break-anything 0.0.0-stage → 0.2.0

package/src/report.js

@@ -0,0 +1,225 @@
+// Human-readable terminal reports. No third-party UI deps.
+// English by default; set BRK_LANG=zh for Chinese labels.
+
+const LANG = (process.env.BRK_LANG || "en").toLowerCase().startsWith("zh") ? "zh" : "en";
+
+const C = {
+  reset: "\x1b[0m", bold: "\x1b[1m", dim: "\x1b[2m",
+  red: "\x1b[31m", yellow: "\x1b[33m", green: "\x1b[32m", cyan: "\x1b[36m", gray: "\x1b[90m",
+};
+
+const SEV_COLOR = { CRITICAL: C.red, HIGH: C.red, MEDIUM: C.yellow, LOW: C.cyan, UNKNOWN: C.gray };
+
+const T = {
+  en: {
+    depsTitle: "Break Anything · dependency scan",
+    depsTarget: (t, n, s) => `target ${t}  ·  ${n} packages scanned  ·  ${s}`,
+    depsClean: "✓ No matching vulnerabilities in the OSV database.",
+    cleanNote: "  Note: this means \"none found\", not \"safe\".",
+    reach: { imported: "reachable", direct: "direct dep", transitive: "transitive", unknown: "—" },
+    epss: (v) => (v != null ? `EPSS ${(v * 100).toFixed(1)}%` : "EPSS —"),
+    fix: (v) => `fix → ${v}`,
+    noFix: "no fix available",
+    summary: "summary",
+    findings: "findings",
+    reachable: "reachable",
+    skipped: (n) => `(${n} packages failed to query, skipped)`,
+    heuristic: "Reachability is a heuristic (is it imported), not proof the vulnerable code runs.",
+    secretsTitle: "Break Anything · secret scan",
+    secretsTarget: (t, on) => `target ${t}  ·  history scan ${on ? "on" : "off"}`,
+    secretsClean: "✓ No leaked secrets found.",
+    history: "git history",
+    inHistory: "in history",
+    rotate: "Secrets in history may still be live even after deletion — rotate them, don't just delete the commit.",
+    imageTitle: "Break Anything · image scan",
+    imageClean: "✓ No known vulnerabilities in the image.",
+    more: (n) => `… ${n} more, use --json for the full list`,
+    fixable: "fixable",
+    sastTitle: "Break Anything · static code scan",
+    sastClean: "✓ No issues found by the static-analysis rules.",
+  },
+  zh: {
+    depsTitle: "Break Anything · 依赖扫描",
+    depsTarget: (t, n, s) => `目标 ${t}  ·  已扫 ${n} 个包  ·  ${s}`,
+    depsClean: "✓ 未在已知漏洞库(OSV)中发现匹配的漏洞。",
+    cleanNote: "  注意:这表示\"未发现\",不等于\"安全\"。",
+    reach: { imported: "可达(已被引用)", direct: "直接依赖", transitive: "传递依赖", unknown: "—" },
+    epss: (v) => (v != null ? `EPSS ${(v * 100).toFixed(1)}%` : "EPSS —"),
+    fix: (v) => `修复 → ${v}`,
+    noFix: "无修复版本",
+    summary: "小结",
+    findings: "条",
+    reachable: "可达",
+    skipped: (n) => `(${n} 个包查询失败,已跳过)`,
+    heuristic: "可达性为启发式(判断是否被引用),非漏洞函数被调用的证明。",
+    secretsTitle: "Break Anything · 密钥扫描",
+    secretsTarget: (t, on) => `目标 ${t}  ·  历史扫描 ${on ? "开" : "关"}`,
+    secretsClean: "✓ 未发现疑似泄露的密钥。",
+    history: "git 历史",
+    inHistory: "历史中",
+    rotate: "历史里的密钥即使已删除也可能仍然有效 —— 请轮换(rotate),不要只删提交。",
+    imageTitle: "Break Anything · 镜像扫描",
+    imageClean: "✓ 未在镜像中发现已知漏洞。",
+    more: (n) => `… 还有 ${n} 条,用 --json 查看全部`,
+    fixable: "可修复",
+    sastTitle: "Break Anything · 静态代码扫描",
+    sastClean: "✓ 静态分析规则未发现问题。",
+  },
+}[LANG];
+
+function palette(color) {
+  return color ? C : new Proxy({}, { get: () => "" });
+}
+
+export function renderHuman(result, { color = true, top } = {}) {
+  const c = palette(color);
+  const lines = [];
+
+  if (!result.ok) {
+    lines.push(`${c.yellow}${result.message}${c.reset}`);
+    lines.push(`${c.gray}${result.target}${c.reset}`);
+    return lines.join("\n");
+  }
+
+  const srcDesc = result.sources.map((s) => `${s.ecosystem}:${s.packages}`).join("  ");
+  lines.push(`${c.bold}${T.depsTitle}${c.reset}`);
+  lines.push(`${c.gray}${T.depsTarget(result.target, result.scanned, srcDesc)}${c.reset}`);
+  lines.push("");
+
+  if (!result.findings.length) {
+    lines.push(`${c.green}${T.depsClean}${c.reset}`);
+    lines.push(`${c.gray}${T.cleanNote}${c.reset}`);
+    return lines.join("\n");
+  }
+
+  const shown = top && result.findings.length > top ? result.findings.slice(0, top) : result.findings;
+  for (const f of shown) {
+    const sev = `${SEV_COLOR[f.severity] || ""}${f.severity.padEnd(8)}${c.reset}`;
+    const idLabel = f.cve || f.id;
+    const fix = f.fixedVersions.length
+      ? `${c.green}${T.fix(f.fixedVersions.join(", "))}${c.reset}`
+      : `${c.red}${T.noFix}${c.reset}`;
+    lines.push(`${sev} ${c.bold}${f.package}@${f.version}${c.reset} ${c.gray}(${f.ecosystem})${c.reset}`);
+    lines.push(`  ${c.cyan}${idLabel}${c.reset}  ·  ${T.reach[f.reachability]}  ·  ${T.epss(f.epss)}  ·  ${fix}`);
+    if (f.summary) lines.push(`  ${c.gray}${f.summary.replace(/\s+/g, " ").slice(0, 120)}${c.reset}`);
+    lines.push("");
+  }
+  if (shown.length < result.findings.length) {
+    lines.push(`${c.gray}${T.more(result.findings.length - shown.length)}${c.reset}`);
+    lines.push("");
+  }
+
+  const s = result.summary;
+  const sevParts = Object.entries(s.bySeverity)
+    .sort((a, b) => sevOrder(b[0]) - sevOrder(a[0]))
+    .map(([k, v]) => `${k} ${v}`)
+    .join("  ");
+  lines.push(`${c.bold}${T.summary}${c.reset} ${s.total} ${T.findings}  ·  ${s.reachable} ${T.reachable}  ·  ${sevParts}`);
+  if (result.errors?.length) lines.push(`${c.gray}${T.skipped(result.errors.length)}${c.reset}`);
+  lines.push(`${c.gray}${T.heuristic}${c.reset}`);
+  return lines.join("\n");
+}
+
+function sevOrder(k) {
+  return { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1, UNKNOWN: 0 }[k] ?? 0;
+}
+
+// ---- secrets ----
+export function renderSecrets(result, { color = true } = {}) {
+  const c = palette(color);
+  const lines = [];
+  lines.push(`${c.bold}${T.secretsTitle}${c.reset}`);
+  lines.push(`${c.gray}${T.secretsTarget(result.target, result.historyScanned)}${c.reset}`);
+  lines.push("");
+
+  if (!result.findings.length) {
+    lines.push(`${c.green}${T.secretsClean}${c.reset}`);
+    lines.push(`${c.gray}${T.cleanNote}${c.reset}`);
+    return lines.join("\n");
+  }
+
+  for (const f of result.findings) {
+    const sev = `${SEV_COLOR[f.severity] || ""}${f.severity.padEnd(8)}${c.reset}`;
+    const loc = f.source === "history"
+      ? `${c.yellow}${T.history}${c.reset} ${c.gray}@${f.commit}${c.reset}`
+      : `${f.location}${f.line ? `:${f.line}` : ""}`;
+    lines.push(`${sev} ${c.bold}${f.rule}${c.reset}`);
+    lines.push(`  ${loc}  ·  ${c.gray}${f.match}${c.reset}`);
+  }
+  lines.push("");
+  const s = result.summary;
+  const parts = Object.entries(s.bySeverity).sort((a, b) => sevOrder(b[0]) - sevOrder(a[0])).map(([k, v]) => `${k} ${v}`).join("  ");
+  lines.push(`${c.bold}${T.summary}${c.reset} ${s.total} ${T.findings}  ·  ${s.inHistory} ${T.inHistory}  ·  ${parts}`);
+  if (s.inHistory) lines.push(`${c.yellow}${T.rotate}${c.reset}`);
+  return lines.join("\n");
+}
+
+// ---- image ----
+export function renderImage(result, { color = true } = {}) {
+  const c = palette(color);
+  const lines = [];
+  lines.push(`${c.bold}${T.imageTitle}${c.reset} ${c.gray}(${result.engine})${c.reset}`);
+
+  if (!result.ok) {
+    lines.push("");
+    lines.push(`${c.yellow}${result.message}${c.reset}`);
+    return lines.join("\n");
+  }
+
+  lines.push(`${c.gray}${result.target}${c.reset}`);
+  lines.push("");
+  if (!result.findings.length) {
+    lines.push(`${c.green}${T.imageClean}${c.reset}`);
+    return lines.join("\n");
+  }
+  for (const f of result.findings.slice(0, 40)) {
+    const sev = `${SEV_COLOR[f.severity] || ""}${f.severity.padEnd(8)}${c.reset}`;
+    const fix = f.fixedVersions.length ? `${c.green}${T.fix(f.fixedVersions.join(", "))}${c.reset}` : `${c.red}${T.noFix}${c.reset}`;
+    lines.push(`${sev} ${c.bold}${f.package}@${f.version}${c.reset} ${c.cyan}${f.cve || f.id}${c.reset}  ${fix}  ${c.gray}[${f.class}]${c.reset}`);
+  }
+  if (result.findings.length > 40) lines.push(`${c.gray}${T.more(result.findings.length - 40)}${c.reset}`);
+  lines.push("");
+  const s = result.summary;
+  const parts = Object.entries(s.bySeverity).sort((a, b) => sevOrder(b[0]) - sevOrder(a[0])).map(([k, v]) => `${k} ${v}`).join("  ");
+  lines.push(`${c.bold}${T.summary}${c.reset} ${s.total} ${T.findings}  ·  ${s.fixable} ${T.fixable}  ·  ${parts}`);
+  return lines.join("\n");
+}
+
+// ---- SAST ----
+export function renderSast(result, { color = true, top } = {}) {
+  const c = palette(color);
+  const lines = [];
+  lines.push(`${c.bold}${T.sastTitle}${c.reset} ${c.gray}(${result.engine})${c.reset}`);
+
+  if (!result.ok) {
+    lines.push("");
+    lines.push(`${c.yellow}${result.message}${c.reset}`);
+    return lines.join("\n");
+  }
+
+  lines.push(`${c.gray}${result.target}${c.reset}`);
+  lines.push("");
+  if (!result.findings.length) {
+    lines.push(`${c.green}${T.sastClean}${c.reset}`);
+    return lines.join("\n");
+  }
+
+  const shown = top && result.findings.length > top ? result.findings.slice(0, top) : result.findings;
+  for (const f of shown) {
+    const sev = `${SEV_COLOR[f.severity] || ""}${f.severity.padEnd(8)}${c.reset}`;
+    const tags = [f.cwe[0], f.owasp[0]].filter(Boolean).join(" · ");
+    lines.push(`${sev} ${c.bold}${f.rule}${c.reset} ${c.gray}${tags}${c.reset}`);
+    lines.push(`  ${c.cyan}${f.location}${c.reset}  ${c.gray}${f.message.slice(0, 100)}${c.reset}`);
+    if (f.snippet) lines.push(`  ${c.gray}${f.snippet.slice(0, 90)}${c.reset}`);
+    lines.push("");
+  }
+  if (shown.length < result.findings.length) {
+    lines.push(`${c.gray}${T.more(result.findings.length - shown.length)}${c.reset}`);
+    lines.push("");
+  }
+
+  const s = result.summary;
+  const parts = Object.entries(s.bySeverity).sort((a, b) => sevOrder(b[0]) - sevOrder(a[0])).map(([k, v]) => `${k} ${v}`).join("  ");
+  lines.push(`${c.bold}${T.summary}${c.reset} ${s.total} ${T.findings}  ·  ${parts}`);
+  return lines.join("\n");
+}

package/src/sast.js

@@ -0,0 +1,128 @@
+import { spawn } from "node:child_process";
+
+// 静态代码分析(SAST):封装 Semgrep。装了 semgrep 就能用,没装给安装提示。
+// 把 Semgrep 的 JSON 归一化成 Break Anything 统一的发现结构。
+// 默认规则集 p/security-audit(首次运行会从 Semgrep registry 拉取并缓存,需联网)。
+
+export async function scanSast(path, { config = "p/security-audit" } = {}) {
+  const semgrep = await which("semgrep");
+  if (!semgrep) {
+    return {
+      target: path,
+      ok: false,
+      engine: "semgrep",
+      message:
+        "未找到 semgrep。SAST 依赖 Semgrep。安装:\n" +
+        "  pipx install semgrep   (或 brew install semgrep)\n" +
+        "  文档:https://semgrep.dev/docs/getting-started/",
+      findings: [],
+      summary: { total: 0, bySeverity: {} },
+    };
+  }
+
+  let raw;
+  try {
+    raw = await run(semgrep, ["--json", "--quiet", "--config", config, "--timeout", "0", path]);
+  } catch (err) {
+    return {
+      target: path,
+      ok: false,
+      engine: "semgrep",
+      message: `semgrep 执行失败:${err instanceof Error ? err.message : String(err)}`,
+      findings: [],
+      summary: { total: 0, bySeverity: {} },
+    };
+  }
+  return normalizeSemgrep(raw, path);
+}
+
+// 导出以便单测:把 semgrep JSON 文本归一化
+export function normalizeSemgrep(rawJson, target) {
+  let data;
+  try { data = typeof rawJson === "string" ? JSON.parse(rawJson) : rawJson; }
+  catch { return { target, ok: false, engine: "semgrep", message: "无法解析 semgrep 输出", findings: [], summary: { total: 0, bySeverity: {} } }; }
+
+  const findings = [];
+  for (const r of data.results || []) {
+    const sev = mapSeverity(r.extra?.severity);
+    const meta = r.extra?.metadata || {};
+    findings.push({
+      rule: shortRule(r.check_id),
+      id: r.check_id,
+      severity: sev,
+      location: `${r.path}:${r.start?.line ?? "?"}`,
+      message: (r.extra?.message || "").replace(/\s+/g, " ").trim(),
+      cwe: toArray(meta.cwe),
+      owasp: toArray(meta.owasp),
+      confidence: meta.confidence || null,
+      snippet: (r.extra?.lines || "").trim().slice(0, 200),
+      references: toArray(meta.references).slice(0, 3),
+    });
+  }
+  findings.sort((a, b) => sevRank(b.severity) - sevRank(a.severity));
+
+  return {
+    target,
+    ok: true,
+    engine: "semgrep",
+    scanned: data.paths?.scanned?.length ?? undefined,
+    errors: (data.errors || []).length,
+    findings,
+    summary: { total: findings.length, bySeverity: countBy(findings, "severity") },
+  };
+}
+
+// Semgrep: ERROR / WARNING / INFO → 我们的严重度
+function mapSeverity(s) {
+  switch ((s || "").toUpperCase()) {
+    case "ERROR": return "HIGH";
+    case "WARNING": return "MEDIUM";
+    case "INFO": return "LOW";
+    default: return "UNKNOWN";
+  }
+}
+
+function shortRule(id) {
+  if (!id) return "rule";
+  const parts = id.split(".");
+  return parts.slice(-2).join(".");
+}
+
+function toArray(v) {
+  if (v == null) return [];
+  return Array.isArray(v) ? v : [v];
+}
+
+function which(cmd) {
+  return new Promise((resolve) => {
+    const p = spawn(process.platform === "win32" ? "where" : "which", [cmd], { stdio: ["ignore", "pipe", "ignore"] });
+    let out = "";
+    p.stdout.on("data", (d) => (out += d));
+    p.on("close", (code) => resolve(code === 0 ? out.trim().split("\n")[0] : null));
+    p.on("error", () => resolve(null));
+  });
+}
+
+function run(cmd, args) {
+  return new Promise((resolve, reject) => {
+    const p = spawn(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
+    let out = "";
+    let err = "";
+    p.stdout.on("data", (d) => (out += d));
+    p.stderr.on("data", (d) => (err += d));
+    p.on("close", (code) => {
+      // semgrep: 0 = 无发现, 1 = 有发现, 其它 = 错误
+      if (code === 0 || code === 1 || out.trim().startsWith("{")) resolve(out);
+      else reject(new Error(err.trim().slice(0, 300) || `exit ${code}`));
+    });
+    p.on("error", reject);
+  });
+}
+
+const SEV = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1, UNKNOWN: 0 };
+function sevRank(s) { return SEV[s] ?? 0; }
+function countBy(arr, key) {
+  const m = {};
+  for (const x of arr) m[x[key]] = (m[x[key]] || 0) + 1;
+  return m;
+}

package/src/scan.js

@@ -0,0 +1,93 @@
+import { loadLockfiles } from "./lockfiles.js";
+import { scanPackages, severityRank } from "./osv.js";
+import { enrichEpss } from "./epss.js";
+import { buildReachability, classify, reachRank } from "./reachability.js";
+
+// 一次完整的依赖扫描:lockfile → OSV → EPSS → 可达性 → 排序后的发现列表
+export async function scanDependencies(targetPath, { reachability = true, concurrency = 8 } = {}) {
+  const { dir, sources } = await loadLockfiles(targetPath);
+  if (!sources.length) {
+    return {
+      target: dir,
+      ok: false,
+      message: "未找到受支持的 lockfile(package-lock.json / composer.lock / requirements.txt)。",
+      sources: [],
+      findings: [],
+      summary: emptySummary(),
+    };
+  }
+
+  const allPackages = sources.flatMap((s) => s.packages);
+  const { findings: raw, errors } = await scanPackages(allPackages, { concurrency });
+
+  // EPSS:汇总所有 CVE 一次性查
+  const cves = raw.flatMap((f) => f.vulns.map((v) => v.cve)).filter(Boolean);
+  const epss = await enrichEpss(cves);
+
+  // 可达性:只在有源码时做
+  let imported = new Set();
+  if (reachability) {
+    const names = [...new Set(allPackages.map((p) => p.name))];
+    imported = await buildReachability(dir, names);
+  }
+
+  // 展开成「每个漏洞一行」的发现
+  const flat = [];
+  for (const { pkg, vulns } of raw) {
+    const reach = reachability ? classify(pkg, imported) : "unknown";
+    for (const v of vulns) {
+      const ep = v.cve ? epss.get(v.cve) : null;
+      flat.push({
+        package: pkg.name,
+        version: pkg.version,
+        ecosystem: pkg.ecosystem,
+        direct: pkg.direct,
+        reachability: reach,
+        id: v.id,
+        cve: v.cve,
+        aliases: v.aliases,
+        severity: v.severity,
+        epss: ep ? ep.epss : null,
+        epssPercentile: ep ? ep.percentile : null,
+        fixedVersions: v.fixedVersions,
+        summary: v.summary,
+        references: v.references,
+      });
+    }
+  }
+
+  flat.sort(cmpFinding);
+
+  return {
+    target: dir,
+    ok: true,
+    sources: sources.map((s) => ({ ecosystem: s.ecosystem, file: s.file, packages: s.packages.length })),
+    scanned: allPackages.length,
+    errors,
+    findings: flat,
+    summary: summarize(flat),
+  };
+}
+
+// 排序:先严重度,再可达性,再 EPSS
+function cmpFinding(a, b) {
+  const s = severityRank(b.severity) - severityRank(a.severity);
+  if (s) return s;
+  const r = reachRank(b.reachability) - reachRank(a.reachability);
+  if (r) return r;
+  return (b.epss ?? 0) - (a.epss ?? 0);
+}
+
+function summarize(flat) {
+  const sum = emptySummary();
+  for (const f of flat) {
+    sum.total++;
+    sum.bySeverity[f.severity] = (sum.bySeverity[f.severity] || 0) + 1;
+    if (f.reachability === "imported") sum.reachable++;
+  }
+  return sum;
+}
+
+function emptySummary() {
+  return { total: 0, reachable: 0, bySeverity: {} };
+}

package/src/secrets.js

@@ -0,0 +1,160 @@
+import { readdir, readFile, stat } from "node:fs/promises";
+import { spawn } from "node:child_process";
+import path from "node:path";
+
+// 密钥扫描:工作区文件 + 可选 git 历史。全部本地完成,不联网。
+// 命中的密钥在输出里脱敏,只保留头尾几位。
+
+const RULES = [
+  { id: "aws-access-key-id", severity: "HIGH", re: /\bAKIA[0-9A-Z]{16}\b/ },
+  { id: "aws-secret-access-key", severity: "CRITICAL", re: /aws_secret_access_key\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/i },
+  { id: "github-token", severity: "HIGH", re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/ },
+  { id: "gitlab-pat", severity: "HIGH", re: /\bglpat-[A-Za-z0-9_-]{20,}\b/ },
+  { id: "slack-token", severity: "HIGH", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/ },
+  { id: "google-api-key", severity: "HIGH", re: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+  { id: "stripe-secret-key", severity: "CRITICAL", re: /\bsk_live_[0-9a-zA-Z]{24,}\b/ },
+  { id: "openai-key", severity: "HIGH", re: /\bsk-[A-Za-z0-9]{20,}T3BlbkFJ[A-Za-z0-9]{20,}\b/ },
+  { id: "private-key", severity: "CRITICAL", re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/ },
+  { id: "jwt", severity: "MEDIUM", re: /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/ },
+  { id: "generic-assigned-secret", severity: "MEDIUM", re: /(?:password|passwd|secret|api[_-]?key|token)\s*[=:]\s*['"]([^'"\s]{12,})['"]/i },
+];
+
+const SKIP_DIR = new Set(["node_modules", ".git", "dist", "build", "vendor", ".venv", "venv", "__pycache__"]);
+const SKIP_EXT = new Set([".png", ".jpg", ".jpeg", ".gif", ".webp", ".pdf", ".zip", ".gz", ".lock", ".min.js", ".map"]);
+const MAX_FILE_BYTES = 1_000_000;
+
+export async function scanSecrets(targetPath, { history = false } = {}) {
+  const dir = await resolveDir(targetPath);
+  const findings = [];
+
+  // 1) 工作区文件
+  const files = [];
+  await collect(dir, files, 0);
+  for (const f of files) {
+    let text;
+    try {
+      const s = await stat(f);
+      if (s.size > MAX_FILE_BYTES) continue;
+      text = await readFile(f, "utf8");
+    } catch { continue; }
+    scanText(text, { location: path.relative(dir, f), source: "worktree" }, findings);
+  }
+
+  // 2) git 历史(可选)
+  let historyScanned = false;
+  if (history) {
+    const hit = await scanGitHistory(dir, findings);
+    historyScanned = hit.ok;
+  }
+
+  dedupe(findings);
+  findings.sort((a, b) => sevRank(b.severity) - sevRank(a.severity));
+
+  return {
+    target: dir,
+    ok: true,
+    historyScanned,
+    findings,
+    summary: {
+      total: findings.length,
+      bySeverity: countBy(findings, "severity"),
+      inHistory: findings.filter((f) => f.source === "history").length,
+    },
+  };
+}
+
+function scanText(text, meta, findings) {
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.length > 500) continue; // 跳过超长压缩行
+    for (const rule of RULES) {
+      const m = rule.re.exec(line);
+      if (!m) continue;
+      const raw = m[1] || m[0];
+      findings.push({
+        rule: rule.id,
+        severity: rule.severity,
+        location: meta.location,
+        line: meta.source === "worktree" ? i + 1 : null,
+        source: meta.source,
+        commit: meta.commit || null,
+        match: redact(raw),
+      });
+    }
+  }
+}
+
+function redact(s) {
+  if (s.length <= 8) return "****";
+  return `${s.slice(0, 4)}…${s.slice(-4)} (${s.length} chars)`;
+}
+
+// 用 git log -p 读历史 diff,有字节上限,防止超大仓库卡死
+function scanGitHistory(dir, findings) {
+  return new Promise((resolve) => {
+    const child = spawn("git", ["-C", dir, "log", "-p", "--all", "-U0", "--no-color"], {
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+    let buf = "";
+    let bytes = 0;
+    let commit = null;
+    const CAP = 8_000_000;
+    child.stdout.on("data", (chunk) => {
+      bytes += chunk.length;
+      buf += chunk.toString("utf8");
+      const lines = buf.split("\n");
+      buf = lines.pop() || "";
+      for (const line of lines) {
+        const cm = line.match(/^commit ([0-9a-f]{7,40})/);
+        if (cm) { commit = cm[1].slice(0, 10); continue; }
+        if (line.startsWith("+") && !line.startsWith("+++")) {
+          scanText(line.slice(1), { location: "(git history)", source: "history", commit }, findings);
+        }
+      }
+      if (bytes > CAP) child.kill();
+    });
+    child.on("close", () => resolve({ ok: true }));
+    child.on("error", () => resolve({ ok: false }));
+  });
+}
+
+function dedupe(findings) {
+  const seen = new Set();
+  for (let i = findings.length - 1; i >= 0; i--) {
+    const f = findings[i];
+    const key = `${f.rule}|${f.match}|${f.source}|${f.location}`;
+    if (seen.has(key)) findings.splice(i, 1);
+    else seen.add(key);
+  }
+}
+
+async function resolveDir(p) {
+  const s = await stat(p);
+  return s.isDirectory() ? p : path.dirname(p);
+}
+
+async function collect(dir, out, depth) {
+  if (depth > 8 || out.length > 8000) return;
+  let entries;
+  try { entries = await readdir(dir, { withFileTypes: true }); } catch { return; }
+  for (const e of entries) {
+    const full = path.join(dir, e.name);
+    if (e.isDirectory()) {
+      if (SKIP_DIR.has(e.name) || e.name.startsWith(".")) continue;
+      await collect(full, out, depth + 1);
+    } else {
+      const ext = path.extname(e.name).toLowerCase();
+      if (SKIP_EXT.has(ext)) continue;
+      out.push(full);
+    }
+  }
+}
+
+const SEV = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1, UNKNOWN: 0 };
+function sevRank(s) { return SEV[s] ?? 0; }
+function countBy(arr, key) {
+  const m = {};
+  for (const x of arr) m[x[key]] = (m[x[key]] || 0) + 1;
+  return m;
+}