@sphior/scan 0.1.5 → 0.1.7

package/README.md

@@ -31,20 +31,44 @@ sphior-scan run <dir> [options]
 
 Options:
   --sarif <file>         write SARIF 2.1.0 (GitHub code scanning, most CI tools)
-  --json <file>          write raw findings as JSON
-  --fix-context <file>   write finding context for an AI assistant to act on
-  --fail-on <severity>   exit non-zero at or above this severity
-                         (critical | high | medium | low)
+  --json <file>          write the findings as JSON
+  --fix-context <file>   write one entry per place to fix, for an AI assistant to act on
+  --suppressed <file>    write the findings accepted via .sphiorignore or inline comments
+  --fail-on <severity>   exit 1 at or above this severity
+                         (critical | high | medium | low | info)
+  --no-ignore-file       do not read .sphiorignore
 ```
 
-SARIF is written to stdout as well, so it pipes cleanly:
+With none of `--sarif`, `--json` or `--fix-context`, results go to stdout: a table in a
+terminal, SARIF when piped. A one-line summary (with engine and ruleset versions) always goes
+to stderr.
 
 ```bash
 sphior-scan run ./src --fail-on high
 ```
 
-Exit code is `0` when nothing at or above `--fail-on` was found, non-zero otherwise —
-which is what you want in CI.
+Exit codes: `0` when nothing reached `--fail-on` (or no threshold was given), `1` when something
+did, `2` when the arguments are wrong or the directory does not exist — so a typo in CI never
+passes as a clean scan.
+
+### Excluding paths and accepting findings
+
+`.sphiorignore` at the scanned root, one entry per line — `<glob> [rule_id] [# reason]`:
+
+```gitignore
+generated/**                                # no rule id: the files are not read
+test/fixtures/**   secret.*                 # rule id: scanned, then accepted with a reason
+```
+
+Inline, with any line-comment syntax:
+
+```js
+eval(template); // sphior-ignore: constant input from build time
+// sphior-ignore-next-line secret.private_key: documentation string
+```
+
+Accepted findings are left out of SARIF (GitHub code scanning ignores SARIF suppressions) and
+written to `--suppressed` with their reason.
 
 ### GitHub Actions
 
@@ -89,7 +113,8 @@ upload, no telemetry, no language model, no account. It runs correctly with netw
 ## Links
 
 - Product: <https://sphior.com/code>
-- Issues: <https://github.com/Toraastrta/Sphior/issues>
+- Source and full documentation: <https://github.com/Toraastrta/sphior-code>
+- Issues: <https://github.com/Toraastrta/sphior-code/issues>
 
 ## License
 

package/dist/cli.js

@@ -14650,6 +14650,30 @@ function shannonEntropy(s) {
   }
   return h;
 }
+var PLACEHOLDER_MARKERS = [
+  "your",
+  "here",
+  "example",
+  "sample",
+  "placeholder",
+  "dummy",
+  "changeme",
+  "change_me",
+  "hardcoded",
+  "redacted",
+  "insert",
+  "replace",
+  "todo",
+  "fixme",
+  "xxxx",
+  "...",
+  "<",
+  ">"
+];
+function looksLikePlaceholder(s) {
+  const lower = s.toLowerCase();
+  return PLACEHOLDER_MARKERS.some((m) => lower.includes(m));
+}
 function looksHighEntropy(s, minLen = 16, minEntropy = 3.5) {
   if (s.length < minLen) return false;
   if (!/^[A-Za-z0-9+/=_\-.]+$/.test(s)) return false;
@@ -14796,7 +14820,20 @@ var SECRET_RULES = [
     provider: "PEM",
     title: "Private Key",
     severity: "critical",
-    pattern: /(-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----)/g,
+    // PEM ヘッダ**単体**では鍵ではない。実測（自社リポジトリ 1 回の走査）で
+    // secret.private_key は 6 件すべて誤検知だった:
+    //   - 日本語コメント中の「-----BEGIN RSA PRIVATE KEY----- で配布される」という説明
+    //   - `.replace(/-----BEGIN PRIVATE KEY-----/g, '')` という除去コード
+    //   - `const PEM = "-----BEGIN RSA PRIVATE KEY-----"` 等のテストベクタ（本体なし）
+    //   - ヘッダ + `btoa(...)` のようにコードで本体を作る箇所
+    // severity=critical のルールが 6/6 外れると、本物（この走査で実際に見つかった
+    // 本番 Stripe キー等）が埋まる。そこで「ヘッダの直後に base64 の鍵本体が続く」
+    // ことを先読みで要求する。
+    //
+    // 先読み（キャプチャしない）にしてある点が重要: group 1 はヘッダのままなので
+    // snippet_hash と fingerprint が変わらず、既存の真検出の delta 追跡が途切れない。
+    // 区切りは実鍵の書かれ方に合わせる — 生改行・`\n` のエスケープ列・引用符・カンマ。
+    pattern: /(-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----)(?=(?:\s|\\+[nrt]|["'`,;+]){0,40}[A-Za-z0-9+/]{40,})/g,
     group: 1,
     references: REF_CWE798
   },
@@ -15053,7 +15090,7 @@ function detectSecrets(path, text, opts = {}) {
       const g = rule.group ?? 0;
       const secret = m[g];
       if (!secret) continue;
-      if (PLACEHOLDER_SECRETS.has(secret)) continue;
+      if (PLACEHOLDER_SECRETS.has(secret) || looksLikePlaceholder(secret)) continue;
       const absStart = m.index + m[0].indexOf(secret);
       push(build(path, rule, secret, absStart, starts, false));
       if (re.lastIndex === m.index) re.lastIndex++;
@@ -15064,7 +15101,7 @@ function detectSecrets(path, text, opts = {}) {
     let m;
     while ((m = re.exec(text)) !== null) {
       const secret = m[1];
-      if (!secret || PLACEHOLDER_SECRETS.has(secret)) continue;
+      if (!secret || PLACEHOLDER_SECRETS.has(secret) || looksLikePlaceholder(secret)) continue;
       if (!looksHighEntropy(secret)) continue;
       const absStart = m.index + m[0].lastIndexOf(secret);
       push(build(path, GENERIC_ASSIGNMENT, secret, absStart, starts, true));
@@ -15237,6 +15274,24 @@ var PATTERN_RULES = [
     exts: JS,
     pattern: /createHash\s*\(\s*['"`](?:md5|sha1)['"`]\s*\)/gi
   },
+  {
+    // 2026-10-23: 自己完結コーパス（measure-gate/sast-corpus.ts）が検出欠落として
+    // 検出した。pattern.go.weak_cipher と pattern.java.weak_cipher は存在するのに
+    // **JS/TS 版が無く**、同じ弱点が Go/Java では検出され Node では無検出だった。
+    //
+    // 0-FP の作り: アルゴリズム名を**引用符の直後に固定**する。これが無いと
+    // "description" のような語が `des` に当たる。安全な算法（aes-256-gcm /
+    // aes-256-cbc 等）に当たらないことはテストで固定している。
+    id: "pattern.js.weak_cipher",
+    cwe: "CWE-327",
+    owasp: "A02:2021",
+    severity: "medium",
+    title: "Weak cipher algorithm",
+    message: "DES/3DES, RC2/RC4, Blowfish and IDEA are broken; ECB mode leaks plaintext structure.",
+    remediation: "Use aes-256-gcm (AEAD) with a random IV via crypto.createCipheriv().",
+    exts: JS,
+    pattern: /create(?:De)?Cipher(?:iv)?\s*\(\s*['"`](?:des(?:-[a-z0-9-]*)?|rc[24](?:-[a-z0-9-]*)?|bf(?:-[a-z0-9-]*)?|blowfish|idea(?:-[a-z0-9-]*)?|[a-z0-9-]*-ecb)['"`]/gi
+  },
   // ── Python ──
   {
     id: "pattern.py.requests_verify_false",
@@ -16460,6 +16515,7 @@ var SOURCE_CALL_SUFFIXES = [
   "formData.get",
   "urlParams.get"
 ];
+var TAINT_WRAPPER_CTORS = /* @__PURE__ */ new Set(["URLSearchParams", "URL"]);
 var SCOPE_TYPES = /* @__PURE__ */ new Set([
   "FunctionDeclaration",
   "FunctionExpression",
@@ -16517,6 +16573,11 @@ function exprIsTainted(node, tainted) {
       return exprIsTainted(node.left, tainted) || exprIsTainted(node.right, tainted);
     case "ConditionalExpression":
       return exprIsTainted(node.consequent, tainted) || exprIsTainted(node.alternate, tainted);
+    case "NewExpression": {
+      const ctor = calleeName(node);
+      if (!ctor || !TAINT_WRAPPER_CTORS.has(ctor)) return false;
+      return (node.arguments ?? []).some((a) => exprIsTainted(a, tainted));
+    }
     case "ParenthesizedExpression":
     case "TSAsExpression":
     case "TSNonNullExpression":
@@ -16571,7 +16632,39 @@ function collectTainted(scope, seed) {
   }
   return tainted;
 }
-function scanSinks(scope, tainted) {
+function isFsModule(spec) {
+  if (typeof spec !== "string") return false;
+  const m = spec.replace(/^node:/, "");
+  return m === "fs" || m === "fs/promises";
+}
+function collectFsImportedNames(ast) {
+  const names = /* @__PURE__ */ new Set();
+  walk(ast, (n) => {
+    if (n.type === "ImportDeclaration" && isFsModule(n.source?.value)) {
+      for (const spec of n.specifiers ?? []) {
+        if (spec.type !== "ImportSpecifier") continue;
+        const imported = spec.imported?.name;
+        const local = spec.local?.name;
+        if (typeof imported === "string" && FS_METHODS.has(imported) && typeof local === "string") names.add(local);
+      }
+      return;
+    }
+    if (n.type === "VariableDeclarator") {
+      const init3 = n.init;
+      const id = n.id;
+      if (!init3 || !id || id.type !== "ObjectPattern") return;
+      if (calleeName(init3) !== "require") return;
+      if (!isFsModule(init3.arguments?.[0]?.value)) return;
+      for (const prop of id.properties ?? []) {
+        const key = prop.key?.name;
+        const val = prop.value?.name;
+        if (typeof key === "string" && FS_METHODS.has(key) && typeof val === "string") names.add(val);
+      }
+    }
+  });
+  return names;
+}
+function scanSinks(scope, tainted, fsNames = /* @__PURE__ */ new Set()) {
   const hits = [];
   const hit = (ruleId, node) => {
     hits.push({ ruleId, node });
@@ -16590,6 +16683,7 @@ function scanSinks(scope, tainted) {
       else if (memberPath(callee) === "document.write" && exprIsTainted(arg0, tainted)) hit("taint.js.xss", n);
       else if ((idName === "fetch" || idName === "axios" || idName === "got") && exprIsTainted(arg0, tainted) || !!method && HTTP_METHODS.has(method) && !!objPath && HTTP_CLIENT_OBJECTS.has(objPath) && exprIsTainted(arg0, tainted)) hit("taint.js.ssrf", n);
       else if (!!method && FS_METHODS.has(method) && !!objPath && (objPath === "fs" || objPath === "fs.promises" || objPath === "fsp") && exprIsTainted(arg0, tainted)) hit("taint.js.path_traversal", n);
+      else if (!!idName && fsNames.has(idName) && exprIsTainted(arg0, tainted)) hit("taint.js.path_traversal", n);
       else if (REDIRECT_CALLS.has(memberPath(callee) ?? "") && exprIsTainted(arg0, tainted)) hit("taint.js.open_redirect", n);
       else if (!!method && ["send", "write", "end"].includes(method) && !!objPath && (objPath === "res" || objPath === "response") && exprIsTainted(arg0, tainted)) hit("taint.js.xss", n);
       else if (!!method && MONGO_QUERY_METHODS.has(method) && exprIsTainted(arg0, tainted)) hit("taint.js.nosql_injection", n);
@@ -16669,6 +16763,7 @@ function detectTaintFromAst(ast, path, text) {
       fingerprint
     });
   };
+  const fsNames = collectFsImportedNames(ast);
   const functions = collectLocalFunctions(ast);
   const paramSinks = /* @__PURE__ */ new Map();
   const hitKey2 = (h) => `${h.ruleId}@${h.node.start ?? -1}`;
@@ -16680,7 +16775,7 @@ function detectTaintFromAst(ast, path, text) {
       fn.params.forEach((p, i2) => {
         if (!p) return;
         const tainted = collectTainted(fn.scope, [p]);
-        const hits = scanSinks(fn.scope, tainted);
+        const hits = scanSinks(fn.scope, tainted, fsNames);
         walkScope(fn.scope, (n) => {
           if (n.type !== "CallExpression") return;
           const callee = calleeName(n);
@@ -16717,7 +16812,7 @@ function detectTaintFromAst(ast, path, text) {
   });
   for (const scope of scopes) {
     const tainted = collectTainted(scope, []);
-    for (const h of scanSinks(scope, tainted)) addFinding(h.ruleId, h.node);
+    for (const h of scanSinks(scope, tainted, fsNames)) addFinding(h.ruleId, h.node);
     walkScope(scope, (n) => {
       if (n.type !== "CallExpression") return;
       const name2 = calleeName(n);
@@ -16775,6 +16870,11 @@ function inLineComment(text, lineStart, matchIndex, isPython) {
   const quotes = (upto.match(/["'`]/g) ?? []).length;
   return quotes % 2 === 0;
 }
+function isBlockCommentLine(text, lineStart) {
+  const lineEnd = text.indexOf("\n", lineStart);
+  const line = text.slice(lineStart, lineEnd < 0 ? text.length : lineEnd).trimStart();
+  return line.startsWith("/*") || /^\*(\s|\/|$)/.test(line);
+}
 function detectPatterns(path, text, opts = {}) {
   if (opts.ignorePaths?.some((re) => re.test(path))) return [];
   const ext = extOf(path);
@@ -16818,7 +16918,7 @@ function detectPatterns(path, text, opts = {}) {
     while ((m = re.exec(text)) !== null) {
       const idx = m.index;
       const pos = toPos2(starts, idx);
-      if (inLineComment(text, pos.lineStart, idx, isPython)) {
+      if (inLineComment(text, pos.lineStart, idx, isPython) || isBlockCommentLine(text, pos.lineStart)) {
         if (re.lastIndex === idx) re.lastIndex++;
         continue;
       }
@@ -16914,7 +17014,160 @@ function scaToCanonical(input) {
 
 // src/engine/version.ts
 var ENGINE_VERSION = "0.1.0";
-var RULESET_VERSION = "2026.07.12-22";
+var RULESET_VERSION = "2026.10.23-24";
+
+// src/engine/suppress.ts
+var EMPTY_CONFIG = { excludes: [], scoped: [], problems: [] };
+var SPHIORIGNORE_FILE = ".sphiorignore";
+function escapeRe(s) {
+  return s.replace(/[.+^$(){}|[\]\\]/g, "\\$&");
+}
+function globToRegExp(glob) {
+  let out2 = "";
+  for (let i2 = 0; i2 < glob.length; i2++) {
+    const c = glob[i2];
+    if (c === "*") {
+      if (glob[i2 + 1] === "*") {
+        if (glob[i2 + 2] === "/") {
+          out2 += "(?:[^/]+/)*";
+          i2 += 2;
+        } else {
+          out2 += ".*";
+          i2 += 1;
+        }
+      } else {
+        out2 += "[^/]*";
+      }
+      continue;
+    }
+    if (c === "?") {
+      out2 += "[^/]";
+      continue;
+    }
+    out2 += escapeRe(c);
+  }
+  return new RegExp(`^${out2}$`);
+}
+function globMatches(glob, relPath) {
+  const g = glob.endsWith("/") ? `${glob.slice(0, -1)}` : glob;
+  if (globToRegExp(g).test(relPath)) return true;
+  return globToRegExp(`${g}/**`).test(relPath);
+}
+function ruleMatches(pattern, ruleId) {
+  if (pattern.endsWith("*")) return ruleId.startsWith(pattern.slice(0, -1));
+  return pattern === ruleId;
+}
+function looksLikeRuleId(tok) {
+  return /^[A-Za-z][A-Za-z0-9_.-]*\*?$/.test(tok) && !tok.includes("/");
+}
+function parseSphiorignore(text) {
+  const excludes = [];
+  const scoped = [];
+  const problems = [];
+  const lines = text.split(/\r?\n/);
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const lineNo = i2 + 1;
+    if (!raw.trim() || raw.trim().startsWith("#")) continue;
+    const hashAt = raw.indexOf("#");
+    const body2 = (hashAt >= 0 ? raw.slice(0, hashAt) : raw).trim();
+    const justification = hashAt >= 0 ? raw.slice(hashAt + 1).trim() || void 0 : void 0;
+    if (!body2) continue;
+    const tokens = body2.split(/\s+/);
+    if (tokens.length > 2) {
+      problems.push({ line: lineNo, text: body2, reason: "expected `<glob> [rule_id]` (too many fields)" });
+      continue;
+    }
+    const [glob, ruleId] = tokens;
+    if (glob.startsWith("/")) {
+      problems.push({ line: lineNo, text: body2, reason: "paths are relative to the scan root \u2014 drop the leading `/`" });
+      continue;
+    }
+    if (ruleId !== void 0 && !looksLikeRuleId(ruleId)) {
+      problems.push({ line: lineNo, text: body2, reason: `not a rule id: ${ruleId}` });
+      continue;
+    }
+    const entry = { line: lineNo, glob, ruleId, justification };
+    (ruleId === void 0 ? excludes : scoped).push(entry);
+  }
+  return { excludes, scoped, problems };
+}
+function makePathExcluder(cfg) {
+  if (cfg.excludes.length === 0) return () => false;
+  return (relPath) => cfg.excludes.some((e) => globMatches(e.glob, relPath));
+}
+function configSuppressionFor(cfg, path, ruleId) {
+  return cfg.scoped.find((e) => e.ruleId && ruleMatches(e.ruleId, ruleId) && globMatches(e.glob, path));
+}
+var INLINE_RE = /sphior-ignore(-next-line)?(?:[ \t]+([A-Za-z][A-Za-z0-9_.-]*\*?))?(?:[ \t]*:[ \t]*(.*))?$/;
+function parseInlineSuppression(lineText) {
+  const m = INLINE_RE.exec(lineText);
+  if (!m) return void 0;
+  return {
+    nextLine: m[1] === "-next-line",
+    ruleId: m[2],
+    justification: m[3]?.trim() || void 0
+  };
+}
+function inlineSuppressionFor(lines, startLine, ruleId) {
+  const own = lines[startLine - 1] !== void 0 ? parseInlineSuppression(lines[startLine - 1]) : void 0;
+  if (own && !own.nextLine && (!own.ruleId || ruleMatches(own.ruleId, ruleId))) return own;
+  const prev = startLine >= 2 && lines[startLine - 2] !== void 0 ? parseInlineSuppression(lines[startLine - 2]) : void 0;
+  if (prev && prev.nextLine && (!prev.ruleId || ruleMatches(prev.ruleId, ruleId))) return prev;
+  return void 0;
+}
+function applySuppressions(findings, input = {}) {
+  const cfg = input.config;
+  const hasConfig = !!cfg && cfg.scoped.length > 0;
+  const hasText = !!input.textByPath && input.textByPath.size > 0;
+  if (!hasConfig && !hasText) return { active: findings, suppressed: [] };
+  const linesCache = /* @__PURE__ */ new Map();
+  const linesOf = (path) => {
+    const cached = linesCache.get(path);
+    if (cached) return cached;
+    const text = input.textByPath?.get(path);
+    if (text === void 0) return void 0;
+    const lines = text.split(/\r?\n/);
+    linesCache.set(path, lines);
+    return lines;
+  };
+  const active = [];
+  const suppressed = [];
+  for (const f of findings) {
+    const byConfig = hasConfig ? configSuppressionFor(cfg, f.location.path, f.rule_id) : void 0;
+    if (byConfig) {
+      suppressed.push({
+        ...f,
+        suppression: {
+          by: "config",
+          rule_scoped: true,
+          justification: byConfig.justification,
+          source: `${SPHIORIGNORE_FILE}:${byConfig.line}`
+        }
+      });
+      continue;
+    }
+    const lines = linesOf(f.location.path);
+    const byInline = lines ? inlineSuppressionFor(lines, f.location.start_line, f.rule_id) : void 0;
+    if (byInline) {
+      suppressed.push({
+        ...f,
+        suppression: {
+          by: "inline",
+          rule_scoped: !!byInline.ruleId,
+          justification: byInline.justification,
+          source: `${f.location.path}:${byInline.nextLine ? f.location.start_line - 1 : f.location.start_line}`
+        }
+      });
+      continue;
+    }
+    active.push(f);
+  }
+  return { active, suppressed };
+}
+function countWithoutJustification(suppressed) {
+  return suppressed.reduce((n, f) => f.suppression && !f.suppression.justification ? n + 1 : n, 0);
+}
 
 // src/engine/run.ts
 var kindOrder = {
@@ -16926,43 +17179,79 @@ var kindOrder = {
 function runScan(input) {
   const files = input.files ?? [];
   const opts = { allowFingerprints: input.allowFingerprints, ignorePaths: input.ignorePaths };
-  const findings = [
+  const detected = [
     ...detectSecretsInFiles(files, opts),
     ...detectPatternsInFiles(files, opts),
     ...scaToCanonical(input.sca ?? [])
   ];
-  findings.sort((a, b) => {
+  detected.sort((a, b) => {
     if (a.location.path !== b.location.path) return a.location.path < b.location.path ? -1 : 1;
     if (a.location.start_line !== b.location.start_line) return a.location.start_line - b.location.start_line;
     if (a.location.start_col !== b.location.start_col) return a.location.start_col - b.location.start_col;
     if (kindOrder[a.kind] !== kindOrder[b.kind]) return kindOrder[a.kind] - kindOrder[b.kind];
     return a.rule_id < b.rule_id ? -1 : a.rule_id > b.rule_id ? 1 : 0;
   });
+  const { active: findings, suppressed } = applySuppressions(detected, {
+    config: input.suppress,
+    textByPath: new Map(files.map((f) => [f.path, f.text]))
+  });
   const sarif = toSarif(findings, { engineVersion: ENGINE_VERSION, rulesetVersion: RULESET_VERSION });
-  return { findings, sarif, engine_version: ENGINE_VERSION, ruleset_version: RULESET_VERSION };
+  return { findings, suppressed, sarif, engine_version: ENGINE_VERSION, ruleset_version: RULESET_VERSION };
 }
 
 // src/engine/collect.ts
 import { readdirSync, statSync, readFileSync } from "node:fs";
 import { join, relative, sep } from "node:path";
 var IGNORE_DIRS = /* @__PURE__ */ new Set([
+  // VCS
   ".git",
+  ".hg",
+  ".svn",
+  // JS/TS の依存と出力
   "node_modules",
+  "bower_components",
+  ".yarn",
+  ".pnp",
+  ".pnpm-store",
   "dist",
   "build",
-  ".next",
   "out",
   "coverage",
-  "vendor",
+  ".cache",
+  ".turbo",
+  ".swc",
+  ".parcel-cache",
+  // フレームワーク/デプロイのビルド出力
+  ".next",
+  ".open-next",
+  ".vercel",
+  ".wrangler",
+  ".serverless",
+  ".sst",
+  ".svelte-kit",
+  ".nuxt",
+  ".output",
+  ".astro",
+  ".docusaurus",
+  // Python
   ".venv",
   "venv",
   "__pycache__",
+  ".mypy_cache",
+  ".pytest_cache",
+  ".ruff_cache",
+  ".tox",
+  ".nox",
+  ".eggs",
+  // JVM / その他言語
   "target",
-  ".turbo",
-  ".cache",
-  ".yarn",
-  ".pnp",
-  "bower_components"
+  ".gradle",
+  "vendor",
+  "Pods",
+  ".dart_tool",
+  ".pub-cache",
+  // IaC のプロバイダバイナリ（`.tf` 本体は配下に無いので検査対象は失わない）
+  ".terraform"
 ]);
 function toPosix(p) {
   return sep === "/" ? p : p.split(sep).join("/");
@@ -16993,9 +17282,11 @@ function collectSourceFiles(rootDir, opts = {}) {
       }
       if (st.isDirectory()) {
         if (ignore.has(name2)) continue;
+        if (opts.exclude?.(toPosix(relative(rootDir, full)))) continue;
         walk2(full);
       } else if (st.isFile()) {
         if (st.size > maxBytes) continue;
+        if (opts.exclude?.(toPosix(relative(rootDir, full)))) continue;
         let buf;
         try {
           buf = readFileSync(full);
@@ -17011,6 +17302,13 @@ function collectSourceFiles(rootDir, opts = {}) {
   files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
   return files;
 }
+function readSphiorignore(rootDir) {
+  try {
+    return parseSphiorignore(readFileSync(join(rootDir, SPHIORIGNORE_FILE), "utf8"));
+  } catch {
+    return EMPTY_CONFIG;
+  }
+}
 
 // src/engine/cli.ts
 import { existsSync, statSync as statSync2, writeFileSync } from "node:fs";
@@ -17165,7 +17463,7 @@ function runCli(argv, ctx = {}) {
   const writeFile = ctx.writeFile ?? ((p, d) => writeFileSync(p, d));
   const [cmd, dir, ...rest] = argv;
   if (cmd !== "run" || !dir) {
-    logErr("usage: sphior-scan run <dir> [--sarif out.sarif] [--json out.json] [--fix-context out.json] [--fail-on high]");
+    logErr("usage: sphior-scan run <dir> [--sarif out.sarif] [--json out.json] [--fix-context out.json] [--suppressed out.json] [--fail-on high] [--no-ignore-file]");
     return { exitCode: 2, error: "bad_args" };
   }
   const flags2 = parseFlags(rest);
@@ -17174,11 +17472,23 @@ function runCli(argv, ctx = {}) {
     logErr("  Nothing was scanned, so this is not a clean result. Check the path.");
     return { exitCode: 2, error: "dir_not_found" };
   }
-  const files = collectSourceFiles(dir);
-  const result = runScan({ files });
+  const ignoreCfg = flags2["no-ignore-file"] ? EMPTY_CONFIG : readSphiorignore(dir);
+  const isExcluded = makePathExcluder(ignoreCfg);
+  let excludedCount = 0;
+  const exclude = (relPath) => {
+    if (!isExcluded(relPath)) return false;
+    excludedCount++;
+    return true;
+  };
+  for (const p of ignoreCfg.problems) {
+    logErr(`warning: ${SPHIORIGNORE_FILE}:${p.line}: ${p.reason} \u2014 ignored this line (\u201C${p.text}\u201D)`);
+  }
+  const files = collectSourceFiles(dir, { exclude });
+  const result = runScan({ files, suppress: ignoreCfg });
   const sarifJson = canonicalJson(result.sarif);
   if (flags2.sarif) writeFile(flags2.sarif, sarifJson);
   if (flags2.json) writeFile(flags2.json, canonicalJson(result.findings));
+  if (flags2.suppressed) writeFile(flags2.suppressed, canonicalJson(result.suppressed));
   if (flags2["fix-context"]) writeFile(flags2["fix-context"], canonicalJson(buildFixContexts(result.findings)));
   if (!flags2.sarif && !flags2.json && !flags2["fix-context"]) {
     if (ctx.isTty) {
@@ -17201,14 +17511,20 @@ function runCli(argv, ctx = {}) {
     acc[f.severity] = (acc[f.severity] ?? 0) + 1;
     return acc;
   }, {});
+  const scope = (excludedCount > 0 ? ` ${excludedCount} files excluded` : "") + (result.suppressed.length > 0 ? `${excludedCount > 0 ? "," : ""} ${result.suppressed.length} suppressed` : "");
   logErr(
-    `SPHIOR CODE: ${result.findings.length} findings (critical=${counts.critical ?? 0} high=${counts.high ?? 0} medium=${counts.medium ?? 0} low=${counts.low ?? 0}) engine=${result.engine_version} ruleset=${result.ruleset_version}`
+    `SPHIOR CODE: ${result.findings.length} findings (critical=${counts.critical ?? 0} high=${counts.high ?? 0} medium=${counts.medium ?? 0} low=${counts.low ?? 0}) ${files.length} files scanned${scope ? ` \u2022${scope}` : ""} engine=${result.engine_version} ruleset=${result.ruleset_version}`
   );
+  const unexplained = countWithoutJustification(result.suppressed);
+  if (unexplained > 0) {
+    logErr(`  note: ${unexplained} of the suppressions carry no reason. Add \`: why\` so an auditor can read it later.`);
+  }
   if (ctx.isTty && !flags2.sarif && !flags2.json && !flags2["fix-context"]) {
     logErr("");
     logErr("  --fix-context fc.json   hand findings to an AI agent to fix");
     logErr("  --sarif out.sarif       for GitHub code scanning / CI dashboards");
     logErr("  --fail-on high          exit 1 if anything at or above this severity (CI)");
+    logErr(`  ${SPHIORIGNORE_FILE}            exclude paths, or accept a rule with a reason`);
   }
   let exitCode = 0;
   const failOn = flags2["fail-on"];

package/dist/server.cjs

@@ -23727,6 +23727,30 @@ function shannonEntropy(s) {
   }
   return h;
 }
+var PLACEHOLDER_MARKERS = [
+  "your",
+  "here",
+  "example",
+  "sample",
+  "placeholder",
+  "dummy",
+  "changeme",
+  "change_me",
+  "hardcoded",
+  "redacted",
+  "insert",
+  "replace",
+  "todo",
+  "fixme",
+  "xxxx",
+  "...",
+  "<",
+  ">"
+];
+function looksLikePlaceholder(s) {
+  const lower = s.toLowerCase();
+  return PLACEHOLDER_MARKERS.some((m) => lower.includes(m));
+}
 function looksHighEntropy(s, minLen = 16, minEntropy = 3.5) {
   if (s.length < minLen) return false;
   if (!/^[A-Za-z0-9+/=_\-.]+$/.test(s)) return false;
@@ -23873,7 +23897,20 @@ var SECRET_RULES = [
     provider: "PEM",
     title: "Private Key",
     severity: "critical",
-    pattern: /(-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----)/g,
+    // PEM ヘッダ**単体**では鍵ではない。実測（自社リポジトリ 1 回の走査）で
+    // secret.private_key は 6 件すべて誤検知だった:
+    //   - 日本語コメント中の「-----BEGIN RSA PRIVATE KEY----- で配布される」という説明
+    //   - `.replace(/-----BEGIN PRIVATE KEY-----/g, '')` という除去コード
+    //   - `const PEM = "-----BEGIN RSA PRIVATE KEY-----"` 等のテストベクタ（本体なし）
+    //   - ヘッダ + `btoa(...)` のようにコードで本体を作る箇所
+    // severity=critical のルールが 6/6 外れると、本物（この走査で実際に見つかった
+    // 本番 Stripe キー等）が埋まる。そこで「ヘッダの直後に base64 の鍵本体が続く」
+    // ことを先読みで要求する。
+    //
+    // 先読み（キャプチャしない）にしてある点が重要: group 1 はヘッダのままなので
+    // snippet_hash と fingerprint が変わらず、既存の真検出の delta 追跡が途切れない。
+    // 区切りは実鍵の書かれ方に合わせる — 生改行・`\n` のエスケープ列・引用符・カンマ。
+    pattern: /(-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----)(?=(?:\s|\\+[nrt]|["'`,;+]){0,40}[A-Za-z0-9+/]{40,})/g,
     group: 1,
     references: REF_CWE798
   },
@@ -24130,7 +24167,7 @@ function detectSecrets(path, text, opts = {}) {
       const g = rule.group ?? 0;
       const secret = m[g];
       if (!secret) continue;
-      if (PLACEHOLDER_SECRETS.has(secret)) continue;
+      if (PLACEHOLDER_SECRETS.has(secret) || looksLikePlaceholder(secret)) continue;
       const absStart = m.index + m[0].indexOf(secret);
       push(build(path, rule, secret, absStart, starts, false));
       if (re.lastIndex === m.index) re.lastIndex++;
@@ -24141,7 +24178,7 @@ function detectSecrets(path, text, opts = {}) {
     let m;
     while ((m = re.exec(text)) !== null) {
       const secret = m[1];
-      if (!secret || PLACEHOLDER_SECRETS.has(secret)) continue;
+      if (!secret || PLACEHOLDER_SECRETS.has(secret) || looksLikePlaceholder(secret)) continue;
       if (!looksHighEntropy(secret)) continue;
       const absStart = m.index + m[0].lastIndexOf(secret);
       push(build(path, GENERIC_ASSIGNMENT, secret, absStart, starts, true));
@@ -24314,6 +24351,24 @@ var PATTERN_RULES = [
     exts: JS,
     pattern: /createHash\s*\(\s*['"`](?:md5|sha1)['"`]\s*\)/gi
   },
+  {
+    // 2026-10-23: 自己完結コーパス（measure-gate/sast-corpus.ts）が検出欠落として
+    // 検出した。pattern.go.weak_cipher と pattern.java.weak_cipher は存在するのに
+    // **JS/TS 版が無く**、同じ弱点が Go/Java では検出され Node では無検出だった。
+    //
+    // 0-FP の作り: アルゴリズム名を**引用符の直後に固定**する。これが無いと
+    // "description" のような語が `des` に当たる。安全な算法（aes-256-gcm /
+    // aes-256-cbc 等）に当たらないことはテストで固定している。
+    id: "pattern.js.weak_cipher",
+    cwe: "CWE-327",
+    owasp: "A02:2021",
+    severity: "medium",
+    title: "Weak cipher algorithm",
+    message: "DES/3DES, RC2/RC4, Blowfish and IDEA are broken; ECB mode leaks plaintext structure.",
+    remediation: "Use aes-256-gcm (AEAD) with a random IV via crypto.createCipheriv().",
+    exts: JS,
+    pattern: /create(?:De)?Cipher(?:iv)?\s*\(\s*['"`](?:des(?:-[a-z0-9-]*)?|rc[24](?:-[a-z0-9-]*)?|bf(?:-[a-z0-9-]*)?|blowfish|idea(?:-[a-z0-9-]*)?|[a-z0-9-]*-ecb)['"`]/gi
+  },
   // ── Python ──
   {
     id: "pattern.py.requests_verify_false",
@@ -25537,6 +25592,7 @@ var SOURCE_CALL_SUFFIXES = [
   "formData.get",
   "urlParams.get"
 ];
+var TAINT_WRAPPER_CTORS = /* @__PURE__ */ new Set(["URLSearchParams", "URL"]);
 var SCOPE_TYPES = /* @__PURE__ */ new Set([
   "FunctionDeclaration",
   "FunctionExpression",
@@ -25594,6 +25650,11 @@ function exprIsTainted(node, tainted) {
       return exprIsTainted(node.left, tainted) || exprIsTainted(node.right, tainted);
     case "ConditionalExpression":
       return exprIsTainted(node.consequent, tainted) || exprIsTainted(node.alternate, tainted);
+    case "NewExpression": {
+      const ctor = calleeName(node);
+      if (!ctor || !TAINT_WRAPPER_CTORS.has(ctor)) return false;
+      return (node.arguments ?? []).some((a) => exprIsTainted(a, tainted));
+    }
     case "ParenthesizedExpression":
     case "TSAsExpression":
     case "TSNonNullExpression":
@@ -25648,7 +25709,39 @@ function collectTainted(scope, seed) {
   }
   return tainted;
 }
-function scanSinks(scope, tainted) {
+function isFsModule(spec) {
+  if (typeof spec !== "string") return false;
+  const m = spec.replace(/^node:/, "");
+  return m === "fs" || m === "fs/promises";
+}
+function collectFsImportedNames(ast) {
+  const names = /* @__PURE__ */ new Set();
+  walk(ast, (n) => {
+    if (n.type === "ImportDeclaration" && isFsModule(n.source?.value)) {
+      for (const spec of n.specifiers ?? []) {
+        if (spec.type !== "ImportSpecifier") continue;
+        const imported = spec.imported?.name;
+        const local = spec.local?.name;
+        if (typeof imported === "string" && FS_METHODS.has(imported) && typeof local === "string") names.add(local);
+      }
+      return;
+    }
+    if (n.type === "VariableDeclarator") {
+      const init3 = n.init;
+      const id = n.id;
+      if (!init3 || !id || id.type !== "ObjectPattern") return;
+      if (calleeName(init3) !== "require") return;
+      if (!isFsModule(init3.arguments?.[0]?.value)) return;
+      for (const prop of id.properties ?? []) {
+        const key = prop.key?.name;
+        const val = prop.value?.name;
+        if (typeof key === "string" && FS_METHODS.has(key) && typeof val === "string") names.add(val);
+      }
+    }
+  });
+  return names;
+}
+function scanSinks(scope, tainted, fsNames = /* @__PURE__ */ new Set()) {
   const hits = [];
   const hit = (ruleId, node) => {
     hits.push({ ruleId, node });
@@ -25667,6 +25760,7 @@ function scanSinks(scope, tainted) {
       else if (memberPath(callee) === "document.write" && exprIsTainted(arg0, tainted)) hit("taint.js.xss", n);
       else if ((idName === "fetch" || idName === "axios" || idName === "got") && exprIsTainted(arg0, tainted) || !!method && HTTP_METHODS.has(method) && !!objPath && HTTP_CLIENT_OBJECTS.has(objPath) && exprIsTainted(arg0, tainted)) hit("taint.js.ssrf", n);
       else if (!!method && FS_METHODS.has(method) && !!objPath && (objPath === "fs" || objPath === "fs.promises" || objPath === "fsp") && exprIsTainted(arg0, tainted)) hit("taint.js.path_traversal", n);
+      else if (!!idName && fsNames.has(idName) && exprIsTainted(arg0, tainted)) hit("taint.js.path_traversal", n);
       else if (REDIRECT_CALLS.has(memberPath(callee) ?? "") && exprIsTainted(arg0, tainted)) hit("taint.js.open_redirect", n);
       else if (!!method && ["send", "write", "end"].includes(method) && !!objPath && (objPath === "res" || objPath === "response") && exprIsTainted(arg0, tainted)) hit("taint.js.xss", n);
       else if (!!method && MONGO_QUERY_METHODS.has(method) && exprIsTainted(arg0, tainted)) hit("taint.js.nosql_injection", n);
@@ -25746,6 +25840,7 @@ function detectTaintFromAst(ast, path, text) {
       fingerprint
     });
   };
+  const fsNames = collectFsImportedNames(ast);
   const functions = collectLocalFunctions(ast);
   const paramSinks = /* @__PURE__ */ new Map();
   const hitKey2 = (h) => `${h.ruleId}@${h.node.start ?? -1}`;
@@ -25757,7 +25852,7 @@ function detectTaintFromAst(ast, path, text) {
       fn.params.forEach((p, i2) => {
         if (!p) return;
         const tainted = collectTainted(fn.scope, [p]);
-        const hits = scanSinks(fn.scope, tainted);
+        const hits = scanSinks(fn.scope, tainted, fsNames);
         walkScope(fn.scope, (n) => {
           if (n.type !== "CallExpression") return;
           const callee = calleeName(n);
@@ -25794,7 +25889,7 @@ function detectTaintFromAst(ast, path, text) {
   });
   for (const scope of scopes) {
     const tainted = collectTainted(scope, []);
-    for (const h of scanSinks(scope, tainted)) addFinding(h.ruleId, h.node);
+    for (const h of scanSinks(scope, tainted, fsNames)) addFinding(h.ruleId, h.node);
     walkScope(scope, (n) => {
       if (n.type !== "CallExpression") return;
       const name2 = calleeName(n);
@@ -25852,6 +25947,11 @@ function inLineComment(text, lineStart, matchIndex, isPython) {
   const quotes = (upto.match(/["'`]/g) ?? []).length;
   return quotes % 2 === 0;
 }
+function isBlockCommentLine(text, lineStart) {
+  const lineEnd = text.indexOf("\n", lineStart);
+  const line = text.slice(lineStart, lineEnd < 0 ? text.length : lineEnd).trimStart();
+  return line.startsWith("/*") || /^\*(\s|\/|$)/.test(line);
+}
 function detectPatterns(path, text, opts = {}) {
   if (opts.ignorePaths?.some((re) => re.test(path))) return [];
   const ext = extOf(path);
@@ -25895,7 +25995,7 @@ function detectPatterns(path, text, opts = {}) {
     while ((m = re.exec(text)) !== null) {
       const idx = m.index;
       const pos = toPos2(starts, idx);
-      if (inLineComment(text, pos.lineStart, idx, isPython)) {
+      if (inLineComment(text, pos.lineStart, idx, isPython) || isBlockCommentLine(text, pos.lineStart)) {
         if (re.lastIndex === idx) re.lastIndex++;
         continue;
       }
@@ -25991,7 +26091,117 @@ function scaToCanonical(input) {
 
 // src/engine/version.ts
 var ENGINE_VERSION = "0.1.0";
-var RULESET_VERSION = "2026.07.12-22";
+var RULESET_VERSION = "2026.10.23-24";
+
+// src/engine/suppress.ts
+var SPHIORIGNORE_FILE = ".sphiorignore";
+function escapeRe(s) {
+  return s.replace(/[.+^$(){}|[\]\\]/g, "\\$&");
+}
+function globToRegExp(glob) {
+  let out2 = "";
+  for (let i2 = 0; i2 < glob.length; i2++) {
+    const c = glob[i2];
+    if (c === "*") {
+      if (glob[i2 + 1] === "*") {
+        if (glob[i2 + 2] === "/") {
+          out2 += "(?:[^/]+/)*";
+          i2 += 2;
+        } else {
+          out2 += ".*";
+          i2 += 1;
+        }
+      } else {
+        out2 += "[^/]*";
+      }
+      continue;
+    }
+    if (c === "?") {
+      out2 += "[^/]";
+      continue;
+    }
+    out2 += escapeRe(c);
+  }
+  return new RegExp(`^${out2}$`);
+}
+function globMatches(glob, relPath) {
+  const g = glob.endsWith("/") ? `${glob.slice(0, -1)}` : glob;
+  if (globToRegExp(g).test(relPath)) return true;
+  return globToRegExp(`${g}/**`).test(relPath);
+}
+function ruleMatches(pattern, ruleId) {
+  if (pattern.endsWith("*")) return ruleId.startsWith(pattern.slice(0, -1));
+  return pattern === ruleId;
+}
+function configSuppressionFor(cfg, path, ruleId) {
+  return cfg.scoped.find((e) => e.ruleId && ruleMatches(e.ruleId, ruleId) && globMatches(e.glob, path));
+}
+var INLINE_RE = /sphior-ignore(-next-line)?(?:[ \t]+([A-Za-z][A-Za-z0-9_.-]*\*?))?(?:[ \t]*:[ \t]*(.*))?$/;
+function parseInlineSuppression(lineText) {
+  const m = INLINE_RE.exec(lineText);
+  if (!m) return void 0;
+  return {
+    nextLine: m[1] === "-next-line",
+    ruleId: m[2],
+    justification: m[3]?.trim() || void 0
+  };
+}
+function inlineSuppressionFor(lines, startLine, ruleId) {
+  const own = lines[startLine - 1] !== void 0 ? parseInlineSuppression(lines[startLine - 1]) : void 0;
+  if (own && !own.nextLine && (!own.ruleId || ruleMatches(own.ruleId, ruleId))) return own;
+  const prev = startLine >= 2 && lines[startLine - 2] !== void 0 ? parseInlineSuppression(lines[startLine - 2]) : void 0;
+  if (prev && prev.nextLine && (!prev.ruleId || ruleMatches(prev.ruleId, ruleId))) return prev;
+  return void 0;
+}
+function applySuppressions(findings, input = {}) {
+  const cfg = input.config;
+  const hasConfig = !!cfg && cfg.scoped.length > 0;
+  const hasText = !!input.textByPath && input.textByPath.size > 0;
+  if (!hasConfig && !hasText) return { active: findings, suppressed: [] };
+  const linesCache = /* @__PURE__ */ new Map();
+  const linesOf = (path) => {
+    const cached = linesCache.get(path);
+    if (cached) return cached;
+    const text = input.textByPath?.get(path);
+    if (text === void 0) return void 0;
+    const lines = text.split(/\r?\n/);
+    linesCache.set(path, lines);
+    return lines;
+  };
+  const active = [];
+  const suppressed = [];
+  for (const f of findings) {
+    const byConfig = hasConfig ? configSuppressionFor(cfg, f.location.path, f.rule_id) : void 0;
+    if (byConfig) {
+      suppressed.push({
+        ...f,
+        suppression: {
+          by: "config",
+          rule_scoped: true,
+          justification: byConfig.justification,
+          source: `${SPHIORIGNORE_FILE}:${byConfig.line}`
+        }
+      });
+      continue;
+    }
+    const lines = linesOf(f.location.path);
+    const byInline = lines ? inlineSuppressionFor(lines, f.location.start_line, f.rule_id) : void 0;
+    if (byInline) {
+      suppressed.push({
+        ...f,
+        suppression: {
+          by: "inline",
+          rule_scoped: !!byInline.ruleId,
+          justification: byInline.justification,
+          source: `${f.location.path}:${byInline.nextLine ? f.location.start_line - 1 : f.location.start_line}`
+        }
+      });
+      continue;
+    }
+    active.push(f);
+  }
+  return { active, suppressed };
+}
 
 // src/engine/run.ts
 var kindOrder = {
@@ -26003,20 +26213,24 @@ var kindOrder = {
 function runScan(input) {
   const files = input.files ?? [];
   const opts = { allowFingerprints: input.allowFingerprints, ignorePaths: input.ignorePaths };
-  const findings = [
+  const detected = [
     ...detectSecretsInFiles(files, opts),
     ...detectPatternsInFiles(files, opts),
     ...scaToCanonical(input.sca ?? [])
   ];
-  findings.sort((a, b) => {
+  detected.sort((a, b) => {
     if (a.location.path !== b.location.path) return a.location.path < b.location.path ? -1 : 1;
     if (a.location.start_line !== b.location.start_line) return a.location.start_line - b.location.start_line;
     if (a.location.start_col !== b.location.start_col) return a.location.start_col - b.location.start_col;
     if (kindOrder[a.kind] !== kindOrder[b.kind]) return kindOrder[a.kind] - kindOrder[b.kind];
     return a.rule_id < b.rule_id ? -1 : a.rule_id > b.rule_id ? 1 : 0;
   });
+  const { active: findings, suppressed } = applySuppressions(detected, {
+    config: input.suppress,
+    textByPath: new Map(files.map((f) => [f.path, f.text]))
+  });
   const sarif = toSarif(findings, { engineVersion: ENGINE_VERSION, rulesetVersion: RULESET_VERSION });
-  return { findings, sarif, engine_version: ENGINE_VERSION, ruleset_version: RULESET_VERSION };
+  return { findings, suppressed, sarif, engine_version: ENGINE_VERSION, ruleset_version: RULESET_VERSION };
 }
 
 // src/engine/mcp/fix-context.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sphior/scan",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Deterministic source scanner — hardcoded secrets and insecure patterns (CWE) with AST/taint analysis. No AI, no network, no source upload. CLI + LSP for editors and CI.",
   "type": "module",
   "bin": {