statSync2(dir).isDirectory()) {
-    logErr(`error: \u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093: ${dir}`);
-    logErr("  \u8D70\u67FB\u3057\u3066\u3044\u306A\u3044\u305F\u3081\u300C\u554F\u984C\u306A\u3057\u300D\u3068\u306F\u5831\u544A\u3057\u307E\u305B\u3093\u3002\u30D1\u30B9\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002");
+    logErr(`error: directory not found: ${dir}`);
+    logErr("  Nothing was scanned, so this is not a clean result. Check the path.");
     return { exitCode: 2, error: "dir_not_found" };
   }
   const files = collectSourceFiles(dir);
@@ -17140,7 +17182,7 @@ function runCli(argv, ctx = {}) {
   if (flags2["fix-context"]) writeFile(flags2["fix-context"], canonicalJson(buildFixContexts(result.findings)));
   if (!flags2.sarif && !flags2.json && !flags2["fix-context"]) {
     if (ctx.isTty) {
-      const rows = [...result.findings].sort((a, b) => SEV_ORDER[b.severity] - SEV_ORDER[a.severity]).map((f) => ({
+      const rows = [...result.findings].sort((a, b) => SEV_ORDER2[b.severity] - SEV_ORDER2[a.severity]).map((f) => ({
         sev: f.severity,
         loc: `${f.location.path}:${f.location.start_line}`,
         text: `${f.title}${f.cwe ? ` (${f.cwe})` : ""}`
@@ -17153,7 +17195,7 @@ function runCli(argv, ctx = {}) {
     }
   }
   if (files.length === 0) {
-    logErr(`warning: ${dir} \u306B\u8D70\u67FB\u5BFE\u8C61\u306E\u30D5\u30A1\u30A4\u30EB\u304C\u3042\u308A\u307E\u305B\u3093\u3067\u3057\u305F\uFF080 \u4EF6\u8D70\u67FB\uFF09\u3002`);
+    logErr(`warning: no scannable files found in ${dir} (0 files scanned).`);
   }
   const counts = result.findings.reduce((acc, f) => {
     acc[f.severity] = (acc[f.severity] ?? 0) + 1;
@@ -17164,15 +17206,15 @@ function runCli(argv, ctx = {}) {
   );
   if (ctx.isTty && !flags2.sarif && !flags2.json && !flags2["fix-context"]) {
     logErr("");
-    logErr("  --fix-context fc.json   AI \u30A8\u30FC\u30B8\u30A7\u30F3\u30C8\u306B\u6E21\u3057\u3066\u4FEE\u6B63\u3055\u305B\u308B");
-    logErr("  --sarif out.sarif       GitHub code scanning / CI \u30C0\u30C3\u30B7\u30E5\u30DC\u30FC\u30C9\u3078");
-    logErr("  --fail-on high          \u6307\u5B9A\u4EE5\u4E0A\u306E\u91CD\u5927\u5EA6\u304C\u3042\u308C\u3070 exit 1\uFF08CI \u7528\uFF09");
+    logErr("  --fix-context fc.json   hand findings to an AI agent to fix");
+    logErr("  --sarif out.sarif       for GitHub code scanning / CI dashboards");
+    logErr("  --fail-on high          exit 1 if anything at or above this severity (CI)");
   }
   let exitCode = 0;
   const failOn = flags2["fail-on"];
-  if (failOn && SEV_ORDER[failOn] !== void 0) {
-    const threshold = SEV_ORDER[failOn];
-    if (result.findings.some((f) => SEV_ORDER[f.severity] >= threshold)) exitCode = 1;
+  if (failOn && SEV_ORDER2[failOn] !== void 0) {
+    const threshold = SEV_ORDER2[failOn];
+    if (result.findings.some((f) => SEV_ORDER2[f.severity] >= threshold)) exitCode = 1;
   }
   return { exitCode, result, sarifJson };
 }

package/dist/server.cjs

@@ -26098,7 +26098,8 @@ function buildFixContext(f) {
     remediation_steps: remediationStepsFor(f),
     references: f.references ?? [],
     agent_instructions: agentInstructions(f),
-    data_boundary_note: DATA_BOUNDARY_NOTE
+    data_boundary_note: DATA_BOUNDARY_NOTE,
+    also: []
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sphior/scan",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Deterministic source scanner — hardcoded secrets and insecure patterns (CWE) with AST/taint analysis. No AI, no network, no source upload. CLI + LSP for editors and CI.",
   "type": "module",
   "bin": {