@sphior/scan 0.1.5 → 0.1.6

package/dist/cli.js

@@ -14650,6 +14650,30 @@ function shannonEntropy(s) {
   }
   return h;
 }
+var PLACEHOLDER_MARKERS = [
+  "your",
+  "here",
+  "example",
+  "sample",
+  "placeholder",
+  "dummy",
+  "changeme",
+  "change_me",
+  "hardcoded",
+  "redacted",
+  "insert",
+  "replace",
+  "todo",
+  "fixme",
+  "xxxx",
+  "...",
+  "<",
+  ">"
+];
+function looksLikePlaceholder(s) {
+  const lower = s.toLowerCase();
+  return PLACEHOLDER_MARKERS.some((m) => lower.includes(m));
+}
 function looksHighEntropy(s, minLen = 16, minEntropy = 3.5) {
   if (s.length < minLen) return false;
   if (!/^[A-Za-z0-9+/=_\-.]+$/.test(s)) return false;
@@ -14796,7 +14820,20 @@ var SECRET_RULES = [
     provider: "PEM",
     title: "Private Key",
     severity: "critical",
-    pattern: /(-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----)/g,
+    // PEM ヘッダ**単体**では鍵ではない。実測（自社リポジトリ 1 回の走査）で
+    // secret.private_key は 6 件すべて誤検知だった:
+    //   - 日本語コメント中の「-----BEGIN RSA PRIVATE KEY----- で配布される」という説明
+    //   - `.replace(/-----BEGIN PRIVATE KEY-----/g, '')` という除去コード
+    //   - `const PEM = "-----BEGIN RSA PRIVATE KEY-----"` 等のテストベクタ（本体なし）
+    //   - ヘッダ + `btoa(...)` のようにコードで本体を作る箇所
+    // severity=critical のルールが 6/6 外れると、本物（この走査で実際に見つかった
+    // 本番 Stripe キー等）が埋まる。そこで「ヘッダの直後に base64 の鍵本体が続く」
+    // ことを先読みで要求する。
+    //
+    // 先読み（キャプチャしない）にしてある点が重要: group 1 はヘッダのままなので
+    // snippet_hash と fingerprint が変わらず、既存の真検出の delta 追跡が途切れない。
+    // 区切りは実鍵の書かれ方に合わせる — 生改行・`\n` のエスケープ列・引用符・カンマ。
+    pattern: /(-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----)(?=(?:\s|\\+[nrt]|["'`,;+]){0,40}[A-Za-z0-9+/]{40,})/g,
     group: 1,
     references: REF_CWE798
   },
@@ -15053,7 +15090,7 @@ function detectSecrets(path, text, opts = {}) {
       const g = rule.group ?? 0;
       const secret = m[g];
       if (!secret) continue;
-      if (PLACEHOLDER_SECRETS.has(secret)) continue;
+      if (PLACEHOLDER_SECRETS.has(secret) || looksLikePlaceholder(secret)) continue;
       const absStart = m.index + m[0].indexOf(secret);
       push(build(path, rule, secret, absStart, starts, false));
       if (re.lastIndex === m.index) re.lastIndex++;
@@ -15064,7 +15101,7 @@ function detectSecrets(path, text, opts = {}) {
     let m;
     while ((m = re.exec(text)) !== null) {
       const secret = m[1];
-      if (!secret || PLACEHOLDER_SECRETS.has(secret)) continue;
+      if (!secret || PLACEHOLDER_SECRETS.has(secret) || looksLikePlaceholder(secret)) continue;
       if (!looksHighEntropy(secret)) continue;
       const absStart = m.index + m[0].lastIndexOf(secret);
       push(build(path, GENERIC_ASSIGNMENT, secret, absStart, starts, true));
@@ -16460,6 +16497,7 @@ var SOURCE_CALL_SUFFIXES = [
   "formData.get",
   "urlParams.get"
 ];
+var TAINT_WRAPPER_CTORS = /* @__PURE__ */ new Set(["URLSearchParams", "URL"]);
 var SCOPE_TYPES = /* @__PURE__ */ new Set([
   "FunctionDeclaration",
   "FunctionExpression",
@@ -16517,6 +16555,11 @@ function exprIsTainted(node, tainted) {
       return exprIsTainted(node.left, tainted) || exprIsTainted(node.right, tainted);
     case "ConditionalExpression":
       return exprIsTainted(node.consequent, tainted) || exprIsTainted(node.alternate, tainted);
+    case "NewExpression": {
+      const ctor = calleeName(node);
+      if (!ctor || !TAINT_WRAPPER_CTORS.has(ctor)) return false;
+      return (node.arguments ?? []).some((a) => exprIsTainted(a, tainted));
+    }
     case "ParenthesizedExpression":
     case "TSAsExpression":
     case "TSNonNullExpression":
@@ -16775,6 +16818,11 @@ function inLineComment(text, lineStart, matchIndex, isPython) {
   const quotes = (upto.match(/["'`]/g) ?? []).length;
   return quotes % 2 === 0;
 }
+function isBlockCommentLine(text, lineStart) {
+  const lineEnd = text.indexOf("\n", lineStart);
+  const line = text.slice(lineStart, lineEnd < 0 ? text.length : lineEnd).trimStart();
+  return line.startsWith("/*") || /^\*(\s|\/|$)/.test(line);
+}
 function detectPatterns(path, text, opts = {}) {
   if (opts.ignorePaths?.some((re) => re.test(path))) return [];
   const ext = extOf(path);
@@ -16818,7 +16866,7 @@ function detectPatterns(path, text, opts = {}) {
     while ((m = re.exec(text)) !== null) {
       const idx = m.index;
       const pos = toPos2(starts, idx);
-      if (inLineComment(text, pos.lineStart, idx, isPython)) {
+      if (inLineComment(text, pos.lineStart, idx, isPython) || isBlockCommentLine(text, pos.lineStart)) {
         if (re.lastIndex === idx) re.lastIndex++;
         continue;
       }
@@ -16914,7 +16962,160 @@ function scaToCanonical(input) {
 
 // src/engine/version.ts
 var ENGINE_VERSION = "0.1.0";
-var RULESET_VERSION = "2026.07.12-22";
+var RULESET_VERSION = "2026.10.20-23";
+
+// src/engine/suppress.ts
+var EMPTY_CONFIG = { excludes: [], scoped: [], problems: [] };
+var SPHIORIGNORE_FILE = ".sphiorignore";
+function escapeRe(s) {
+  return s.replace(/[.+^$(){}|[\]\\]/g, "\\$&");
+}
+function globToRegExp(glob) {
+  let out2 = "";
+  for (let i2 = 0; i2 < glob.length; i2++) {
+    const c = glob[i2];
+    if (c === "*") {
+      if (glob[i2 + 1] === "*") {
+        if (glob[i2 + 2] === "/") {
+          out2 += "(?:[^/]+/)*";
+          i2 += 2;
+        } else {
+          out2 += ".*";
+          i2 += 1;
+        }
+      } else {
+        out2 += "[^/]*";
+      }
+      continue;
+    }
+    if (c === "?") {
+      out2 += "[^/]";
+      continue;
+    }
+    out2 += escapeRe(c);
+  }
+  return new RegExp(`^${out2}$`);
+}
+function globMatches(glob, relPath) {
+  const g = glob.endsWith("/") ? `${glob.slice(0, -1)}` : glob;
+  if (globToRegExp(g).test(relPath)) return true;
+  return globToRegExp(`${g}/**`).test(relPath);
+}
+function ruleMatches(pattern, ruleId) {
+  if (pattern.endsWith("*")) return ruleId.startsWith(pattern.slice(0, -1));
+  return pattern === ruleId;
+}
+function looksLikeRuleId(tok) {
+  return /^[A-Za-z][A-Za-z0-9_.-]*\*?$/.test(tok) && !tok.includes("/");
+}
+function parseSphiorignore(text) {
+  const excludes = [];
+  const scoped = [];
+  const problems = [];
+  const lines = text.split(/\r?\n/);
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const lineNo = i2 + 1;
+    if (!raw.trim() || raw.trim().startsWith("#")) continue;
+    const hashAt = raw.indexOf("#");
+    const body2 = (hashAt >= 0 ? raw.slice(0, hashAt) : raw).trim();
+    const justification = hashAt >= 0 ? raw.slice(hashAt + 1).trim() || void 0 : void 0;
+    if (!body2) continue;
+    const tokens = body2.split(/\s+/);
+    if (tokens.length > 2) {
+      problems.push({ line: lineNo, text: body2, reason: "expected `<glob> [rule_id]` (too many fields)" });
+      continue;
+    }
+    const [glob, ruleId] = tokens;
+    if (glob.startsWith("/")) {
+      problems.push({ line: lineNo, text: body2, reason: "paths are relative to the scan root \u2014 drop the leading `/`" });
+      continue;
+    }
+    if (ruleId !== void 0 && !looksLikeRuleId(ruleId)) {
+      problems.push({ line: lineNo, text: body2, reason: `not a rule id: ${ruleId}` });
+      continue;
+    }
+    const entry = { line: lineNo, glob, ruleId, justification };
+    (ruleId === void 0 ? excludes : scoped).push(entry);
+  }
+  return { excludes, scoped, problems };
+}
+function makePathExcluder(cfg) {
+  if (cfg.excludes.length === 0) return () => false;
+  return (relPath) => cfg.excludes.some((e) => globMatches(e.glob, relPath));
+}
+function configSuppressionFor(cfg, path, ruleId) {
+  return cfg.scoped.find((e) => e.ruleId && ruleMatches(e.ruleId, ruleId) && globMatches(e.glob, path));
+}
+var INLINE_RE = /sphior-ignore(-next-line)?(?:[ \t]+([A-Za-z][A-Za-z0-9_.-]*\*?))?(?:[ \t]*:[ \t]*(.*))?$/;
+function parseInlineSuppression(lineText) {
+  const m = INLINE_RE.exec(lineText);
+  if (!m) return void 0;
+  return {
+    nextLine: m[1] === "-next-line",
+    ruleId: m[2],
+    justification: m[3]?.trim() || void 0
+  };
+}
+function inlineSuppressionFor(lines, startLine, ruleId) {
+  const own = lines[startLine - 1] !== void 0 ? parseInlineSuppression(lines[startLine - 1]) : void 0;
+  if (own && !own.nextLine && (!own.ruleId || ruleMatches(own.ruleId, ruleId))) return own;
+  const prev = startLine >= 2 && lines[startLine - 2] !== void 0 ? parseInlineSuppression(lines[startLine - 2]) : void 0;
+  if (prev && prev.nextLine && (!prev.ruleId || ruleMatches(prev.ruleId, ruleId))) return prev;
+  return void 0;
+}
+function applySuppressions(findings, input = {}) {
+  const cfg = input.config;
+  const hasConfig = !!cfg && cfg.scoped.length > 0;
+  const hasText = !!input.textByPath && input.textByPath.size > 0;
+  if (!hasConfig && !hasText) return { active: findings, suppressed: [] };
+  const linesCache = /* @__PURE__ */ new Map();
+  const linesOf = (path) => {
+    const cached = linesCache.get(path);
+    if (cached) return cached;
+    const text = input.textByPath?.get(path);
+    if (text === void 0) return void 0;
+    const lines = text.split(/\r?\n/);
+    linesCache.set(path, lines);
+    return lines;
+  };
+  const active = [];
+  const suppressed = [];
+  for (const f of findings) {
+    const byConfig = hasConfig ? configSuppressionFor(cfg, f.location.path, f.rule_id) : void 0;
+    if (byConfig) {
+      suppressed.push({
+        ...f,
+        suppression: {
+          by: "config",
+          rule_scoped: true,
+          justification: byConfig.justification,
+          source: `${SPHIORIGNORE_FILE}:${byConfig.line}`
+        }
+      });
+      continue;
+    }
+    const lines = linesOf(f.location.path);
+    const byInline = lines ? inlineSuppressionFor(lines, f.location.start_line, f.rule_id) : void 0;
+    if (byInline) {
+      suppressed.push({
+        ...f,
+        suppression: {
+          by: "inline",
+          rule_scoped: !!byInline.ruleId,
+          justification: byInline.justification,
+          source: `${f.location.path}:${byInline.nextLine ? f.location.start_line - 1 : f.location.start_line}`
+        }
+      });
+      continue;
+    }
+    active.push(f);
+  }
+  return { active, suppressed };
+}
+function countWithoutJustification(suppressed) {
+  return suppressed.reduce((n, f) => f.suppression && !f.suppression.justification ? n + 1 : n, 0);
+}
 
 // src/engine/run.ts
 var kindOrder = {
@@ -16926,43 +17127,79 @@ var kindOrder = {
 function runScan(input) {
   const files = input.files ?? [];
   const opts = { allowFingerprints: input.allowFingerprints, ignorePaths: input.ignorePaths };
-  const findings = [
+  const detected = [
     ...detectSecretsInFiles(files, opts),
     ...detectPatternsInFiles(files, opts),
     ...scaToCanonical(input.sca ?? [])
   ];
-  findings.sort((a, b) => {
+  detected.sort((a, b) => {
     if (a.location.path !== b.location.path) return a.location.path < b.location.path ? -1 : 1;
     if (a.location.start_line !== b.location.start_line) return a.location.start_line - b.location.start_line;
     if (a.location.start_col !== b.location.start_col) return a.location.start_col - b.location.start_col;
     if (kindOrder[a.kind] !== kindOrder[b.kind]) return kindOrder[a.kind] - kindOrder[b.kind];
     return a.rule_id < b.rule_id ? -1 : a.rule_id > b.rule_id ? 1 : 0;
   });
+  const { active: findings, suppressed } = applySuppressions(detected, {
+    config: input.suppress,
+    textByPath: new Map(files.map((f) => [f.path, f.text]))
+  });
   const sarif = toSarif(findings, { engineVersion: ENGINE_VERSION, rulesetVersion: RULESET_VERSION });
-  return { findings, sarif, engine_version: ENGINE_VERSION, ruleset_version: RULESET_VERSION };
+  return { findings, suppressed, sarif, engine_version: ENGINE_VERSION, ruleset_version: RULESET_VERSION };
 }
 
 // src/engine/collect.ts
 import { readdirSync, statSync, readFileSync } from "node:fs";
 import { join, relative, sep } from "node:path";
 var IGNORE_DIRS = /* @__PURE__ */ new Set([
+  // VCS
   ".git",
+  ".hg",
+  ".svn",
+  // JS/TS の依存と出力
   "node_modules",
+  "bower_components",
+  ".yarn",
+  ".pnp",
+  ".pnpm-store",
   "dist",
   "build",
-  ".next",
   "out",
   "coverage",
-  "vendor",
+  ".cache",
+  ".turbo",
+  ".swc",
+  ".parcel-cache",
+  // フレームワーク/デプロイのビルド出力
+  ".next",
+  ".open-next",
+  ".vercel",
+  ".wrangler",
+  ".serverless",
+  ".sst",
+  ".svelte-kit",
+  ".nuxt",
+  ".output",
+  ".astro",
+  ".docusaurus",
+  // Python
   ".venv",
   "venv",
   "__pycache__",
+  ".mypy_cache",
+  ".pytest_cache",
+  ".ruff_cache",
+  ".tox",
+  ".nox",
+  ".eggs",
+  // JVM / その他言語
   "target",
-  ".turbo",
-  ".cache",
-  ".yarn",
-  ".pnp",
-  "bower_components"
+  ".gradle",
+  "vendor",
+  "Pods",
+  ".dart_tool",
+  ".pub-cache",
+  // IaC のプロバイダバイナリ（`.tf` 本体は配下に無いので検査対象は失わない）
+  ".terraform"
 ]);
 function toPosix(p) {
   return sep === "/" ? p : p.split(sep).join("/");
@@ -16993,9 +17230,11 @@ function collectSourceFiles(rootDir, opts = {}) {
       }
       if (st.isDirectory()) {
         if (ignore.has(name2)) continue;
+        if (opts.exclude?.(toPosix(relative(rootDir, full)))) continue;
         walk2(full);
       } else if (st.isFile()) {
         if (st.size > maxBytes) continue;
+        if (opts.exclude?.(toPosix(relative(rootDir, full)))) continue;
         let buf;
         try {
           buf = readFileSync(full);
@@ -17011,6 +17250,13 @@ function collectSourceFiles(rootDir, opts = {}) {
   files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
   return files;
 }
+function readSphiorignore(rootDir) {
+  try {
+    return parseSphiorignore(readFileSync(join(rootDir, SPHIORIGNORE_FILE), "utf8"));
+  } catch {
+    return EMPTY_CONFIG;
+  }
+}
 
 // src/engine/cli.ts
 import { existsSync, statSync as statSync2, writeFileSync } from "node:fs";
@@ -17165,7 +17411,7 @@ function runCli(argv, ctx = {}) {
   const writeFile = ctx.writeFile ?? ((p, d) => writeFileSync(p, d));
   const [cmd, dir, ...rest] = argv;
   if (cmd !== "run" || !dir) {
-    logErr("usage: sphior-scan run <dir> [--sarif out.sarif] [--json out.json] [--fix-context out.json] [--fail-on high]");
+    logErr("usage: sphior-scan run <dir> [--sarif out.sarif] [--json out.json] [--fix-context out.json] [--suppressed out.json] [--fail-on high] [--no-ignore-file]");
     return { exitCode: 2, error: "bad_args" };
   }
   const flags2 = parseFlags(rest);
@@ -17174,11 +17420,23 @@ function runCli(argv, ctx = {}) {
     logErr("  Nothing was scanned, so this is not a clean result. Check the path.");
     return { exitCode: 2, error: "dir_not_found" };
   }
-  const files = collectSourceFiles(dir);
-  const result = runScan({ files });
+  const ignoreCfg = flags2["no-ignore-file"] ? EMPTY_CONFIG : readSphiorignore(dir);
+  const isExcluded = makePathExcluder(ignoreCfg);
+  let excludedCount = 0;
+  const exclude = (relPath) => {
+    if (!isExcluded(relPath)) return false;
+    excludedCount++;
+    return true;
+  };
+  for (const p of ignoreCfg.problems) {
+    logErr(`warning: ${SPHIORIGNORE_FILE}:${p.line}: ${p.reason} \u2014 ignored this line (\u201C${p.text}\u201D)`);
+  }
+  const files = collectSourceFiles(dir, { exclude });
+  const result = runScan({ files, suppress: ignoreCfg });
   const sarifJson = canonicalJson(result.sarif);
   if (flags2.sarif) writeFile(flags2.sarif, sarifJson);
   if (flags2.json) writeFile(flags2.json, canonicalJson(result.findings));
+  if (flags2.suppressed) writeFile(flags2.suppressed, canonicalJson(result.suppressed));
   if (flags2["fix-context"]) writeFile(flags2["fix-context"], canonicalJson(buildFixContexts(result.findings)));
   if (!flags2.sarif && !flags2.json && !flags2["fix-context"]) {
     if (ctx.isTty) {
@@ -17201,14 +17459,20 @@ function runCli(argv, ctx = {}) {
     acc[f.severity] = (acc[f.severity] ?? 0) + 1;
     return acc;
   }, {});
+  const scope = (excludedCount > 0 ? ` ${excludedCount} files excluded` : "") + (result.suppressed.length > 0 ? `${excludedCount > 0 ? "," : ""} ${result.suppressed.length} suppressed` : "");
   logErr(
-    `SPHIOR CODE: ${result.findings.length} findings (critical=${counts.critical ?? 0} high=${counts.high ?? 0} medium=${counts.medium ?? 0} low=${counts.low ?? 0}) engine=${result.engine_version} ruleset=${result.ruleset_version}`
+    `SPHIOR CODE: ${result.findings.length} findings (critical=${counts.critical ?? 0} high=${counts.high ?? 0} medium=${counts.medium ?? 0} low=${counts.low ?? 0}) ${files.length} files scanned${scope ? ` \u2022${scope}` : ""} engine=${result.engine_version} ruleset=${result.ruleset_version}`
   );
+  const unexplained = countWithoutJustification(result.suppressed);
+  if (unexplained > 0) {
+    logErr(`  note: ${unexplained} of the suppressions carry no reason. Add \`: why\` so an auditor can read it later.`);
+  }
   if (ctx.isTty && !flags2.sarif && !flags2.json && !flags2["fix-context"]) {
     logErr("");
     logErr("  --fix-context fc.json   hand findings to an AI agent to fix");
     logErr("  --sarif out.sarif       for GitHub code scanning / CI dashboards");
     logErr("  --fail-on high          exit 1 if anything at or above this severity (CI)");
+    logErr(`  ${SPHIORIGNORE_FILE}            exclude paths, or accept a rule with a reason`);
   }
   let exitCode = 0;
   const failOn = flags2["fail-on"];

package/dist/server.cjs

@@ -23727,6 +23727,30 @@ function shannonEntropy(s) {
   }
   return h;
 }
+var PLACEHOLDER_MARKERS = [
+  "your",
+  "here",
+  "example",
+  "sample",
+  "placeholder",
+  "dummy",
+  "changeme",
+  "change_me",
+  "hardcoded",
+  "redacted",
+  "insert",
+  "replace",
+  "todo",
+  "fixme",
+  "xxxx",
+  "...",
+  "<",
+  ">"
+];
+function looksLikePlaceholder(s) {
+  const lower = s.toLowerCase();
+  return PLACEHOLDER_MARKERS.some((m) => lower.includes(m));
+}
 function looksHighEntropy(s, minLen = 16, minEntropy = 3.5) {
   if (s.length < minLen) return false;
   if (!/^[A-Za-z0-9+/=_\-.]+$/.test(s)) return false;
@@ -23873,7 +23897,20 @@ var SECRET_RULES = [
     provider: "PEM",
     title: "Private Key",
     severity: "critical",
-    pattern: /(-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----)/g,
+    // PEM ヘッダ**単体**では鍵ではない。実測（自社リポジトリ 1 回の走査）で
+    // secret.private_key は 6 件すべて誤検知だった:
+    //   - 日本語コメント中の「-----BEGIN RSA PRIVATE KEY----- で配布される」という説明
+    //   - `.replace(/-----BEGIN PRIVATE KEY-----/g, '')` という除去コード
+    //   - `const PEM = "-----BEGIN RSA PRIVATE KEY-----"` 等のテストベクタ（本体なし）
+    //   - ヘッダ + `btoa(...)` のようにコードで本体を作る箇所
+    // severity=critical のルールが 6/6 外れると、本物（この走査で実際に見つかった
+    // 本番 Stripe キー等）が埋まる。そこで「ヘッダの直後に base64 の鍵本体が続く」
+    // ことを先読みで要求する。
+    //
+    // 先読み（キャプチャしない）にしてある点が重要: group 1 はヘッダのままなので
+    // snippet_hash と fingerprint が変わらず、既存の真検出の delta 追跡が途切れない。
+    // 区切りは実鍵の書かれ方に合わせる — 生改行・`\n` のエスケープ列・引用符・カンマ。
+    pattern: /(-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----)(?=(?:\s|\\+[nrt]|["'`,;+]){0,40}[A-Za-z0-9+/]{40,})/g,
     group: 1,
     references: REF_CWE798
   },
@@ -24130,7 +24167,7 @@ function detectSecrets(path, text, opts = {}) {
       const g = rule.group ?? 0;
       const secret = m[g];
       if (!secret) continue;
-      if (PLACEHOLDER_SECRETS.has(secret)) continue;
+      if (PLACEHOLDER_SECRETS.has(secret) || looksLikePlaceholder(secret)) continue;
       const absStart = m.index + m[0].indexOf(secret);
       push(build(path, rule, secret, absStart, starts, false));
       if (re.lastIndex === m.index) re.lastIndex++;
@@ -24141,7 +24178,7 @@ function detectSecrets(path, text, opts = {}) {
     let m;
     while ((m = re.exec(text)) !== null) {
       const secret = m[1];
-      if (!secret || PLACEHOLDER_SECRETS.has(secret)) continue;
+      if (!secret || PLACEHOLDER_SECRETS.has(secret) || looksLikePlaceholder(secret)) continue;
       if (!looksHighEntropy(secret)) continue;
       const absStart = m.index + m[0].lastIndexOf(secret);
       push(build(path, GENERIC_ASSIGNMENT, secret, absStart, starts, true));
@@ -25537,6 +25574,7 @@ var SOURCE_CALL_SUFFIXES = [
   "formData.get",
   "urlParams.get"
 ];
+var TAINT_WRAPPER_CTORS = /* @__PURE__ */ new Set(["URLSearchParams", "URL"]);
 var SCOPE_TYPES = /* @__PURE__ */ new Set([
   "FunctionDeclaration",
   "FunctionExpression",
@@ -25594,6 +25632,11 @@ function exprIsTainted(node, tainted) {
       return exprIsTainted(node.left, tainted) || exprIsTainted(node.right, tainted);
     case "ConditionalExpression":
       return exprIsTainted(node.consequent, tainted) || exprIsTainted(node.alternate, tainted);
+    case "NewExpression": {
+      const ctor = calleeName(node);
+      if (!ctor || !TAINT_WRAPPER_CTORS.has(ctor)) return false;
+      return (node.arguments ?? []).some((a) => exprIsTainted(a, tainted));
+    }
     case "ParenthesizedExpression":
     case "TSAsExpression":
     case "TSNonNullExpression":
@@ -25852,6 +25895,11 @@ function inLineComment(text, lineStart, matchIndex, isPython) {
   const quotes = (upto.match(/["'`]/g) ?? []).length;
   return quotes % 2 === 0;
 }
+function isBlockCommentLine(text, lineStart) {
+  const lineEnd = text.indexOf("\n", lineStart);
+  const line = text.slice(lineStart, lineEnd < 0 ? text.length : lineEnd).trimStart();
+  return line.startsWith("/*") || /^\*(\s|\/|$)/.test(line);
+}
 function detectPatterns(path, text, opts = {}) {
   if (opts.ignorePaths?.some((re) => re.test(path))) return [];
   const ext = extOf(path);
@@ -25895,7 +25943,7 @@ function detectPatterns(path, text, opts = {}) {
     while ((m = re.exec(text)) !== null) {
       const idx = m.index;
       const pos = toPos2(starts, idx);
-      if (inLineComment(text, pos.lineStart, idx, isPython)) {
+      if (inLineComment(text, pos.lineStart, idx, isPython) || isBlockCommentLine(text, pos.lineStart)) {
         if (re.lastIndex === idx) re.lastIndex++;
         continue;
       }
@@ -25991,7 +26039,117 @@ function scaToCanonical(input) {
 
 // src/engine/version.ts
 var ENGINE_VERSION = "0.1.0";
-var RULESET_VERSION = "2026.07.12-22";
+var RULESET_VERSION = "2026.10.20-23";
+
+// src/engine/suppress.ts
+var SPHIORIGNORE_FILE = ".sphiorignore";
+function escapeRe(s) {
+  return s.replace(/[.+^$(){}|[\]\\]/g, "\\$&");
+}
+function globToRegExp(glob) {
+  let out2 = "";
+  for (let i2 = 0; i2 < glob.length; i2++) {
+    const c = glob[i2];
+    if (c === "*") {
+      if (glob[i2 + 1] === "*") {
+        if (glob[i2 + 2] === "/") {
+          out2 += "(?:[^/]+/)*";
+          i2 += 2;
+        } else {
+          out2 += ".*";
+          i2 += 1;
+        }
+      } else {
+        out2 += "[^/]*";
+      }
+      continue;
+    }
+    if (c === "?") {
+      out2 += "[^/]";
+      continue;
+    }
+    out2 += escapeRe(c);
+  }
+  return new RegExp(`^${out2}$`);
+}
+function globMatches(glob, relPath) {
+  const g = glob.endsWith("/") ? `${glob.slice(0, -1)}` : glob;
+  if (globToRegExp(g).test(relPath)) return true;
+  return globToRegExp(`${g}/**`).test(relPath);
+}
+function ruleMatches(pattern, ruleId) {
+  if (pattern.endsWith("*")) return ruleId.startsWith(pattern.slice(0, -1));
+  return pattern === ruleId;
+}
+function configSuppressionFor(cfg, path, ruleId) {
+  return cfg.scoped.find((e) => e.ruleId && ruleMatches(e.ruleId, ruleId) && globMatches(e.glob, path));
+}
+var INLINE_RE = /sphior-ignore(-next-line)?(?:[ \t]+([A-Za-z][A-Za-z0-9_.-]*\*?))?(?:[ \t]*:[ \t]*(.*))?$/;
+function parseInlineSuppression(lineText) {
+  const m = INLINE_RE.exec(lineText);
+  if (!m) return void 0;
+  return {
+    nextLine: m[1] === "-next-line",
+    ruleId: m[2],
+    justification: m[3]?.trim() || void 0
+  };
+}
+function inlineSuppressionFor(lines, startLine, ruleId) {
+  const own = lines[startLine - 1] !== void 0 ? parseInlineSuppression(lines[startLine - 1]) : void 0;
+  if (own && !own.nextLine && (!own.ruleId || ruleMatches(own.ruleId, ruleId))) return own;
+  const prev = startLine >= 2 && lines[startLine - 2] !== void 0 ? parseInlineSuppression(lines[startLine - 2]) : void 0;
+  if (prev && prev.nextLine && (!prev.ruleId || ruleMatches(prev.ruleId, ruleId))) return prev;
+  return void 0;
+}
+function applySuppressions(findings, input = {}) {
+  const cfg = input.config;
+  const hasConfig = !!cfg && cfg.scoped.length > 0;
+  const hasText = !!input.textByPath && input.textByPath.size > 0;
+  if (!hasConfig && !hasText) return { active: findings, suppressed: [] };
+  const linesCache = /* @__PURE__ */ new Map();
+  const linesOf = (path) => {
+    const cached = linesCache.get(path);
+    if (cached) return cached;
+    const text = input.textByPath?.get(path);
+    if (text === void 0) return void 0;
+    const lines = text.split(/\r?\n/);
+    linesCache.set(path, lines);
+    return lines;
+  };
+  const active = [];
+  const suppressed = [];
+  for (const f of findings) {
+    const byConfig = hasConfig ? configSuppressionFor(cfg, f.location.path, f.rule_id) : void 0;
+    if (byConfig) {
+      suppressed.push({
+        ...f,
+        suppression: {
+          by: "config",
+          rule_scoped: true,
+          justification: byConfig.justification,
+          source: `${SPHIORIGNORE_FILE}:${byConfig.line}`
+        }
+      });
+      continue;
+    }
+    const lines = linesOf(f.location.path);
+    const byInline = lines ? inlineSuppressionFor(lines, f.location.start_line, f.rule_id) : void 0;
+    if (byInline) {
+      suppressed.push({
+        ...f,
+        suppression: {
+          by: "inline",
+          rule_scoped: !!byInline.ruleId,
+          justification: byInline.justification,
+          source: `${f.location.path}:${byInline.nextLine ? f.location.start_line - 1 : f.location.start_line}`
+        }
+      });
+      continue;
+    }
+    active.push(f);
+  }
+  return { active, suppressed };
+}
 
 // src/engine/run.ts
 var kindOrder = {
@@ -26003,20 +26161,24 @@ var kindOrder = {
 function runScan(input) {
   const files = input.files ?? [];
   const opts = { allowFingerprints: input.allowFingerprints, ignorePaths: input.ignorePaths };
-  const findings = [
+  const detected = [
     ...detectSecretsInFiles(files, opts),
     ...detectPatternsInFiles(files, opts),
     ...scaToCanonical(input.sca ?? [])
   ];
-  findings.sort((a, b) => {
+  detected.sort((a, b) => {
     if (a.location.path !== b.location.path) return a.location.path < b.location.path ? -1 : 1;
     if (a.location.start_line !== b.location.start_line) return a.location.start_line - b.location.start_line;
     if (a.location.start_col !== b.location.start_col) return a.location.start_col - b.location.start_col;
     if (kindOrder[a.kind] !== kindOrder[b.kind]) return kindOrder[a.kind] - kindOrder[b.kind];
     return a.rule_id < b.rule_id ? -1 : a.rule_id > b.rule_id ? 1 : 0;
   });
+  const { active: findings, suppressed } = applySuppressions(detected, {
+    config: input.suppress,
+    textByPath: new Map(files.map((f) => [f.path, f.text]))
+  });
   const sarif = toSarif(findings, { engineVersion: ENGINE_VERSION, rulesetVersion: RULESET_VERSION });
-  return { findings, sarif, engine_version: ENGINE_VERSION, ruleset_version: RULESET_VERSION };
+  return { findings, suppressed, sarif, engine_version: ENGINE_VERSION, ruleset_version: RULESET_VERSION };
 }
 
 // src/engine/mcp/fix-context.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sphior/scan",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Deterministic source scanner — hardcoded secrets and insecure patterns (CWE) with AST/taint analysis. No AI, no network, no source upload. CLI + LSP for editors and CI.",
   "type": "module",
   "bin": {