canship 0.2.0 → 0.3.0

package/dist/cli.js

@@ -47,13 +47,7 @@ var SECRET_PATTERNS = [
   {
     id: "npm-token",
     name: "npm access token",
-    // Shape only, though npm encodes a CRC32 of the token into its last six
-    // characters and this could verify it. The github-token entry above uses
-    // the same scheme and does not verify it either, for the reason that
-    // settles it: if the algorithm ever changes, a checksum test turns a real
-    // leaked token into a silent pass. A false positive costs a glance. This
-    // particular false negative costs the account, and every account that
-    // installs anything published from it afterwards.
+    // 仅检查令牌形状，不校验其校验码。
     pattern: /\bnpm_[A-Za-z0-9]{36}\b/g,
     impact: "Publishes packages under your account. Anyone who installs one afterwards runs whatever that version contains.",
     rotateAt: "https://docs.npmjs.com/creating-and-viewing-access-tokens"
@@ -64,13 +58,7 @@ var SECRET_PATTERNS = [
     pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g,
     impact: "Depending on its scope, this can be used to run up billed usage on Google Cloud services.",
     rotateAt: "https://console.cloud.google.com/apis/credentials",
-    // Unlike every other pattern in this table, an AIza-format key is not a
-    // bearer credential: it identifies a Firebase project or a Maps Platform
-    // caller, and Google's own docs say it belongs in client code. Flagging
-    // it as "exposed to the browser — rotate this" was a false positive on
-    // every ordinary Firebase or Maps front-end, and the actual protection
-    // (application/API restrictions in the Cloud console) is not something a
-    // static scan of the repository can confirm one way or the other.
+    // Google 项目标识符不直接作为私密凭据报告。
     publicByDesign: true
   },
   {
@@ -91,17 +79,7 @@ var SECRET_PATTERNS = [
     id: "supabase-secret-key",
     name: "Supabase secret key",
     rotateLabel: "Supabase secret key",
-    // Supabase's newer key format. The prefix settles it: sb_secret_ is the
-    // server-side half, sb_publishable_ is the one meant for browsers, and the
-    // two are never confusable.
-    //
-    // framework.ts has recognised this format since the day it was written —
-    // but only for deciding whether a *client-exposed* value is the admin key.
-    // It was never in this table, and this table is what the hardcoded-secret
-    // rule and the output-boundary redaction both walk. So a project with one
-    // of these in its source got a clean report, and a project with one beside
-    // another credential had it printed in full: the redaction pass could not
-    // mask a format it did not know.
+    // 共享新版 Supabase 私密密钥模式，与公开密钥区分。
     pattern: new RegExp(String.raw`\b${SB_SECRET_SOURCE}\b`, "g"),
     impact: "This is the server-side Supabase key. It bypasses every Row Level Security policy \u2014 it is effectively your database root password.",
     rotateAt: "your Supabase dashboard, Project Settings -> API Keys"
@@ -117,22 +95,9 @@ var SECRET_PATTERNS = [
     id: "db-connection-string",
     name: "Database connection string with password",
     pattern: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/[^\s:@/'"`]+:([^\s@/'"`]+)@(\[[^\]\s]+\]|[^\s'"`/:]+)(?::\d+)?(?:[/?#][^\s'"`]*)?/g,
-    // Check only the password group for placeholders, so an "example" or "test"
-    // in the host does not cause a miss.
+    // 仅用密码组判断占位符，避免主机名影响判断。
     secretGroup: 1,
-    // But if the host itself is an example domain or a local address, the
-    // connection string is worthless and not worth reporting.
-    //
-    // The host alternative takes a bracketed form first so IPv6 survives:
-    // `[^\s'"/:]+` stops at the first colon, so `@[::1]:5432` captured a lone
-    // `[`, which matches no entry below — an IPv6 loopback string was reported
-    // P0 while the identical `localhost` one was correctly ignored.
-    //
-    // The backtick is excluded for the same reason. It is the third string
-    // delimiter in JavaScript and the only one this pattern had never heard of,
-    // so a connection string written in a template literal handed the host
-    // group a trailing backtick and defeated the check below. canship found
-    // that one on its own source, in the comment above.
+    // 支持 IPv6，并排除示例和本地地址。
     ignoreIf: (m) => IRRELEVANT_HOSTS.test(m[2] ?? ""),
     rotateLabel: "database password",
     impact: "This contains your database username AND password. Anyone with it can read, modify, or delete your entire database."
@@ -233,6 +198,7 @@ import { execFileSync } from "child_process";
 import { accessSync, constants, existsSync, lstatSync, readFileSync, realpathSync, statSync } from "fs";
 import { delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "path";
 var MAX_GIT_OUTPUT = 32 * 1024 * 1024;
+var GIT_TIMEOUT_MS = 3e4;
 function canonical(path) {
   try {
     return realpathSync.native(path);
@@ -437,6 +403,7 @@ function hardeningArgs(root) {
 }
 function execGitSync(executable, root, args, options = {}) {
   return execFileSync(executable, [...hardeningArgs(root), ...args], {
+    timeout: GIT_TIMEOUT_MS,
     cwd: root,
     encoding: "utf8",
     maxBuffer: options.maxBuffer ?? MAX_GIT_OUTPUT,
@@ -447,6 +414,7 @@ function execGitSync(executable, root, args, options = {}) {
 }
 function execGitBatch(executable, root, args, input, options = {}) {
   return execFileSync(executable, [...hardeningArgs(root), ...args], {
+    timeout: GIT_TIMEOUT_MS,
     cwd: root,
     input,
     maxBuffer: options.maxBuffer ?? MAX_GIT_OUTPUT,
@@ -458,6 +426,8 @@ function execGitBatch(executable, root, args, input, options = {}) {
 
 // src/walker.ts
 var MAX_FILE_BYTES = 2 * 1024 * 1024;
+var MAX_SCAN_BYTES = 128 * 1024 * 1024;
+var MAX_SCAN_FILES = 1e4;
 var MAX_WALK_DEPTH = 16;
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
@@ -476,8 +446,7 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".venv",
   "venv",
   ".cache",
-  // Build output and tool caches from ecosystems beyond JavaScript. Walking
-  // these to look for credential files is pure cost.
+  // 排除其他生态的构建产物和工具缓存。
   ".dart_tool",
   ".gradle",
   "Pods",
@@ -515,7 +484,7 @@ var SCAN_EXTENSIONS = /* @__PURE__ */ new Set([
   ".yml",
   ".toml",
   ".sql",
-  // Firebase security rules (firestore.rules / storage.rules)
+  // Firebase 规则文件。
   ".rules",
   ".env",
   ".sh",
@@ -810,7 +779,7 @@ function isExampleContext(relPath) {
   if (/\.(test|spec)\.[jt]sx?$/i.test(name)) return true;
   return false;
 }
-function collectFiles(root, isGitRepo, gitExecutable = resolveGitExecutable(root)) {
+function collectFiles(root, isGitRepo, gitExecutable = resolveGitExecutable(root), limits = {}) {
   const skipped = [];
   const ignored = [];
   const fromGit = isGitRepo ? listViaGit(root, gitExecutable) : null;
@@ -839,6 +808,10 @@ function collectFiles(root, isGitRepo, gitExecutable = resolveGitExecutable(root
     forced.add(hidden);
   }
   const files = [];
+  let bytesRead = 0;
+  let filesRead = 0;
+  const maxBytes = limits.maxBytes ?? MAX_SCAN_BYTES;
+  const maxFiles = limits.maxFiles ?? MAX_SCAN_FILES;
   for (const relPath of candidates) {
     if (!forced.has(relPath) && !shouldScan(relPath)) continue;
     const absPath = join2(root, relPath);
@@ -859,7 +832,22 @@ function collectFiles(root, isGitRepo, gitExecutable = resolveGitExecutable(root
         });
         continue;
       }
-      content = decodeText(readFileSync2(absPath));
+      if (filesRead >= maxFiles || bytesRead + size > maxBytes) {
+        skipped.push({
+          path: relPath,
+          reason: "too-large",
+          detail: `scan read budget exceeded (${maxFiles} files, ${maxBytes} bytes); remaining candidates were not read`
+        });
+        break;
+      }
+      const bytes = readFileSync2(absPath);
+      bytesRead += bytes.length;
+      filesRead++;
+      if (bytesRead > maxBytes) {
+        skipped.push({ path: relPath, reason: "too-large", detail: "scan read budget exceeded during file read" });
+        break;
+      }
+      content = decodeText(bytes);
     } catch (err) {
       if (!isMissing(err)) {
         skipped.push({
@@ -964,71 +952,68 @@ function endOfString(src, start, quote) {
   }
   return length;
 }
-function maskTemplate(src, out, start) {
+function maskTemplate(src, out, start, maskStrings = true) {
   const length = src.length;
+  const stack = [{ kind: "literal", from: start + 1 }];
   let i = start + 1;
-  let literalFrom = i;
-  while (i < length) {
+  while (i < length && stack.length > 0) {
+    const frame = stack[stack.length - 1];
     const ch = src.charCodeAt(i);
-    if (ch === BACKSLASH) {
-      i += 2;
+    if (frame.kind === "literal") {
+      if (ch === BACKSLASH) {
+        i = Math.min(i + 2, length);
+        continue;
+      }
+      if (ch === BACKTICK) {
+        if (maskStrings) blank(out, frame.from, i);
+        stack.pop();
+        i++;
+        continue;
+      }
+      if (ch === DOLLAR && src.charCodeAt(i + 1) === OPEN_BRACE) {
+        if (maskStrings) blank(out, frame.from, i);
+        stack.push({ kind: "expression", depth: 1 });
+        i += 2;
+        continue;
+      }
+      i++;
+      continue;
+    }
+    if (ch === SLASH) {
+      const next = src.charCodeAt(i + 1);
+      if (next === SLASH || next === STAR) {
+        const close = next === SLASH ? src.indexOf("\n", i) : src.indexOf("*/", i + 2);
+        const stop = close === -1 ? length : close + (next === STAR ? 2 : 0);
+        blank(out, i, stop);
+        i = stop;
+        continue;
+      }
+    }
+    if (ch === DOUBLE_QUOTE || ch === SINGLE_QUOTE) {
+      const stop = endOfString(src, i, ch);
+      if (maskStrings) blank(out, i + 1, stop - 1);
+      i = stop;
       continue;
     }
     if (ch === BACKTICK) {
-      blank(out, literalFrom, i);
-      return i + 1;
+      stack.push({ kind: "literal", from: i + 1 });
+      i++;
+      continue;
     }
-    if (ch === DOLLAR && src.charCodeAt(i + 1) === OPEN_BRACE) {
-      blank(out, literalFrom, i);
-      let depth = 0;
-      let j = i + 1;
-      while (j < length) {
-        const inner = src.charCodeAt(j);
-        if (inner === SLASH) {
-          const next = src.charCodeAt(j + 1);
-          if (next === SLASH) {
-            const end = src.indexOf("\n", j);
-            const stop = end === -1 ? length : end;
-            blank(out, j, stop);
-            j = stop;
-            continue;
-          }
-          if (next === STAR) {
-            const close = src.indexOf("*/", j + 2);
-            const stop = close === -1 ? length : close + 2;
-            blank(out, j, stop);
-            j = stop;
-            continue;
-          }
-        }
-        if (inner === DOUBLE_QUOTE || inner === SINGLE_QUOTE) {
-          const stop = endOfString(src, j, inner);
-          blank(out, j + 1, stop - 1);
-          j = stop;
-          continue;
-        }
-        if (inner === BACKTICK) {
-          j = maskTemplate(src, out, j);
-          continue;
-        }
-        if (inner === OPEN_BRACE) depth++;
-        else if (inner === CLOSE_BRACE) {
-          depth--;
-          if (depth === 0) {
-            j++;
-            break;
-          }
-        }
-        j++;
+    if (ch === OPEN_BRACE) frame.depth++;
+    else if (ch === CLOSE_BRACE) {
+      frame.depth--;
+      if (frame.depth === 0) {
+        stack.pop();
+        const parent = stack[stack.length - 1];
+        if (parent.kind === "literal") parent.from = i + 1;
       }
-      i = j;
-      literalFrom = i;
-      continue;
     }
     i++;
   }
-  blank(out, literalFrom, length);
-  return length;
+  const last = stack[stack.length - 1];
+  if (maskStrings && last?.kind === "literal") blank(out, last.from, length);
+  return i;
 }
 function maskJsComments(src) {
   const length = src.length;
@@ -1053,10 +1038,14 @@ function maskJsComments(src) {
         continue;
       }
     }
-    if (ch === DOUBLE_QUOTE || ch === SINGLE_QUOTE || ch === BACKTICK) {
+    if (ch === DOUBLE_QUOTE || ch === SINGLE_QUOTE) {
       i = endOfString(src, i, ch);
       continue;
     }
+    if (ch === BACKTICK) {
+      i = maskTemplate(src, out, i, false);
+      continue;
+    }
     i++;
   }
   return stringOf(out);
@@ -1350,6 +1339,20 @@ var secretsRule = {
 // src/rules/exposure.ts
 import { basename as basename3 } from "path";
 var JWT_SHAPED2 = new RegExp(String.raw`\b${JWT_SOURCE}\b`, "g");
+var FindingBuffer = class {
+  items = [];
+  overflow = false;
+  push(finding) {
+    if (this.items.length < MAX_FINDINGS_PER_FILE) {
+      this.items.push(finding);
+      return;
+    }
+    this.overflow = true;
+    if (finding.confidence !== "certain") return;
+    const index = this.items.findIndex((item) => item.confidence === "likely");
+    if (index !== -1) this.items[index] = finding;
+  }
+};
 function parseEnv(file) {
   const entries = [];
   file.lines.forEach((raw, i) => {
@@ -1366,35 +1369,20 @@ var exposureRule = {
     if (isEnvFile(name)) return true;
     return /\.(ts|tsx|js|jsx|mjs|cjs|svelte|vue|astro)$/.test(name);
   },
-  /**
-   * The ceiling, applied here rather than inside each branch.
-   *
-   * This rule was the last one without one. secrets.ts, firebase.ts and
-   * supabase.ts all cap and all say so — the constant was pulled into limits.ts
-   * precisely so the reasoning would not have to be rediscovered — and exposure
-   * never adopted it. A `.env` holding 3,000 public-prefixed credential names
-   * produced 3,000 findings, 2.36 MB of JSON and 48,046 lines of terminal
-   * output, with `partial` false and `errors` empty: the identical shape of the
-   * bug firebase.ts records in its own comment.
-   *
-   * At the entry point because there are two branches and a future third would
-   * have to remember. Truncating after the fact rather than stopping the loop
-   * keeps that single place honest: the input is already bounded by
-   * MAX_FILE_BYTES, so what this protects is the report, not the scan.
-   */
+  /** 使用有界缓冲区保留结果，超限时记录扫描缺口。 */
   check(file, ctx) {
     const name = basename3(file.path);
     const findings = isEnvFile(name) ? checkEnvFile(file) : checkSourceFile(file);
-    if (findings.length <= MAX_FINDINGS_PER_FILE) return findings;
+    if (!findings.overflow) return findings.items;
     ctx.reportIncomplete(
       "exposure/public-env",
       `${file.path} holds more than ${MAX_FINDINGS_PER_FILE} values exposed to the browser; the rest were not reported`
     );
-    return findings.slice(0, MAX_FINDINGS_PER_FILE);
+    return findings.items;
   }
 };
 function checkEnvFile(file) {
-  const findings = [];
+  const findings = new FindingBuffer();
   for (const entry of parseEnv(file)) {
     const prefix = publicPrefixOf(entry.key);
     if (!prefix) continue;
@@ -1473,7 +1461,7 @@ function checkEnvFile(file) {
   return findings;
 }
 function checkSourceFile(file) {
-  const findings = [];
+  const findings = new FindingBuffer();
   const clientSide = isClientCode(file);
   const commentless = commentsMaskedOf(file).split(/\r?\n/);
   file.lines.forEach((line, i) => {
@@ -1654,6 +1642,7 @@ function historicalEvidence(root, gitExecutable, entry) {
     "--no-textconv",
     "--all",
     "--format=%H",
+    `--max-count=${MAX_HISTORY_REVISIONS + 1}`,
     "--",
     entry.localPath
   ]) ?? "").split(/\r?\n/).filter(Boolean);
@@ -1731,9 +1720,7 @@ var gitleakRule = {
       findings.push({
         ruleId: "gitleak/env-tracked",
         severity: "P0",
-        // Only claim certainty when the file actually holds something that is
-        // recognisably a credential. Everything else is a committed env file
-        // that might hold one, which is worth saying quietly.
+        // 只有非示例中的明确凭据使用确定置信度。
         confidence: evidence === "proof" && !scaffolding ? "certain" : "likely",
         title: evidence === "proof" && !scaffolding ? `${path} is committed to git, with a credential in it` : `${path} is committed to git`,
         file: path,
@@ -1760,7 +1747,7 @@ var gitleakRule = {
       if (history && history.unread > 0) {
         ctx.reportIncomplete(
           "gitleak/env-in-history",
-          `only the ${MAX_HISTORY_REVISIONS} most recent versions of ${path} were read; ${history.unread} older ${history.unread === 1 ? "version was" : "versions were"} not checked`
+          `only the ${MAX_HISTORY_REVISIONS} most recent versions of ${path} were read; at least ${history.unread} older ${history.unread === 1 ? "version was" : "versions were"} not checked`
         );
       }
       if (history && history.unreadable > 0) {
@@ -1776,8 +1763,7 @@ var gitleakRule = {
         ruleId: "gitleak/env-in-history",
         ...history?.sourceFingerprint === void 0 ? {} : { sourceFingerprint: history.sourceFingerprint },
         severity: "P0",
-        // Claiming certainty about a file nobody could read would be the same
-        // overreach the tracked branch just stopped making.
+        // 证据或上下文不足时降低置信度。
         confidence: evidence === "proof" && !scaffolding ? "certain" : "likely",
         title: stillTracked ? `${path} is committed to git, and an older version of it held a credential` : `${path} was removed, but it is still in your git history`,
         file: path,
@@ -2117,8 +2103,8 @@ var supabaseRlsRule = {
         line: entry.line,
         excerpt: null,
         why: [
-          `Supabase exposes your database to the browser directly, and the anon key that reaches it is public by design \u2014 it ships inside your frontend. Row Level Security is the only thing that decides who can read or write a row.`,
-          `No "ALTER TABLE ${renderIdent(entry.table)} ENABLE ROW LEVEL SECURITY" appears anywhere in your SQL, and new tables do not get it by default. If that is the real state, anyone who visits your site can list this entire table with a single request \u2014 and depending on your policies, write to it too.`,
+          `Supabase's browser clients use public identifiers. For exposed tables, database grants and Row Level Security determine which operations and rows a caller can access.`,
+          `After replaying the scanned migrations, the final recorded state of ${renderIdent(entry.table)} does not have RLS enabled. It may never have been enabled or may have been disabled by a later migration. Without RLS, any access granted to the caller is not restricted by row policies.`,
           `If you enabled RLS from the Supabase dashboard instead, this file simply cannot show it. Check the Authentication -> Policies page to confirm.`
         ],
         fix: [
@@ -2145,9 +2131,7 @@ var supabaseRlsRule = {
 // src/rules/firebase.ts
 import { basename as basename5 } from "path";
 function isRulesFile(file) {
-  const name = basename5(file.path).toLowerCase();
-  if (name.endsWith(".rules")) return true;
-  return name === "firestore.rules" || name === "storage.rules";
+  return basename5(file.path).toLowerCase().endsWith(".rules");
 }
 function productOf(path) {
   const name = basename5(path).toLowerCase();
@@ -2251,8 +2235,7 @@ var firebaseRulesRule = {
       findings.push({
         ruleId: "firebase/open-rules",
         severity: "P1",
-        // Open writes are unambiguous. An open read might be intentional
-        // (a public catalogue, announcements), so it stays lower-confidence.
+        // 开放写入为确定结果，公开读取需人工确认。
         confidence: canWrite ? "certain" : "likely",
         title: canWrite ? `Your ${product} rules let anyone ${ops} this data` : `Your ${product} rules make this data publicly readable`,
         file: file.path,
@@ -2260,7 +2243,7 @@ var firebaseRulesRule = {
         excerpt: m[0].trim(),
         why: canWrite ? [
           `"if true" grants access unconditionally \u2014 no sign-in, no ownership check, nothing. The Firebase client SDK talks to your database straight from the browser, so these rules are the only access control that exists.`,
-          `Anyone who finds your project id can read every document here, overwrite it, or delete all of it. Project ids are not secret; they ship inside your frontend bundle.`
+          `Anyone can perform the allowed ${ops} operations on this matched path without authentication. Other operations depend on their own rules. Project ids are public identifiers, not access controls.`
         ] : [
           `"if true" grants read access unconditionally, so anyone who finds your project id can list every document in this collection. Project ids are not secret; they ship inside your frontend bundle.`,
           `Writes are still denied by default, so this is only a problem if the data is not meant to be public. If it is a public catalogue or announcements, ignore this \u2014 and consider adding "allow write: if false;" to make that intent explicit.`
@@ -2290,8 +2273,7 @@ var firebaseRulesRule = {
       findings.push({
         ruleId: "firebase/test-mode-rules",
         severity: "P1",
-        // A hardcoded expiry date is never a deliberate authorisation design,
-        // so this stays certain whether or not writes are involved.
+        // 固定日期测试模式均作为确定配置问题。
         confidence: "certain",
         title: expired ? `Your ${product} rules are in test mode and expired on ${dateStr}` : `Your ${product} rules allow ${ops} to anyone until ${dateStr}`,
         file: file.path,
@@ -2320,7 +2302,10 @@ import { posix } from "path";
 var APP_ROUTER = /(?:^|\/)app\/api\/(?:.+\/)?route\.[mc]?[jt]sx?$/;
 var PAGES_ROUTER = /(?:^|\/)pages\/api\/.+\.[mc]?[jt]sx?$/;
 function isApiRoute(path) {
-  return APP_ROUTER.test(path) || PAGES_ROUTER.test(path);
+  return APP_ROUTER.test(routePathOf(path)) || PAGES_ROUTER.test(path);
+}
+function routePathOf(path) {
+  return path.replace(/(^|\/)\([^/]+\)(?=\/)/g, "$1").replace(/\/{2,}/g, "/");
 }
 var AUTH_ENDPOINT_NAMES = /^\/api\/auth\/(?:sign[-_]?in|sign[-_]?up|sign[-_]?out|log[-_]?in|log[-_]?out|register|session|verify|confirm|reset(?:[-_]password)?|forgot(?:[-_]password)?|magic[-_]?link|otp)$/;
 var AUTH_CALLBACK = /^\/api\/auth\/callback(?:\/[^/]+)?$/;
@@ -2328,7 +2313,7 @@ function isAuthEndpoint(url) {
   return AUTH_ENDPOINT_NAMES.test(url) || AUTH_CALLBACK.test(url);
 }
 function routeUrl(path) {
-  const m = /(?:^|\/)(?:app|pages)\/(api\/.*)$/.exec(path);
+  const m = /(?:^|\/)(?:app|pages)\/(api\/.*)$/.exec(routePathOf(path));
   if (!m) return `/${path}`;
   const url = m[1].replace(/\/route\.[mc]?[jt]sx?$/, "").replace(/\/index\.[mc]?[jt]sx?$/, "").replace(/\.[mc]?[jt]sx?$/, "");
   return `/${url}`;
@@ -2359,17 +2344,37 @@ function controlledStatement(source, afterCondition) {
   return source.slice(start, end);
 }
 function hasConditionalAuthGuard(code) {
-  const starts = code.matchAll(/\bif\s*\(/g);
-  for (const match of starts) {
+  const starts = /\bif\s*\(/g;
+  let match;
+  while ((match = starts.exec(code)) !== null) {
     const open = code.indexOf("(", match.index);
     const close = closingDelimiter(code, open, "(", ")");
     if (close === null) continue;
     const condition = code.slice(open + 1, close);
     const statement = controlledStatement(code, close + 1);
-    const stopsRequest = /\b(?:return|throw|redirect|notFound)\b/.test(statement);
+    const body = statement.startsWith("{") ? statement.slice(1, -1) : statement;
+    const pairs = delimiterPairs(body);
+    let stopsRequest = false;
+    for (let i = 0; i < body.length; i++) {
+      if (/^(?:return|throw|redirect|notFound)\b/.test(body.slice(i, i + 16)) && (i === 0 || !/[\w$]/.test(body[i - 1]))) {
+        stopsRequest = true;
+        break;
+      }
+      if (/^if\s*\(/.test(body.slice(i, i + 16))) break;
+      const end = pairs.get(i);
+      if (end !== void 0) i = end;
+    }
+    let statementStart = close + 1;
+    while (/\s/.test(code[statementStart] ?? "")) statementStart++;
+    starts.lastIndex = statementStart + statement.length;
     if (!stopsRequest) continue;
     const returnsDeniedStatus = /\b(?:return|throw)\b[\s\S]{0,300}\bstatus\s*[:(=]\s*(?:401|403)\b/i.test(statement);
-    if (AUTH_CONDITION.test(condition) || returnsDeniedStatus) return true;
+    const negative = !/&&|\?/.test(condition) && condition.split("||").some((part) => {
+      const term = part.trim();
+      const rejects = /^!\s*[\w$.]+(?:\s*\([^=]*\))?$/.test(term) || /^[\w$.]+\s*={2,3}\s*(?:null|undefined|false)$/.test(term) || /^[\w$.]+\s*!={1,2}\s*(?!(?:null|undefined|false)\b)[\w$.]+$/.test(term);
+      return rejects && (AUTH_CONDITION.test(term) || returnsDeniedStatus);
+    });
+    if (negative) return true;
   }
   return false;
 }
@@ -2462,6 +2467,16 @@ function unguardedOperations(file, ops) {
       }
       const call = AUTH_ENFORCING_CALL.exec(code.slice(i, i + 100));
       if (call?.index === 0 && !/^(?:withAuth|NextAuth)\b/i.test(call[0]) && !/\bfunction\s*$/.test(code.slice(Math.max(owner.start, i - 30), i))) {
+        const prefixStart = Math.max(
+          owner.start + 1,
+          code.lastIndexOf(";", i - 1) + 1,
+          code.lastIndexOf("\n", i - 1) + 1
+        );
+        const prefix = code.slice(prefixStart, i).trim();
+        if (/(?:&&|\|\||\?|:)\s*$/.test(code.slice(owner.start + 1, prefixStart))) continue;
+        const awaited = /^(?:await|(?:const|let|var)\s+[\w${},:\s]+?=\s*await)(?:\s+[\w$.]+\.)?$/.test(prefix);
+        const synchronous = /^(?:assertAuth(?:enticated)?|constructEvent)\b/i.test(call[0]) && /^(?:(?:const|let|var)\s+[\w$]+\s*=\s*)?(?:[\w$]+\.)*$/.test(prefix);
+        if (!awaited && !synchronous) continue;
         const close2 = pairs.get(i + call[0].length - 1);
         if (close2 !== void 0 && close2 < owner.end) return close2 + 1;
       }
@@ -2559,7 +2574,7 @@ function usesSessionClient(route, sessionModules, allFiles) {
   return buildsSessionClient(route) || importsAnyOf(route, sessionModules, allFiles);
 }
 function moduleScopeOf(routePath) {
-  return /^(.*?)(?:src\/)?(?:app|pages)\/api\//.exec(routePath)?.[1] ?? "";
+  return /^(.*?)(?:src\/)?(?:app|pages)\/api\//.exec(routePathOf(routePath))?.[1] ?? "";
 }
 function importedModules(file, allFiles, aliasScope) {
   const found = [];
@@ -2899,18 +2914,16 @@ var apiAuthRule = {
         findings.push({
           ruleId: "api/admin-db-access-without-auth",
           severity: "P0",
-          // Hard evidence: the route runs queries through a key that bypasses
-          // every RLS policy, and nothing in the file or in middleware checks
-          // who sent the request.
+          // 管理员客户端缺少鉴权时使用确定置信度。
           confidence: "certain",
           title: `Anyone can call ${url} and it queries your database as admin`,
           file: route.path,
           line,
           excerpt,
           why: [
-            `This route uses the service_role key, which bypasses every Row Level Security policy you have. Whatever your database would normally refuse, this route performs.`,
-            `Nothing in this file checks who is calling \u2014 no session lookup, no token check, no 401 anywhere \u2014 and no middleware covers it. The URL is not a secret either: it is spelled out by the file path, and it appears in your frontend bundle as soon as anything calls it.`,
-            `So a single curl to ${url} gets the same access your admin key has.`,
+            `This route references a recognized admin client. Such clients can bypass normal per-user access checks; verify the effective credentials and granted permissions.`,
+            `The scan did not recognize an authentication guard protecting this operation or applicable middleware. Indirect wrappers and deployment-level controls may not be recognized; verify them before exposing this route.`,
+            `If ${url} is reachable without authentication, callers can trigger the admin-backed operations implemented by this handler.`,
             `If this endpoint is meant to be public \u2014 handing out a guest session, taking a waitlist signup \u2014 then the problem is not that it is open, it is that it is open *and* holds the admin key. Give it a client that can only do the one thing it needs.`
           ],
           fix: [
@@ -2929,17 +2942,15 @@ var apiAuthRule = {
         findings.push({
           ruleId: "api/db-write-without-auth",
           severity: "P1",
-          // Lower confidence on purpose: the write may be legitimately open
-          // (a waitlist, a contact form), and protection can also live in a
-          // deployment-level proxy this scan cannot see.
+          // 公开写入可能是业务设计，保留疑似置信度。
           confidence: "likely",
           title: `${url} writes to your database with no sign-in check`,
           file: route.path,
           line,
           excerpt,
           why: [
-            `This route changes data, and nothing in the file checks who is calling \u2014 no session lookup, no token check, no 401 anywhere.`,
-            `Route URLs are not secret; this one is spelled out by its file path. Anyone who sends a request can trigger the same write.`,
+            `This route changes data, and the scan did not recognize an authentication guard before the operation. Indirect guards and runtime controls require manual verification.`,
+            `If this route is publicly reachable and no other control rejects the caller, unauthenticated requests can trigger this write.`,
             `If this is a public form \u2014 a waitlist, a contact box \u2014 that may be intentional. It is still worth rate limiting, because an open write endpoint is what gets a database filled with spam overnight.`
           ],
           fix: [
@@ -2956,8 +2967,31 @@ var apiAuthRule = {
 
 // src/rules/cors.ts
 var CORS_MARKER = /Access-Control-Allow-Origin|\bcors\s*\(/i;
-var ACAO = /['"]Access-Control-Allow-Origin['"]\s*(?:,|:)\s*(?:value\s*:\s*)?([^\n]+)/gi;
-var CORS_ORIGIN_OPTION = /\borigin\s*:\s*(true|['"`]\*['"`])/gi;
+var ACAO = /['"]Access-Control-Allow-Origin['"]\s*(?:,|:)\s*(?:value\s*:\s*)?/gi;
+function headerExpression(content, start) {
+  const closes = [];
+  let quote = null;
+  let end = start;
+  for (; end < content.length; end++) {
+    const ch = content[end];
+    if (ch === "\n" || ch === "\r") break;
+    if (quote !== null) {
+      if (ch === "\\") end++;
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"' || ch === "`") quote = ch;
+    else if (ch === "(") closes.push(")");
+    else if (ch === "[") closes.push("]");
+    else if (ch === "{") closes.push("}");
+    else if (ch === ")" || ch === "]" || ch === "}") {
+      if (closes.at(-1) !== ch) break;
+      closes.pop();
+    } else if (closes.length === 0 && (ch === "," || ch === ";")) break;
+  }
+  return content.slice(start, end);
+}
+var CORS_ORIGIN_OPTION = /\borigin\s*:\s*/gi;
 var CORS_ORIGIN_PROPERTY_START = /\borigin\s*:\s*(?:async\s+)?(?:(function)\s*(?:[A-Za-z_$][\w$]*)?\s*)?\(/gi;
 var CORS_ORIGIN_METHOD_START = /\borigin\s*\(/gi;
 function closingParameterList(source, open) {
@@ -2998,6 +3032,8 @@ function readOriginCallback(content, match, kind) {
   }
   return {
     index: match.index,
+    parametersStart: open + 1,
+    parametersEnd: close,
     params: content.slice(open + 1, close),
     body: content.slice(bodyStart, bodyStart + 400)
   };
@@ -3106,31 +3142,63 @@ function classifyOrigin(raw) {
   return /\b(?:req|request|headers?|ctx|event)/i.test(compact) ? "reflected" : "unknown";
 }
 var PAIRING_DISTANCE = 25;
+function optionScopes(file, positions) {
+  const scopes = /* @__PURE__ */ new Map();
+  const wanted = [...new Set(positions)].sort((a, b) => a - b);
+  if (wanted.length === 0) return scopes;
+  const content = noiseMaskedOf(file);
+  const stack = [-1];
+  let next = 0;
+  for (let at = 0; at < content.length && next < wanted.length; at++) {
+    if (at === wanted[next]) {
+      scopes.set(at, stack[stack.length - 1]);
+      next++;
+    }
+    if (content[at] === "{") stack.push(at);
+    else if (content[at] === "}" && stack.length > 1) stack.pop();
+  }
+  return scopes;
+}
 function collectOrigins(file) {
   const marks = [];
   let m;
   const content = commentsMaskedOf(file);
   const contentLines = lineStartsOf(content);
+  const code = noiseMaskedOf(file);
+  const callbacks = originCallbacks(content).filter((callback) => code[callback.index] === content[callback.index]);
+  const callbackIndices = new Set(callbacks.map((callback) => callback.index));
+  const parameterRanges = [...callbacks].sort((a, b) => a.parametersStart - b.parametersStart);
+  let parameterRange = 0;
   ACAO.lastIndex = 0;
   while ((m = ACAO.exec(content)) !== null) {
+    if (code[m.index] !== content[m.index]) continue;
     const line = lineNumberAt(contentLines, m.index);
-    marks.push({ line, kind: classifyOrigin(m[1] ?? ""), excerpt: (file.lines[line - 1] ?? "").trim() });
+    const expression = headerExpression(content, ACAO.lastIndex);
+    ACAO.lastIndex += expression.length;
+    marks.push({ line, at: m.index, mode: "header", kind: classifyOrigin(expression), excerpt: (file.lines[line - 1] ?? "").trim() });
   }
   CORS_ORIGIN_OPTION.lastIndex = 0;
   while ((m = CORS_ORIGIN_OPTION.exec(content)) !== null) {
+    if (code[m.index] !== content[m.index]) continue;
+    while (parameterRange < parameterRanges.length && parameterRanges[parameterRange].parametersEnd < m.index) parameterRange++;
+    if (parameterRanges[parameterRange] && parameterRanges[parameterRange].parametersStart <= m.index) continue;
+    if (callbackIndices.has(m.index)) continue;
     const line = lineNumberAt(contentLines, m.index);
+    const expression = headerExpression(content, CORS_ORIGIN_OPTION.lastIndex);
+    CORS_ORIGIN_OPTION.lastIndex += expression.length;
     marks.push({
       line,
-      kind: (m[1] ?? "") === "true" ? "reflected" : "wildcard",
+      at: m.index,
+      mode: "option",
+      kind: expression.trim() === "true" ? "reflected" : classifyOrigin(expression),
       excerpt: (file.lines[line - 1] ?? "").trim()
     });
   }
-  for (const callback of originCallbacks(content)) {
+  for (const callback of callbacks) {
     const answer = callbackAnswer(callback.params, callback.body);
-    if (answer === null) continue;
-    if (ORIGIN_IS_CHECKED.test(callback.body.slice(0, answer.index))) continue;
+    const kind = answer !== null && !ORIGIN_IS_CHECKED.test(callback.body.slice(0, answer.index)) ? answer.kind : "unknown";
     const line = lineNumberAt(contentLines, callback.index);
-    marks.push({ line, kind: answer.kind, excerpt: (file.lines[line - 1] ?? "").trim() });
+    marks.push({ line, at: callback.index, mode: "option", kind, excerpt: (file.lines[line - 1] ?? "").trim() });
   }
   return marks;
 }
@@ -3138,11 +3206,16 @@ function collectCredentialLines(file) {
   const lines = [];
   let m;
   const content = commentsMaskedOf(file);
+  const code = noiseMaskedOf(file);
   const contentLines = lineStartsOf(content);
   ACAC_HEADER.lastIndex = 0;
-  while ((m = ACAC_HEADER.exec(content)) !== null) lines.push(lineNumberAt(contentLines, m.index));
+  while ((m = ACAC_HEADER.exec(content)) !== null) {
+    if (code[m.index] === content[m.index]) lines.push({ line: lineNumberAt(contentLines, m.index), at: m.index, mode: "header" });
+  }
   CORS_CREDENTIALS_OPTION.lastIndex = 0;
-  while ((m = CORS_CREDENTIALS_OPTION.exec(content)) !== null) lines.push(lineNumberAt(contentLines, m.index));
+  while ((m = CORS_CREDENTIALS_OPTION.exec(content)) !== null) {
+    if (code[m.index] === content[m.index]) lines.push({ line: lineNumberAt(contentLines, m.index), at: m.index, mode: "option" });
+  }
   return lines;
 }
 function nearestOrigin(origins, credLine) {
@@ -3172,10 +3245,12 @@ var corsRule = {
     if (credentialLines.length === 0) return [];
     const origins = collectOrigins(file);
     if (origins.length === 0) return [];
+    const scopes = optionScopes(file, [...origins, ...credentialLines].filter((mark) => mark.mode === "option").map((mark) => mark.at));
     const findings = [];
     const reported = /* @__PURE__ */ new Set();
-    for (const credLine of credentialLines) {
-      const origin = nearestOrigin(origins, credLine);
+    for (const credential of credentialLines) {
+      const candidates = origins.filter((origin2) => origin2.mode === credential.mode && (credential.mode === "header" || scopes.get(origin2.at) === scopes.get(credential.at)));
+      const origin = nearestOrigin(candidates, credential.line);
       if (!origin) continue;
       if (origin.kind !== "reflected" && origin.kind !== "wildcard") continue;
       if (reported.has(origin.kind)) continue;
@@ -3184,8 +3259,7 @@ var corsRule = {
         findings.push({
           ruleId: "cors/reflected-origin-with-credentials",
           severity: "P1",
-          // Both halves are read straight out of the file: the origin is handed
-          // back unchanged, and credentials are allowed. Nothing is inferred.
+          // 明确的来源回显和凭据配置使用确定置信度。
           confidence: "certain",
           title: "Any website can make signed-in requests to your API and read the answer",
           file: file.path,
@@ -3207,8 +3281,7 @@ var corsRule = {
         findings.push({
           ruleId: "cors/wildcard-with-credentials",
           severity: "P2",
-          // Not a judgement call: the specification forbids this pair, so every
-          // browser rejects it.
+          // 通配符与凭据组合违反浏览器跨域约束。
           confidence: "certain",
           title: "This CORS setup is rejected by every browser, so the requests it enables never work",
           file: file.path,
@@ -3247,8 +3320,7 @@ var RULE_IDS = [
   "gitleak/env-in-history",
   "gitleak/env-tracked",
   "supabase/rls-not-enabled",
-  // One per credential format, built the same way secrets.ts builds them, so
-  // adding a pattern cannot leave a finding id this list has never heard of.
+  // 凭据规则 ID 从共享格式表生成。
   ...SECRET_PATTERNS.map((p) => `secrets/hardcoded/${p.id}`)
 ];
 function ruleMatches(selector, ruleId) {
@@ -3257,6 +3329,13 @@ function ruleMatches(selector, ruleId) {
 function isKnownSelector(selector) {
   return RULE_IDS.some((id) => ruleMatches(selector, id));
 }
+function shouldRunRule(id, only, skip) {
+  if (only.length === 0 && skip.length === 0) return true;
+  const namespace = id.split("/")[0];
+  return RULE_IDS.filter((candidate) => candidate.startsWith(`${namespace}/`)).some(
+    (candidate) => (only.length === 0 || only.some((selector) => ruleMatches(selector, candidate))) && !skip.some((selector) => ruleMatches(selector, candidate))
+  );
+}
 
 // src/engine.ts
 import { createHash as createHash2 } from "crypto";
@@ -3299,28 +3378,11 @@ function sanitize(findings, files) {
     // 仅输出摘要；原始行不进入报告，移动行号不改变身份。
     ...sourceIdentity(f),
     title: clean(f.title),
-    // Per paragraph, so the breaks between them survive a cleaner that removes
-    // every newline inside them. See Finding.why.
+    // 按段落清理，保留段落之间的结构。
     why: f.why.map(clean),
-    // The path was left out of this list once, and a filename holding a
-    // credential put it straight back into the JSON, the terminal, the HTML
-    // and the prompt meant for pasting into an assistant.
+    // 文件路径也必须经过输出清理。
     file: f.file === null ? null : clean(f.file),
-    // Redacted first, cut second, and both of them here.
-    //
-    // A rule that trimmed its own excerpt to length before this ran could
-    // defeat the redaction entirely: cutting at 120 characters through the
-    // middle of a key leaves a fragment that matches no pattern, so `clean`
-    // waved it past and nineteen characters of a live OpenAI key reached the
-    // terminal, the JSON, the HTML report and the prompt meant for pasting
-    // into an assistant. The rule was not doing anything unreasonable — it
-    // truncated, which every other rule also does. The order was simply not
-    // its decision to make.
-    //
-    // So rules hand over the whole line and the boundary does both jobs, in
-    // the only order that is safe. Rules that redact per match still may:
-    // masking a known secret before this point is additive, and truncating an
-    // already-truncated string is a no-op.
+    // 先脱敏再截断，避免截断导致凭据特征失效。
     excerpt: f.excerpt === null ? null : truncate(clean(f.excerpt)),
     fix: f.fix.map(clean),
     ...f.humanOnly ? { humanOnly: f.humanOnly.map(clean) } : {}
@@ -3394,19 +3456,15 @@ async function scan(root, options = {}) {
   const { files, skipped, ignored, vendored } = collectFiles(root, git2 === "repo", gitExecutable);
   const findings = [];
   const errors = [];
+  const fileRules = FILE_RULES.filter((rule2) => shouldRunRule(rule2.id, options.only ?? [], options.skip ?? []));
+  const projectRules = PROJECT_RULES.filter((rule2) => shouldRunRule(rule2.id, options.only ?? [], options.skip ?? []));
   const incompleteSeen = /* @__PURE__ */ new Set();
   const ctx = {
     root,
     files,
     git: git2,
     gitExecutable,
-    // Deduplicated here rather than by each rule remembering to report once.
-    // A rule that reaches the same ceiling from two loops over the same file —
-    // firebase does, once for open rules and once for test-mode rules — said
-    // the identical sentence twice, in the terminal's incomplete section and in
-    // the JSON. Saying "part of this did not happen" twice does not make it
-    // twice as true, and a once-flag per rule is the kind of bookkeeping every
-    // new rule would have to remember.
+    // 统一记录不完整状态，避免重复提示。
     reportIncomplete: (ruleId, message) => {
       if (incompleteSeen.has(`${ruleId} ${message}`)) return;
       incompleteSeen.add(`${ruleId} ${message}`);
@@ -3414,20 +3472,20 @@ async function scan(root, options = {}) {
     }
   };
   for (const file of files) {
-    for (const rule of FILE_RULES) {
-      if (!rule.appliesTo(file)) continue;
+    for (const rule2 of fileRules) {
       try {
-        findings.push(...rule.check(file, ctx));
+        if (!rule2.appliesTo(file)) continue;
+        findings.push(...rule2.check(file, ctx));
       } catch (err) {
-        errors.push({ ruleId: rule.id, file: file.path, message: messageOf(err), kind: "crashed" });
+        errors.push({ ruleId: rule2.id, file: file.path, message: messageOf(err), kind: "crashed" });
       }
     }
   }
-  for (const rule of PROJECT_RULES) {
+  for (const rule2 of projectRules) {
     try {
-      findings.push(...await rule.check(ctx));
+      findings.push(...await rule2.check(ctx));
     } catch (err) {
-      errors.push({ ruleId: rule.id, file: null, message: messageOf(err), kind: "crashed" });
+      errors.push({ ruleId: rule2.id, file: null, message: messageOf(err), kind: "crashed" });
     }
   }
   const { kept, ignored: ignoredFindings } = suppressIgnoredLines(
@@ -3435,8 +3493,19 @@ async function scan(root, options = {}) {
     files
   );
   const selected = applyRuleSelection(kept, options);
+  const counts = /* @__PURE__ */ new Map();
+  const bounded = sortFindings(selected.kept).filter((finding) => {
+    const count = (counts.get(finding.file) ?? 0) + 1;
+    counts.set(finding.file, count);
+    if (count <= MAX_FINDINGS_PER_FILE) return true;
+    if (count === MAX_FINDINGS_PER_FILE + 1) ctx.reportIncomplete(
+      "engine/findings-limit",
+      `${finding.file ?? "project"} has more than ${MAX_FINDINGS_PER_FILE} findings; remaining findings were not reported`
+    );
+    return false;
+  });
   return {
-    findings: sanitize(sortFindings(selected.kept), files),
+    findings: sanitize(bounded, files),
     filesScanned: files.length,
     durationMs: Date.now() - started,
     errors: errors.map((e) => ({
@@ -3446,29 +3515,16 @@ async function scan(root, options = {}) {
     })),
     skipped: sanitizeSkippedForOutput(skipped),
     ignored: ignored.map(clean),
-    // The path goes through the boundary like every other path that reaches a
-    // reader: a filename is chosen by whoever can add a file to the repository,
-    // and one holding a credential would otherwise print it here in full.
+    // 清理被忽略结果的路径。
     ignoredFindings: ignoredFindings.map((f) => ({ ...f, file: clean(f.file) })),
-    // Selectors come from a config file or the command line, both of which are
-    // text canship prints back, so both go through the boundary.
+    // 选择器来自外部输入，输出前也需清理。
     ruleSelection: selected.selection === null ? null : {
       only: selected.selection.only.map(clean),
       skip: selected.selection.skip.map(clean),
       removed: selected.selection.removed
     },
     vendored,
-    // A deliberate opt-out is not an incomplete scan: the user made that call
-    // knowingly. It is listed in the report, not treated as a failure.
-    //
-    // Examining no files at all, however, is the purest form of an incomplete
-    // scan, and it used to print a green tick and exit 0 — the exact outcome
-    // the README says must never share an exit code with "clean". It is also
-    // the most likely way to be wrong in practice: the headline command is
-    // `npx canship` with no argument, so running it from the wrong directory
-    // is the ordinary user error, and a directory holding nothing but a
-    // build/ folder (every entry of which the walker skips by design) reaches
-    // zero without looking empty to a human.
+    // 主动忽略不影响完整性；错误、跳过或零文件扫描均标记为未完成。
     partial: errors.length > 0 || skipped.length > 0 || files.length === 0
   };
 }
@@ -3543,8 +3599,7 @@ function renderBaseline(opts) {
   }
   if (stale > 0) {
     out.push(
-      // Not plural() — that helper only appends an s, and "entrys" is not a
-      // word. The irregular ones have to be written out.
+      // 不规则复数单独处理。
       `${INDENT}${dim(`${stale} baseline ${stale === 1 ? "entry" : "entries"} no longer ${stale === 1 ? "matches" : "match"} anything \u2014 re-run --baseline-write to prune.`)}`
     );
   }
@@ -3938,22 +3993,17 @@ function renderHtml(result, opts) {
   const baselineStale = opts.baselineStale ?? 0;
   const { blocking: certain, minor, unsure } = verdictOf(findings);
   const verdict = findings.length === 0 ? result.filesScanned === 0 ? (
-    // Examined nothing, so there is nothing to report either way.
+    // 未扫描文件时不显示通过结论。
     `<div class="verdict warn">No files were scanned &mdash; nothing was checked</div>`
   ) : result.partial ? (
-    // Never the green banner on a partial scan: it reads as a guarantee,
-    // and a scan that skipped files cannot make one.
+    // 扫描不完整时不得显示正常通过。
     hiddenLikely > 0 ? `<div class="verdict warn">No certain findings &mdash; ${hiddenLikely} lower-confidence ${plural(hiddenLikely, "finding")} hidden, and not everything was checked</div>` : `<div class="verdict warn">No findings &mdash; but not everything was checked</div>`
   ) : hiddenLikely > 0 ? `<div class="verdict warn">No certain findings &mdash; ${hiddenLikely} lower-confidence ${plural(hiddenLikely, "finding")} hidden</div>` : (
-    // The green banner is a statement about the project. A baseline
-    // makes it a statement about the diff instead, and this document
-    // outlives the run that produced it — whoever opens it later has
-    // only the banner to go on.
+    // 基线抑制结果时明确说明，避免误报为项目无问题。
     baselineSuppressed > 0 ? `<div class="verdict warn">No new findings &mdash; ${baselineSuppressed} ${plural(baselineSuppressed, "finding")} accepted by the baseline</div>` : `<div class="verdict clean">No exposed credentials found</div>`
   ) : certain > 0 ? `<div class="verdict bad">${certain} critical ${plural(certain, "issue")} &mdash; do not deploy</div>` : minor > 0 ? `<div class="verdict warn">${minor} ${plural(minor, "thing")} to fix &mdash; nothing exposed</div>` : `<div class="verdict warn">${unsure} possible ${plural(unsure, "issue")} to review</div>`;
   const body = findings.length === 0 ? result.filesScanned === 0 ? (
-    // The checklist below would be a false statement here: none of those
-    // checks had any input to run against.
+    // 零文件扫描不能显示已完成的检查清单。
     `<div class="clean-note">
            <p>canship found no files it could read at this path, so none of its checks ran.
            <strong>This is not a clean result &mdash; it is an empty one.</strong></p>
@@ -3988,10 +4038,7 @@ function renderHtml(result, opts) {
   const incomplete = result.partial ? `<div class="incomplete">
          <h2>Not everything was checked</h2>
          <ul>
-           ${// Reachable with findings present: a repository whose working
-  // tree is entirely gitignored still has a git history, and the
-  // history rule reads it. The findings are real; the file-based
-  // checks simply never ran.
+           ${// 工作区零文件时仍可能产生 Git 历史结果。
   result.filesScanned === 0 ? `<li>no files could be read at this path, so every file-based check was skipped</li>` : ""}
            ${result.errors.map(
     (e) => `<li>the <code>${esc(e.ruleId)}</code> check ${e.kind === "incomplete" ? "did not finish" : "failed"}${e.file ? ` on <code>${esc(e.file)}</code>` : ""} &mdash; ${esc(e.message)}</li>`
@@ -4204,9 +4251,10 @@ function applyBaseline(findings, baseline) {
   const kept = [];
   let suppressed = 0;
   for (const f of findings) {
-    const budget = remaining.get(fingerprintOf(f)) ?? 0;
+    const fp = fingerprintOf(f);
+    const budget = remaining.get(fp) ?? 0;
     if (budget > 0) {
-      remaining.set(fingerprintOf(f), budget - 1);
+      remaining.set(fp, budget - 1);
       suppressed++;
       continue;
     }
@@ -4276,8 +4324,7 @@ function rulesOf(findings) {
       text: [...f.why, ...f.fix.length > 0 ? ["How to fix:", ...f.fix] : []].join("\n")
     },
     properties: {
-      // Not part of the SARIF vocabulary, so it travels as a property rather
-      // than being mangled into one of the three levels above.
+      // 工具专属严重度和置信度保存在扩展属性中。
       "canship-severity": f.severity,
       "canship-confidence": f.confidence
     },
@@ -4289,15 +4336,12 @@ function resultsOf(findings) {
     ruleId: f.ruleId,
     level: levelOf(f),
     message: { text: f.title },
-    // A finding with no file — git history, an RLS gap spanning migrations —
-    // gets no location rather than a made-up one. SARIF permits that, and
-    // pointing it at an arbitrary file would put an annotation on a line that
-    // has nothing to do with it.
+    // 无可定位文件时不构造虚假位置。
     locations: f.file === null ? [] : [
       {
         physicalLocation: {
-          // Already relative and already slash-separated, on Windows too.
-          artifactLocation: { uri: f.file },
+          // 按路径段进行 URI 编码，保留目录分隔符。
+          artifactLocation: { uri: f.file.split("/").map((part) => encodeURIComponent(part)).join("/") },
           ...f.line === null ? {} : { region: { startLine: f.line } }
         }
       }
@@ -4308,6 +4352,10 @@ function resultsOf(findings) {
 function renderSarif(result, opts) {
   const { findings } = result;
   const notifications = [
+    ...result.skipped.map((item) => ({
+      level: "warning",
+      message: { text: `${item.path}: ${item.reason}${item.detail ? ` \u2014 ${item.detail}` : ""}` }
+    })),
     ...result.errors.map((e) => ({
       level: e.kind === "crashed" ? "error" : "warning",
       message: { text: `${e.ruleId}: ${e.message}` }
@@ -4330,9 +4378,7 @@ function renderSarif(result, opts) {
         results: resultsOf(findings),
         invocations: [
           {
-            // False when a rule crashed or a file could not be read. It is not
-            // about whether findings exist — a scan that finds problems and
-            // completes was a successful invocation.
+            // 该字段表示执行是否完整，与是否发现问题无关。
             executionSuccessful: !result.partial,
             ...notifications.length > 0 ? { toolExecutionNotifications: notifications } : {}
           }
@@ -4344,6 +4390,29 @@ function renderSarif(result, opts) {
 `;
 }
 
+// src/report/json.ts
+function createJsonReport(result, options) {
+  return {
+    schemaVersion: 1,
+    version: options.version,
+    root: options.root,
+    filesScanned: result.filesScanned,
+    durationMs: result.durationMs,
+    partial: result.partial,
+    errors: result.errors,
+    skipped: result.skipped,
+    ignored: result.ignored,
+    ignoredFindings: result.ignoredFindings,
+    ruleSelection: result.ruleSelection,
+    vendored: result.vendored,
+    hiddenLikely: options.hiddenLikely,
+    baselineSuppressed: options.baselineSuppressed,
+    baselineStale: options.baselineStale,
+    excerptsOmitted: options.excerptsOmitted ?? false,
+    findings: result.findings
+  };
+}
+
 // src/config.ts
 import { existsSync as existsSync2, readFileSync as readFileSync4, statSync as statSync4 } from "fs";
 import { join as join3 } from "path";
@@ -4434,12 +4503,137 @@ function loadConfig(root) {
   return { config: parseConfig(text, path), path };
 }
 
+// src/rules/catalog.ts
+var rule = (id, name, severity, confidence, scope, limitation) => ({ id, name, severity, confidence, scope, limitation, reportsFindings: true });
+var RULE_CATALOG = [
+  rule(
+    "api/admin-db-access-without-auth",
+    "Admin database access without a recognized auth guard",
+    "P0",
+    "certain",
+    "Next.js App/Pages API handlers, including workspace applications.",
+    "Syntactic guards only; runtime authentication and business authorization are not verified."
+  ),
+  rule(
+    "api/db-write-without-auth",
+    "Database write without a recognized auth guard",
+    "P1",
+    "likely",
+    "Next.js App/Pages API handlers.",
+    "Session-scoped clients and indirect guards may need manual review."
+  ),
+  rule(
+    "cors/reflected-origin-with-credentials",
+    "Reflected origin with credentials",
+    "P1",
+    "certain",
+    "Response headers and cors middleware options.",
+    "Static pairing does not prove the deployed policy or cookie behavior."
+  ),
+  rule(
+    "cors/wildcard-with-credentials",
+    "Wildcard origin with credentials",
+    "P2",
+    "certain",
+    "Response headers and cors middleware options.",
+    "Browsers reject this combination; it is not proof of data exposure."
+  ),
+  rule(
+    "exposure/private-name-in-public-env",
+    "Private-looking name with a public env prefix",
+    "P0",
+    "likely",
+    "Environment files and source references using recognized public prefixes.",
+    "A variable name is not proof that its value is a secret."
+  ),
+  rule(
+    "exposure/secret-in-public-env",
+    "Recognized secret in a public env variable",
+    "P0",
+    "certain",
+    "Environment files using recognized public prefixes.",
+    "Credential validity and actual deployment are not verified."
+  ),
+  rule(
+    "exposure/supabase-service-role-in-client",
+    "Supabase admin credential exposed in source or public env",
+    "P0",
+    "certain",
+    "Recognized service_role JWTs in source; Supabase admin credentials in public environment variables.",
+    "Source presence is observable; actual browser delivery and key validity are not verified."
+  ),
+  rule(
+    "firebase/open-rules",
+    "Unconditional Firebase access",
+    "P1",
+    "varies",
+    "Firebase .rules files: unconditional writes are certain; public reads require review.",
+    "Public reads may be intentional; runtime rules and business authorization are not verified."
+  ),
+  rule(
+    "firebase/test-mode-rules",
+    "Date-based Firebase test rules",
+    "P1",
+    "certain",
+    "Firebase .rules files using a fixed timestamp cutoff.",
+    "Expired rules may deny access; deployment state is not verified."
+  ),
+  rule(
+    "gitleak/env-in-history",
+    "Private env values in local Git history",
+    "P0",
+    "varies",
+    "Relevant historical versions of environment files in the local repository.",
+    "History and resource limits apply; remote refs not available locally are not checked."
+  ),
+  rule(
+    "gitleak/env-tracked",
+    "Private env values tracked by Git",
+    "P0",
+    "varies",
+    "Tracked environment files; templates and public-only values are treated separately.",
+    "Unrecognized private values are heuristic findings, not verified credentials."
+  ),
+  rule(
+    "supabase/rls-not-enabled",
+    "Table without RLS in migrations",
+    "P1",
+    "certain",
+    "Supabase SQL migrations, replayed by application scope.",
+    "Migration state is not deployed database state; grants and policy correctness are outside this check."
+  ),
+  ...SECRET_PATTERNS.map((pattern) => ({
+    ...rule(
+      `secrets/hardcoded/${pattern.id}`,
+      pattern.name,
+      "P0",
+      "certain",
+      "Recognized credential formats in scanned text files.",
+      "Validity, revocation, and use are not checked; example contexts lower confidence."
+    ),
+    reportsFindings: !pattern.publicByDesign,
+    ...pattern.publicByDesign ? { limitation: "Treated as a public identifier; this format alone does not produce a finding." } : {}
+  }))
+];
+function renderRuleCatalog() {
+  return "canship rules\n\n" + RULE_CATALOG.map(
+    (item) => `${item.id}
+  ${item.name}
+  ${item.reportsFindings ? `${item.severity}; ${item.confidence}` : "Public identifier; not reported"}
+  Scope: ${item.scope}
+  Limit: ${item.limitation}`
+  ).join("\n\n") + "\n\nExample and fixture contexts may lower confidence. No credential validity or deployed configuration is verified.\n";
+}
+
 // src/cli.ts
-var VERSION = true ? "0.2.0" : "0.0.0-dev";
+var VERSION = true ? "0.3.0" : "0.0.0-dev";
+function finish(code) {
+  process.exitCode = code;
+}
+var ArgumentError = class extends Error {
+};
 function argumentError(message) {
-  process.stderr.write(`canship: ${cleanForOutput(message)}
-`);
-  process.exit(3);
+  throw new ArgumentError(cleanForOutput(message));
 }
 function optionalValue(arg, name, fallback) {
   if (arg === name) return fallback;
@@ -4498,7 +4692,9 @@ function parseArgs(argv) {
     sarif: null,
     noConfig: false,
     help: false,
-    version: false
+    version: false,
+    listRules: false,
+    noExcerpts: false
   };
   const positional = [];
   for (const arg of argv) {
@@ -4563,6 +4759,12 @@ function parseArgs(argv) {
       case "--no-config":
         args.noConfig = true;
         break;
+      case "--list-rules":
+        args.listRules = true;
+        break;
+      case "--no-excerpts":
+        args.noExcerpts = true;
+        break;
       case "--help":
       case "-h":
         args.help = true;
@@ -4600,11 +4802,13 @@ var HELP = `
         --baseline[=F]       Hide findings already recorded in F, so only new
                              ones are reported (default ${DEFAULT_BASELINE_PATH})
         --baseline-write[=F] Record the current findings as a new baseline and exit
-        --only=IDS    Report only these rules (comma-separated, repeatable)
-        --skip=IDS    Report everything except these rules
+        --only=IDS    Run matching rules (comma-separated, repeatable)
+        --skip=IDS    Exclude matching rules
         --sarif[=F]   Write a SARIF 2.1.0 log for CI code scanning
                       (default canship.sarif)
         --no-config   Ignore canship.config.json in the scanned directory
+        --list-rules  List rule IDs, scope, and limits; add --json for structured output
+        --no-excerpts Omit source excerpts from every report; paths and descriptions remain
     -h, --help        Show this help
     -v, --version     Show version
 
@@ -4627,12 +4831,20 @@ async function main() {
   if (args.help) {
     process.stdout.write(`${HELP}
 `);
-    return process.exit(0);
+    return finish(0);
   }
   if (args.version) {
     process.stdout.write(`${VERSION}
 `);
-    return process.exit(0);
+    return finish(0);
+  }
+  if (args.listRules) {
+    if (process.argv.slice(2).some((arg) => arg !== "--list-rules" && arg !== "--json")) {
+      argumentError("--list-rules only supports --json; scan options and paths cannot be combined with it");
+    }
+    process.stdout.write(args.json ? `${JSON.stringify({ schemaVersion: 1, kind: "rule-catalog", version: VERSION, rules: RULE_CATALOG }, null, 2)}
+` : renderRuleCatalog());
+    return;
   }
   if (args.json && args.fixPrompt) {
     argumentError("--json and --fix-prompt are mutually exclusive");
@@ -4643,7 +4855,7 @@ async function main() {
   if (!existsSync3(args.root) || !statSync5(args.root).isDirectory()) {
     process.stderr.write(`${red("canship:")} not a directory: ${cleanForOutput(args.root)}
 `);
-    return process.exit(3);
+    return finish(3);
   }
   let config;
   try {
@@ -4652,7 +4864,7 @@ async function main() {
     if (err instanceof ConfigError) {
       process.stderr.write(`${red("canship:")} ${cleanForOutput(err.message)}
 `);
-      return process.exit(3);
+      return finish(3);
     }
     throw err;
   }
@@ -4687,7 +4899,7 @@ async function main() {
 ${cleanForOutput(String(err))}
 `
       );
-      return process.exit(3);
+      return finish(3);
     }
     const accepted = scanned.findings.length;
     process.stdout.write(
@@ -4714,7 +4926,7 @@ ${cleanForOutput(String(err))}
 `
       );
     }
-    return process.exit(0);
+    return finish(0);
   }
   let baselineSuppressed = 0;
   let baselineStale = 0;
@@ -4730,12 +4942,13 @@ ${cleanForOutput(String(err))}
       if (err instanceof BaselineError) {
         process.stderr.write(`${red("canship:")} ${cleanForOutput(err.message)}
 `);
-        return process.exit(3);
+        return finish(3);
       }
       throw err;
     }
   }
   const displayRoot = cleanForOutput(args.root);
+  if (args.noExcerpts) result = { ...result, findings: result.findings.map((finding) => ({ ...finding, excerpt: null })) };
   const shown = showAll ? result.findings : result.findings.filter((f) => f.confidence === "certain");
   const hiddenLikely = showAll ? 0 : result.findings.filter((f) => f.confidence === "likely").length;
   if (args.fixPrompt) {
@@ -4755,31 +4968,14 @@ ${cleanForOutput(String(err))}
   } else if (args.json) {
     process.stdout.write(
       `${JSON.stringify(
-        {
+        createJsonReport({ ...result, findings: shown }, {
           version: VERSION,
           root: displayRoot,
-          filesScanned: result.filesScanned,
-          durationMs: result.durationMs,
-          // Machine consumers need the same distinction humans get: an empty
-          // findings array from a partial scan is not a pass.
-          partial: result.partial,
-          errors: result.errors,
-          skipped: result.skipped,
-          ignored: result.ignored,
-          ignoredFindings: result.ignoredFindings,
-          ruleSelection: result.ruleSelection,
-          vendored: result.vendored,
-          // The default view hides the detail, never the fact. A machine reading this
-          // must not see "no findings" while lower-confidence ones exist.
           hiddenLikely,
-          // Same reason, for the other thing that removes findings from this
-          // array. A CI job reading `findings: []` is entitled to know whether
-          // that means "nothing is wrong" or "a file in your repository says
-          // not to mention it".
           baselineSuppressed,
           baselineStale,
-          findings: shown
-        },
+          excerptsOmitted: args.noExcerpts
+        }),
         null,
         2
       )}
@@ -4828,7 +5024,7 @@ ${cleanForOutput(String(err))}
 ${cleanForOutput(String(err))}
 `
       );
-      return process.exit(3);
+      return finish(3);
     }
   }
   if (args.report) {
@@ -4860,17 +5056,19 @@ ${cleanForOutput(String(err))}
 ${cleanForOutput(String(err))}
 `
       );
-      return process.exit(3);
+      return finish(3);
     }
   }
-  if (verdictOf(result.findings).blocking > 0) return process.exit(1);
-  if (result.findings.length > 0) return process.exit(2);
-  if (result.partial && !bestEffort) return process.exit(3);
-  return process.exit(0);
+  if (verdictOf(result.findings).blocking > 0) return finish(1);
+  if (result.findings.length > 0) return finish(2);
+  if (result.partial && !bestEffort) return finish(3);
+  return finish(0);
 }
 main().catch((err) => {
-  process.stderr.write(`${red("canship: unexpected error")}
+  if (err instanceof ArgumentError) process.stderr.write(`canship: ${err.message}
+`);
+  else process.stderr.write(`${red("canship: unexpected error")}
 ${cleanForOutput(String(err))}
 `);
-  process.exit(3);
+  finish(3);
 });