agentsafe-cli 0.1.1 → 0.3.1

package/README.md

@@ -1,36 +1,207 @@
-# AgentSafe
+# AgentSafe-CLI
 
-AgentSafe 是一个面向 AI 编程 Agent 使用场景的开源项目安装前安全体检 CLI。它只做静态扫描，不执行目标项目代码，默认在本地输出中文 Markdown 和 JSON 风险报告。
+AgentSafe 是一个面向 AI 编程 Agent 使用场景的开源项目安装前安全体检 CLI。它在本地做静态扫描，不执行目标项目代码，默认不调用任何网络 API，并输出中文 Markdown、HTML 和 JSON 风险报告。
 
-## 开发运行
+适用场景：
 
-```powershell
-pnpm install
+- 你准备把 GitHub/Gitee 项目交给 Cursor、Cline、Roo Code、Copilot、Codex 等 Agent 跑起来。
+- 你想先确认 README、安装脚本、`package.json` 生命周期、Dockerfile、CI 配置里有没有高风险行为。
+- 你希望生成一段可以直接贴给 AI Agent 的安全执行提示词，约束它不要盲目运行危险命令。
+
+## 当前版本
+
+当前源码版本：`0.3.1`
+
+已完成的升级点：
+
+- `0.1.2`：同步 CLI/package 版本号，修正 README 调试脚本路径说明，明确 lockfile 当前只做文件收集和基础规则扫描，暂未做依赖信誉深度分析。
+- `0.2.0`：新增 README 命令提取和 package scripts 执行链推断，可展示 `README -> npm install -> postinstall -> 脚本文件风险`。
+- `0.2.1`：新增 `.agentsaferc.json` 配置，支持可信域名、忽略规则、忽略路径和严重度覆盖。
+- `0.3.0`：新增 `report.html`，便于本地浏览、分享和给团队成员阅读。
+- `0.3.1`：修复 HTML 报告中 Agent 执行提示词的字体颜色显示问题（改为易读的浅底黑字）。
+
+## 快速使用
+
+免安装运行：
+
+```bash
+npx agentsafe-cli scan "/path/to/local/project" -o agentsafe-report
+```
+
+扫描远程 Git 仓库：
+
+```bash
+npx agentsafe-cli scan "https://github.com/octocat/Spoon-Knife.git" -o agentsafe-report
+```
+
+全局安装：
+
+```bash
+npm install -g agentsafe-cli
+agentsafe scan "/path/to/local/project" -o agentsafe-report
+```
+
+扫描完成后会生成：
+
+- `report.md`：中文 Markdown 风险报告。
+- `report.html`：本地 HTML 可视化报告。
+- `report.json`：结构化结果，适合接入 CI/CD 或其他工具。
+
+## CLI 参数
+
+```bash
+agentsafe scan <本地目录或 Git URL> [options]
+```
+
+常用参数：
+
+- `-o, --out-dir <dir>`：报告输出目录，默认 `agentsafe-report`。
+- `-c, --config <path>`：指定 `.agentsaferc.json` 配置文件。
+- `--allow-domain <domain...>`：加入可信域名白名单，可传多个；会和配置文件中的 `allowDomains` 合并。
+- `--git-binary <path>`：手动指定 Git 可执行文件路径。
+
+退出码：
+
+- `0`：未发现 high 或 block 风险。
+- `1`：发现 high 风险。
+- `2`：发现 block 阻断风险。
+
+## Agent 执行链推断
+
+从 `0.2.0` 开始，AgentSafe 不只展示单条规则命中，还会推断 AI Agent 可能执行的安装路径。
+
+例如 README 中存在：
+
+```bash
+npm install
+npm run dev
+```
+
+而 `package.json` 中存在：
+
+```json
+{
+  "scripts": {
+    "postinstall": "bash install.sh",
+    "dev": "bash install.sh"
+  }
+}
+```
+
+如果 `install.sh` 又命中读取 `.env`、`~/.ssh` 或外联上传规则，报告会展示类似链路：
+
+```text
+README 安装命令 -> package.json scripts.postinstall -> install.sh -> 风险命中
+README 运行命令 -> package.json scripts.dev -> install.sh -> 风险命中
+```
+
+同时报告会给出更安全的替代命令，例如：
+
+```bash
+npm install --ignore-scripts
+pnpm install --ignore-scripts
+yarn install --ignore-scripts
+```
+
+## 配置文件
+
+你可以在被扫描项目根目录创建 `.agentsaferc.json`，也可以通过 `--config` 指定配置路径。
+
+示例：
+
+```json
+{
+  "allowDomains": [
+    "registry.npmjs.org",
+    "*.mycorp.example"
+  ],
+  "ignoreRules": [
+    "github-action-unpinned"
+  ],
+  "ignorePaths": [
+    "docs/**",
+    "examples/legacy/**"
+  ],
+  "severityOverrides": {
+    "dockerfile-remote-add": "low"
+  }
+}
+```
+
+字段说明：
+
+- `allowDomains`：可信域名白名单。用于降低已知内网、私有 registry、公司服务域名的外联误报。
+- `ignoreRules`：忽略指定规则 ID。
+- `ignorePaths`：忽略指定文件路径，支持 glob，例如 `docs/**`。
+- `severityOverrides`：覆盖规则严重度，适合团队内部策略调优。
+
+也可以使用仓库里的示例文件 `.agentsaferc.example.json` 作为模板。
+
+## HTML 报告
+
+从 `0.3.0` 开始，输出目录会额外生成 `report.html`。HTML 报告包含：
+
+- 风险分和风险数量概览。
+- 阻断/高风险明细。
+- Agent 执行链推断。
+- 建议替代命令。
+- Agent 安全执行提示词。
+- 生效配置摘要。
+
+HTML 报告仍然是本地生成，不上传源码。
+
+## Lockfile 说明
+
+当前版本会收集并扫描 `package-lock.json`、`pnpm-lock.yaml`、`yarn.lock` 等 lockfile 中的基础文本风险，但暂未做深度依赖信誉分析，例如：
+
+- npm 包下载量和发布时间。
+- typosquatting 包名相似度。
+- 维护者变更。
+- 包版本近期异常发布。
+- 第三方 registry 信誉。
+
+这类能力计划以显式开关形式加入，例如未来的 `--online-reputation`，默认仍保持离线扫描和隐私优先。
+
+## 本地开发
+
+安装依赖：
+
+```bash
+pnpm install --ignore-scripts
+```
+
+运行测试：
+
+```bash
 pnpm test
+```
+
+构建：
+
+```bash
 pnpm build
-pnpm dev -- scan . -o agentsafe-report
 ```
 
-如果当前终端没有 Node/pnpm，可以在 Codex 桌面环境中使用自带运行时：
+扫描内置风险样例：
 
-```powershell
-& 'C:\Users\95365\.cache\codex-runtimes\codex-primary-runtime\dependencies\bin\pnpm.cmd' install
-& 'C:\Users\95365\.cache\codex-runtimes\codex-primary-runtime\dependencies\bin\pnpm.cmd' test
+```bash
+pnpm scan:sample
 ```
 
-## CLI
+调试脚本：
 
 ```powershell
-agentsafe scan <本地目录或 Git URL> -o agentsafe-report
+powershell -ExecutionPolicy Bypass -File .\run-debug.ps1 -Mode all
+powershell -ExecutionPolicy Bypass -File .\run-debug.ps1 -Mode scan-custom -Target "E:\your-project"
 ```
 
-常用参数：
+## 防御边界
 
-- `-o, --out-dir <dir>`：报告输出目录，默认 `agentsafe-report`
-- `--allow-domain <domain...>`：把公司内网、私有 registry 等域名加入网络风险白名单
-- `--git-binary <path>`：指定 Git 可执行文件路径
+AgentSafe 是防御性静态扫描工具，不是杀毒软件，也不会主动利用漏洞。它的目标是在用户把项目交给 AI Agent 自动运行前，提前发现高风险安装路径和可疑脚本行为。
 
-输出文件：
+默认行为：
 
-- `report.md`：中文风险报告
-- `report.json`：结构化扫描结果
+- 不执行目标项目代码。
+- 不上传用户源码。
+- 不绕过平台安全机制。
+- 不对第三方项目直接定性为恶意，只报告“高风险行为”“阻断级风险”“需人工确认”。

package/dist/execution.d.ts

@@ -0,0 +1,3 @@
+import type { CollectedFile } from "./files.js";
+import type { ExecutionChain, Finding } from "./types.js";
+export declare function buildExecutionChains(files: CollectedFile[], findings: Finding[]): ExecutionChain[];

package/dist/execution.js

@@ -0,0 +1,275 @@
+import path from "node:path";
+import { severityRank } from "./config.js";
+const lifecycleScripts = ["preinstall", "install", "postinstall", "prepare"];
+export function buildExecutionChains(files, findings) {
+    const readmeCommands = files
+        .filter((file) => isReadme(file.relativePath))
+        .flatMap((file) => extractReadmeCommands(file.relativePath, file.content));
+    const packageScripts = files
+        .filter((file) => file.relativePath.endsWith("package.json"))
+        .flatMap((file) => extractPackageScripts(file.relativePath, file.content));
+    const filePaths = new Set(files.map((file) => file.relativePath));
+    const chains = [];
+    for (const command of readmeCommands) {
+        if (isPackageInstallCommand(command.command)) {
+            chains.push(...buildInstallChains({
+                command,
+                packageScripts,
+                findings,
+                filePaths
+            }));
+            continue;
+        }
+        const scriptName = extractPackageRunScriptName(command.command);
+        if (scriptName) {
+            chains.push(...buildRunScriptChains({
+                command,
+                scriptName,
+                packageScripts,
+                findings,
+                filePaths
+            }));
+        }
+    }
+    return dedupeChains(chains).sort((a, b) => {
+        const severityDelta = severityRank[b.risk] - severityRank[a.risk];
+        return severityDelta !== 0 ? severityDelta : a.title.localeCompare(b.title);
+    });
+}
+function buildInstallChains(input) {
+    const lifecycle = input.packageScripts.filter((script) => lifecycleScripts.includes(script.name));
+    if (!lifecycle.length) {
+        return [];
+    }
+    return lifecycle.map((script) => buildScriptChain({
+        idPrefix: "install",
+        title: `README 安装命令可能触发 ${script.name}`,
+        summary: `README 中的 ${input.command.command} 可能在安装阶段触发 package.json 的 ${script.name} 脚本。`,
+        command: input.command,
+        script,
+        findings: input.findings,
+        filePaths: input.filePaths,
+        safeCommand: safeInstallCommand(input.command.command),
+        recommendation: "先使用忽略生命周期脚本的安装命令，再人工审阅 package scripts 和关联脚本文件。"
+    }));
+}
+function buildRunScriptChains(input) {
+    return input.packageScripts
+        .filter((script) => script.name === input.scriptName)
+        .map((script) => buildScriptChain({
+        idPrefix: "run-script",
+        title: `README 命令会运行 npm script: ${script.name}`,
+        summary: `README 中的 ${input.command.command} 会进入 package.json 的 ${script.name} 脚本。`,
+        command: input.command,
+        script,
+        findings: input.findings,
+        filePaths: input.filePaths,
+        recommendation: "运行前先展开 npm script 的真实命令，并确认关联脚本没有读取凭据或外联上传。"
+    }));
+}
+function buildScriptChain(input) {
+    const nodes = [
+        {
+            kind: "readme-command",
+            label: "README 安装/运行命令",
+            filePath: input.command.filePath,
+            line: input.command.line,
+            command: input.command.command
+        },
+        {
+            kind: "package-script",
+            label: `package.json scripts.${input.script.name}`,
+            filePath: input.script.packagePath,
+            line: input.script.line,
+            command: input.script.command
+        }
+    ];
+    const scriptFiles = extractReferencedScriptFiles(input.script.command, input.script.packagePath, input.filePaths);
+    for (const scriptFile of scriptFiles) {
+        nodes.push({
+            kind: "script-file",
+            label: "关联脚本文件",
+            filePath: scriptFile,
+            line: 1
+        });
+    }
+    const chainFindings = input.findings.filter((finding) => {
+        if (finding.filePath === input.script.packagePath && Math.abs(finding.line - input.script.line) <= 1) {
+            return true;
+        }
+        return scriptFiles.includes(finding.filePath);
+    });
+    for (const finding of chainFindings.slice(0, 6)) {
+        nodes.push({
+            kind: "finding",
+            label: finding.title,
+            filePath: finding.filePath,
+            line: finding.line,
+            command: finding.snippet
+        });
+    }
+    return {
+        id: `${input.idPrefix}:${input.command.filePath}:${input.command.line}:${input.script.packagePath}:${input.script.name}`,
+        title: input.title,
+        risk: maxSeverity(chainFindings, input.script.name),
+        summary: input.summary,
+        nodes,
+        findings: chainFindings,
+        safeCommand: input.safeCommand,
+        recommendation: input.recommendation
+    };
+}
+function extractReadmeCommands(filePath, content) {
+    const lines = content.split(/\r?\n/);
+    const commands = [];
+    let inCodeBlock = false;
+    let codeFenceLanguage = "";
+    for (const [index, rawLine] of lines.entries()) {
+        const line = rawLine.trim();
+        const fence = /^```([A-Za-z0-9_-]*)/.exec(line);
+        if (fence) {
+            inCodeBlock = !inCodeBlock;
+            codeFenceLanguage = inCodeBlock ? fence[1].toLowerCase() : "";
+            continue;
+        }
+        if (!line || line.startsWith("#")) {
+            continue;
+        }
+        const command = normalizePromptPrefix(line);
+        if (inCodeBlock && isCommandLike(command, codeFenceLanguage)) {
+            commands.push({
+                filePath,
+                line: index + 1,
+                command
+            });
+            continue;
+        }
+        if (!inCodeBlock && /`[^`]*(npm|pnpm|yarn|bun|pip|docker)[^`]*`/.test(line)) {
+            const inlineCommands = [...line.matchAll(/`([^`]+)`/g)].map((match) => normalizePromptPrefix(match[1]));
+            for (const inlineCommand of inlineCommands) {
+                if (isCommandLike(inlineCommand, "")) {
+                    commands.push({
+                        filePath,
+                        line: index + 1,
+                        command: inlineCommand
+                    });
+                }
+            }
+        }
+    }
+    return commands;
+}
+function extractPackageScripts(filePath, content) {
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        return [];
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return [];
+    }
+    const scripts = parsed.scripts;
+    if (!scripts || typeof scripts !== "object" || Array.isArray(scripts)) {
+        return [];
+    }
+    return Object.entries(scripts)
+        .filter((entry) => typeof entry[1] === "string")
+        .map(([name, command]) => ({
+        packagePath: filePath,
+        name,
+        command,
+        line: findJsonKeyLine(content, name)
+    }));
+}
+function isReadme(filePath) {
+    return path.basename(filePath).toLowerCase().startsWith("readme");
+}
+function normalizePromptPrefix(line) {
+    return line.replace(/^[$>]\s+/, "").trim();
+}
+function isCommandLike(command, language) {
+    if (language && !["bash", "shell", "sh", "zsh", "powershell", "ps1", "text", ""].includes(language)) {
+        return false;
+    }
+    return /^(npm|pnpm|yarn|bun|npx|pip|python|docker|docker-compose)\b/.test(command);
+}
+function isPackageInstallCommand(command) {
+    return /^(npm|pnpm)\s+(install|i)(\s|$)/.test(command) || /^yarn\s+(install)?(\s|$)/.test(command) || /^bun\s+install(\s|$)/.test(command);
+}
+function extractPackageRunScriptName(command) {
+    const npmMatch = /^(npm|pnpm)\s+run\s+([A-Za-z0-9:_-]+)/.exec(command);
+    if (npmMatch) {
+        return npmMatch[2];
+    }
+    const yarnMatch = /^yarn\s+([A-Za-z0-9:_-]+)/.exec(command);
+    if (yarnMatch && yarnMatch[1] !== "install") {
+        return yarnMatch[1];
+    }
+    return undefined;
+}
+function extractReferencedScriptFiles(command, packagePath, filePaths) {
+    const packageDir = path.posix.dirname(packagePath);
+    const candidates = [
+        ...command.matchAll(/\b(?:bash|sh|zsh|source|\.)\s+([^\s;&|]+\.sh)\b/g),
+        ...command.matchAll(/\bnode\s+([^\s;&|]+\.js)\b/g),
+        ...command.matchAll(/\bpython(?:3)?\s+([^\s;&|]+\.py)\b/g)
+    ].map((match) => normalizeRelativeScriptPath(packageDir, match[1]));
+    return [...new Set(candidates.filter((candidate) => filePaths.has(candidate)))];
+}
+function normalizeRelativeScriptPath(packageDir, scriptPath) {
+    const cleanPath = scriptPath.replace(/^['"]|['"]$/g, "");
+    if (packageDir === ".") {
+        return cleanPath.replace(/\\/g, "/").replace(/^\.\//, "");
+    }
+    return path.posix.normalize(path.posix.join(packageDir, cleanPath)).replace(/^\.\//, "");
+}
+function findJsonKeyLine(content, key) {
+    const lines = content.split(/\r?\n/);
+    const keyPattern = new RegExp(`"${escapeRegExp(key)}"\\s*:`);
+    for (const [index, line] of lines.entries()) {
+        if (keyPattern.test(line)) {
+            return index + 1;
+        }
+    }
+    return 1;
+}
+function safeInstallCommand(command) {
+    if (/^pnpm\s+/.test(command)) {
+        return "pnpm install --ignore-scripts";
+    }
+    if (/^yarn\s+/.test(command)) {
+        return "yarn install --ignore-scripts";
+    }
+    if (/^bun\s+/.test(command)) {
+        return "bun install --ignore-scripts";
+    }
+    if (/^npm\s+/.test(command)) {
+        return "npm install --ignore-scripts";
+    }
+    return undefined;
+}
+function maxSeverity(findings, scriptName) {
+    let max = lifecycleScripts.includes(scriptName) ? "high" : "medium";
+    for (const finding of findings) {
+        if (severityRank[finding.severity] > severityRank[max]) {
+            max = finding.severity;
+        }
+    }
+    return max;
+}
+function dedupeChains(chains) {
+    const seen = new Set();
+    return chains.filter((chain) => {
+        if (seen.has(chain.id)) {
+            return false;
+        }
+        seen.add(chain.id);
+        return true;
+    });
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+//# sourceMappingURL=execution.js.map

package/dist/execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.js","sourceRoot":"","sources":["../src/execution.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAiB3C,MAAM,gBAAgB,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;AAE7E,MAAM,UAAU,oBAAoB,CAAC,KAAsB,EAAE,QAAmB;IAC9E,MAAM,cAAc,GAAG,KAAK;SACzB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;SAC7C,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,KAAK;SACzB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;SAC5D,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAqB,EAAE,CAAC;IAEpC,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,IAAI,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CACT,GAAG,kBAAkB,CAAC;gBACpB,OAAO;gBACP,cAAc;gBACd,QAAQ;gBACR,SAAS;aACV,CAAC,CACH,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,UAAU,GAAG,2BAA2B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAEhE,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,GAAG,oBAAoB,CAAC;gBACtB,OAAO;gBACP,UAAU;gBACV,cAAc;gBACd,QAAQ;gBACR,SAAS;aACV,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClE,OAAO,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,KAK3B;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAElG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC9B,gBAAgB,CAAC;QACf,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,mBAAmB,MAAM,CAAC,IAAI,EAAE;QACvC,OAAO,EAAE,aAAa,KAAK,CAAC,OAAO,CAAC,OAAO,6BAA6B,MAAM,CAAC,IAAI,MAAM;QACzF,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM;QACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACtD,cAAc,EAAE,iDAAiD;KAClE,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAM7B;IACC,OAAO,KAAK,CAAC,cAAc;SACxB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC;SACpD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACd,gBAAgB,CAAC;QACf,QAAQ,EAAE,YAAY;QACtB,KAAK,EAAE,4BAA4B,MAAM,CAAC,IAAI,EAAE;QAChD,OAAO,EAAE,aAAa,KAAK,CAAC,OAAO,CAAC,OAAO,uBAAuB,MAAM,CAAC,IAAI,MAAM;QACnF,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM;QACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,6CAA6C;KAC9D,CAAC,CACH,CAAC;AACN,CAAC;AAED,SAAS,gBAAgB,CAAC,KAUzB;IACC,MAAM,KAAK,GAAoB;QAC7B;YACE,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,gBAAgB;YACvB,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;YAChC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;SAC/B;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,wBAAwB,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE;YAClD,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;YAClC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;YACvB,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;SAC9B;KACF,CAAC;IACF,MAAM,WAAW,GAAG,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAElH,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,QAAQ;YACf,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;QACtD,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrG,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE;QACxH,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;QACnD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK;QACL,QAAQ,EAAE,aAAa;QACvB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB,EAAE,OAAe;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,iBAAiB,GAAG,EAAE,CAAC;IAE3B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEhD,IAAI,KAAK,EAAE,CAAC;YACV,WAAW,GAAG,CAAC,WAAW,CAAC;YAC3B,iBAAiB,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,SAAS;QACX,CAAC;QAED,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE5C,IAAI,WAAW,IAAI,aAAa,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC7D,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ;gBACR,IAAI,EAAE,KAAK,GAAG,CAAC;gBACf,OAAO;aACR,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,CAAC,WAAW,IAAI,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5E,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAExG,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;gBAC3C,IAAI,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC;oBACrC,QAAQ,CAAC,IAAI,CAAC;wBACZ,QAAQ;wBACR,IAAI,EAAE,KAAK,GAAG,CAAC;wBACf,OAAO,EAAE,aAAa;qBACvB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB,EAAE,OAAe;IAC9D,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAI,MAAgC,CAAC,OAAO,CAAC;IAE1D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SAC3B,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;SAC1E,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,WAAW,EAAE,QAAQ;QACrB,IAAI;QACJ,OAAO;QACP,IAAI,EAAE,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC;KACrC,CAAC,CAAC,CAAC;AACR,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,QAAgB;IACtD,IAAI,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpG,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,6DAA6D,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe;IAC9C,OAAO,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC7I,CAAC;AAED,SAAS,2BAA2B,CAAC,OAAe;IAClD,MAAM,QAAQ,GAAG,uCAAuC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEvE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,SAAS,GAAG,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE5D,IAAI,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,4BAA4B,CAAC,OAAe,EAAE,WAAmB,EAAE,SAAsB;IAChG,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG;QACjB,GAAG,OAAO,CAAC,QAAQ,CAAC,kDAAkD,CAAC;QACvE,GAAG,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QAClD,GAAG,OAAO,CAAC,QAAQ,CAAC,qCAAqC,CAAC;KAC3D,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,2BAA2B,CAAC,UAAkB,EAAE,UAAkB;IACzE,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAEzD,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,GAAW;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE7D,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,+BAA+B,CAAC;IACzC,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,+BAA+B,CAAC;IACzC,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,8BAA8B,CAAC;IACxC,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,8BAA8B,CAAC;IACxC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,QAAmB,EAAE,UAAkB;IAC1D,IAAI,GAAG,GAAa,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAE9E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,MAAwB;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC"}

package/dist/index.js

@@ -6,16 +6,18 @@ import { writeReports } from "./report.js";
 import { loadRules } from "./rules.js";
 import { runScan } from "./scanner.js";
 import { resolveTarget } from "./target.js";
+import { loadAgentSafeConfig } from "./user-config.js";
 const program = new Command();
 program
     .name("agentsafe")
     .description("AI Agent 开源项目安装前安全体检工具")
-    .version("0.1.0");
+    .version("0.3.1");
 program
     .command("scan")
     .argument("<target>", "本地目录或 Git 仓库 URL")
     .option("-o, --out-dir <dir>", "报告输出目录", defaultReportDir)
     .option("--allow-domain <domain...>", "允许的可信域名，可传多个")
+    .option("-c, --config <path>", "指定 .agentsaferc.json 配置文件路径")
     .option("--git-binary <path>", "Git 可执行文件路径")
     .action(async (target, options) => {
     let cleanup;
@@ -23,17 +25,23 @@ program
         const resolved = await resolveTarget(target, options.gitBinary);
         cleanup = resolved.cleanup;
         const rules = await loadRules(defaultRulesPath);
+        const config = await loadAgentSafeConfig({
+            rootDir: resolved.rootDir,
+            configPath: options.config,
+            cliAllowDomains: options.allowDomain ?? []
+        });
         const report = await runScan({
             target: resolved.original,
             rootDir: resolved.rootDir,
             rules,
-            allowDomains: options.allowDomain ?? []
+            config
         });
         const outDir = path.resolve(options.outDir);
         const paths = await writeReports(report, outDir);
         console.log(`AgentSafe 扫描完成：${report.summary.totalFindings} 个风险项，风险分 ${report.summary.score}/100`);
         console.log(`Markdown 报告：${paths.markdownPath}`);
         console.log(`JSON 报告：${paths.jsonPath}`);
+        console.log(`HTML 报告：${paths.htmlPath}`);
         if (report.summary.bySeverity.block > 0) {
             process.exitCode = 2;
         }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,WAAW,CAAC;KACjB,WAAW,CAAC,wBAAwB,CAAC;KACrC,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;KACxC,MAAM,CAAC,qBAAqB,EAAE,QAAQ,EAAE,gBAAgB,CAAC;KACzD,MAAM,CAAC,4BAA4B,EAAE,cAAc,CAAC;KACpD,MAAM,CAAC,qBAAqB,EAAE,aAAa,CAAC;KAC5C,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,OAI9B,EAAE,EAAE;IACH,IAAI,OAA0C,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAChE,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAE3B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;YAC3B,MAAM,EAAE,QAAQ,CAAC,QAAQ;YACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,KAAK;YACL,YAAY,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;SACxC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAEjD,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,OAAO,CAAC,aAAa,aAAa,MAAM,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,CAAC;QACnG,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEzC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,KAAK,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,EAAE,CAAC;IACpB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,WAAW,CAAC;KACjB,WAAW,CAAC,wBAAwB,CAAC;KACrC,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;KACxC,MAAM,CAAC,qBAAqB,EAAE,QAAQ,EAAE,gBAAgB,CAAC;KACzD,MAAM,CAAC,4BAA4B,EAAE,cAAc,CAAC;KACpD,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,CAAC;KAC5D,MAAM,CAAC,qBAAqB,EAAE,aAAa,CAAC;KAC5C,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,OAK9B,EAAE,EAAE;IACH,IAAI,OAA0C,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAChE,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAE3B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACvC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU,EAAE,OAAO,CAAC,MAAM;YAC1B,eAAe,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;SAC3C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;YAC3B,MAAM,EAAE,QAAQ,CAAC,QAAQ;YACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,KAAK;YACL,MAAM;SACP,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAEjD,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,OAAO,CAAC,aAAa,aAAa,MAAM,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,CAAC;QACnG,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEzC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,KAAK,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,EAAE,CAAC;IACpB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/prompts.d.ts

@@ -1,3 +1,3 @@
-import type { Finding } from "./types.js";
+import type { ExecutionChain, Finding } from "./types.js";
 export declare function generateRecommendations(findings: Finding[]): string[];
-export declare function generateAgentPrompt(findings: Finding[]): string;
+export declare function generateAgentPrompt(findings: Finding[], executionChains?: ExecutionChain[]): string;

package/dist/prompts.js

@@ -18,7 +18,7 @@ export function generateRecommendations(findings) {
     recommendations.add("给 Agent 的执行权限应保持最小化：禁止自动运行 curl|bash、postinstall、未知脚本和需要 sudo 的命令。");
     return [...recommendations];
 }
-export function generateAgentPrompt(findings) {
+export function generateAgentPrompt(findings, executionChains = []) {
     const blocked = findings.filter((finding) => finding.severity === "block");
     const high = findings.filter((finding) => finding.severity === "high");
     const riskyItems = [...blocked, ...high].slice(0, 8);
@@ -27,6 +27,12 @@ export function generateAgentPrompt(findings) {
             .map((finding) => `- ${finding.filePath}:${finding.line} 命中 ${finding.title}，不要自动运行相关命令。`)
             .join("\n")
         : "- 暂未发现阻断/高风险命中，但仍需逐条解释命令后再请求用户确认。";
+    const chainText = executionChains.length
+        ? executionChains
+            .slice(0, 5)
+            .map((chain) => `- ${chain.title}：${chain.summary}`)
+            .join("\n")
+        : "- 暂未推断出 README 到 package scripts 的高风险执行链。";
     return [
         "你是 AI 编程 Agent。接下来处理该项目时必须遵守：",
         "",
@@ -36,7 +42,10 @@ export function generateAgentPrompt(findings) {
         "4. 如命令会访问 SSH、云厂商凭据、.env、浏览器目录或上传文件，必须停止并请求用户确认。",
         "",
         "本次扫描需特别注意：",
-        riskyText
+        riskyText,
+        "",
+        "推断出的 Agent 执行链：",
+        chainText
     ].join("\n");
 }
 //# sourceMappingURL=prompts.js.map

package/dist/prompts.js.map

@@ -1 +1 @@
-{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,uBAAuB,CAAC,QAAmB;IACzD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;QAC7D,eAAe,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,mBAAmB,CAAC,EAAE,CAAC;QACzE,eAAe,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,sBAAsB,CAAC,EAAE,CAAC;QAC5E,eAAe,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,mBAAmB,CAAC,EAAE,CAAC;QACzE,eAAe,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,eAAe,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IAC9D,CAAC;IAED,eAAe,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;IAE1F,OAAO,CAAC,GAAG,eAAe,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAmB;IACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM;QACjC,CAAC,CAAC,UAAU;aACT,GAAG,CACF,CAAC,OAAO,EAAE,EAAE,CACV,KAAK,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,KAAK,cAAc,CAC1E;aACA,IAAI,CAAC,IAAI,CAAC;QACb,CAAC,CAAC,mCAAmC,CAAC;IAExC,OAAO;QACL,+BAA+B;QAC/B,EAAE;QACF,sFAAsF;QACtF,yCAAyC;QACzC,oCAAoC;QACpC,kDAAkD;QAClD,EAAE;QACF,YAAY;QACZ,SAAS;KACV,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,uBAAuB,CAAC,QAAmB;IACzD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;QAC7D,eAAe,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,mBAAmB,CAAC,EAAE,CAAC;QACzE,eAAe,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,sBAAsB,CAAC,EAAE,CAAC;QAC5E,eAAe,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,mBAAmB,CAAC,EAAE,CAAC;QACzE,eAAe,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,eAAe,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IAC9D,CAAC;IAED,eAAe,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;IAE1F,OAAO,CAAC,GAAG,eAAe,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAmB,EAAE,kBAAoC,EAAE;IAC7F,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM;QACjC,CAAC,CAAC,UAAU;aACT,GAAG,CACF,CAAC,OAAO,EAAE,EAAE,CACV,KAAK,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,KAAK,cAAc,CAC1E;aACA,IAAI,CAAC,IAAI,CAAC;QACb,CAAC,CAAC,mCAAmC,CAAC;IACxC,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM;QACtC,CAAC,CAAC,eAAe;aACd,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;aACnD,IAAI,CAAC,IAAI,CAAC;QACb,CAAC,CAAC,2CAA2C,CAAC;IAEhD,OAAO;QACL,+BAA+B;QAC/B,EAAE;QACF,sFAAsF;QACtF,yCAAyC;QACzC,oCAAoC;QACpC,kDAAkD;QAClD,EAAE;QACF,YAAY;QACZ,SAAS;QACT,EAAE;QACF,iBAAiB;QACjB,SAAS;KACV,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/report.d.ts

@@ -2,5 +2,7 @@ import type { ScanReport } from "./types.js";
 export declare function writeReports(report: ScanReport, outDir: string): Promise<{
     markdownPath: string;
     jsonPath: string;
+    htmlPath: string;
 }>;
 export declare function renderMarkdownReport(report: ScanReport): string;
+export declare function renderHtmlReport(report: ScanReport): string;

package/dist/report.js

@@ -10,11 +10,14 @@ export async function writeReports(report, outDir) {
     await fs.mkdir(outDir, { recursive: true });
     const markdownPath = path.join(outDir, "report.md");
     const jsonPath = path.join(outDir, "report.json");
+    const htmlPath = path.join(outDir, "report.html");
     await fs.writeFile(markdownPath, renderMarkdownReport(report), "utf8");
     await fs.writeFile(jsonPath, `${JSON.stringify(report, null, 2)}\n`, "utf8");
+    await fs.writeFile(htmlPath, renderHtmlReport(report), "utf8");
     return {
         markdownPath,
-        jsonPath
+        jsonPath,
+        htmlPath
     };
 }
 export function renderMarkdownReport(report) {
@@ -41,9 +44,18 @@ export function renderMarkdownReport(report) {
         "",
         ...report.recommendations.map((item) => `- ${item}`),
         "",
-        "## 风险明细",
+        "## Agent 执行链推断",
         ""
     ];
+    if (!report.executionChains.length) {
+        lines.push("暂未推断出 README 到 package scripts 的执行链。", "");
+    }
+    else {
+        for (const chain of report.executionChains) {
+            lines.push(...renderExecutionChain(chain));
+        }
+    }
+    lines.push("## 风险明细", "");
     if (!report.findings.length) {
         lines.push("未发现内置规则命中的风险项。", "");
     }
@@ -52,9 +64,119 @@ export function renderMarkdownReport(report) {
             lines.push(...renderFinding(finding));
         }
     }
-    lines.push("## 给 AI 编程 Agent 的安全执行提示", "", "```text", report.agentPrompt, "```", "", "## 已扫描文件", "", "| 文件 | 字节 | 命中数 |", "| --- | ---: | ---: |", ...report.scannedFiles.map((file) => `| ${file.path} | ${file.bytes} | ${file.matchedFindings} |`), "");
+    lines.push("## 给 AI 编程 Agent 的安全执行提示", "", "```text", report.agentPrompt, "```", "", "## 已扫描文件", "", "| 文件 | 字节 | 命中数 |", "| --- | ---: | ---: |", ...report.scannedFiles.map((file) => `| ${file.path} | ${file.bytes} | ${file.matchedFindings} |`), "", "## 生效配置", "", `- allowDomains：${report.config.allowDomains.length ? report.config.allowDomains.join(", ") : "无"}`, `- ignoreRules：${report.config.ignoreRules.length ? report.config.ignoreRules.join(", ") : "无"}`, `- ignorePaths：${report.config.ignorePaths.length ? report.config.ignorePaths.join(", ") : "无"}`, `- severityOverrides：${Object.keys(report.config.severityOverrides).length ? JSON.stringify(report.config.severityOverrides) : "无"}`, "");
     return lines.join("\n");
 }
+export function renderHtmlReport(report) {
+    const findingRows = report.findings.length
+        ? report.findings.map((finding) => `
+      <article class="finding finding-${finding.severity}">
+        <div class="finding-head">
+          <span class="badge">${severityZh[finding.severity]}</span>
+          <h3>${escapeHtml(finding.title)}</h3>
+        </div>
+        <p class="meta">${escapeHtml(finding.filePath)}:${finding.line}:${finding.column} · ${escapeHtml(finding.ruleId)} · ${escapeHtml(finding.category)}</p>
+        <p>${escapeHtml(finding.explainZh)}</p>
+        <p class="advice">${escapeHtml(finding.safeFix)}</p>
+        <pre>${escapeHtml(finding.snippet)}</pre>
+      </article>`).join("\n")
+        : "<p>未发现内置规则命中的风险项。</p>";
+    const chainRows = report.executionChains.length
+        ? report.executionChains.map((chain) => `
+      <article class="chain chain-${chain.risk}">
+        <div class="finding-head">
+          <span class="badge">${severityZh[chain.risk]}</span>
+          <h3>${escapeHtml(chain.title)}</h3>
+        </div>
+        <p>${escapeHtml(chain.summary)}</p>
+        ${chain.safeCommand ? `<p class="safe-command">建议替代命令：<code>${escapeHtml(chain.safeCommand)}</code></p>` : ""}
+        <ol>
+          ${chain.nodes.map((node) => `<li><strong>${escapeHtml(node.label)}</strong> <span>${escapeHtml(node.filePath)}:${node.line}</span>${node.command ? `<pre>${escapeHtml(node.command)}</pre>` : ""}</li>`).join("\n")}
+        </ol>
+        <p class="advice">${escapeHtml(chain.recommendation)}</p>
+      </article>`).join("\n")
+        : "<p>暂未推断出 README 到 package scripts 的执行链。</p>";
+    return `<!doctype html>
+<html lang="zh-CN">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>AgentSafe 风险报告</title>
+  <style>
+    :root { color-scheme: light; --text: #18212f; --muted: #5c6675; --line: #d9dee7; --bg: #f6f8fb; --panel: #ffffff; --block: #b42318; --high: #b54708; --medium: #175cd3; --low: #067647; }
+    body { margin: 0; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; background: var(--bg); color: var(--text); }
+    main { max-width: 1120px; margin: 0 auto; padding: 32px 20px 56px; }
+    header { border-bottom: 1px solid var(--line); padding-bottom: 20px; margin-bottom: 24px; }
+    h1 { margin: 0 0 12px; font-size: 32px; }
+    h2 { margin-top: 32px; font-size: 22px; }
+    h3 { margin: 0; font-size: 17px; }
+    .summary { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); gap: 12px; margin: 20px 0; }
+    .metric, article, .prompt, .config { background: var(--panel); border: 1px solid var(--line); border-radius: 8px; padding: 16px; }
+    .metric strong { display: block; font-size: 28px; }
+    .muted, .meta { color: var(--muted); }
+    .finding, .chain { margin: 14px 0; }
+    .finding-head { display: flex; align-items: center; gap: 10px; }
+    .badge { color: #fff; border-radius: 999px; padding: 3px 9px; font-size: 12px; background: var(--medium); }
+    .finding-block .badge, .chain-block .badge { background: var(--block); }
+    .finding-high .badge, .chain-high .badge { background: var(--high); }
+    .finding-low .badge, .chain-low .badge { background: var(--low); }
+    pre { overflow: auto; white-space: pre-wrap; word-break: break-word; background: #111827; color: #f9fafb; border-radius: 6px; padding: 12px; }
+    .prompt { background: #f3f4f6; color: var(--text); font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace; }
+    code { background: #eef2f7; padding: 2px 5px; border-radius: 4px; }
+    .advice, .safe-command { font-weight: 600; }
+    ol { padding-left: 22px; }
+    li { margin: 10px 0; }
+  </style>
+</head>
+<body>
+  <main>
+    <header>
+      <h1>AgentSafe 风险报告</h1>
+      <p class="muted">${escapeHtml(report.target)} · ${escapeHtml(report.scannedAt)}</p>
+    </header>
+    <section class="summary">
+      <div class="metric"><span>风险分</span><strong>${report.summary.score}/100</strong></div>
+      <div class="metric"><span>风险项</span><strong>${report.summary.totalFindings}</strong></div>
+      <div class="metric"><span>阻断</span><strong>${report.summary.bySeverity.block}</strong></div>
+      <div class="metric"><span>高风险</span><strong>${report.summary.bySeverity.high}</strong></div>
+      <div class="metric"><span>扫描文件</span><strong>${report.summary.scannedFiles}</strong></div>
+    </section>
+    <h2>建议</h2>
+    <ul>${report.recommendations.map((item) => `<li>${escapeHtml(item)}</li>`).join("")}</ul>
+    <h2>Agent 执行链推断</h2>
+    ${chainRows}
+    <h2>风险明细</h2>
+    ${findingRows}
+    <h2>给 AI 编程 Agent 的安全执行提示</h2>
+    <pre class="prompt">${escapeHtml(report.agentPrompt)}</pre>
+    <h2>生效配置</h2>
+    <div class="config">
+      <p>allowDomains：${escapeHtml(report.config.allowDomains.join(", ") || "无")}</p>
+      <p>ignoreRules：${escapeHtml(report.config.ignoreRules.join(", ") || "无")}</p>
+      <p>ignorePaths：${escapeHtml(report.config.ignorePaths.join(", ") || "无")}</p>
+      <p>severityOverrides：${escapeHtml(JSON.stringify(report.config.severityOverrides))}</p>
+    </div>
+  </main>
+</body>
+</html>`;
+}
+function renderExecutionChain(chain) {
+    const lines = [
+        `### ${severityZh[chain.risk]}：${chain.title}`,
+        "",
+        `- 摘要：${chain.summary}`,
+        `- 建议：${chain.recommendation}`
+    ];
+    if (chain.safeCommand) {
+        lines.push(`- 建议替代命令：\`${chain.safeCommand}\``);
+    }
+    lines.push("", "| 步骤 | 位置 | 命令/内容 |", "| --- | --- | --- |");
+    for (const node of chain.nodes) {
+        lines.push(`| ${node.label} | ${node.filePath}:${node.line} | ${escapeMarkdownTable(node.command ?? "")} |`);
+    }
+    lines.push("");
+    return lines;
+}
 function renderFinding(finding) {
     return [
         `### ${severityZh[finding.severity]}：${finding.title}`,
@@ -71,4 +193,14 @@ function renderFinding(finding) {
         ""
     ];
 }
+function escapeMarkdownTable(value) {
+    return value.replace(/\|/g, "\\|").replace(/\r?\n/g, " ");
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}
 //# sourceMappingURL=report.js.map

package/dist/report.js.map

@@ -1 +1 @@
-{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,UAAU,GAA6B;IAC3C,GAAG,EAAE,GAAG;IACR,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,GAAG;IACT,KAAK,EAAE,IAAI;CACZ,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAkB,EAAE,MAAc;IAInE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAElD,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACvE,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAE7E,OAAO;QACL,YAAY;QACZ,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,MAAM,KAAK,GAAG;QACZ,kBAAkB;QAClB,EAAE;QACF,UAAU,MAAM,CAAC,MAAM,EAAE;QACzB,UAAU,MAAM,CAAC,OAAO,EAAE;QAC1B,UAAU,MAAM,CAAC,SAAS,EAAE;QAC5B,SAAS,MAAM,CAAC,OAAO,CAAC,KAAK,MAAM;QACnC,WAAW,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE;QACxC,WAAW,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE;QACzC,EAAE;QACF,WAAW;QACX,EAAE;QACF,aAAa;QACb,gBAAgB;QAChB,UAAU,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI;QAC7C,SAAS,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI;QAC3C,SAAS,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,IAAI;QAC7C,SAAS,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI;QAC1C,EAAE;QACF,OAAO;QACP,EAAE;QACF,GAAG,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QACpD,EAAE;QACF,SAAS;QACT,EAAE;KACH,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CACR,0BAA0B,EAC1B,EAAE,EACF,SAAS,EACT,MAAM,CAAC,WAAW,EAClB,KAAK,EACL,EAAE,EACF,UAAU,EACV,EAAE,EACF,mBAAmB,EACnB,uBAAuB,EACvB,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,eAAe,IAAI,CAAC,EAClG,EAAE,CACH,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,OAAgB;IACrC,OAAO;QACL,OAAO,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE;QACtD,EAAE;QACF,QAAQ,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE;QAC5D,QAAQ,OAAO,CAAC,MAAM,EAAE;QACxB,QAAQ,OAAO,CAAC,QAAQ,EAAE;QAC1B,QAAQ,OAAO,CAAC,SAAS,EAAE;QAC3B,QAAQ,OAAO,CAAC,OAAO,EAAE;QACzB,EAAE;QACF,SAAS;QACT,OAAO,CAAC,OAAO;QACf,KAAK;QACL,EAAE;KACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,UAAU,GAA6B;IAC3C,GAAG,EAAE,GAAG;IACR,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,GAAG;IACT,KAAK,EAAE,IAAI;CACZ,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAkB,EAAE,MAAc;IAKnE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAElD,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACvE,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7E,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAE/D,OAAO;QACL,YAAY;QACZ,QAAQ;QACR,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,MAAM,KAAK,GAAG;QACZ,kBAAkB;QAClB,EAAE;QACF,UAAU,MAAM,CAAC,MAAM,EAAE;QACzB,UAAU,MAAM,CAAC,OAAO,EAAE;QAC1B,UAAU,MAAM,CAAC,SAAS,EAAE;QAC5B,SAAS,MAAM,CAAC,OAAO,CAAC,KAAK,MAAM;QACnC,WAAW,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE;QACxC,WAAW,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE;QACzC,EAAE;QACF,WAAW;QACX,EAAE;QACF,aAAa;QACb,gBAAgB;QAChB,UAAU,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI;QAC7C,SAAS,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI;QAC3C,SAAS,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,IAAI;QAC7C,SAAS,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI;QAC1C,EAAE;QACF,OAAO;QACP,EAAE;QACF,GAAG,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QACpD,EAAE;QACF,gBAAgB;QAChB,EAAE;KACH,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CACR,SAAS,EACT,EAAE,CACH,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CACR,0BAA0B,EAC1B,EAAE,EACF,SAAS,EACT,MAAM,CAAC,WAAW,EAClB,KAAK,EACL,EAAE,EACF,UAAU,EACV,EAAE,EACF,mBAAmB,EACnB,uBAAuB,EACvB,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,eAAe,IAAI,CAAC,EAClG,EAAE,EACF,SAAS,EACT,EAAE,EACF,kBAAkB,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,EACnG,iBAAiB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,EAChG,iBAAiB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,EAChG,uBAAuB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,EACpI,EAAE,CACH,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAkB;IACjD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM;QACxC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;wCACC,OAAO,CAAC,QAAQ;;gCAExB,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC5C,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;;0BAEf,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC;aAC7I,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC;4BACd,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC;eACxC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC;iBACzB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACzB,CAAC,CAAC,uBAAuB,CAAC;IAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM;QAC7C,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;oCACR,KAAK,CAAC,IAAI;;gCAEd,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;gBACtC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;;aAE1B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;UAC5B,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,wCAAwC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;;YAEzG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;4BAEjM,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC;iBAC3C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACzB,CAAC,CAAC,6CAA6C,CAAC;IAElD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAoCgB,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;;;oDAGhC,MAAM,CAAC,OAAO,CAAC,KAAK;oDACpB,MAAM,CAAC,OAAO,CAAC,aAAa;mDAC7B,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK;oDAC9B,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI;qDAC7B,MAAM,CAAC,OAAO,CAAC,YAAY;;;UAGtE,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;;MAEjF,SAAS;;MAET,WAAW;;0BAES,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC;;;wBAGhC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;uBACzD,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;uBACvD,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;6BACjD,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;;;;QAIhF,CAAC;AACT,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA4C;IACxE,MAAM,KAAK,GAAG;QACZ,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE;QAC9C,EAAE;QACF,QAAQ,KAAK,CAAC,OAAO,EAAE;QACvB,QAAQ,KAAK,CAAC,cAAc,EAAE;KAC/B,CAAC;IAEF,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,cAAc,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;IAE7D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,MAAM,mBAAmB,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/G,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,OAAgB;IACrC,OAAO;QACL,OAAO,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE;QACtD,EAAE;QACF,QAAQ,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE;QAC5D,QAAQ,OAAO,CAAC,MAAM,EAAE;QACxB,QAAQ,OAAO,CAAC,QAAQ,EAAE;QAC1B,QAAQ,OAAO,CAAC,SAAS,EAAE;QAC3B,QAAQ,OAAO,CAAC,OAAO,EAAE;QACzB,EAAE;QACF,SAAS;QACT,OAAO,CAAC,OAAO;QACf,KAAK;QACL,EAAE;KACH,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC"}

package/dist/scanner.d.ts

@@ -1,8 +1,9 @@
-import type { Rule, ScanReport } from "./types.js";
+import type { AgentSafeConfig, Rule, ScanReport } from "./types.js";
 export interface RunScanInput {
     target: string;
     rootDir: string;
     rules: Rule[];
     allowDomains?: string[];
+    config?: AgentSafeConfig;
 }
 export declare function runScan(input: RunScanInput): Promise<ScanReport>;

package/dist/scanner.js

@@ -1,9 +1,11 @@
 import picomatch from "picomatch";
 import { severityRank, severityWeight } from "./config.js";
 import { allMatchedDomainsAllowed } from "./domain.js";
+import { buildExecutionChains } from "./execution.js";
 import { collectFiles } from "./files.js";
 import { generateAgentPrompt, generateRecommendations } from "./prompts.js";
 import { scanStructuredFile } from "./structured.js";
+import { defaultAgentSafeConfig } from "./user-config.js";
 const emptySeverityCounts = {
     low: 0,
     medium: 0,
@@ -11,11 +13,12 @@ const emptySeverityCounts = {
     block: 0
 };
 export async function runScan(input) {
-    const files = await collectFiles(input.rootDir);
+    const config = mergeScanConfig(input.config, input.allowDomains ?? []);
+    const files = (await collectFiles(input.rootDir)).filter((file) => !matchesAnyGlob(file.relativePath, config.ignorePaths));
     const findings = [];
     const scannedFiles = [];
     for (const file of files) {
-        const fileFindings = [
+        const fileFindings = applyFindingConfig([
             ...scanStructuredFile({
                 relativePath: file.relativePath,
                 content: file.content,
@@ -25,9 +28,9 @@ export async function runScan(input) {
                 relativePath: file.relativePath,
                 content: file.content,
                 rules: input.rules,
-                allowDomains: input.allowDomains ?? []
+                allowDomains: config.allowDomains
             })
-        ];
+        ], config);
         findings.push(...fileFindings);
         scannedFiles.push({
             path: file.relativePath,
@@ -36,6 +39,7 @@ export async function runScan(input) {
         });
     }
     const sortedFindings = sortFindings(findings);
+    const executionChains = buildExecutionChains(files, sortedFindings);
     const summary = summarize(sortedFindings, scannedFiles.length);
     return {
         target: input.target,
@@ -43,9 +47,11 @@ export async function runScan(input) {
         scannedAt: new Date().toISOString(),
         summary,
         findings: sortedFindings,
+        executionChains,
         scannedFiles,
         recommendations: generateRecommendations(sortedFindings),
-        agentPrompt: generateAgentPrompt(sortedFindings)
+        agentPrompt: generateAgentPrompt(sortedFindings, executionChains),
+        config
     };
 }
 function scanContent(input) {
@@ -91,6 +97,25 @@ function scanContent(input) {
 function matchesAnyGlob(filePath, globs) {
     return globs.some((glob) => picomatch.isMatch(filePath, glob, { dot: true }));
 }
+function mergeScanConfig(config, cliAllowDomains) {
+    return {
+        allowDomains: [
+            ...(config?.allowDomains ?? defaultAgentSafeConfig.allowDomains),
+            ...cliAllowDomains
+        ],
+        ignoreRules: config?.ignoreRules ?? defaultAgentSafeConfig.ignoreRules,
+        ignorePaths: config?.ignorePaths ?? defaultAgentSafeConfig.ignorePaths,
+        severityOverrides: config?.severityOverrides ?? defaultAgentSafeConfig.severityOverrides
+    };
+}
+function applyFindingConfig(findings, config) {
+    return findings
+        .filter((finding) => !config.ignoreRules.includes(finding.ruleId))
+        .map((finding) => ({
+        ...finding,
+        severity: config.severityOverrides[finding.ruleId] ?? finding.severity
+    }));
+}
 function compactSnippet(line) {
     const normalized = line.trim().replace(/\s+/g, " ");
     return normalized.length > 240 ? `${normalized.slice(0, 237)}...` : normalized;

package/dist/scanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAGrD,MAAM,mBAAmB,GAA6B;IACpD,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;CACT,CAAC;AASF,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAmB;IAC/C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAkB,EAAE,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,YAAY,GAAG;YACnB,GAAG,kBAAkB,CAAC;gBACpB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC;YACF,GAAG,WAAW,CAAC;gBACb,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;aACvC,CAAC;SACH,CAAC;QAEF,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAC/B,YAAY,CAAC,IAAI,CAAC;YAChB,IAAI,EAAE,IAAI,CAAC,YAAY;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,eAAe,EAAE,YAAY,CAAC,MAAM;SACrC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,cAAc,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,SAAS,CAAC,cAAc,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IAE/D,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO;QACP,QAAQ,EAAE,cAAc;QACxB,YAAY;QACZ,eAAe,EAAE,uBAAuB,CAAC,cAAc,CAAC;QACxD,WAAW,EAAE,mBAAmB,CAAC,cAAc,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAKpB;IACC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE3C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,EAAE,KAAK,2BAA2B,EAAE,CAAC;YAC5C,SAAS;QACX,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAClF,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAE3E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC5C,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;gBACpB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAE/B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,SAAS;gBACX,CAAC;gBAED,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;gBAErC,IACE,IAAI,CAAC,QAAQ,KAAK,sBAAsB;oBACxC,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,EACrD,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,KAAK,CAAC,YAAY;oBAC5B,IAAI,EAAE,KAAK,GAAG,CAAC;oBACf,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;oBACvB,OAAO;oBACP,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,KAAe;IACvD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;AACjF,CAAC;AAED,SAAS,cAAc,CAAC,QAAmB;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;QACjC,MAAM,GAAG,GAAG;YACV,OAAO,CAAC,MAAM;YACd,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,IAAI;YACZ,OAAO,CAAC,MAAM;YACd,OAAO,CAAC,OAAO;SAChB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,QAAmB;IACvC,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAE1E,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,OAAO,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,QAAmB,EAAE,YAAoB;IAC1D,MAAM,UAAU,GAAG,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAE9C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAElG,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC;QAC9B,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,UAAU;QACV,YAAY;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,mBAAmB,GAA6B;IACpD,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;CACT,CAAC;AAUF,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAmB;IAC/C,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CACtD,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,CACjE,CAAC;IACF,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAkB,EAAE,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,YAAY,GAAG,kBAAkB,CAAC;YACtC,GAAG,kBAAkB,CAAC;gBACpB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC;YACF,GAAG,WAAW,CAAC;gBACb,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC;SACH,EAAE,MAAM,CAAC,CAAC;QAEX,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAC/B,YAAY,CAAC,IAAI,CAAC;YAChB,IAAI,EAAE,IAAI,CAAC,YAAY;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,eAAe,EAAE,YAAY,CAAC,MAAM;SACrC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,cAAc,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,eAAe,GAAG,oBAAoB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,SAAS,CAAC,cAAc,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IAE/D,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO;QACP,QAAQ,EAAE,cAAc;QACxB,eAAe;QACf,YAAY;QACZ,eAAe,EAAE,uBAAuB,CAAC,cAAc,CAAC;QACxD,WAAW,EAAE,mBAAmB,CAAC,cAAc,EAAE,eAAe,CAAC;QACjE,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAKpB;IACC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE3C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,EAAE,KAAK,2BAA2B,EAAE,CAAC;YAC5C,SAAS;QACX,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAClF,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAE3E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC5C,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;gBACpB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAE/B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,SAAS;gBACX,CAAC;gBAED,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;gBAErC,IACE,IAAI,CAAC,QAAQ,KAAK,sBAAsB;oBACxC,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,EACrD,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,KAAK,CAAC,YAAY;oBAC5B,IAAI,EAAE,KAAK,GAAG,CAAC;oBACf,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;oBACvB,OAAO;oBACP,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,KAAe;IACvD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,eAAe,CAAC,MAAmC,EAAE,eAAyB;IACrF,OAAO;QACL,YAAY,EAAE;YACZ,GAAG,CAAC,MAAM,EAAE,YAAY,IAAI,sBAAsB,CAAC,YAAY,CAAC;YAChE,GAAG,eAAe;SACnB;QACD,WAAW,EAAE,MAAM,EAAE,WAAW,IAAI,sBAAsB,CAAC,WAAW;QACtE,WAAW,EAAE,MAAM,EAAE,WAAW,IAAI,sBAAsB,CAAC,WAAW;QACtE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,IAAI,sBAAsB,CAAC,iBAAiB;KACzF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAmB,EAAE,MAAuB;IACtE,OAAO,QAAQ;SACZ,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;SACjE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACjB,GAAG,OAAO;QACV,QAAQ,EAAE,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ;KACvE,CAAC,CAAC,CAAC;AACR,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;AACjF,CAAC;AAED,SAAS,cAAc,CAAC,QAAmB;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;QACjC,MAAM,GAAG,GAAG;YACV,OAAO,CAAC,MAAM;YACd,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,IAAI;YACZ,OAAO,CAAC,MAAM;YACd,OAAO,CAAC,OAAO;SAChB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,QAAmB;IACvC,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAE1E,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,OAAO,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,QAAmB,EAAE,YAAoB;IAC1D,MAAM,UAAU,GAAG,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAE9C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAElG,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC;QAC9B,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,UAAU;QACV,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -33,6 +33,29 @@ export interface Finding {
     explainZh: string;
     safeFix: string;
 }
+export interface AgentSafeConfig {
+    allowDomains: string[];
+    ignoreRules: string[];
+    ignorePaths: string[];
+    severityOverrides: Partial<Record<string, Severity>>;
+}
+export interface ExecutionNode {
+    kind: "readme-command" | "package-script" | "script-file" | "finding";
+    label: string;
+    filePath: string;
+    line: number;
+    command?: string;
+}
+export interface ExecutionChain {
+    id: string;
+    title: string;
+    risk: Severity;
+    summary: string;
+    nodes: ExecutionNode[];
+    findings: Finding[];
+    safeCommand?: string;
+    recommendation: string;
+}
 export interface ScannedFile {
     path: string;
     bytes: number;
@@ -50,15 +73,18 @@ export interface ScanReport {
     scannedAt: string;
     summary: ScanSummary;
     findings: Finding[];
+    executionChains: ExecutionChain[];
     scannedFiles: ScannedFile[];
     agentPrompt: string;
     recommendations: string[];
+    config: AgentSafeConfig;
 }
 export interface ScanOptions {
     target: string;
     outDir?: string;
     allowDomains?: string[];
     gitBinary?: string;
+    configPath?: string;
 }
 export interface ResolvedTarget {
     original: string;

package/dist/user-config.d.ts

@@ -0,0 +1,7 @@
+import type { AgentSafeConfig } from "./types.js";
+export declare const defaultAgentSafeConfig: AgentSafeConfig;
+export declare function loadAgentSafeConfig(input: {
+    rootDir: string;
+    configPath?: string;
+    cliAllowDomains?: string[];
+}): Promise<AgentSafeConfig>;

package/dist/user-config.js

@@ -0,0 +1,58 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+export const defaultAgentSafeConfig = {
+    allowDomains: [],
+    ignoreRules: [],
+    ignorePaths: [],
+    severityOverrides: {}
+};
+export async function loadAgentSafeConfig(input) {
+    const resolvedConfigPath = input.configPath
+        ? path.resolve(input.configPath)
+        : path.join(input.rootDir, ".agentsaferc.json");
+    const raw = await readConfigFile(resolvedConfigPath);
+    return {
+        allowDomains: uniqueValues([
+            ...defaultAgentSafeConfig.allowDomains,
+            ...(raw?.allowDomains ?? []),
+            ...(input.cliAllowDomains ?? [])
+        ]),
+        ignoreRules: uniqueValues([
+            ...defaultAgentSafeConfig.ignoreRules,
+            ...(raw?.ignoreRules ?? [])
+        ]),
+        ignorePaths: uniqueValues([
+            ...defaultAgentSafeConfig.ignorePaths,
+            ...(raw?.ignorePaths ?? [])
+        ]),
+        severityOverrides: {
+            ...defaultAgentSafeConfig.severityOverrides,
+            ...(raw?.severityOverrides ?? {})
+        }
+    };
+}
+async function readConfigFile(configPath) {
+    const content = await fs.readFile(configPath, "utf8").catch((error) => {
+        if (isNotFound(error)) {
+            return undefined;
+        }
+        throw error;
+    });
+    if (!content) {
+        return undefined;
+    }
+    try {
+        return JSON.parse(content);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`配置文件解析失败 ${configPath}: ${message}`);
+    }
+}
+function uniqueValues(values) {
+    return [...new Set(values.filter(Boolean))];
+}
+function isNotFound(error) {
+    return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
+}
+//# sourceMappingURL=user-config.js.map

package/dist/user-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-config.js","sourceRoot":"","sources":["../src/user-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAU7B,MAAM,CAAC,MAAM,sBAAsB,GAAoB;IACrD,YAAY,EAAE,EAAE;IAChB,WAAW,EAAE,EAAE;IACf,WAAW,EAAE,EAAE;IACf,iBAAiB,EAAE,EAAE;CACtB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAIzC;IACC,MAAM,kBAAkB,GAAG,KAAK,CAAC,UAAU;QACzC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,kBAAkB,CAAC,CAAC;IAErD,OAAO;QACL,YAAY,EAAE,YAAY,CAAC;YACzB,GAAG,sBAAsB,CAAC,YAAY;YACtC,GAAG,CAAC,GAAG,EAAE,YAAY,IAAI,EAAE,CAAC;YAC5B,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC;SACjC,CAAC;QACF,WAAW,EAAE,YAAY,CAAC;YACxB,GAAG,sBAAsB,CAAC,WAAW;YACrC,GAAG,CAAC,GAAG,EAAE,WAAW,IAAI,EAAE,CAAC;SAC5B,CAAC;QACF,WAAW,EAAE,YAAY,CAAC;YACxB,GAAG,sBAAsB,CAAC,WAAW;YACrC,GAAG,CAAC,GAAG,EAAE,WAAW,IAAI,EAAE,CAAC;SAC5B,CAAC;QACF,iBAAiB,EAAE;YACjB,GAAG,sBAAsB,CAAC,iBAAiB;YAC3C,GAAG,CAAC,GAAG,EAAE,iBAAiB,IAAI,EAAE,CAAC;SAClC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,UAAkB;IAC9C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC7E,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAuB,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,KAAK,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAgB;IACpC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;AACnG,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentsafe-cli",
-  "version": "0.1.1",
+  "version": "0.3.1",
   "description": "AgentSafe: AI Agent 开源项目安装前安全体检 CLI",
   "type": "module",
   "bin": {
@@ -42,4 +42,4 @@
     "node": ">=20"
   },
   "packageManager": "pnpm@11.7.0"
-}
+}