canship 0.1.0 → 0.2.0

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { resolve as resolve2 } from "path";
-import { existsSync as existsSync2, statSync as statSync3, writeFileSync } from "fs";
+import { isAbsolute as isAbsolute2, relative as relative_, resolve as resolve2 } from "path";
+import { existsSync as existsSync3, realpathSync as realpathSync2, statSync as statSync5, writeFileSync as writeFileSync2 } from "fs";
 
 // src/rules/patterns.ts
 var IRRELEVANT_HOSTS = /^(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\]|host\.docker\.internal|.*\.?example\.(?:com|org|net)|.*\.(?:test|invalid|localhost))$/i;
@@ -44,6 +44,20 @@ var SECRET_PATTERNS = [
     impact: "Grants access to your repositories \u2014 including private ones, and the ability to push code.",
     rotateAt: "https://github.com/settings/tokens"
   },
+  {
+    id: "npm-token",
+    name: "npm access token",
+    // Shape only, though npm encodes a CRC32 of the token into its last six
+    // characters and this could verify it. The github-token entry above uses
+    // the same scheme and does not verify it either, for the reason that
+    // settles it: if the algorithm ever changes, a checksum test turns a real
+    // leaked token into a silent pass. A false positive costs a glance. This
+    // particular false negative costs the account, and every account that
+    // installs anything published from it afterwards.
+    pattern: /\bnpm_[A-Za-z0-9]{36}\b/g,
+    impact: "Publishes packages under your account. Anyone who installs one afterwards runs whatever that version contains.",
+    rotateAt: "https://docs.npmjs.com/creating-and-viewing-access-tokens"
+  },
   {
     id: "google-api-key",
     name: "Google API key",
@@ -191,8 +205,8 @@ function redactSecret(secret) {
 }
 function redactLine(line, secret) {
   const trimmed = line.trim();
-  if (!secret) return truncate(trimmed);
-  return truncate(trimmed.split(secret).join(redactSecret(secret)));
+  if (!secret) return trimmed;
+  return trimmed.split(secret).join(redactSecret(secret));
 }
 var JWT_SHAPED = new RegExp(String.raw`\b${JWT_SOURCE}\b`, "g");
 function redactAll(text) {
@@ -407,31 +421,39 @@ function gitEnvironment() {
   env.PAGER = "";
   return env;
 }
-function execGitSync(executable, root, args, options = {}) {
+function hardeningArgs(root) {
   const worktree = gitRootAbove(root) ?? root;
   const noHooks = process.platform === "win32" ? "NUL" : "/dev/null";
-  return execFileSync(
-    executable,
-    [
-      "-c",
-      `core.worktree=${worktree}`,
-      "-c",
-      "core.bare=false",
-      "-c",
-      "core.fsmonitor=false",
-      "-c",
-      `core.hooksPath=${noHooks}`,
-      ...args
-    ],
-    {
-      cwd: root,
-      encoding: "utf8",
-      maxBuffer: options.maxBuffer ?? MAX_GIT_OUTPUT,
-      stdio: ["ignore", "pipe", options.stderr ?? "ignore"],
-      windowsHide: true,
-      env: gitEnvironment()
-    }
-  );
+  return [
+    "-c",
+    `core.worktree=${worktree}`,
+    "-c",
+    "core.bare=false",
+    "-c",
+    "core.fsmonitor=false",
+    "-c",
+    `core.hooksPath=${noHooks}`
+  ];
+}
+function execGitSync(executable, root, args, options = {}) {
+  return execFileSync(executable, [...hardeningArgs(root), ...args], {
+    cwd: root,
+    encoding: "utf8",
+    maxBuffer: options.maxBuffer ?? MAX_GIT_OUTPUT,
+    stdio: ["ignore", "pipe", options.stderr ?? "ignore"],
+    windowsHide: true,
+    env: gitEnvironment()
+  });
+}
+function execGitBatch(executable, root, args, input, options = {}) {
+  return execFileSync(executable, [...hardeningArgs(root), ...args], {
+    cwd: root,
+    input,
+    maxBuffer: options.maxBuffer ?? MAX_GIT_OUTPUT,
+    stdio: ["pipe", "pipe", options.stderr ?? "ignore"],
+    windowsHide: true,
+    env: gitEnvironment()
+  });
 }
 
 // src/walker.ts
@@ -521,10 +543,29 @@ var CREDENTIAL_FILENAMES = /* @__PURE__ */ new Set([
   "id_ed25519"
 ]);
 var PROBE_BYTES = 4096;
-var IGNORE_FILE_MARKER = /^\s*(?:\/\/|#|--|\*\/?|\/\*|<!--)?\s*canship-ignore-file\s*(?:\*\/|-->)?\s*$/;
+var IGNORE_FILE_MARKER = /^\s*(?:(?:\/\/|#|--|\*\/?|\/\*|<!--)\s*)?canship-ignore-file(?:\s*(?:\*\/|-->))?\s*$/;
 function hasIgnoreMarker(lines) {
   return lines.some((line) => IGNORE_FILE_MARKER.test(line));
 }
+var IGNORE_LINE_MARKER = /^\s*(?:(?:\/\/|#|--|\*\/?|\/\*|<!--)\s*)?canship-ignore-next-line(?:\s+([\w./-]+))?(?:\s*(?:\*\/|-->))?\s*$/;
+function ignoredLinesOf(lines) {
+  const found = /* @__PURE__ */ new Map();
+  lines.forEach((line, index) => {
+    const match = IGNORE_LINE_MARKER.exec(line);
+    if (match === null) return;
+    const governed = index + 2;
+    const ruleId = match[1];
+    if (ruleId === void 0) {
+      found.set(governed, null);
+      return;
+    }
+    if (found.has(governed) && found.get(governed) === null) return;
+    const rules = found.get(governed) ?? /* @__PURE__ */ new Set();
+    rules.add(ruleId);
+    found.set(governed, rules);
+  });
+  return found;
+}
 var SKIP_FILENAMES = /* @__PURE__ */ new Set(["bun.lockb"]);
 function isEnvFile(name) {
   const lower = name.toLowerCase();
@@ -878,68 +919,100 @@ function parseEnvLine(raw) {
 }
 
 // src/mask.ts
+var SLASH = 47;
+var STAR = 42;
+var DOUBLE_QUOTE = 34;
+var SINGLE_QUOTE = 39;
+var BACKTICK = 96;
+var BACKSLASH = 92;
+var DOLLAR = 36;
+var OPEN_BRACE = 123;
+var CLOSE_BRACE = 125;
+var NEWLINE = 10;
+var SPACE = 32;
+function codesOf(src) {
+  const out = new Uint16Array(src.length);
+  for (let i = 0; i < src.length; i++) out[i] = src.charCodeAt(i);
+  return out;
+}
+var CHUNK = 8192;
+function stringOf(out) {
+  let text = "";
+  for (let i = 0; i < out.length; i += CHUNK) {
+    const end = i + CHUNK < out.length ? i + CHUNK : out.length;
+    text += String.fromCharCode.apply(null, out.subarray(i, end));
+  }
+  return text;
+}
 function blank(out, from, to) {
-  for (let i = from; i < to && i < out.length; i++) {
-    if (out[i] !== "\n") out[i] = " ";
+  const end = to < out.length ? to : out.length;
+  for (let i = from; i < end; i++) {
+    if (out[i] !== NEWLINE) out[i] = SPACE;
   }
 }
 function endOfString(src, start, quote) {
+  const length = src.length;
   let i = start + 1;
-  while (i < src.length) {
-    if (src[i] === "\\") {
+  while (i < length) {
+    const ch = src.charCodeAt(i);
+    if (ch === BACKSLASH) {
       i += 2;
       continue;
     }
-    if (src[i] === quote) return i + 1;
+    if (ch === quote) return i + 1;
     i++;
   }
-  return src.length;
+  return length;
 }
 function maskTemplate(src, out, start) {
+  const length = src.length;
   let i = start + 1;
   let literalFrom = i;
-  while (i < src.length) {
-    if (src[i] === "\\") {
+  while (i < length) {
+    const ch = src.charCodeAt(i);
+    if (ch === BACKSLASH) {
       i += 2;
       continue;
     }
-    if (src[i] === "`") {
+    if (ch === BACKTICK) {
       blank(out, literalFrom, i);
       return i + 1;
     }
-    if (src[i] === "$" && src[i + 1] === "{") {
+    if (ch === DOLLAR && src.charCodeAt(i + 1) === OPEN_BRACE) {
       blank(out, literalFrom, i);
       let depth = 0;
       let j = i + 1;
-      while (j < src.length) {
-        const ch = src[j];
-        const pair = src.slice(j, j + 2);
-        if (pair === "//") {
-          const end = src.indexOf("\n", j);
-          const stop = end === -1 ? src.length : end;
-          blank(out, j, stop);
-          j = stop;
-          continue;
-        }
-        if (pair === "/*") {
-          const close = src.indexOf("*/", j + 2);
-          const stop = close === -1 ? src.length : close + 2;
-          blank(out, j, stop);
-          j = stop;
-          continue;
+      while (j < length) {
+        const inner = src.charCodeAt(j);
+        if (inner === SLASH) {
+          const next = src.charCodeAt(j + 1);
+          if (next === SLASH) {
+            const end = src.indexOf("\n", j);
+            const stop = end === -1 ? length : end;
+            blank(out, j, stop);
+            j = stop;
+            continue;
+          }
+          if (next === STAR) {
+            const close = src.indexOf("*/", j + 2);
+            const stop = close === -1 ? length : close + 2;
+            blank(out, j, stop);
+            j = stop;
+            continue;
+          }
         }
-        if (ch === '"' || ch === "'") {
-          const stop = endOfString(src, j, ch);
+        if (inner === DOUBLE_QUOTE || inner === SINGLE_QUOTE) {
+          const stop = endOfString(src, j, inner);
           blank(out, j + 1, stop - 1);
           j = stop;
           continue;
         }
-        if (ch === "`") {
+        if (inner === BACKTICK) {
           j = maskTemplate(src, out, j);
           continue;
         }
-        if (ch === "{") depth++;
-        else if (ch === "}") {
+        if (inner === OPEN_BRACE) depth++;
+        else if (inner === CLOSE_BRACE) {
           depth--;
           if (depth === 0) {
             j++;
@@ -954,70 +1027,76 @@ function maskTemplate(src, out, start) {
     }
     i++;
   }
-  blank(out, literalFrom, src.length);
-  return src.length;
+  blank(out, literalFrom, length);
+  return length;
 }
 function maskJsComments(src) {
-  const out = src.split("");
+  const length = src.length;
+  const out = codesOf(src);
   let i = 0;
-  while (i < src.length) {
-    const ch = src[i];
-    const two = src.slice(i, i + 2);
-    if (two === "//") {
-      const end = src.indexOf("\n", i);
-      const stop = end === -1 ? src.length : end;
-      blank(out, i, stop);
-      i = stop;
-      continue;
-    }
-    if (two === "/*") {
-      const close = src.indexOf("*/", i + 2);
-      const stop = close === -1 ? src.length : close + 2;
-      blank(out, i, stop);
-      i = stop;
-      continue;
+  while (i < length) {
+    const ch = src.charCodeAt(i);
+    if (ch === SLASH) {
+      const next = src.charCodeAt(i + 1);
+      if (next === SLASH) {
+        const end = src.indexOf("\n", i);
+        const stop = end === -1 ? length : end;
+        blank(out, i, stop);
+        i = stop;
+        continue;
+      }
+      if (next === STAR) {
+        const close = src.indexOf("*/", i + 2);
+        const stop = close === -1 ? length : close + 2;
+        blank(out, i, stop);
+        i = stop;
+        continue;
+      }
     }
-    if (ch === '"' || ch === "'" || ch === "`") {
+    if (ch === DOUBLE_QUOTE || ch === SINGLE_QUOTE || ch === BACKTICK) {
       i = endOfString(src, i, ch);
       continue;
     }
     i++;
   }
-  return out.join("");
+  return stringOf(out);
 }
 function maskJsNoise(src) {
-  const out = src.split("");
+  const length = src.length;
+  const out = codesOf(src);
   let i = 0;
-  while (i < src.length) {
-    const ch = src[i];
-    const two = src.slice(i, i + 2);
-    if (two === "//") {
-      const end = src.indexOf("\n", i);
-      const stop = end === -1 ? src.length : end;
-      blank(out, i, stop);
-      i = stop;
-      continue;
-    }
-    if (two === "/*") {
-      const close = src.indexOf("*/", i + 2);
-      const stop = close === -1 ? src.length : close + 2;
-      blank(out, i, stop);
-      i = stop;
-      continue;
+  while (i < length) {
+    const ch = src.charCodeAt(i);
+    if (ch === SLASH) {
+      const next = src.charCodeAt(i + 1);
+      if (next === SLASH) {
+        const end = src.indexOf("\n", i);
+        const stop = end === -1 ? length : end;
+        blank(out, i, stop);
+        i = stop;
+        continue;
+      }
+      if (next === STAR) {
+        const close = src.indexOf("*/", i + 2);
+        const stop = close === -1 ? length : close + 2;
+        blank(out, i, stop);
+        i = stop;
+        continue;
+      }
     }
-    if (ch === '"' || ch === "'") {
+    if (ch === DOUBLE_QUOTE || ch === SINGLE_QUOTE) {
       const stop = endOfString(src, i, ch);
       blank(out, i + 1, stop - 1);
       i = stop;
       continue;
     }
-    if (ch === "`") {
+    if (ch === BACKTICK) {
       i = maskTemplate(src, out, i);
       continue;
     }
     i++;
   }
-  return out.join("");
+  return stringOf(out);
 }
 var commentCache = /* @__PURE__ */ new WeakMap();
 var noiseCache = /* @__PURE__ */ new WeakMap();
@@ -1108,12 +1187,14 @@ function isClientCode(file) {
   }
   return false;
 }
-function isSupabaseProject(ctx) {
+var MENTIONS_SUPABASE = /supabase/i;
+function isSupabaseProject(ctx, files = ctx.files, scope = "") {
   const isSupabaseUrlName = (name) => name === "SUPABASE_URL" || name.endsWith("_SUPABASE_URL");
-  for (const file of ctx.files) {
-    if (file.path === "supabase" || file.path.startsWith("supabase/")) return true;
-    if (file.path.includes("/supabase/migrations/")) return true;
-    const name = file.path.slice(file.path.lastIndexOf("/") + 1);
+  for (const file of files) {
+    const path = scope === "" ? file.path : file.path.slice(scope.length + 1);
+    if (path === "supabase" || path.startsWith("supabase/")) return true;
+    if (path.includes("/supabase/migrations/")) return true;
+    const name = path.slice(path.lastIndexOf("/") + 1);
     if (isEnvFile(name)) {
       for (const line of file.lines) {
         const entry = parseEnvLine(line);
@@ -1134,6 +1215,7 @@ function isSupabaseProject(ctx) {
       }
       continue;
     }
+    if (!MENTIONS_SUPABASE.test(file.content)) continue;
     const commentsRemoved = commentsMaskedOf(file);
     const code = noiseMaskedOf(file);
     const supabaseImport = /(?:\bfrom\s*|\bimport\s*\(\s*|\brequire\s*\(\s*|\bimport\s*)['"]@supabase\/(?:supabase-js|ssr)(?:\/[^'"]*)?['"]/g;
@@ -1209,18 +1291,17 @@ var secretsRule = {
       if (pat.publicByDesign) continue;
       pat.pattern.lastIndex = 0;
       let match;
-      if (findings.length >= MAX_FINDINGS_PER_FILE) break;
       while ((match = pat.pattern.exec(file.content)) !== null) {
+        const secret = match[0];
+        if (isPlaceholder(secretPartOf(match, pat))) continue;
+        if (pat.ignoreIf?.(match)) continue;
         if (findings.length >= MAX_FINDINGS_PER_FILE) {
           ctx.reportIncomplete(
             "secrets/hardcoded",
             `${file.path} holds more than ${MAX_FINDINGS_PER_FILE} credential-shaped strings; the rest were not reported`
           );
-          break;
+          return findings;
         }
-        const secret = match[0];
-        if (isPlaceholder(secretPartOf(match, pat))) continue;
-        if (pat.ignoreIf?.(match)) continue;
         const line = lineNumberAt(lineStarts, match.index);
         const rawLine = file.lines[line - 1] ?? "";
         const clientSide = isClientCode(file);
@@ -1454,6 +1535,7 @@ function checkSourceFile(file) {
 
 // src/rules/gitleak.ts
 import { basename as basename4 } from "path";
+import { createHash } from "crypto";
 function isEnvTemplate(path) {
   return isTemplateName(path);
 }
@@ -1495,6 +1577,41 @@ function git(root, gitExecutable, args) {
     return null;
   }
 }
+function batchBlobs(root, gitExecutable, specs) {
+  if (gitExecutable === null || specs.length === 0) return specs.map(() => null);
+  if (specs.some((spec) => spec.includes("\n") || spec.includes("\r"))) {
+    return specs.map((spec) => git(root, gitExecutable, ["show", "--no-ext-diff", "--no-textconv", spec]));
+  }
+  let out;
+  try {
+    out = execGitBatch(
+      gitExecutable,
+      root,
+      ["cat-file", "--batch", "--buffer"],
+      `${specs.join("\n")}
+`
+    );
+  } catch {
+    return specs.map(() => null);
+  }
+  const blobs = [];
+  let at = 0;
+  for (let i = 0; i < specs.length; i++) {
+    const newline = out.indexOf(10, at);
+    if (newline === -1) break;
+    const header = out.toString("utf8", at, newline);
+    at = newline + 1;
+    const size = Number(header.slice(header.lastIndexOf(" ") + 1));
+    if (!Number.isInteger(size) || size < 0) {
+      blobs.push(null);
+      continue;
+    }
+    blobs.push(out.toString("utf8", at, at + size));
+    at += size + 1;
+  }
+  while (blobs.length < specs.length) blobs.push(null);
+  return blobs;
+}
 function gitOrThrow(root, gitExecutable, args) {
   const out = git(root, gitExecutable, args);
   if (out === null) throw new Error(`git ${args.slice(0, 2).join(" ")} failed in ${root}`);
@@ -1542,24 +1659,37 @@ function historicalEvidence(root, gitExecutable, entry) {
   ]) ?? "").split(/\r?\n/).filter(Boolean);
   if (all.length === 0) return null;
   const revs = all.slice(0, MAX_HISTORY_REVISIONS);
+  const bodies = batchBlobs(
+    root,
+    gitExecutable,
+    revs.map((rev) => `${rev}:${entry.repoPath}`)
+  );
   let best = "none";
   let unreadable = 0;
-  for (const rev of revs) {
-    const body = git(root, gitExecutable, [
-      "show",
-      "--no-ext-diff",
-      "--no-textconv",
-      `${rev}:${entry.repoPath}`
-    ]);
+  const hintHashes = /* @__PURE__ */ new Set();
+  for (const body of bodies) {
     if (body === null) {
       unreadable++;
       continue;
     }
     const evidence = evidenceIn(body.split(/\r?\n/));
-    if (evidence === "proof") return { evidence: "proof", unread: 0, unreadable };
-    if (evidence === "hint") best = "hint";
+    if (evidence === "proof") return {
+      evidence: "proof",
+      unread: 0,
+      unreadable,
+      sourceFingerprint: createHash("sha256").update(body.trim(), "utf8").digest("hex")
+    };
+    if (evidence === "hint") {
+      best = "hint";
+      hintHashes.add(createHash("sha256").update(body.trim(), "utf8").digest("hex"));
+    }
   }
-  return { evidence: best, unread: all.length - revs.length, unreadable };
+  return {
+    evidence: best,
+    unread: all.length - revs.length,
+    unreadable,
+    sourceFingerprint: createHash("sha256").update([...hintHashes].sort().join("\n")).digest("hex")
+  };
 }
 function hasRemote(root, gitExecutable) {
   const out = git(root, gitExecutable, ["remote"]);
@@ -1636,7 +1766,7 @@ var gitleakRule = {
       if (history && history.unreadable > 0) {
         ctx.reportIncomplete(
           "gitleak/env-in-history",
-          `${history.unreadable} historical ${history.unreadable === 1 ? "version" : "versions"} of ${path} could not be read with git show; the repository may be incomplete or the file may exceed the Git output limit`
+          `${history.unreadable} historical ${history.unreadable === 1 ? "version" : "versions"} of ${path} could not be read from the repository; the repository may be incomplete or the file may exceed the Git output limit`
         );
       }
       const evidence = history?.evidence ?? "hint";
@@ -1644,6 +1774,7 @@ var gitleakRule = {
       const scaffolding = isScaffolding(path);
       findings.push({
         ruleId: "gitleak/env-in-history",
+        ...history?.sourceFingerprint === void 0 ? {} : { sourceFingerprint: history.sourceFingerprint },
         severity: "P0",
         // Claiming certainty about a file nobody could read would be the same
         // overreach the tracked branch just stopped making.
@@ -1686,28 +1817,41 @@ var INTERNAL_SCHEMAS = /* @__PURE__ */ new Set([
   "pg_catalog"
 ]);
 var IS_DO_BLOCK = /\bdo\s+(?:language\s+\w+\s+)?$/i;
+var DASH = 45;
+var SLASH2 = 47;
+var STAR2 = 42;
+var SINGLE_QUOTE2 = 39;
+var DOUBLE_QUOTE2 = 34;
+var DOLLAR2 = 36;
+var NEWLINE2 = 10;
+var UNDERSCORE = 95;
+function isSpaceCode(code) {
+  if (code === 32 || code >= 9 && code <= 13) return true;
+  return code > 127 && /\s/.test(String.fromCharCode(code));
+}
 function maskSqlNoise(sql) {
-  const out = sql.split("");
+  const length = sql.length;
+  const out = codesOf(sql);
   const erase = (from, to) => blank(out, from, to);
   let i = 0;
-  while (i < sql.length) {
-    const ch = sql[i];
-    const two = sql.slice(i, i + 2);
-    if (two === "--") {
+  while (i < length) {
+    const ch = sql.charCodeAt(i);
+    if (ch === DASH && sql.charCodeAt(i + 1) === DASH) {
       const end = sql.indexOf("\n", i);
-      erase(i, end === -1 ? sql.length : end);
-      i = end === -1 ? sql.length : end;
+      erase(i, end === -1 ? length : end);
+      i = end === -1 ? length : end;
       continue;
     }
-    if (two === "/*") {
+    if (ch === SLASH2 && sql.charCodeAt(i + 1) === STAR2) {
       let depth = 0;
       let j = i;
-      while (j < sql.length) {
-        const pair = sql.slice(j, j + 2);
-        if (pair === "/*") {
+      while (j < length) {
+        const first = sql.charCodeAt(j);
+        const second = sql.charCodeAt(j + 1);
+        if (first === SLASH2 && second === STAR2) {
           depth++;
           j += 2;
-        } else if (pair === "*/") {
+        } else if (first === STAR2 && second === SLASH2) {
           depth--;
           j += 2;
           if (depth === 0) break;
@@ -1719,16 +1863,17 @@ function maskSqlNoise(sql) {
       i = j;
       continue;
     }
-    if (ch === "'") {
+    if (ch === SINGLE_QUOTE2) {
       const escaped = i > 0 && /[Ee]/.test(sql[i - 1] ?? "") && !/[A-Za-z0-9_]/.test(sql[i - 2] ?? "");
       let j = i + 1;
-      while (j < sql.length) {
-        if (escaped && sql[j] === "\\") {
+      while (j < length) {
+        const inner = sql.charCodeAt(j);
+        if (escaped && inner === 92) {
           j += 2;
           continue;
         }
-        if (sql[j] === "'") {
-          if (sql[j + 1] === "'") {
+        if (inner === SINGLE_QUOTE2) {
+          if (sql.charCodeAt(j + 1) === SINGLE_QUOTE2) {
             j += 2;
             continue;
           }
@@ -1741,20 +1886,21 @@ function maskSqlNoise(sql) {
       i = j;
       continue;
     }
-    if (ch === '"') {
+    if (ch === DOUBLE_QUOTE2) {
       let j = i + 1;
-      while (j < sql.length && sql[j] !== '"') {
-        if (/\s/.test(out[j] ?? "") && out[j] !== "\n") out[j] = "_";
+      while (j < length && sql.charCodeAt(j) !== DOUBLE_QUOTE2) {
+        const code = out[j];
+        if (code !== void 0 && code !== NEWLINE2 && isSpaceCode(code)) out[j] = UNDERSCORE;
         j++;
       }
       i = j + 1;
       continue;
     }
-    if (ch === "$") {
+    if (ch === DOLLAR2) {
       const tag = /^\$(?:[A-Za-z_]\w*)?\$/.exec(sql.slice(i))?.[0];
       if (tag) {
         const close = sql.indexOf(tag, i + tag.length);
-        const end = close === -1 ? sql.length : close + tag.length;
+        const end = close === -1 ? length : close + tag.length;
         if (!IS_DO_BLOCK.test(sql.slice(0, i))) erase(i, end);
         i = end;
         continue;
@@ -1762,7 +1908,7 @@ function maskSqlNoise(sql) {
     }
     i++;
   }
-  return out.join("");
+  return stringOf(out);
 }
 function unquote(ident) {
   const quoted = /^"(.*)"$/.exec(ident);
@@ -1851,10 +1997,7 @@ function projectScopeOf(path, scopes) {
   return best;
 }
 function isActiveSupabaseScope(ctx, files, scope) {
-  const rebased = files.map(
-    (file) => scope === "" ? file : { ...file, path: file.path.slice(scope.length + 1) }
-  );
-  return isSupabaseProject({ ...ctx, files: rebased });
+  return isSupabaseProject(ctx, files, scope);
 }
 function replayScopeOf(file, projectScope) {
   return `${file.isExampleContext ? "example" : "project"}:${projectScope}`;
@@ -2234,6 +2377,122 @@ function hasAuthSignal(file) {
   const code = noiseMaskedOf(file);
   return AUTH_ENFORCING_CALL.test(code) || hasConditionalAuthGuard(code);
 }
+function delimiterPairs(code) {
+  const pairs = /* @__PURE__ */ new Map();
+  const stack = [];
+  for (let i = 0; i < code.length; i++) {
+    const ch = code[i];
+    if ("({[".includes(ch)) stack.push(i);
+    else if (")}]".includes(ch)) {
+      const open = stack.pop();
+      if (open !== void 0 && "({[".indexOf(code[open]) === ")}]".indexOf(ch)) {
+        pairs.set(open, i);
+      }
+    }
+  }
+  return pairs;
+}
+function functionBodies(code, pairs) {
+  const bodies = [];
+  for (const match of code.matchAll(/\bfunction\s*\*?\s*(?:\w+\s*)?\(|=>\s*\{/g)) {
+    let body;
+    if (match[0].startsWith("=>")) body = match.index + match[0].length - 1;
+    else {
+      const close = pairs.get(match.index + match[0].length - 1);
+      if (close === void 0) continue;
+      body = close + 1;
+      while (/\s/.test(code[body] ?? "")) body++;
+      if (code[body] === ":") {
+        const type = /^:[\w\s.<>,[\]|?]+(?=\{)/.exec(code.slice(body));
+        if (type) body += type[0].length;
+      }
+    }
+    const end = pairs.get(body);
+    if (code[body] === "{" && end !== void 0) bodies.push({ declaration: match.index, start: body, end });
+  }
+  return bodies;
+}
+function statementEnd(code, start, limit, pairs) {
+  if (code[start] === "{") return (pairs.get(start) ?? limit) + 1;
+  for (let i = start; i < limit; i++) {
+    if (code[i] === ";" || code[i] === "\n") return i + 1;
+    const close = pairs.get(i);
+    if (close !== void 0) i = close;
+  }
+  return limit;
+}
+function unguardedOperations(file, ops) {
+  if (ops.length === 0) return ops;
+  const code = noiseMaskedOf(file);
+  const pairs = delimiterPairs(code);
+  const bodies = functionBodies(code, pairs);
+  const declarations = new Map(bodies.map((body) => [body.declaration, body]));
+  const functionStarts = new Set(bodies.map((body) => body.start));
+  const guardEnds = /* @__PURE__ */ new Map();
+  const blocks = [...pairs].filter(([start]) => code[start] === "{").map(([start, end]) => ({ start, end })).sort((a, b) => a.start - b.start);
+  const active = [];
+  let blockIndex = 0;
+  const wrappers = [...code.matchAll(/\b(?:withAuth|NextAuth)\s*\(/g)].map((match) => {
+    const open = match.index + match[0].length - 1;
+    return { start: open, end: pairs.get(open) ?? open };
+  });
+  const guardEnd = (owner) => {
+    for (let i = owner.start + 1; i < owner.end; i++) {
+      const nested = declarations.get(i);
+      if (nested) {
+        i = nested.end;
+        continue;
+      }
+      if (code.startsWith("=>", i)) {
+        i = statementEnd(code, i + 2, owner.end, pairs) - 1;
+        continue;
+      }
+      if (i > 0 && /[\w$]/.test(code[i - 1])) continue;
+      const conditional = /^if\s*\(/.exec(code.slice(i, i + 32));
+      if (conditional) {
+        const open = i + conditional[0].length - 1;
+        const close2 = pairs.get(open);
+        if (close2 === void 0) return Infinity;
+        let start = close2 + 1;
+        while (/\s/.test(code[start] ?? "")) start++;
+        const end = statementEnd(code, start, owner.end, pairs);
+        if (end <= owner.end && hasConditionalAuthGuard(code.slice(i, end))) return end;
+        i = Math.min(end, owner.end) - 1;
+        continue;
+      }
+      const call = AUTH_ENFORCING_CALL.exec(code.slice(i, i + 100));
+      if (call?.index === 0 && !/^(?:withAuth|NextAuth)\b/i.test(call[0]) && !/\bfunction\s*$/.test(code.slice(Math.max(owner.start, i - 30), i))) {
+        const close2 = pairs.get(i + call[0].length - 1);
+        if (close2 !== void 0 && close2 < owner.end) return close2 + 1;
+      }
+      const close = pairs.get(i);
+      if (close !== void 0) i = close;
+    }
+    return Infinity;
+  };
+  return ops.filter((op) => {
+    while (blockIndex < blocks.length && blocks[blockIndex].start < op.index) {
+      const block = blocks[blockIndex++];
+      while (active.length && active[active.length - 1].end < block.start) active.pop();
+      active.push(block);
+    }
+    while (active.length && active[active.length - 1].end < op.index) active.pop();
+    if (wrappers.some((w) => w.start < op.index && w.end > op.index)) return false;
+    let ownerIndex = active.length - 1;
+    while (ownerIndex >= 0 && !functionStarts.has(active[ownerIndex].start)) ownerIndex--;
+    if (ownerIndex < 0) return true;
+    for (let index = ownerIndex; index < active.length; index++) {
+      const block = active[index];
+      let end = guardEnds.get(block.start);
+      if (end === void 0) {
+        end = guardEnd(block);
+        guardEnds.set(block.start, end);
+      }
+      if (end <= op.index) return false;
+    }
+    return true;
+  });
+}
 var CLIENT_CONSTRUCTOR = /\b(?:createClient|createServerClient)\s*(?:<[^()]{0,200}>)?\s*\(/;
 var SERVICE_ROLE_ENV = /\bSUPABASE_SERVICE_ROLE(?:_KEY)?\b|\bSERVICE_ROLE_KEY\b|\bSUPABASE_SECRET_KEY\b/;
 var SERVICE_ROLE_LITERAL = new RegExp(String.raw`['"\`](${JWT_SOURCE}|${SB_SECRET_SOURCE})['"\`]`, "g");
@@ -2627,8 +2886,7 @@ var apiAuthRule = {
     const sessionModules = ctx.files.filter(buildsSessionClient);
     const findings = [];
     for (const route of routes) {
-      if (hasAuthSignal(route)) continue;
-      const ops = findDataOps(route);
+      const ops = unguardedOperations(route, findDataOps(route));
       if (ops.length === 0) continue;
       const url = routeUrl(route.path);
       if (isAuthEndpoint(url)) continue;
@@ -2976,8 +3234,32 @@ var corsRule = {
 // src/rules/index.ts
 var FILE_RULES = [secretsRule, exposureRule, firebaseRulesRule, corsRule];
 var PROJECT_RULES = [gitleakRule, supabaseRlsRule, apiAuthRule];
+var RULE_IDS = [
+  "api/admin-db-access-without-auth",
+  "api/db-write-without-auth",
+  "cors/reflected-origin-with-credentials",
+  "cors/wildcard-with-credentials",
+  "exposure/private-name-in-public-env",
+  "exposure/secret-in-public-env",
+  "exposure/supabase-service-role-in-client",
+  "firebase/open-rules",
+  "firebase/test-mode-rules",
+  "gitleak/env-in-history",
+  "gitleak/env-tracked",
+  "supabase/rls-not-enabled",
+  // One per credential format, built the same way secrets.ts builds them, so
+  // adding a pattern cannot leave a finding id this list has never heard of.
+  ...SECRET_PATTERNS.map((p) => `secrets/hardcoded/${p.id}`)
+];
+function ruleMatches(selector, ruleId) {
+  return ruleId === selector || ruleId.startsWith(`${selector}/`);
+}
+function isKnownSelector(selector) {
+  return RULE_IDS.some((id) => ruleMatches(selector, id));
+}
 
 // src/engine.ts
+import { createHash as createHash2 } from "crypto";
 var SEVERITY_ORDER = { P0: 0, P1: 1, P2: 2 };
 var CONFIDENCE_ORDER = { certain: 0, likely: 1 };
 function dedupe(findings) {
@@ -3002,9 +3284,20 @@ function clean(text) {
 function cleanForOutput(text) {
   return clean(text);
 }
-function sanitize(findings) {
+function sanitize(findings, files) {
+  const byPath = new Map(files.map((file) => [file.path, file]));
+  const sourceIdentity = (f) => {
+    if (f.sourceFingerprint !== void 0) return { sourceFingerprint: f.sourceFingerprint };
+    const file = f.file === null ? void 0 : byPath.get(f.file);
+    const source = f.line === null ? file?.content : file?.lines[f.line - 1];
+    return source === void 0 ? {} : {
+      sourceFingerprint: createHash2("sha256").update(source.trim(), "utf8").digest("hex")
+    };
+  };
   return findings.map((f) => ({
     ...f,
+    // 仅输出摘要；原始行不进入报告，移动行号不改变身份。
+    ...sourceIdentity(f),
     title: clean(f.title),
     // Per paragraph, so the breaks between them survive a cleaner that removes
     // every newline inside them. See Finding.why.
@@ -3046,6 +3339,45 @@ function downgradeExampleContext(findings, files) {
     (f) => f.file !== null && examples.has(f.file) ? { ...f, confidence: "likely" } : f
   );
 }
+function suppressIgnoredLines(findings, files) {
+  const byPath = new Map(files.map((f) => [f.path, f]));
+  const markers = /* @__PURE__ */ new Map();
+  const kept = [];
+  const ignored = [];
+  for (const f of findings) {
+    if (f.file === null || f.line === null) {
+      kept.push(f);
+      continue;
+    }
+    let lines = markers.get(f.file);
+    if (lines === void 0) {
+      const file = byPath.get(f.file);
+      lines = file === void 0 ? /* @__PURE__ */ new Map() : ignoredLinesOf(file.lines);
+      markers.set(f.file, lines);
+    }
+    if (!lines.has(f.line)) {
+      kept.push(f);
+      continue;
+    }
+    const rules = lines.get(f.line);
+    if (rules !== null && rules !== void 0 && !rules.has(f.ruleId)) {
+      kept.push(f);
+      continue;
+    }
+    ignored.push({ file: f.file, line: f.line, ruleId: f.ruleId });
+  }
+  return { kept, ignored };
+}
+function applyRuleSelection(findings, options) {
+  const only = options.only ?? [];
+  const skip = options.skip ?? [];
+  if (only.length === 0 && skip.length === 0) return { kept: findings, selection: null };
+  const kept = findings.filter((f) => {
+    if (only.length > 0) return only.some((s) => ruleMatches(s, f.ruleId));
+    return !skip.some((s) => ruleMatches(s, f.ruleId));
+  });
+  return { kept, selection: { only, skip, removed: findings.length - kept.length } };
+}
 function sortFindings(findings) {
   return [...findings].sort((a, b) => {
     const bySeverity = SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity];
@@ -3055,7 +3387,7 @@ function sortFindings(findings) {
     return (a.file ?? "").localeCompare(b.file ?? "") || (a.line ?? 0) - (b.line ?? 0);
   });
 }
-async function scan(root) {
+async function scan(root, options = {}) {
   const started = Date.now();
   const gitExecutable = resolveGitExecutable(root);
   const git2 = detectGitRepo(root, gitExecutable);
@@ -3098,8 +3430,13 @@ async function scan(root) {
       errors.push({ ruleId: rule.id, file: null, message: messageOf(err), kind: "crashed" });
     }
   }
+  const { kept, ignored: ignoredFindings } = suppressIgnoredLines(
+    dedupe(downgradeExampleContext(findings, files)),
+    files
+  );
+  const selected = applyRuleSelection(kept, options);
   return {
-    findings: sanitize(sortFindings(dedupe(downgradeExampleContext(findings, files)))),
+    findings: sanitize(sortFindings(selected.kept), files),
     filesScanned: files.length,
     durationMs: Date.now() - started,
     errors: errors.map((e) => ({
@@ -3109,6 +3446,17 @@ async function scan(root) {
     })),
     skipped: sanitizeSkippedForOutput(skipped),
     ignored: ignored.map(clean),
+    // The path goes through the boundary like every other path that reaches a
+    // reader: a filename is chosen by whoever can add a file to the repository,
+    // and one holding a credential would otherwise print it here in full.
+    ignoredFindings: ignoredFindings.map((f) => ({ ...f, file: clean(f.file) })),
+    // Selectors come from a config file or the command line, both of which are
+    // text canship prints back, so both go through the boundary.
+    ruleSelection: selected.selection === null ? null : {
+      only: selected.selection.only.map(clean),
+      skip: selected.selection.skip.map(clean),
+      removed: selected.selection.removed
+    },
     vendored,
     // A deliberate opt-out is not an incomplete scan: the user made that call
     // knowingly. It is listed in the report, not treated as a failure.
@@ -3181,6 +3529,27 @@ function skipPhrase(reason) {
 
 // src/report/terminal.ts
 var INDENT = "  ";
+function renderBaseline(opts) {
+  const suppressed = opts.baselineSuppressed ?? 0;
+  const stale = opts.baselineStale ?? 0;
+  if (suppressed === 0 && stale === 0) return [];
+  const out = [];
+  if (suppressed > 0) {
+    const where = opts.baselinePath ? ` (${opts.baselinePath})` : "";
+    out.push(
+      `${INDENT}${yellow(`${suppressed} ${plural(suppressed, "finding")} hidden by the baseline${where}`)}`
+    );
+    out.push(`${INDENT}${dim("These problems still exist. Re-run without --baseline to see them.")}`);
+  }
+  if (stale > 0) {
+    out.push(
+      // Not plural() — that helper only appends an s, and "entrys" is not a
+      // word. The irregular ones have to be written out.
+      `${INDENT}${dim(`${stale} baseline ${stale === 1 ? "entry" : "entries"} no longer ${stale === 1 ? "matches" : "match"} anything \u2014 re-run --baseline-write to prune.`)}`
+    );
+  }
+  return out;
+}
 function renderReport(result, opts) {
   const out = [""];
   const { findings } = result;
@@ -3215,6 +3584,7 @@ function renderReport(result, opts) {
     out.push("");
   }
   out.push(...renderIgnored(result));
+  out.push(...renderBaseline(opts));
   if (!opts.showingLikely && opts.hiddenLikely > 0) {
     out.push(
       `${INDENT}${dim(`${opts.hiddenLikely} lower-confidence ${plural(opts.hiddenLikely, "finding")} hidden. Run with --all to see ${opts.hiddenLikely === 1 ? "it" : "them"}.`)}`
@@ -3292,10 +3662,17 @@ function renderClean(result, opts) {
     out.push(
       `${INDENT}${yellow(bold(`! No certain findings \u2014 ${opts.hiddenLikely} lower-confidence ${plural(opts.hiddenLikely, "finding")} hidden`))}`
     );
+  } else if ((opts.baselineSuppressed ?? 0) > 0) {
+    const suppressed = opts.baselineSuppressed ?? 0;
+    out.push(
+      `${INDENT}${yellow(bold(`! No new findings \u2014 ${suppressed} ${plural(suppressed, "finding")} accepted by the baseline`))}`
+    );
   } else {
     out.push(`${INDENT}${green(bold("\u2713 No exposed credentials found"))}`);
   }
   out.push("");
+  out.push(...renderBaseline(opts));
+  if ((opts.baselineSuppressed ?? 0) > 0 || (opts.baselineStale ?? 0) > 0) out.push("");
   out.push(`${INDENT}${dim("canship checked for:")}`);
   out.push(`${INDENT}${dim("  \xB7 API keys hardcoded in source code")}`);
   out.push(`${INDENT}${dim("  \xB7 Server-side secrets exposed to the browser via public env prefixes")}`);
@@ -3310,6 +3687,10 @@ function renderClean(result, opts) {
   out.push(`${INDENT}${dim("did find are the right ones.")}`);
   if (opts.hiddenLikely > 0) {
     out.push(`${INDENT}${dim("This is not a finding-free result. Review the hidden items with --all.")}`);
+  } else if (result.ignoredFindings.length > 0) {
+    out.push(
+      `${INDENT}${dim("This is not a finding-free result \u2014 some were silenced in the source. See below.")}`
+    );
   } else {
     out.push(`${INDENT}${dim("A clean result means these checks passed \u2014 not that your app is secure.")}`);
   }
@@ -3338,6 +3719,20 @@ function renderIgnored(result) {
       `${INDENT}${dim(`${result.ignored.length} ${plural(result.ignored.length, "file")} excluded by canship-ignore-file: ${shown}${more}`)}`
     );
   }
+  if (result.ruleSelection !== null) {
+    const { only, skip, removed } = result.ruleSelection;
+    const which = only.length > 0 ? `only ${only.join(", ")}` : `everything except ${skip.join(", ")}`;
+    const cost = removed > 0 ? `, hiding ${removed} ${plural(removed, "finding")}` : "";
+    out.push(`${INDENT}${dim(`Rule selection in force: ${which}${cost}`)}`);
+  }
+  if (result.ignoredFindings.length > 0) {
+    const n = result.ignoredFindings.length;
+    const shown = result.ignoredFindings.slice(0, 3).map((f) => `${f.file}:${f.line} (${f.ruleId})`).join(", ");
+    const more = n > 3 ? `, and ${n - 3} more` : "";
+    out.push(
+      `${INDENT}${dim(`${n} ${plural(n, "finding")} silenced by canship-ignore-next-line: ${shown}${more}`)}`
+    );
+  }
   if (result.vendored > 0) {
     out.push(
       `${INDENT}${dim(`${result.vendored} ${plural(result.vendored, "file")} skipped inside dependency directories (node_modules, vendor, Pods, .yarn, .pnpm-store)`)}`
@@ -3431,8 +3826,18 @@ function renderFixPrompt(findings, ctx) {
   const incompleteNote = !ctx?.partial ? null : ctx.filesScanned === 0 ? "Note: canship scanned zero files at this path, so none of its file-based checks ran. Do not treat this as a clean result. The path was probably wrong, or everything there is gitignored or build output \u2014 re-run canship pointed at the project source." : "Note: the scan did not finish \u2014 some rules failed or some files could not be read. Fixing what follows does not mean the project is clear; re-run canship once it can complete.";
   const hiddenLikely = ctx?.hiddenLikely ?? 0;
   const hiddenNote = hiddenLikely === 0 ? null : `Note: ${hiddenLikely} lower-confidence ${hiddenLikely === 1 ? "finding was" : "findings were"} hidden by the default view. Do not treat this as a finding-free result. Re-run with --all --fix-prompt to review them.`;
+  const baselineSuppressed = ctx?.baselineSuppressed ?? 0;
+  const silenced = ctx?.silenced ?? [];
+  const suppressedNotes = [
+    !ctx?.ignoredFiles?.length ? null : `Note: ${ctx.ignoredFiles.length} file(s) excluded by canship-ignore-file: ${defuseMarkers(ctx.ignoredFiles.join(", "))}. Their contents were not checked. Do not treat this as a clean result.`,
+    baselineSuppressed === 0 ? null : `Note: ${baselineSuppressed} ${baselineSuppressed === 1 ? "finding was" : "findings were"} hidden by a baseline. Those problems still exist and are not listed below. Re-run without --baseline to see them.`,
+    silenced.length === 0 ? null : `Note: ${silenced.length} ${silenced.length === 1 ? "finding was" : "findings were"} silenced by a canship-ignore-next-line marker in the source, at ${defuseMarkers(silenced.join(", "))}. Those problems still exist and are not listed below.`,
+    !ctx?.ruleSelection ? null : `Note: rules were selected before this list was produced \u2014 ${defuseMarkers(ctx.ruleSelection)}. Findings from the rules that did not run are not listed below.`
+  ].filter((note) => note !== null);
   if (findings.length === 0) {
-    const notes = [incompleteNote, hiddenNote].filter((note) => note !== null);
+    const notes = [incompleteNote, hiddenNote, ...suppressedNotes].filter(
+      (note) => note !== null
+    );
     return notes.length === 0 ? null : `${notes.join("\n\n")}
 `;
   }
@@ -3449,6 +3854,10 @@ function renderFixPrompt(findings, ctx) {
     out.push(hiddenNote);
     out.push("");
   }
+  for (const note of suppressedNotes) {
+    out.push(note);
+    out.push("");
+  }
   if (codeFixable.length > 0) {
     out.push("--- Paste everything below into your coding assistant ---");
     out.push("");
@@ -3525,6 +3934,8 @@ function renderFinding2(f, index) {
 function renderHtml(result, opts) {
   const { findings } = result;
   const hiddenLikely = opts.hiddenLikely ?? 0;
+  const baselineSuppressed = opts.baselineSuppressed ?? 0;
+  const baselineStale = opts.baselineStale ?? 0;
   const { blocking: certain, minor, unsure } = verdictOf(findings);
   const verdict = findings.length === 0 ? result.filesScanned === 0 ? (
     // Examined nothing, so there is nothing to report either way.
@@ -3533,7 +3944,13 @@ function renderHtml(result, opts) {
     // Never the green banner on a partial scan: it reads as a guarantee,
     // and a scan that skipped files cannot make one.
     hiddenLikely > 0 ? `<div class="verdict warn">No certain findings &mdash; ${hiddenLikely} lower-confidence ${plural(hiddenLikely, "finding")} hidden, and not everything was checked</div>` : `<div class="verdict warn">No findings &mdash; but not everything was checked</div>`
-  ) : hiddenLikely > 0 ? `<div class="verdict warn">No certain findings &mdash; ${hiddenLikely} lower-confidence ${plural(hiddenLikely, "finding")} hidden</div>` : `<div class="verdict clean">No exposed credentials found</div>` : certain > 0 ? `<div class="verdict bad">${certain} critical ${plural(certain, "issue")} &mdash; do not deploy</div>` : minor > 0 ? `<div class="verdict warn">${minor} ${plural(minor, "thing")} to fix &mdash; nothing exposed</div>` : `<div class="verdict warn">${unsure} possible ${plural(unsure, "issue")} to review</div>`;
+  ) : hiddenLikely > 0 ? `<div class="verdict warn">No certain findings &mdash; ${hiddenLikely} lower-confidence ${plural(hiddenLikely, "finding")} hidden</div>` : (
+    // The green banner is a statement about the project. A baseline
+    // makes it a statement about the diff instead, and this document
+    // outlives the run that produced it — whoever opens it later has
+    // only the banner to go on.
+    baselineSuppressed > 0 ? `<div class="verdict warn">No new findings &mdash; ${baselineSuppressed} ${plural(baselineSuppressed, "finding")} accepted by the baseline</div>` : `<div class="verdict clean">No exposed credentials found</div>`
+  ) : certain > 0 ? `<div class="verdict bad">${certain} critical ${plural(certain, "issue")} &mdash; do not deploy</div>` : minor > 0 ? `<div class="verdict warn">${minor} ${plural(minor, "thing")} to fix &mdash; nothing exposed</div>` : `<div class="verdict warn">${unsure} possible ${plural(unsure, "issue")} to review</div>`;
   const body = findings.length === 0 ? result.filesScanned === 0 ? (
     // The checklist below would be a false statement here: none of those
     // checks had any input to run against.
@@ -3548,6 +3965,10 @@ function renderHtml(result, opts) {
              <p><strong>This is not a finding-free result.</strong> The default report hides
              ${hiddenLikely} lower-confidence ${plural(hiddenLikely, "finding")}.</p>
              <p>Re-run with <code>--all --report</code> to include ${hiddenLikely === 1 ? "it" : "them"} in the report.</p>
+           </div>` : baselineSuppressed > 0 ? `<div class="clean-note">
+             <p><strong>This is not a finding-free result.</strong> A baseline is hiding
+             ${baselineSuppressed} ${plural(baselineSuppressed, "finding")}${opts.baselinePath ? ` (<code>${esc(opts.baselinePath)}</code>)` : ""}.</p>
+             <p>Those problems still exist. Re-run without <code>--baseline</code> to see ${baselineSuppressed === 1 ? "it" : "them"}.</p>
            </div>` : `<div class="clean-note">
            <p>canship checked for hardcoded API keys, server secrets exposed to the browser,
             Supabase tables without Row Level Security, open Firebase rules, API routes that reach
@@ -3558,7 +3979,12 @@ function renderHtml(result, opts) {
            checks it did find are the right ones.</p>
          </div>` : findings.map((f, i) => renderFinding2(f, i + 1)).join("\n");
   const optedOut = result.ignored.length > 0 ? `<p class="opted-out">${result.ignored.length} ${plural(result.ignored.length, "file")} excluded by <code>canship-ignore-file</code>: ${result.ignored.map((f) => `<code>${esc(f)}</code>`).join(", ")}</p>` : "";
+  const selection = result.ruleSelection;
+  const ruleSelection = selection === null ? "" : `<p class="opted-out">Rule selection in force: ${selection.only.length > 0 ? `only <code>${selection.only.map(esc).join("</code>, <code>")}</code>` : `everything except <code>${selection.skip.map(esc).join("</code>, <code>")}</code>`}${selection.removed > 0 ? `, hiding ${selection.removed} ${plural(selection.removed, "finding")}` : ""}.</p>`;
+  const silenced = result.ignoredFindings.length > 0 ? `<p class="opted-out">${result.ignoredFindings.length} ${plural(result.ignoredFindings.length, "finding")} silenced by <code>canship-ignore-next-line</code>: ${result.ignoredFindings.map((f) => `<code>${esc(f.file)}:${f.line}</code> (${esc(f.ruleId)})`).join(", ")}</p>` : "";
   const hiddenNotice = hiddenLikely > 0 && findings.length > 0 ? `<p class="opted-out">${hiddenLikely} lower-confidence ${plural(hiddenLikely, "finding")} hidden. Re-run with <code>--all --report</code> to include ${hiddenLikely === 1 ? "it" : "them"}.</p>` : "";
+  const baselineNotice = baselineSuppressed > 0 && findings.length > 0 ? `<p class="opted-out">${baselineSuppressed} ${plural(baselineSuppressed, "finding")} hidden by the baseline${opts.baselinePath ? ` (<code>${esc(opts.baselinePath)}</code>)` : ""}. Those problems still exist.</p>` : "";
+  const staleNotice = baselineStale > 0 ? `<p class="opted-out">${baselineStale} baseline ${baselineStale === 1 ? "entry" : "entries"} no longer ${baselineStale === 1 ? "matches" : "match"} anything &mdash; re-run <code>--baseline-write</code> to prune.</p>` : "";
   const incomplete = result.partial ? `<div class="incomplete">
          <h2>Not everything was checked</h2>
          <ul>
@@ -3660,6 +4086,10 @@ function renderHtml(result, opts) {
   ${body}
   ${incomplete}
   ${hiddenNotice}
+  ${baselineNotice}
+  ${staleNotice}
+  ${silenced}
+  ${ruleSelection}
   ${optedOut}
   <footer>
     Generated by canship. Everything ran locally; nothing was uploaded.
@@ -3670,13 +4100,387 @@ function renderHtml(result, opts) {
 `;
 }
 
+// src/baseline.ts
+import { createHash as createHash3 } from "crypto";
+import { readFileSync as readFileSync3, statSync as statSync3, writeFileSync } from "fs";
+var BASELINE_VERSION = 2;
+var DEFAULT_BASELINE_PATH = "canship-baseline.json";
+function fingerprintOf(f) {
+  const identity = [f.ruleId, f.file ?? "", f.title, f.sourceFingerprint ?? f.excerpt ?? ""].join("\0");
+  return createHash3("sha256").update(identity, "utf8").digest("hex");
+}
+function buildBaseline(findings, now = /* @__PURE__ */ new Date()) {
+  const byFingerprint = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    const fingerprint = fingerprintOf(f);
+    const existing = byFingerprint.get(fingerprint);
+    if (existing) {
+      existing.count++;
+      continue;
+    }
+    byFingerprint.set(fingerprint, {
+      fingerprint,
+      ruleId: f.ruleId,
+      file: f.file,
+      title: f.title,
+      count: 1
+    });
+  }
+  const entries = [...byFingerprint.values()].sort(
+    (a, b) => (a.file ?? "").localeCompare(b.file ?? "") || a.ruleId.localeCompare(b.ruleId) || a.fingerprint.localeCompare(b.fingerprint)
+  );
+  return { version: BASELINE_VERSION, generatedAt: now.toISOString(), entries };
+}
+function serializeBaseline(baseline) {
+  return `${JSON.stringify(baseline, null, 2)}
+`;
+}
+function writeBaseline(path, baseline) {
+  writeFileSync(path, serializeBaseline(baseline), "utf8");
+}
+var BaselineError = class extends Error {
+};
+function isEntry(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const e = value;
+  return typeof e["fingerprint"] === "string" && e["fingerprint"].length > 0 && typeof e["ruleId"] === "string" && (e["file"] === null || typeof e["file"] === "string") && typeof e["title"] === "string" && typeof e["count"] === "number" && Number.isInteger(e["count"]) && e["count"] > 0;
+}
+var MAX_BASELINE_BYTES = 10 * 1024 * 1024;
+function readBaseline(path) {
+  let text;
+  try {
+    const size = statSync3(path).size;
+    if (size > MAX_BASELINE_BYTES) {
+      throw new BaselineError(
+        `baseline ${path} is ${size} bytes, over the ${MAX_BASELINE_BYTES}-byte limit`
+      );
+    }
+    text = readFileSync3(path, "utf8");
+  } catch (err) {
+    if (err instanceof BaselineError) throw err;
+    throw new BaselineError(
+      `could not read baseline ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new BaselineError(`baseline ${path} is not valid JSON`);
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new BaselineError(`baseline ${path} is not a baseline file`);
+  }
+  const obj = parsed;
+  const version = obj["version"];
+  if (version !== BASELINE_VERSION) {
+    throw new BaselineError(
+      `baseline ${path} has version ${String(version)}; this canship reads version ${BASELINE_VERSION}. Review the findings and regenerate the baseline with --baseline-write.`
+    );
+  }
+  const rawEntries = obj["entries"];
+  if (!Array.isArray(rawEntries)) {
+    throw new BaselineError(`baseline ${path} has no entries array`);
+  }
+  const entries = [];
+  for (const [i, raw] of rawEntries.entries()) {
+    if (!isEntry(raw)) throw new BaselineError(`baseline ${path}: entry ${i} is malformed`);
+    entries.push({
+      fingerprint: raw.fingerprint,
+      ruleId: raw.ruleId,
+      file: raw.file,
+      title: raw.title,
+      count: raw.count
+    });
+  }
+  const generatedAt = typeof obj["generatedAt"] === "string" ? obj["generatedAt"] : "";
+  return { version: BASELINE_VERSION, generatedAt, entries };
+}
+function applyBaseline(findings, baseline) {
+  const remaining = /* @__PURE__ */ new Map();
+  for (const entry of baseline.entries) {
+    remaining.set(entry.fingerprint, (remaining.get(entry.fingerprint) ?? 0) + entry.count);
+  }
+  const kept = [];
+  let suppressed = 0;
+  for (const f of findings) {
+    const budget = remaining.get(fingerprintOf(f)) ?? 0;
+    if (budget > 0) {
+      remaining.set(fingerprintOf(f), budget - 1);
+      suppressed++;
+      continue;
+    }
+    kept.push(f);
+  }
+  let stale = 0;
+  for (const left of remaining.values()) stale += left;
+  return { kept, suppressed, stale };
+}
+
+// src/report/sarif.ts
+var INFORMATION_URI = "https://github.com/Tasomei/canship";
+function suppressionNotes(result, opts) {
+  const notes = [];
+  const baseline = opts.baselineSuppressed ?? 0;
+  const hidden = opts.hiddenLikely ?? 0;
+  if (baseline > 0) {
+    notes.push({
+      level: "warning",
+      message: {
+        text: `${baseline} finding${baseline === 1 ? "" : "s"} hidden by a baseline. Those problems still exist.`
+      }
+    });
+  }
+  if (result.ignoredFindings.length > 0) {
+    const where = result.ignoredFindings.map((f) => `${f.file}:${f.line} (${f.ruleId})`).join(", ");
+    notes.push({
+      level: "warning",
+      message: {
+        text: `${result.ignoredFindings.length} finding${result.ignoredFindings.length === 1 ? "" : "s"} silenced by canship-ignore-next-line: ${where}`
+      }
+    });
+  }
+  if (result.ignored.length > 0) {
+    notes.push({
+      level: "warning",
+      message: {
+        text: `${result.ignored.length} file${result.ignored.length === 1 ? "" : "s"} excluded by canship-ignore-file: ${result.ignored.join(", ")}`
+      }
+    });
+  }
+  if (opts.ruleSelection) {
+    notes.push({ level: "warning", message: { text: `Rule selection in force: ${opts.ruleSelection}` } });
+  }
+  if (hidden > 0) {
+    notes.push({
+      level: "warning",
+      message: {
+        text: `${hidden} lower-confidence finding${hidden === 1 ? "" : "s"} not included; re-run with --all.`
+      }
+    });
+  }
+  return notes;
+}
+function levelOf(f) {
+  return f.confidence === "certain" && BLOCKING.has(f.severity) ? "error" : "warning";
+}
+function rulesOf(findings) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const f of findings) if (!seen.has(f.ruleId)) seen.set(f.ruleId, f);
+  return [...seen.entries()].map(([id, f]) => ({
+    id,
+    name: id,
+    shortDescription: { text: f.title },
+    fullDescription: { text: f.why.join(" ") },
+    help: {
+      text: [...f.why, ...f.fix.length > 0 ? ["How to fix:", ...f.fix] : []].join("\n")
+    },
+    properties: {
+      // Not part of the SARIF vocabulary, so it travels as a property rather
+      // than being mangled into one of the three levels above.
+      "canship-severity": f.severity,
+      "canship-confidence": f.confidence
+    },
+    defaultConfiguration: { level: levelOf(f) }
+  }));
+}
+function resultsOf(findings) {
+  return findings.map((f) => ({
+    ruleId: f.ruleId,
+    level: levelOf(f),
+    message: { text: f.title },
+    // A finding with no file — git history, an RLS gap spanning migrations —
+    // gets no location rather than a made-up one. SARIF permits that, and
+    // pointing it at an arbitrary file would put an annotation on a line that
+    // has nothing to do with it.
+    locations: f.file === null ? [] : [
+      {
+        physicalLocation: {
+          // Already relative and already slash-separated, on Windows too.
+          artifactLocation: { uri: f.file },
+          ...f.line === null ? {} : { region: { startLine: f.line } }
+        }
+      }
+    ],
+    partialFingerprints: { canshipFindingV2: fingerprintOf(f) }
+  }));
+}
+function renderSarif(result, opts) {
+  const { findings } = result;
+  const notifications = [
+    ...result.errors.map((e) => ({
+      level: e.kind === "crashed" ? "error" : "warning",
+      message: { text: `${e.ruleId}: ${e.message}` }
+    })),
+    ...suppressionNotes(result, opts)
+  ];
+  const log = {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "canship",
+            version: opts.version,
+            informationUri: INFORMATION_URI,
+            rules: rulesOf(findings)
+          }
+        },
+        results: resultsOf(findings),
+        invocations: [
+          {
+            // False when a rule crashed or a file could not be read. It is not
+            // about whether findings exist — a scan that finds problems and
+            // completes was a successful invocation.
+            executionSuccessful: !result.partial,
+            ...notifications.length > 0 ? { toolExecutionNotifications: notifications } : {}
+          }
+        ]
+      }
+    ]
+  };
+  return `${JSON.stringify(log, null, 2)}
+`;
+}
+
+// src/config.ts
+import { existsSync as existsSync2, readFileSync as readFileSync4, statSync as statSync4 } from "fs";
+import { join as join3 } from "path";
+var CONFIG_FILENAME = "canship.config.json";
+var REFUSED_KEYS = /* @__PURE__ */ new Map([
+  [
+    "bestEffort",
+    "accepting an incomplete scan is a decision for whoever runs canship, not for the project being scanned \u2014 pass --best-effort instead"
+  ]
+]);
+var ConfigError = class extends Error {
+};
+var KNOWN_KEYS = /* @__PURE__ */ new Set(["baseline", "only", "skip", "all"]);
+function selectors(value, field, path) {
+  if (!Array.isArray(value)) {
+    throw new ConfigError(`${path}: "${field}" must be an array of rule ids`);
+  }
+  const out = [];
+  for (const entry of value) {
+    if (typeof entry !== "string" || entry === "") {
+      throw new ConfigError(`${path}: "${field}" must contain only rule ids`);
+    }
+    if (!isKnownSelector(entry)) {
+      throw new ConfigError(`${path}: "${field}" names no known rule: ${entry}`);
+    }
+    out.push(entry);
+  }
+  return out;
+}
+function boolean(value, field, path) {
+  if (typeof value !== "boolean") throw new ConfigError(`${path}: "${field}" must be true or false`);
+  return value;
+}
+function parseConfig(text, path) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new ConfigError(`${path} is not valid JSON`);
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new ConfigError(`${path} must contain a JSON object`);
+  }
+  const raw = parsed;
+  for (const key of Object.keys(raw)) {
+    const refused = REFUSED_KEYS.get(key);
+    if (refused !== void 0) {
+      throw new ConfigError(`${path}: "${key}" is not allowed here \u2014 ${refused}`);
+    }
+    if (!KNOWN_KEYS.has(key)) {
+      throw new ConfigError(`${path}: unknown setting "${key}"`);
+    }
+  }
+  const config = {};
+  if (raw["baseline"] !== void 0) {
+    if (typeof raw["baseline"] !== "string" || raw["baseline"] === "") {
+      throw new ConfigError(`${path}: "baseline" must be a file path`);
+    }
+    config.baseline = raw["baseline"];
+  }
+  if (raw["only"] !== void 0) config.only = selectors(raw["only"], "only", path);
+  if (raw["skip"] !== void 0) config.skip = selectors(raw["skip"], "skip", path);
+  if (raw["all"] !== void 0) config.all = boolean(raw["all"], "all", path);
+  if (config.only !== void 0 && config.skip !== void 0) {
+    throw new ConfigError(`${path}: "only" and "skip" cannot both be set`);
+  }
+  return config;
+}
+var MAX_CONFIG_BYTES = 1024 * 1024;
+function loadConfig(root) {
+  const path = join3(root, CONFIG_FILENAME);
+  if (!existsSync2(path)) return { config: {}, path: null };
+  let text;
+  try {
+    const size = statSync4(path).size;
+    if (size > MAX_CONFIG_BYTES) {
+      throw new ConfigError(
+        `${path} is ${size} bytes, over the ${MAX_CONFIG_BYTES}-byte limit`
+      );
+    }
+    text = readFileSync4(path, "utf8");
+  } catch (err) {
+    if (err instanceof ConfigError) throw err;
+    throw new ConfigError(
+      `could not read ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  return { config: parseConfig(text, path), path };
+}
+
 // src/cli.ts
-var VERSION = true ? "0.1.0" : "0.0.0-dev";
+var VERSION = true ? "0.2.0" : "0.0.0-dev";
 function argumentError(message) {
   process.stderr.write(`canship: ${cleanForOutput(message)}
 `);
   process.exit(3);
 }
+function optionalValue(arg, name, fallback) {
+  if (arg === name) return fallback;
+  if (!arg.startsWith(`${name}=`)) return null;
+  const value = arg.slice(name.length + 1);
+  if (!value) argumentError(`${name}= needs a file path`);
+  return value;
+}
+function insideProject(root, relative3) {
+  const target = resolve2(root, relative3);
+  const inside = relative_(realPathOf(root), realPathOf(target));
+  if (inside === "" || inside.startsWith("..") || isAbsolute2(inside)) {
+    argumentError(
+      `${CONFIG_FILENAME}: "baseline" must stay inside the project, and ${relative3} does not`
+    );
+  }
+  return target;
+}
+function realPathOf(path) {
+  let at = path;
+  const rest = [];
+  for (let depth = 0; depth < MAX_REAL_PATH_DEPTH; depth++) {
+    try {
+      const real = realpathSync2(at);
+      return rest.length === 0 ? real : resolve2(real, ...rest);
+    } catch {
+      const parent = resolve2(at, "..");
+      if (parent === at) return path;
+      rest.unshift(relative_(parent, at));
+      at = parent;
+    }
+  }
+  return path;
+}
+var MAX_REAL_PATH_DEPTH = 64;
+var UNREACHABLE_DEFAULT = "";
+function selectionPhrase(selection) {
+  if (selection === null) return null;
+  const which = selection.only.length > 0 ? `only ${selection.only.join(", ")}` : `everything except ${selection.skip.join(", ")}`;
+  return `${which}, hiding ${selection.removed}`;
+}
 function parseArgs(argv) {
   const args = {
     root: process.cwd(),
@@ -3685,21 +4489,61 @@ function parseArgs(argv) {
     fixPrompt: false,
     report: null,
     bestEffort: false,
+    baseline: null,
+    baselineDefault: false,
+    baselineWrite: null,
+    baselineWriteDefault: false,
+    only: [],
+    skip: [],
+    sarif: null,
+    noConfig: false,
     help: false,
     version: false
   };
   const positional = [];
   for (const arg of argv) {
-    if (arg === "--report") {
-      args.report = "canship-report.html";
+    const list = (name) => {
+      if (!arg.startsWith(`${name}=`)) return null;
+      const value = arg.slice(name.length + 1);
+      if (!value) argumentError(`${name}= needs at least one rule id`);
+      return value.split(",").map((s) => s.trim()).filter(Boolean);
+    };
+    const only = list("--only");
+    if (only !== null) {
+      args.only.push(...only);
       continue;
     }
-    if (arg.startsWith("--report=")) {
-      const value = arg.slice("--report=".length);
-      if (!value) {
-        argumentError("--report= needs a file path");
-      }
-      args.report = value;
+    const skip = list("--skip");
+    if (skip !== null) {
+      args.skip.push(...skip);
+      continue;
+    }
+    const report = optionalValue(arg, "--report", "canship-report.html");
+    if (report !== null) {
+      args.report = report;
+      continue;
+    }
+    if (arg === "--baseline") {
+      args.baselineDefault = true;
+      continue;
+    }
+    const baseline = optionalValue(arg, "--baseline", UNREACHABLE_DEFAULT);
+    if (baseline !== null) {
+      args.baseline = baseline;
+      continue;
+    }
+    if (arg === "--baseline-write") {
+      args.baselineWriteDefault = true;
+      continue;
+    }
+    const baselineWrite = optionalValue(arg, "--baseline-write", UNREACHABLE_DEFAULT);
+    if (baselineWrite !== null) {
+      args.baselineWrite = baselineWrite;
+      continue;
+    }
+    const sarif = optionalValue(arg, "--sarif", "canship.sarif");
+    if (sarif !== null) {
+      args.sarif = sarif;
       continue;
     }
     switch (arg) {
@@ -3716,6 +4560,9 @@ function parseArgs(argv) {
       case "--best-effort":
         args.bestEffort = true;
         break;
+      case "--no-config":
+        args.noConfig = true;
+        break;
       case "--help":
       case "-h":
         args.help = true;
@@ -3750,6 +4597,14 @@ var HELP = `
         --json        Output raw JSON (for CI or tooling)
         --best-effort Allow exit 0 for an incomplete scan with no findings;
                       findings still exit 1 or 2
+        --baseline[=F]       Hide findings already recorded in F, so only new
+                             ones are reported (default ${DEFAULT_BASELINE_PATH})
+        --baseline-write[=F] Record the current findings as a new baseline and exit
+        --only=IDS    Report only these rules (comma-separated, repeatable)
+        --skip=IDS    Report everything except these rules
+        --sarif[=F]   Write a SARIF 2.1.0 log for CI code scanning
+                      (default canship.sarif)
+        --no-config   Ignore canship.config.json in the scanned directory
     -h, --help        Show this help
     -v, --version     Show version
 
@@ -3761,6 +4616,10 @@ var HELP = `
 
   ${dim("--json and --fix-prompt are alternative stdout modes; --report may be combined with either.")}
 
+  ${dim("A baseline hides real findings. Every output says how many it hid.")}
+
+  ${dim(`Settings may also be committed to ${CONFIG_FILENAME}. A flag always wins over the file.`)}
+
   ${dim("Scanned files stay local: no project-code execution, network requests, or uploads.")}
 `;
 async function main() {
@@ -3778,20 +4637,116 @@ async function main() {
   if (args.json && args.fixPrompt) {
     argumentError("--json and --fix-prompt are mutually exclusive");
   }
-  if (!existsSync2(args.root) || !statSync3(args.root).isDirectory()) {
+  if ((args.baseline !== null || args.baselineDefault) && (args.baselineWrite !== null || args.baselineWriteDefault)) {
+    argumentError("--baseline and --baseline-write are mutually exclusive");
+  }
+  if (!existsSync3(args.root) || !statSync5(args.root).isDirectory()) {
     process.stderr.write(`${red("canship:")} not a directory: ${cleanForOutput(args.root)}
 `);
     return process.exit(3);
   }
-  const result = await scan(args.root);
+  let config;
+  try {
+    config = args.noConfig ? {} : loadConfig(args.root).config;
+  } catch (err) {
+    if (err instanceof ConfigError) {
+      process.stderr.write(`${red("canship:")} ${cleanForOutput(err.message)}
+`);
+      return process.exit(3);
+    }
+    throw err;
+  }
+  for (const [field, values] of [
+    ["--only", args.only],
+    ["--skip", args.skip]
+  ]) {
+    for (const selector of values) {
+      if (!isKnownSelector(selector)) {
+        argumentError(`${field} names no known rule: ${selector}`);
+      }
+    }
+  }
+  const cliSelection = args.only.length > 0 || args.skip.length > 0;
+  const only = cliSelection ? args.only : config.only ?? [];
+  const skip = cliSelection ? args.skip : config.skip ?? [];
+  if (only.length > 0 && skip.length > 0) {
+    argumentError("rule selection cannot use both only and skip");
+  }
+  const showAll = args.showAll || config.all === true;
+  const bestEffort = args.bestEffort;
+  const baselinePath = args.baseline !== null ? resolve2(args.baseline) : args.baselineDefault ? resolve2(args.root, DEFAULT_BASELINE_PATH) : config.baseline !== void 0 ? insideProject(args.root, config.baseline) : null;
+  const scanned = await scan(args.root, { only, skip });
+  if (args.baselineWrite !== null || args.baselineWriteDefault) {
+    const target = args.baselineWrite !== null ? resolve2(args.baselineWrite) : resolve2(args.root, DEFAULT_BASELINE_PATH);
+    const baseline = buildBaseline(scanned.findings);
+    try {
+      writeBaseline(target, baseline);
+    } catch (err) {
+      process.stderr.write(
+        `${red("canship:")} could not write baseline to ${cleanForOutput(target)}
+${cleanForOutput(String(err))}
+`
+      );
+      return process.exit(3);
+    }
+    const accepted = scanned.findings.length;
+    process.stdout.write(
+      `
+  ${bold("Baseline written to")} ${cyan(cleanForOutput(target))}
+  ${dim(`${accepted} ${accepted === 1 ? "finding is" : "findings are"} now accepted and will not be reported.`)}
+  ${yellow("These problems still exist.")}
+  ${dim("The file names the path, rule and title of each one \u2014 including findings")}
+  ${dim("in files git does not track, such as .env.local. It holds no credential")}
+  ${dim("values. Commit it so the decision is reviewable; on a public repository,")}
+  ${dim("weigh what that publishes first.")}
+
+`
+    );
+    if (scanned.partial) {
+      process.stderr.write(
+        `${yellow("canship:")} the scan was incomplete, so this baseline may be missing findings.
+`
+      );
+    }
+    if (scanned.ruleSelection !== null) {
+      process.stderr.write(
+        `${yellow("canship:")} rule selection was in force, so this baseline covers only the rules that ran.
+`
+      );
+    }
+    return process.exit(0);
+  }
+  let baselineSuppressed = 0;
+  let baselineStale = 0;
+  let result = scanned;
+  if (baselinePath !== null) {
+    const source = baselinePath;
+    try {
+      const applied = applyBaseline(scanned.findings, readBaseline(source));
+      result = { ...scanned, findings: applied.kept };
+      baselineSuppressed = applied.suppressed;
+      baselineStale = applied.stale;
+    } catch (err) {
+      if (err instanceof BaselineError) {
+        process.stderr.write(`${red("canship:")} ${cleanForOutput(err.message)}
+`);
+        return process.exit(3);
+      }
+      throw err;
+    }
+  }
   const displayRoot = cleanForOutput(args.root);
-  const shown = args.showAll ? result.findings : result.findings.filter((f) => f.confidence === "certain");
-  const hiddenLikely = args.showAll ? 0 : result.findings.filter((f) => f.confidence === "likely").length;
+  const shown = showAll ? result.findings : result.findings.filter((f) => f.confidence === "certain");
+  const hiddenLikely = showAll ? 0 : result.findings.filter((f) => f.confidence === "likely").length;
   if (args.fixPrompt) {
     const prompt = renderFixPrompt(shown, {
       partial: result.partial,
       filesScanned: result.filesScanned,
-      hiddenLikely
+      hiddenLikely,
+      baselineSuppressed,
+      silenced: result.ignoredFindings.map((f) => `${f.file}:${f.line} (${f.ruleId})`),
+      ignoredFiles: result.ignored,
+      ruleSelection: selectionPhrase(result.ruleSelection)
     });
     process.stdout.write(
       prompt === null ? "Nothing to fix \u2014 no findings.\n" : `${prompt}
@@ -3811,10 +4766,18 @@ async function main() {
           errors: result.errors,
           skipped: result.skipped,
           ignored: result.ignored,
+          ignoredFindings: result.ignoredFindings,
+          ruleSelection: result.ruleSelection,
           vendored: result.vendored,
           // The default view hides the detail, never the fact. A machine reading this
           // must not see "no findings" while lower-confidence ones exist.
           hiddenLikely,
+          // Same reason, for the other thing that removes findings from this
+          // array. A CI job reading `findings: []` is entitled to know whether
+          // that means "nothing is wrong" or "a file in your repository says
+          // not to mention it".
+          baselineSuppressed,
+          baselineStale,
           findings: shown
         },
         null,
@@ -3826,19 +4789,63 @@ async function main() {
     process.stdout.write(
       `${renderReport(
         { ...result, findings: shown },
-        { root: displayRoot, showingLikely: args.showAll, hiddenLikely }
+        {
+          root: displayRoot,
+          showingLikely: showAll,
+          hiddenLikely,
+          baselineSuppressed,
+          baselineStale,
+          baselinePath: baselinePath === null ? null : cleanForOutput(baselinePath)
+        }
       )}
 `
     );
   }
+  if (args.sarif) {
+    const target = resolve2(args.sarif);
+    try {
+      writeFileSync2(
+        target,
+        renderSarif(
+          { ...result, findings: shown },
+          {
+            version: VERSION,
+            baselineSuppressed,
+            hiddenLikely,
+            ruleSelection: selectionPhrase(result.ruleSelection)
+          }
+        ),
+        "utf8"
+      );
+      if (!args.json && !args.fixPrompt) {
+        process.stdout.write(`  ${dim("SARIF written to")} ${cyan(cleanForOutput(target))}
+
+`);
+      }
+    } catch (err) {
+      process.stderr.write(
+        `${red("canship:")} could not write SARIF to ${cleanForOutput(target)}
+${cleanForOutput(String(err))}
+`
+      );
+      return process.exit(3);
+    }
+  }
   if (args.report) {
     const target = resolve2(args.report);
     try {
-      writeFileSync(
+      writeFileSync2(
         target,
         renderHtml(
           { ...result, findings: shown },
-          { root: displayRoot, generatedAt: (/* @__PURE__ */ new Date()).toISOString(), hiddenLikely }
+          {
+            root: displayRoot,
+            generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            hiddenLikely,
+            baselineSuppressed,
+            baselineStale,
+            baselinePath: baselinePath === null ? null : cleanForOutput(baselinePath)
+          }
         ),
         "utf8"
       );
@@ -3858,7 +4865,7 @@ ${cleanForOutput(String(err))}
   }
   if (verdictOf(result.findings).blocking > 0) return process.exit(1);
   if (result.findings.length > 0) return process.exit(2);
-  if (result.partial && !args.bestEffort) return process.exit(3);
+  if (result.partial && !bestEffort) return process.exit(3);
   return process.exit(0);
 }
 main().catch((err) => {