bounty-guard 0.2.0

package/dist/llm/openai.js

@@ -0,0 +1,193 @@
+import { SEVERITY_RANK } from '../types.js';
+const DEFAULT_BASE_URL = 'https://api.openai.com/v1';
+const DEFAULT_MODEL = 'gpt-4o-mini';
+const DEFAULT_TIMEOUT_MS = 30_000;
+const DEFAULT_RETRIES = 1;
+const DEFAULT_RETRY_BASE_DELAY_MS = 1_000;
+const DEFAULT_MAX_TOKENS = 500;
+const MAX_RETRY_DELAY_MS = 10_000;
+const VERDICTS = ['confirmed', 'false-positive', 'unsure'];
+const SEVERITIES = ['high', 'medium', 'low', 'info'];
+/** 复核提示词：中文、只输出 JSON、严重度只允许下调 */
+const SYSTEM_PROMPT = [
+    '你是代码安全告警的复核员。输入是一条静态规则命中的告警（规则 ID、初判严重度、命中代码行与上下文）。你的职责：',
+    '1. 判断该告警在当前上下文中是否为真实的安全问题；',
+    '2. 给出结论与一句话中文解释；确属问题时可附具体修复建议；',
+    '3. 严重度只能建议下调或维持，禁止上调；不确定时用 unsure，不要猜测。',
+    '判定倾向：宁可漏报不可误报——测试文件、注释、示例代码、占位符、纯静态字符串等非真实风险一律判 false-positive。',
+    '只输出一个 JSON 对象，不要输出任何其他内容，格式：',
+    '{"verdict":"confirmed|false-positive|unsure","severity":"high|medium|low|info","explanation":"一句话中文理由","fixSuggestion":"可选的中文修复建议"}',
+    '其中 verdict 必填；severity 仅在需要下调时给出；fixSuggestion 可选。'
+].join('\n');
+/** 截断上限：控制单条复核的 Token 消耗 */
+const MAX_SNIPPET_CHARS = 400;
+const MAX_CONTEXT_LINES = 6;
+const MAX_CONTEXT_LINE_CHARS = 160;
+/** HTTP 层错误：携带状态码与 Retry-After，供重试策略决策 */
+export class LLMHttpError extends Error {
+    status;
+    retryAfterMs;
+    constructor(status, retryAfterMs, detail) {
+        super(`HTTP ${status}${detail ? `：${detail}` : ''}`);
+        this.status = status;
+        this.retryAfterMs = retryAfterMs;
+    }
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+export class OpenAICompatibleProvider {
+    name;
+    apiKey;
+    baseUrl;
+    model;
+    fetchImpl;
+    timeoutMs;
+    retries;
+    retryBaseDelayMs;
+    maxTokens;
+    constructor(options) {
+        this.apiKey = options.apiKey;
+        this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, '');
+        this.model = options.model ?? DEFAULT_MODEL;
+        this.fetchImpl = options.fetchImpl ?? fetch;
+        this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        this.retries = options.retries ?? DEFAULT_RETRIES;
+        this.retryBaseDelayMs = options.retryBaseDelayMs ?? DEFAULT_RETRY_BASE_DELAY_MS;
+        this.maxTokens = options.maxTokens ?? DEFAULT_MAX_TOKENS;
+        this.name = `openai-compatible:${this.model}`;
+    }
+    async review(request) {
+        const messages = this.buildMessages(request);
+        let lastError = '未知错误';
+        let lastDelayMs = 0;
+        let jsonMode = true;
+        for (let attempt = 0; attempt <= this.retries; attempt++) {
+            if (attempt > 0 && lastDelayMs > 0)
+                await sleep(lastDelayMs);
+            try {
+                const content = await this.chat(messages, { jsonMode, retryNote: attempt > 0 });
+                const parsed = this.parseReview(content, request.severity);
+                if (parsed)
+                    return parsed;
+                lastError = '输出无法解析为合法 JSON';
+                lastDelayMs = 0; // 解析类失败立即重试，无需退避
+            }
+            catch (err) {
+                lastError = err instanceof Error ? err.message : String(err);
+                if (err instanceof LLMHttpError) {
+                    // 供应商不支持 response_format（多见于 400）：关闭 JSON 模式再试
+                    if (err.status === 400 && jsonMode)
+                        jsonMode = false;
+                    lastDelayMs = Math.min(err.retryAfterMs ?? this.retryBaseDelayMs * (attempt + 1), MAX_RETRY_DELAY_MS);
+                }
+                else {
+                    lastDelayMs = Math.min(this.retryBaseDelayMs * (attempt + 1), MAX_RETRY_DELAY_MS);
+                }
+            }
+        }
+        return { verdict: 'unsure', explanation: `LLM 复核失败（${lastError}），保留规则原判` };
+    }
+    /** 组装消息：组件级截断，控制单条复核的 Token 消耗 */
+    buildMessages(request) {
+        const context = (request.context ?? [])
+            .slice(0, MAX_CONTEXT_LINES)
+            .map((line) => line.slice(0, MAX_CONTEXT_LINE_CHARS))
+            .join('\n');
+        const user = [
+            `规则 ID：${request.ruleId}`,
+            `规则初判严重度：${request.severity}`,
+            `语言：${request.language}`,
+            `命中行：${request.snippet.slice(0, MAX_SNIPPET_CHARS)}`,
+            '上下文：',
+            context || '（无）'
+        ].join('\n');
+        return [
+            { role: 'system', content: SYSTEM_PROMPT },
+            { role: 'user', content: user }
+        ];
+    }
+    async chat(messages, opts) {
+        const controller = new AbortController();
+        let timer;
+        const timeout = new Promise((_, reject) => {
+            timer = setTimeout(() => {
+                controller.abort();
+                reject(new Error('请求超时'));
+            }, this.timeoutMs);
+        });
+        try {
+            const body = {
+                model: this.model,
+                messages: opts.retryNote
+                    ? [...messages, { role: 'user', content: '你上一次的输出无法解析，请严格只输出一个 JSON 对象。' }]
+                    : messages,
+                temperature: 0,
+                max_tokens: this.maxTokens
+            };
+            if (opts.jsonMode)
+                body.response_format = { type: 'json_object' };
+            const pending = this.fetchImpl(`${this.baseUrl}/chat/completions`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Authorization: `Bearer ${this.apiKey}`
+                },
+                body: JSON.stringify(body),
+                signal: controller.signal
+            });
+            pending.catch(() => { }); // 防 timeout 赢得竞速后出现未处理拒绝
+            const response = (await Promise.race([pending, timeout]));
+            if (!response.ok) {
+                let detail = '';
+                try {
+                    detail = (await response.text()).slice(0, 200);
+                }
+                catch {
+                    detail = '';
+                }
+                const retryAfter = Number(response.headers?.get?.('retry-after'));
+                throw new LLMHttpError(response.status, Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter * 1000 : undefined, detail);
+            }
+            const data = (await Promise.race([response.json(), timeout]));
+            return data.choices?.[0]?.message?.content ?? '';
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+    /** 解析模型输出；严重度只保留「低于初判」的建议（上调与维持直接丢弃） */
+    parseReview(content, originalSeverity) {
+        const start = content.indexOf('{');
+        const end = content.lastIndexOf('}');
+        if (start === -1 || end <= start)
+            return null;
+        let obj;
+        try {
+            obj = JSON.parse(content.slice(start, end + 1));
+        }
+        catch {
+            return null;
+        }
+        if (typeof obj !== 'object' || obj === null)
+            return null;
+        const record = obj;
+        if (typeof record.verdict !== 'string' || !VERDICTS.includes(record.verdict))
+            return null;
+        const result = {
+            verdict: record.verdict,
+            explanation: typeof record.explanation === 'string' && record.explanation.trim()
+                ? record.explanation.trim()
+                : '（模型未给出解释）'
+        };
+        if (typeof record.severity === 'string' &&
+            SEVERITIES.includes(record.severity) &&
+            SEVERITY_RANK[record.severity] < SEVERITY_RANK[originalSeverity]) {
+            result.severity = record.severity;
+        }
+        if (typeof record.fixSuggestion === 'string' && record.fixSuggestion.trim()) {
+            result.fixSuggestion = record.fixSuggestion.trim();
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=openai.js.map

package/dist/llm/openai.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai.js","sourceRoot":"","sources":["../../src/llm/openai.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA8B5C,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AACrD,MAAM,aAAa,GAAG,aAAa,CAAC;AACpC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAC1C,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;AAC3D,MAAM,UAAU,GAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEjE,iCAAiC;AACjC,MAAM,aAAa,GAAG;IACpB,0DAA0D;IAC1D,4BAA4B;IAC5B,gCAAgC;IAChC,yCAAyC;IACzC,iEAAiE;IACjE,8BAA8B;IAC9B,qIAAqI;IACrI,oDAAoD;CACrD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,4BAA4B;AAC5B,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAQnC,0CAA0C;AAC1C,MAAM,OAAO,YAAa,SAAQ,KAAK;IAE1B;IACA;IAFX,YACW,MAAc,EACd,YAAgC,EACzC,MAAc;QAEd,KAAK,CAAC,QAAQ,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAJ5C,WAAM,GAAN,MAAM,CAAQ;QACd,iBAAY,GAAZ,YAAY,CAAoB;IAI3C,CAAC;CACF;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEnF,MAAM,OAAO,wBAAwB;IAC1B,IAAI,CAAS;IACL,MAAM,CAAS;IACf,OAAO,CAAS;IAChB,KAAK,CAAS;IACd,SAAS,CAAe;IACxB,SAAS,CAAS;IAClB,OAAO,CAAS;IAChB,gBAAgB,CAAS;IACzB,SAAS,CAAS;IAEnC,YAAY,OAA8B;QACxC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACzD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC;QAClD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,2BAA2B,CAAC;QAChF,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAyB;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,SAAS,GAAG,MAAM,CAAC;QACvB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;YACzD,IAAI,OAAO,GAAG,CAAC,IAAI,WAAW,GAAG,CAAC;gBAAE,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;YAC7D,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChF,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC3D,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC;gBAC1B,SAAS,GAAG,gBAAgB,CAAC;gBAC7B,WAAW,GAAG,CAAC,CAAC,CAAC,iBAAiB;YACpC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;oBAChC,+CAA+C;oBAC/C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ;wBAAE,QAAQ,GAAG,KAAK,CAAC;oBACrD,WAAW,GAAG,IAAI,CAAC,GAAG,CACpB,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,gBAAgB,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,EACzD,kBAAkB,CACnB,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;gBACpF,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,SAAS,UAAU,EAAE,CAAC;IAC7E,CAAC;IAED,kCAAkC;IAC1B,aAAa,CAAC,OAAyB;QAC7C,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;aACpC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC;aAC3B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;aACpD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,GAAG;YACX,SAAS,OAAO,CAAC,MAAM,EAAE;YACzB,WAAW,OAAO,CAAC,QAAQ,EAAE;YAC7B,MAAM,OAAO,CAAC,QAAQ,EAAE;YACxB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,EAAE;YACpD,MAAM;YACN,OAAO,IAAI,KAAK;SACjB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,OAAO;YACL,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE;YAC1C,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;SAChC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,QAAuB,EACvB,IAA+C;QAE/C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,KAAgD,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,IAAI,GAA4B;gBACpC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,SAAS;oBACtB,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;oBAC3E,CAAC,CAAC,QAAQ;gBACZ,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,IAAI,CAAC,SAAS;aAC3B,CAAC;YACF,IAAI,IAAI,CAAC,QAAQ;gBAAE,IAAI,CAAC,eAAe,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,mBAAmB,EAAE;gBACjE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;iBACvC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,yBAAyB;YAClD,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAa,CAAC;YACtE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACjD,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,EAAE,CAAC;gBACd,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;gBAClE,MAAM,IAAI,YAAY,CACpB,QAAQ,CAAC,MAAM,EACf,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,EAC7E,MAAM,CACP,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC,CAA2B,CAAC;YACxF,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;QACnD,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,wCAAwC;IAChC,WAAW,CAAC,OAAe,EAAE,gBAA0B;QAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,KAAK;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,MAAM,GAAG,GAA8B,CAAC;QAC9C,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1F,MAAM,MAAM,GAAoB;YAC9B,OAAO,EAAE,MAAM,CAAC,OAAqC;YACrD,WAAW,EACT,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE;gBACjE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE;gBAC3B,CAAC,CAAC,WAAW;SAClB,CAAC;QACF,IACE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAClC,UAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;YAClD,aAAa,CAAC,MAAM,CAAC,QAAoB,CAAC,GAAG,aAAa,CAAC,gBAAgB,CAAC,EAC5E,CAAC;YACD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAoB,CAAC;QAChD,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5E,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QACrD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/llm/provider.d.ts

@@ -0,0 +1,20 @@
+import type { BountyConfig } from '../config.js';
+import type { LLMProvider } from '../types.js';
+/**
+ * Provider 工厂。选择逻辑：
+ * - ai.provider=off 或未启用 → Mock（纯规则模式）
+ * - ai.provider=mock → Mock（显式走 Mock，可演练复核流水线）
+ * - ai.provider=openai-compatible → 读取环境变量 Key；无 Key 降级 Mock 并说明原因
+ */
+export interface LoadedProvider {
+    provider: LLMProvider;
+    /** mock=纯规则/显式 Mock；llm=真实复核 */
+    mode: 'mock' | 'llm';
+    /** true=想要复核但条件不满足而降级（CLI 会提示原因） */
+    degraded: boolean;
+    reason?: string;
+    /** mode=llm 时提供——供 doctor 探测连通性（不会出现在任何输出中） */
+    baseUrl?: string;
+    apiKey?: string;
+}
+export declare function loadProvider(config?: BountyConfig): LoadedProvider;

package/dist/llm/provider.js

@@ -0,0 +1,36 @@
+import { loadConfig } from '../config.js';
+import { MockProvider } from './mock.js';
+import { OpenAICompatibleProvider } from './openai.js';
+export function loadProvider(config = loadConfig()) {
+    const ai = config.ai;
+    if (!ai.enabled || ai.provider === 'off') {
+        return {
+            provider: new MockProvider(),
+            mode: 'mock',
+            degraded: true,
+            reason: 'LLM 复核未启用，当前为纯规则模式'
+        };
+    }
+    if (ai.provider === 'mock') {
+        return { provider: new MockProvider(), mode: 'mock', degraded: false };
+    }
+    const apiKey = process.env.BOUNTY_GUARD_API_KEY ?? process.env.OPENAI_API_KEY;
+    if (!apiKey) {
+        return {
+            provider: new MockProvider(),
+            mode: 'mock',
+            degraded: true,
+            reason: '未检测到 API Key（设置 BOUNTY_GUARD_API_KEY 或 OPENAI_API_KEY），已降级为纯规则模式'
+        };
+    }
+    const baseUrl = ai.baseUrl ?? process.env.BOUNTY_GUARD_BASE_URL ?? process.env.OPENAI_BASE_URL ?? undefined;
+    const model = ai.model ?? process.env.BOUNTY_GUARD_MODEL ?? undefined;
+    return {
+        provider: new OpenAICompatibleProvider({ apiKey, baseUrl, model, maxTokens: ai.maxTokens }),
+        mode: 'llm',
+        degraded: false,
+        baseUrl: (baseUrl ?? 'https://api.openai.com/v1').replace(/\/+$/, ''),
+        apiKey
+    };
+}
+//# sourceMappingURL=provider.js.map

package/dist/llm/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/llm/provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAqBvD,MAAM,UAAU,YAAY,CAAC,SAAuB,UAAU,EAAE;IAC9D,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QACzC,OAAO;YACL,QAAQ,EAAE,IAAI,YAAY,EAAE;YAC5B,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,oBAAoB;SAC7B,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,EAAE,QAAQ,EAAE,IAAI,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,QAAQ,EAAE,IAAI,YAAY,EAAE;YAC5B,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,kEAAkE;SAC3E,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,SAAS,CAAC;IAC5G,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,SAAS,CAAC;IACtE,OAAO;QACL,QAAQ,EAAE,IAAI,wBAAwB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC;QAC3F,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,CAAC,OAAO,IAAI,2BAA2B,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACrE,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/mcp/server.d.ts

@@ -0,0 +1,8 @@
+/** MCP 工具实现（可独立测试） */
+export declare function callTool(name: string, args: Record<string, unknown>): Promise<{
+    text: string;
+}>;
+/** 处理一行 JSON-RPC 请求，返回响应行；无需响应（通知/非法输入）返回 null */
+export declare function handleRpc(raw: string): Promise<string | null>;
+/** 启动 stdio 服务器：stdout 只写协议消息，日志走 stderr */
+export declare function startMcpServer(): void;

package/dist/mcp/server.js

@@ -0,0 +1,181 @@
+/**
+ * MCP（Model Context Protocol）stdio 服务器形态：
+ * 任何 AI 编程助手都可作为 MCP 客户端接入 bounty-guard，在写码瞬间调用扫描。
+ * 协议：stdin/stdout 上的换行分隔 JSON-RPC 2.0（零依赖实现）。
+ * 注意：stdout 只承载协议消息——一切日志一律走 stderr。
+ */
+import { createRequire } from 'node:module';
+import { createInterface } from 'node:readline';
+import { loadConfig } from '../config.js';
+import { collectGitChanges, collectStagedChanges } from '../git-scan.js';
+import { matchGlob } from '../glob.js';
+import { loadProvider } from '../llm/provider.js';
+import { renderReport } from '../report.js';
+import { reviewFindings } from '../review.js';
+import { scanDiff } from '../scanner.js';
+import { ALL_RULES } from '../rules/index.js';
+import { parseDiff } from '../diff.js';
+const require2 = createRequire(import.meta.url);
+const VERSION = require2('../../package.json').version;
+const PROTOCOL_VERSION = '2024-11-05';
+function resp(id, result) {
+    return { jsonrpc: '2.0', id: id ?? null, result };
+}
+function errResp(id, code, message) {
+    return { jsonrpc: '2.0', id: id ?? null, error: { code, message } };
+}
+const TOOL_DEFS = [
+    {
+        name: 'scan_git',
+        description: '扫描指定目录的未提交/已暂存变更（只审新增行），返回中文安全报告与门禁结论',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                cwd: { type: 'string', description: '项目目录，缺省为当前工作目录' },
+                staged: { type: 'boolean', description: '只扫描已暂存变更' },
+                ai: { type: 'boolean', description: '启用 LLM 复核（需已配置 Key）' }
+            }
+        }
+    },
+    {
+        name: 'scan_diff',
+        description: '扫描一段 unified diff 文本，返回中文安全报告',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                diff: { type: 'string', description: 'unified diff 全文' },
+                ai: { type: 'boolean', description: '启用 LLM 复核' }
+            },
+            required: ['diff']
+        }
+    },
+    {
+        name: 'list_rules',
+        description: '列出全部内置安全规则（id、严重度、说明）',
+        inputSchema: { type: 'object', properties: {} }
+    },
+    {
+        name: 'doctor',
+        description: '查看当前目录的 bounty-guard 配置摘要',
+        inputSchema: { type: 'object', properties: { cwd: { type: 'string' } } }
+    }
+];
+/** 扫描并渲染为文本报告（MCP 内容载荷） */
+async function scanToText(diff, cwd, wantAi, source) {
+    const config = loadConfig(cwd);
+    let findings = scanDiff(diff, {
+        ignore: config.ignore,
+        skipTests: !config.scanTests,
+        disabledRules: config.disabledRules
+    });
+    const scannable = diff.files.filter((f) => !f.isBinary && !matchGlob(f.path, config.ignore));
+    const addedLines = scannable.reduce((sum, f) => sum + f.hunks.reduce((n, h) => n + h.lines.filter((l) => l.type === 'add').length, 0), 0);
+    let review;
+    if (wantAi) {
+        const loaded = loadProvider(config);
+        if (!loaded.degraded) {
+            const outcome = await reviewFindings(findings, loaded.provider);
+            findings = outcome.findings;
+            review = {
+                provider: loaded.provider.name,
+                confirmed: outcome.findings.length,
+                filtered: outcome.filtered,
+                downgraded: outcome.downgraded,
+                unreviewed: outcome.unreviewed
+            };
+        }
+    }
+    return renderReport(findings, {
+        source,
+        scannedFiles: scannable.length,
+        addedLines,
+        review
+    });
+}
+/** MCP 工具实现（可独立测试） */
+export async function callTool(name, args) {
+    const cwd = typeof args.cwd === 'string' && args.cwd ? args.cwd : process.cwd();
+    if (name === 'scan_git') {
+        const diff = args.staged === true ? await collectStagedChanges(cwd) : await collectGitChanges(cwd);
+        return {
+            text: await scanToText(diff, cwd, args.ai === true, args.staged === true ? 'git 已暂存变更' : 'git 未提交变更')
+        };
+    }
+    if (name === 'scan_diff') {
+        if (typeof args.diff !== 'string' || args.diff.trim() === '') {
+            throw new Error('缺少 diff 参数（unified diff 文本）');
+        }
+        return { text: await scanToText(parseDiff(args.diff), cwd, args.ai === true, 'diff 文本') };
+    }
+    if (name === 'list_rules') {
+        const lines = ALL_RULES.map((r) => `- [${r.severity}] ${r.id}：${r.message}`);
+        return { text: `bounty-guard 共 ${ALL_RULES.length} 条规则：\n${lines.join('\n')}` };
+    }
+    if (name === 'doctor') {
+        const config = loadConfig(cwd);
+        return {
+            text: [
+                `Node：${process.versions.node}`,
+                `failOn：${config.failOn} · scanTests：${config.scanTests} · 禁用规则：${config.disabledRules?.length ?? 0} 条`,
+                `AI：${config.ai.enabled ? `已启用（${config.ai.provider}）` : '未启用（纯规则模式）'}${config.ai.model ? ` · 模型 ${config.ai.model}` : ''}`
+            ].join('\n')
+        };
+    }
+    throw new Error(`未知工具：${name}`);
+}
+/** 处理一行 JSON-RPC 请求，返回响应行；无需响应（通知/非法输入）返回 null */
+export async function handleRpc(raw) {
+    let req;
+    try {
+        req = JSON.parse(raw);
+    }
+    catch {
+        return null; // 非法行静默忽略（协议健壮性）
+    }
+    if (typeof req.method !== 'string')
+        return null;
+    if (req.method === 'initialize') {
+        return JSON.stringify(resp(req.id ?? null, {
+            protocolVersion: PROTOCOL_VERSION,
+            capabilities: { tools: { listChanged: false } },
+            serverInfo: { name: 'bounty-guard', version: VERSION }
+        }));
+    }
+    if (req.method.startsWith('notifications/'))
+        return null;
+    if (req.method === 'tools/list')
+        return JSON.stringify(resp(req.id ?? null, { tools: TOOL_DEFS }));
+    if (req.method === 'tools/call') {
+        const params = req.params ?? {};
+        const name = typeof params.name === 'string' ? params.name : '';
+        const args = (params.arguments ?? {});
+        try {
+            const { text } = await callTool(name, args);
+            return JSON.stringify(resp(req.id ?? null, { content: [{ type: 'text', text }], isError: false }));
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return JSON.stringify(resp(req.id ?? null, { content: [{ type: 'text', text: message }], isError: true }));
+        }
+    }
+    if (req.id !== undefined && req.id !== null) {
+        return JSON.stringify(errResp(req.id, -32601, `未知方法：${req.method}`));
+    }
+    return null;
+}
+/** 启动 stdio 服务器：stdout 只写协议消息，日志走 stderr */
+export function startMcpServer() {
+    const rl = createInterface({ input: process.stdin });
+    rl.on('line', (line) => {
+        const trimmed = line.trim();
+        if (!trimmed)
+            return;
+        void handleRpc(trimmed).then((out) => {
+            if (out)
+                process.stdout.write(`${out}\n`);
+        });
+    });
+    rl.on('close', () => process.exit(0));
+    process.stderr.write(`bounty-guard MCP 服务器已启动（stdio，协议 ${PROTOCOL_VERSION}）\n`);
+}
+//# sourceMappingURL=server.js.map

package/dist/mcp/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAmB,MAAM,YAAY,CAAC;AAExD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChD,MAAM,OAAO,GAAW,QAAQ,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC;AAE/D,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAgBtC,SAAS,IAAI,CAAC,EAAoB,EAAE,MAAe;IACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,OAAO,CAAC,EAAoB,EAAE,IAAY,EAAE,OAAe;IAClE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,SAAS,GAAG;IAChB;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,uCAAuC;QACpD,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE;gBACtD,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE;gBACpD,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,qBAAqB,EAAE;aAC5D;SACF;KACF;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,+BAA+B;QAC5C,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iBAAiB,EAAE;gBACxD,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE;aAClD;YACD,QAAQ,EAAE,CAAC,MAAM,CAAC;SACnB;KACF;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,uBAAuB;QACpC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;KAChD;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,2BAA2B;QACxC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;KACzE;CACF,CAAC;AAEF,2BAA2B;AAC3B,KAAK,UAAU,UAAU,CAAC,IAAgB,EAAE,GAAW,EAAE,MAAe,EAAE,MAAc;IACtF,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE;QAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS;QAC5B,aAAa,EAAE,MAAM,CAAC,aAAa;KACpC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CACjC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EACjG,CAAC,CACF,CAAC;IACF,IAAI,MAAM,CAAC;IACX,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAChE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC5B,MAAM,GAAG;gBACP,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI;gBAC9B,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC,QAAQ,EAAE;QAC5B,MAAM;QACN,YAAY,EAAE,SAAS,CAAC,MAAM;QAC9B,UAAU;QACV,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,sBAAsB;AACtB,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,IAA6B;IACxE,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAChF,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACnG,OAAO;YACL,IAAI,EAAE,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;SACtG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,OAAO,EAAE,IAAI,EAAE,kBAAkB,SAAS,CAAC,MAAM,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO;YACL,IAAI,EAAE;gBACJ,QAAQ,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE;gBAC/B,UAAU,MAAM,CAAC,MAAM,gBAAgB,MAAM,CAAC,SAAS,WAAW,MAAM,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC,IAAI;gBACvG,MAAM,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aAC5H,CAAC,IAAI,CAAC,IAAI,CAAC;SACb,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,IAAI,GAAe,CAAC;IACpB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,iBAAiB;IAChC,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC,SAAS,CACnB,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE;YACnB,eAAe,EAAE,gBAAgB;YACjC,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;YAC/C,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE;SACvD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACnG,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACrG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,cAAc;IAC5B,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACrD,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,KAAK,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACnC,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,gBAAgB,KAAK,CAAC,CAAC;AAClF,CAAC"}

package/dist/report.d.ts

@@ -0,0 +1,34 @@
+import type { Finding, Severity } from './types.js';
+/** 粘性评论的识别标记：更新而非新建全靠它 */
+export declare const COMMENT_MARKER = "<!-- bounty-guard-report -->";
+/** 各严重度的中文标签（终端、Markdown 与告警标注共用） */
+export declare const LABELS: Record<Severity, string>;
+/** CI 门禁：任一告警达到 failOn 档即应非零退出 */
+export declare function shouldFail(findings: Finding[], failOn: Severity): boolean;
+export interface ReportMeta {
+    /** 扫描来源描述，如「git 未提交变更」 */
+    source: string;
+    scannedFiles: number;
+    addedLines: number;
+    /** LLM 复核汇总（未开启复核时缺省） */
+    review?: {
+        provider: string;
+        confirmed: number;
+        filtered: number;
+        downgraded: number;
+        unreviewed?: number;
+    };
+}
+/** 渲染中文终端报告，按文件分组 */
+export declare function renderReport(findings: Finding[], meta: ReportMeta): string;
+/** Markdown 版报告：PR 粘性评论与 Job Summary 共用 */
+export declare function renderMarkdownReport(findings: Finding[], meta: ReportMeta): string;
+/** SARIF 2.1.0 输出：可直接对接 GitHub code-scanning（actions/upload-sarif） */
+export declare function renderSarif(findings: Finding[], meta: Pick<ReportMeta, 'source' | 'scannedFiles' | 'addedLines'>): Record<string, unknown>;
+export interface MetricsRow {
+    pr: string;
+    addedLines: number;
+    findings: string[];
+}
+/** 周报表格：配合 scripts/weekly-report.ts 定时生成 docs/metrics.md */
+export declare function renderMetricsTable(rows: MetricsRow[], date: string): string;