canship 0.2.1 → 0.3.1

package/dist/cli.js

@@ -779,7 +779,7 @@ function isExampleContext(relPath) {
   if (/\.(test|spec)\.[jt]sx?$/i.test(name)) return true;
   return false;
 }
-function collectFiles(root, isGitRepo, gitExecutable = resolveGitExecutable(root), limits = {}) {
+function collectFiles(root, isGitRepo, gitExecutable = resolveGitExecutable(root), limits = {}, honorIgnoreMarkers = true) {
   const skipped = [];
   const ignored = [];
   const fromGit = isGitRepo ? listViaGit(root, gitExecutable) : null;
@@ -863,7 +863,7 @@ function collectFiles(root, isGitRepo, gitExecutable = resolveGitExecutable(root
       continue;
     }
     const lines = content.split(/\r?\n/);
-    if (hasIgnoreMarker(lines)) {
+    if (honorIgnoreMarkers && hasIgnoreMarker(lines)) {
       ignored.push(relPath);
       continue;
     }
@@ -952,71 +952,68 @@ function endOfString(src, start, quote) {
   }
   return length;
 }
-function maskTemplate(src, out, start) {
+function maskTemplate(src, out, start, maskStrings = true) {
   const length = src.length;
+  const stack = [{ kind: "literal", from: start + 1 }];
   let i = start + 1;
-  let literalFrom = i;
-  while (i < length) {
+  while (i < length && stack.length > 0) {
+    const frame = stack[stack.length - 1];
     const ch = src.charCodeAt(i);
-    if (ch === BACKSLASH) {
-      i += 2;
+    if (frame.kind === "literal") {
+      if (ch === BACKSLASH) {
+        i = Math.min(i + 2, length);
+        continue;
+      }
+      if (ch === BACKTICK) {
+        if (maskStrings) blank(out, frame.from, i);
+        stack.pop();
+        i++;
+        continue;
+      }
+      if (ch === DOLLAR && src.charCodeAt(i + 1) === OPEN_BRACE) {
+        if (maskStrings) blank(out, frame.from, i);
+        stack.push({ kind: "expression", depth: 1 });
+        i += 2;
+        continue;
+      }
+      i++;
+      continue;
+    }
+    if (ch === SLASH) {
+      const next = src.charCodeAt(i + 1);
+      if (next === SLASH || next === STAR) {
+        const close = next === SLASH ? src.indexOf("\n", i) : src.indexOf("*/", i + 2);
+        const stop = close === -1 ? length : close + (next === STAR ? 2 : 0);
+        blank(out, i, stop);
+        i = stop;
+        continue;
+      }
+    }
+    if (ch === DOUBLE_QUOTE || ch === SINGLE_QUOTE) {
+      const stop = endOfString(src, i, ch);
+      if (maskStrings) blank(out, i + 1, stop - 1);
+      i = stop;
       continue;
     }
     if (ch === BACKTICK) {
-      blank(out, literalFrom, i);
-      return i + 1;
+      stack.push({ kind: "literal", from: i + 1 });
+      i++;
+      continue;
     }
-    if (ch === DOLLAR && src.charCodeAt(i + 1) === OPEN_BRACE) {
-      blank(out, literalFrom, i);
-      let depth = 0;
-      let j = i + 1;
-      while (j < length) {
-        const inner = src.charCodeAt(j);
-        if (inner === SLASH) {
-          const next = src.charCodeAt(j + 1);
-          if (next === SLASH) {
-            const end = src.indexOf("\n", j);
-            const stop = end === -1 ? length : end;
-            blank(out, j, stop);
-            j = stop;
-            continue;
-          }
-          if (next === STAR) {
-            const close = src.indexOf("*/", j + 2);
-            const stop = close === -1 ? length : close + 2;
-            blank(out, j, stop);
-            j = stop;
-            continue;
-          }
-        }
-        if (inner === DOUBLE_QUOTE || inner === SINGLE_QUOTE) {
-          const stop = endOfString(src, j, inner);
-          blank(out, j + 1, stop - 1);
-          j = stop;
-          continue;
-        }
-        if (inner === BACKTICK) {
-          j = maskTemplate(src, out, j);
-          continue;
-        }
-        if (inner === OPEN_BRACE) depth++;
-        else if (inner === CLOSE_BRACE) {
-          depth--;
-          if (depth === 0) {
-            j++;
-            break;
-          }
-        }
-        j++;
+    if (ch === OPEN_BRACE) frame.depth++;
+    else if (ch === CLOSE_BRACE) {
+      frame.depth--;
+      if (frame.depth === 0) {
+        stack.pop();
+        const parent = stack[stack.length - 1];
+        if (parent.kind === "literal") parent.from = i + 1;
       }
-      i = j;
-      literalFrom = i;
-      continue;
     }
     i++;
   }
-  blank(out, literalFrom, length);
-  return length;
+  const last = stack[stack.length - 1];
+  if (maskStrings && last?.kind === "literal") blank(out, last.from, length);
+  return i;
 }
 function maskJsComments(src) {
   const length = src.length;
@@ -1041,10 +1038,14 @@ function maskJsComments(src) {
         continue;
       }
     }
-    if (ch === DOUBLE_QUOTE || ch === SINGLE_QUOTE || ch === BACKTICK) {
+    if (ch === DOUBLE_QUOTE || ch === SINGLE_QUOTE) {
       i = endOfString(src, i, ch);
       continue;
     }
+    if (ch === BACKTICK) {
+      i = maskTemplate(src, out, i, false);
+      continue;
+    }
     i++;
   }
   return stringOf(out);
@@ -2102,8 +2103,8 @@ var supabaseRlsRule = {
         line: entry.line,
         excerpt: null,
         why: [
-          `Supabase exposes your database to the browser directly, and the anon key that reaches it is public by design \u2014 it ships inside your frontend. Row Level Security is the only thing that decides who can read or write a row.`,
-          `No "ALTER TABLE ${renderIdent(entry.table)} ENABLE ROW LEVEL SECURITY" appears anywhere in your SQL, and new tables do not get it by default. If that is the real state, anyone who visits your site can list this entire table with a single request \u2014 and depending on your policies, write to it too.`,
+          `Supabase's browser clients use public identifiers. For exposed tables, database grants and Row Level Security determine which operations and rows a caller can access.`,
+          `After replaying the scanned migrations, the final recorded state of ${renderIdent(entry.table)} does not have RLS enabled. It may never have been enabled or may have been disabled by a later migration. Without RLS, any access granted to the caller is not restricted by row policies.`,
           `If you enabled RLS from the Supabase dashboard instead, this file simply cannot show it. Check the Authentication -> Policies page to confirm.`
         ],
         fix: [
@@ -2130,9 +2131,7 @@ var supabaseRlsRule = {
 // src/rules/firebase.ts
 import { basename as basename5 } from "path";
 function isRulesFile(file) {
-  const name = basename5(file.path).toLowerCase();
-  if (name.endsWith(".rules")) return true;
-  return name === "firestore.rules" || name === "storage.rules";
+  return basename5(file.path).toLowerCase().endsWith(".rules");
 }
 function productOf(path) {
   const name = basename5(path).toLowerCase();
@@ -2244,7 +2243,7 @@ var firebaseRulesRule = {
         excerpt: m[0].trim(),
         why: canWrite ? [
           `"if true" grants access unconditionally \u2014 no sign-in, no ownership check, nothing. The Firebase client SDK talks to your database straight from the browser, so these rules are the only access control that exists.`,
-          `Anyone who finds your project id can read every document here, overwrite it, or delete all of it. Project ids are not secret; they ship inside your frontend bundle.`
+          `Anyone can perform the allowed ${ops} operations on this matched path without authentication. Other operations depend on their own rules. Project ids are public identifiers, not access controls.`
         ] : [
           `"if true" grants read access unconditionally, so anyone who finds your project id can list every document in this collection. Project ids are not secret; they ship inside your frontend bundle.`,
           `Writes are still denied by default, so this is only a problem if the data is not meant to be public. If it is a public catalogue or announcements, ignore this \u2014 and consider adding "allow write: if false;" to make that intent explicit.`
@@ -2922,9 +2921,9 @@ var apiAuthRule = {
           line,
           excerpt,
           why: [
-            `This route uses the service_role key, which bypasses every Row Level Security policy you have. Whatever your database would normally refuse, this route performs.`,
-            `Nothing in this file checks who is calling \u2014 no session lookup, no token check, no 401 anywhere \u2014 and no middleware covers it. The URL is not a secret either: it is spelled out by the file path, and it appears in your frontend bundle as soon as anything calls it.`,
-            `So a single curl to ${url} gets the same access your admin key has.`,
+            `This route references a recognized admin client. Such clients can bypass normal per-user access checks; verify the effective credentials and granted permissions.`,
+            `The scan did not recognize an authentication guard protecting this operation or applicable middleware. Indirect wrappers and deployment-level controls may not be recognized; verify them before exposing this route.`,
+            `If ${url} is reachable without authentication, callers can trigger the admin-backed operations implemented by this handler.`,
             `If this endpoint is meant to be public \u2014 handing out a guest session, taking a waitlist signup \u2014 then the problem is not that it is open, it is that it is open *and* holds the admin key. Give it a client that can only do the one thing it needs.`
           ],
           fix: [
@@ -2950,8 +2949,8 @@ var apiAuthRule = {
           line,
           excerpt,
           why: [
-            `This route changes data, and nothing in the file checks who is calling \u2014 no session lookup, no token check, no 401 anywhere.`,
-            `Route URLs are not secret; this one is spelled out by its file path. Anyone who sends a request can trigger the same write.`,
+            `This route changes data, and the scan did not recognize an authentication guard before the operation. Indirect guards and runtime controls require manual verification.`,
+            `If this route is publicly reachable and no other control rejects the caller, unauthenticated requests can trigger this write.`,
             `If this is a public form \u2014 a waitlist, a contact box \u2014 that may be intentional. It is still worth rate limiting, because an open write endpoint is what gets a database filled with spam overnight.`
           ],
           fix: [
@@ -2968,8 +2967,31 @@ var apiAuthRule = {
 
 // src/rules/cors.ts
 var CORS_MARKER = /Access-Control-Allow-Origin|\bcors\s*\(/i;
-var ACAO = /['"]Access-Control-Allow-Origin['"]\s*(?:,|:)\s*(?:value\s*:\s*)?([^\n]+)/gi;
-var CORS_ORIGIN_OPTION = /\borigin\s*:\s*(true|['"`]\*['"`])/gi;
+var ACAO = /['"]Access-Control-Allow-Origin['"]\s*(?:,|:)\s*(?:value\s*:\s*)?/gi;
+function headerExpression(content, start) {
+  const closes = [];
+  let quote = null;
+  let end = start;
+  for (; end < content.length; end++) {
+    const ch = content[end];
+    if (ch === "\n" || ch === "\r") break;
+    if (quote !== null) {
+      if (ch === "\\") end++;
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"' || ch === "`") quote = ch;
+    else if (ch === "(") closes.push(")");
+    else if (ch === "[") closes.push("]");
+    else if (ch === "{") closes.push("}");
+    else if (ch === ")" || ch === "]" || ch === "}") {
+      if (closes.at(-1) !== ch) break;
+      closes.pop();
+    } else if (closes.length === 0 && (ch === "," || ch === ";")) break;
+  }
+  return content.slice(start, end);
+}
+var CORS_ORIGIN_OPTION = /\borigin\s*:\s*/gi;
 var CORS_ORIGIN_PROPERTY_START = /\borigin\s*:\s*(?:async\s+)?(?:(function)\s*(?:[A-Za-z_$][\w$]*)?\s*)?\(/gi;
 var CORS_ORIGIN_METHOD_START = /\borigin\s*\(/gi;
 function closingParameterList(source, open) {
@@ -3010,6 +3032,8 @@ function readOriginCallback(content, match, kind) {
   }
   return {
     index: match.index,
+    parametersStart: open + 1,
+    parametersEnd: close,
     params: content.slice(open + 1, close),
     body: content.slice(bodyStart, bodyStart + 400)
   };
@@ -3118,31 +3142,63 @@ function classifyOrigin(raw) {
   return /\b(?:req|request|headers?|ctx|event)/i.test(compact) ? "reflected" : "unknown";
 }
 var PAIRING_DISTANCE = 25;
+function optionScopes(file, positions) {
+  const scopes = /* @__PURE__ */ new Map();
+  const wanted = [...new Set(positions)].sort((a, b) => a - b);
+  if (wanted.length === 0) return scopes;
+  const content = noiseMaskedOf(file);
+  const stack = [-1];
+  let next = 0;
+  for (let at = 0; at < content.length && next < wanted.length; at++) {
+    if (at === wanted[next]) {
+      scopes.set(at, stack[stack.length - 1]);
+      next++;
+    }
+    if (content[at] === "{") stack.push(at);
+    else if (content[at] === "}" && stack.length > 1) stack.pop();
+  }
+  return scopes;
+}
 function collectOrigins(file) {
   const marks = [];
   let m;
   const content = commentsMaskedOf(file);
   const contentLines = lineStartsOf(content);
+  const code = noiseMaskedOf(file);
+  const callbacks = originCallbacks(content).filter((callback) => code[callback.index] === content[callback.index]);
+  const callbackIndices = new Set(callbacks.map((callback) => callback.index));
+  const parameterRanges = [...callbacks].sort((a, b) => a.parametersStart - b.parametersStart);
+  let parameterRange = 0;
   ACAO.lastIndex = 0;
   while ((m = ACAO.exec(content)) !== null) {
+    if (code[m.index] !== content[m.index]) continue;
     const line = lineNumberAt(contentLines, m.index);
-    marks.push({ line, kind: classifyOrigin(m[1] ?? ""), excerpt: (file.lines[line - 1] ?? "").trim() });
+    const expression = headerExpression(content, ACAO.lastIndex);
+    ACAO.lastIndex += expression.length;
+    marks.push({ line, at: m.index, mode: "header", kind: classifyOrigin(expression), excerpt: (file.lines[line - 1] ?? "").trim() });
   }
   CORS_ORIGIN_OPTION.lastIndex = 0;
   while ((m = CORS_ORIGIN_OPTION.exec(content)) !== null) {
+    if (code[m.index] !== content[m.index]) continue;
+    while (parameterRange < parameterRanges.length && parameterRanges[parameterRange].parametersEnd < m.index) parameterRange++;
+    if (parameterRanges[parameterRange] && parameterRanges[parameterRange].parametersStart <= m.index) continue;
+    if (callbackIndices.has(m.index)) continue;
     const line = lineNumberAt(contentLines, m.index);
+    const expression = headerExpression(content, CORS_ORIGIN_OPTION.lastIndex);
+    CORS_ORIGIN_OPTION.lastIndex += expression.length;
     marks.push({
       line,
-      kind: (m[1] ?? "") === "true" ? "reflected" : "wildcard",
+      at: m.index,
+      mode: "option",
+      kind: expression.trim() === "true" ? "reflected" : classifyOrigin(expression),
       excerpt: (file.lines[line - 1] ?? "").trim()
     });
   }
-  for (const callback of originCallbacks(content)) {
+  for (const callback of callbacks) {
     const answer = callbackAnswer(callback.params, callback.body);
-    if (answer === null) continue;
-    if (ORIGIN_IS_CHECKED.test(callback.body.slice(0, answer.index))) continue;
+    const kind = answer !== null && !ORIGIN_IS_CHECKED.test(callback.body.slice(0, answer.index)) ? answer.kind : "unknown";
     const line = lineNumberAt(contentLines, callback.index);
-    marks.push({ line, kind: answer.kind, excerpt: (file.lines[line - 1] ?? "").trim() });
+    marks.push({ line, at: callback.index, mode: "option", kind, excerpt: (file.lines[line - 1] ?? "").trim() });
   }
   return marks;
 }
@@ -3150,11 +3206,16 @@ function collectCredentialLines(file) {
   const lines = [];
   let m;
   const content = commentsMaskedOf(file);
+  const code = noiseMaskedOf(file);
   const contentLines = lineStartsOf(content);
   ACAC_HEADER.lastIndex = 0;
-  while ((m = ACAC_HEADER.exec(content)) !== null) lines.push(lineNumberAt(contentLines, m.index));
+  while ((m = ACAC_HEADER.exec(content)) !== null) {
+    if (code[m.index] === content[m.index]) lines.push({ line: lineNumberAt(contentLines, m.index), at: m.index, mode: "header" });
+  }
   CORS_CREDENTIALS_OPTION.lastIndex = 0;
-  while ((m = CORS_CREDENTIALS_OPTION.exec(content)) !== null) lines.push(lineNumberAt(contentLines, m.index));
+  while ((m = CORS_CREDENTIALS_OPTION.exec(content)) !== null) {
+    if (code[m.index] === content[m.index]) lines.push({ line: lineNumberAt(contentLines, m.index), at: m.index, mode: "option" });
+  }
   return lines;
 }
 function nearestOrigin(origins, credLine) {
@@ -3184,10 +3245,12 @@ var corsRule = {
     if (credentialLines.length === 0) return [];
     const origins = collectOrigins(file);
     if (origins.length === 0) return [];
+    const scopes = optionScopes(file, [...origins, ...credentialLines].filter((mark) => mark.mode === "option").map((mark) => mark.at));
     const findings = [];
     const reported = /* @__PURE__ */ new Set();
-    for (const credLine of credentialLines) {
-      const origin = nearestOrigin(origins, credLine);
+    for (const credential of credentialLines) {
+      const candidates = origins.filter((origin2) => origin2.mode === credential.mode && (credential.mode === "header" || scopes.get(origin2.at) === scopes.get(credential.at)));
+      const origin = nearestOrigin(candidates, credential.line);
       if (!origin) continue;
       if (origin.kind !== "reflected" && origin.kind !== "wildcard") continue;
       if (reported.has(origin.kind)) continue;
@@ -3390,11 +3453,12 @@ async function scan(root, options = {}) {
   const started = Date.now();
   const gitExecutable = resolveGitExecutable(root);
   const git2 = detectGitRepo(root, gitExecutable);
-  const { files, skipped, ignored, vendored } = collectFiles(root, git2 === "repo", gitExecutable);
+  const honorIgnoreMarkers = options.honorIgnoreMarkers !== false;
+  const { files, skipped, ignored, vendored } = collectFiles(root, git2 === "repo", gitExecutable, {}, honorIgnoreMarkers);
   const findings = [];
   const errors = [];
-  const fileRules = FILE_RULES.filter((rule) => shouldRunRule(rule.id, options.only ?? [], options.skip ?? []));
-  const projectRules = PROJECT_RULES.filter((rule) => shouldRunRule(rule.id, options.only ?? [], options.skip ?? []));
+  const fileRules = FILE_RULES.filter((rule2) => shouldRunRule(rule2.id, options.only ?? [], options.skip ?? []));
+  const projectRules = PROJECT_RULES.filter((rule2) => shouldRunRule(rule2.id, options.only ?? [], options.skip ?? []));
   const incompleteSeen = /* @__PURE__ */ new Set();
   const ctx = {
     root,
@@ -3409,26 +3473,24 @@ async function scan(root, options = {}) {
     }
   };
   for (const file of files) {
-    for (const rule of fileRules) {
+    for (const rule2 of fileRules) {
       try {
-        if (!rule.appliesTo(file)) continue;
-        findings.push(...rule.check(file, ctx));
+        if (!rule2.appliesTo(file)) continue;
+        findings.push(...rule2.check(file, ctx));
       } catch (err) {
-        errors.push({ ruleId: rule.id, file: file.path, message: messageOf(err), kind: "crashed" });
+        errors.push({ ruleId: rule2.id, file: file.path, message: messageOf(err), kind: "crashed" });
       }
     }
   }
-  for (const rule of projectRules) {
+  for (const rule2 of projectRules) {
     try {
-      findings.push(...await rule.check(ctx));
+      findings.push(...await rule2.check(ctx));
     } catch (err) {
-      errors.push({ ruleId: rule.id, file: null, message: messageOf(err), kind: "crashed" });
+      errors.push({ ruleId: rule2.id, file: null, message: messageOf(err), kind: "crashed" });
     }
   }
-  const { kept, ignored: ignoredFindings } = suppressIgnoredLines(
-    dedupe(downgradeExampleContext(findings, files)),
-    files
-  );
+  const deduped = dedupe(downgradeExampleContext(findings, files));
+  const { kept, ignored: ignoredFindings } = honorIgnoreMarkers ? suppressIgnoredLines(deduped, files) : { kept: deduped, ignored: [] };
   const selected = applyRuleSelection(kept, options);
   const counts = /* @__PURE__ */ new Map();
   const bounded = sortFindings(selected.kept).filter((finding) => {
@@ -4188,9 +4250,10 @@ function applyBaseline(findings, baseline) {
   const kept = [];
   let suppressed = 0;
   for (const f of findings) {
-    const budget = remaining.get(fingerprintOf(f)) ?? 0;
+    const fp = fingerprintOf(f);
+    const budget = remaining.get(fp) ?? 0;
     if (budget > 0) {
-      remaining.set(fingerprintOf(f), budget - 1);
+      remaining.set(fp, budget - 1);
       suppressed++;
       continue;
     }
@@ -4326,6 +4389,29 @@ function renderSarif(result, opts) {
 `;
 }
 
+// src/report/json.ts
+function createJsonReport(result, options) {
+  return {
+    schemaVersion: 1,
+    version: options.version,
+    root: options.root,
+    filesScanned: result.filesScanned,
+    durationMs: result.durationMs,
+    partial: result.partial,
+    errors: result.errors,
+    skipped: result.skipped,
+    ignored: result.ignored,
+    ignoredFindings: result.ignoredFindings,
+    ruleSelection: result.ruleSelection,
+    vendored: result.vendored,
+    hiddenLikely: options.hiddenLikely,
+    baselineSuppressed: options.baselineSuppressed,
+    baselineStale: options.baselineStale,
+    excerptsOmitted: options.excerptsOmitted ?? false,
+    findings: result.findings
+  };
+}
+
 // src/config.ts
 import { existsSync as existsSync2, readFileSync as readFileSync4, statSync as statSync4 } from "fs";
 import { join as join3 } from "path";
@@ -4416,12 +4502,137 @@ function loadConfig(root) {
   return { config: parseConfig(text, path), path };
 }
 
+// src/rules/catalog.ts
+var rule = (id, name, severity, confidence, scope, limitation) => ({ id, name, severity, confidence, scope, limitation, reportsFindings: true });
+var RULE_CATALOG = [
+  rule(
+    "api/admin-db-access-without-auth",
+    "Admin database access without a recognized auth guard",
+    "P0",
+    "certain",
+    "Next.js App/Pages API handlers, including workspace applications.",
+    "Syntactic guards only; runtime authentication and business authorization are not verified."
+  ),
+  rule(
+    "api/db-write-without-auth",
+    "Database write without a recognized auth guard",
+    "P1",
+    "likely",
+    "Next.js App/Pages API handlers.",
+    "Session-scoped clients and indirect guards may need manual review."
+  ),
+  rule(
+    "cors/reflected-origin-with-credentials",
+    "Reflected origin with credentials",
+    "P1",
+    "certain",
+    "Response headers and cors middleware options.",
+    "Static pairing does not prove the deployed policy or cookie behavior."
+  ),
+  rule(
+    "cors/wildcard-with-credentials",
+    "Wildcard origin with credentials",
+    "P2",
+    "certain",
+    "Response headers and cors middleware options.",
+    "Browsers reject this combination; it is not proof of data exposure."
+  ),
+  rule(
+    "exposure/private-name-in-public-env",
+    "Private-looking name with a public env prefix",
+    "P0",
+    "likely",
+    "Environment files and source references using recognized public prefixes.",
+    "A variable name is not proof that its value is a secret."
+  ),
+  rule(
+    "exposure/secret-in-public-env",
+    "Recognized secret in a public env variable",
+    "P0",
+    "certain",
+    "Environment files using recognized public prefixes.",
+    "Credential validity and actual deployment are not verified."
+  ),
+  rule(
+    "exposure/supabase-service-role-in-client",
+    "Supabase admin credential exposed in source or public env",
+    "P0",
+    "certain",
+    "Recognized service_role JWTs in source; Supabase admin credentials in public environment variables.",
+    "Source presence is observable; actual browser delivery and key validity are not verified."
+  ),
+  rule(
+    "firebase/open-rules",
+    "Unconditional Firebase access",
+    "P1",
+    "varies",
+    "Firebase .rules files: unconditional writes are certain; public reads require review.",
+    "Public reads may be intentional; runtime rules and business authorization are not verified."
+  ),
+  rule(
+    "firebase/test-mode-rules",
+    "Date-based Firebase test rules",
+    "P1",
+    "certain",
+    "Firebase .rules files using a fixed timestamp cutoff.",
+    "Expired rules may deny access; deployment state is not verified."
+  ),
+  rule(
+    "gitleak/env-in-history",
+    "Private env values in local Git history",
+    "P0",
+    "varies",
+    "Relevant historical versions of environment files in the local repository.",
+    "History and resource limits apply; remote refs not available locally are not checked."
+  ),
+  rule(
+    "gitleak/env-tracked",
+    "Private env values tracked by Git",
+    "P0",
+    "varies",
+    "Tracked environment files; templates and public-only values are treated separately.",
+    "Unrecognized private values are heuristic findings, not verified credentials."
+  ),
+  rule(
+    "supabase/rls-not-enabled",
+    "Table without RLS in migrations",
+    "P1",
+    "certain",
+    "Supabase SQL migrations, replayed by application scope.",
+    "Migration state is not deployed database state; grants and policy correctness are outside this check."
+  ),
+  ...SECRET_PATTERNS.map((pattern) => ({
+    ...rule(
+      `secrets/hardcoded/${pattern.id}`,
+      pattern.name,
+      "P0",
+      "certain",
+      "Recognized credential formats in scanned text files.",
+      "Validity, revocation, and use are not checked; example contexts lower confidence."
+    ),
+    reportsFindings: !pattern.publicByDesign,
+    ...pattern.publicByDesign ? { limitation: "Treated as a public identifier; this format alone does not produce a finding." } : {}
+  }))
+];
+function renderRuleCatalog() {
+  return "canship rules\n\n" + RULE_CATALOG.map(
+    (item) => `${item.id}
+  ${item.name}
+  ${item.reportsFindings ? `${item.severity}; ${item.confidence}` : "Public identifier; not reported"}
+  Scope: ${item.scope}
+  Limit: ${item.limitation}`
+  ).join("\n\n") + "\n\nExample and fixture contexts may lower confidence. No credential validity or deployed configuration is verified.\n";
+}
+
 // src/cli.ts
-var VERSION = true ? "0.2.1" : "0.0.0-dev";
+var VERSION = true ? "0.3.1" : "0.0.0-dev";
+function finish(code) {
+  process.exitCode = code;
+}
+var ArgumentError = class extends Error {
+};
 function argumentError(message) {
-  process.stderr.write(`canship: ${cleanForOutput(message)}
-`);
-  process.exit(3);
+  throw new ArgumentError(cleanForOutput(message));
 }
 function optionalValue(arg, name, fallback) {
   if (arg === name) return fallback;
@@ -4479,8 +4690,11 @@ function parseArgs(argv) {
     skip: [],
     sarif: null,
     noConfig: false,
+    noIgnoreMarkers: false,
     help: false,
-    version: false
+    version: false,
+    listRules: false,
+    noExcerpts: false
   };
   const positional = [];
   for (const arg of argv) {
@@ -4545,6 +4759,15 @@ function parseArgs(argv) {
       case "--no-config":
         args.noConfig = true;
         break;
+      case "--no-ignore-markers":
+        args.noIgnoreMarkers = true;
+        break;
+      case "--list-rules":
+        args.listRules = true;
+        break;
+      case "--no-excerpts":
+        args.noExcerpts = true;
+        break;
       case "--help":
       case "-h":
         args.help = true;
@@ -4587,6 +4810,11 @@ var HELP = `
         --sarif[=F]   Write a SARIF 2.1.0 log for CI code scanning
                       (default canship.sarif)
         --no-config   Ignore canship.config.json in the scanned directory
+        --no-ignore-markers
+                      Disregard canship-ignore-file and canship-ignore-next-line
+                      markers; use with --no-config for untrusted projects
+        --list-rules  List rule IDs, scope, and limits; add --json for structured output
+        --no-excerpts Omit source excerpts from every report; paths and descriptions remain
     -h, --help        Show this help
     -v, --version     Show version
 
@@ -4609,12 +4837,20 @@ async function main() {
   if (args.help) {
     process.stdout.write(`${HELP}
 `);
-    return process.exit(0);
+    return finish(0);
   }
   if (args.version) {
     process.stdout.write(`${VERSION}
 `);
-    return process.exit(0);
+    return finish(0);
+  }
+  if (args.listRules) {
+    if (process.argv.slice(2).some((arg) => arg !== "--list-rules" && arg !== "--json")) {
+      argumentError("--list-rules only supports --json; scan options and paths cannot be combined with it");
+    }
+    process.stdout.write(args.json ? `${JSON.stringify({ schemaVersion: 1, kind: "rule-catalog", version: VERSION, rules: RULE_CATALOG }, null, 2)}
+` : renderRuleCatalog());
+    return;
   }
   if (args.json && args.fixPrompt) {
     argumentError("--json and --fix-prompt are mutually exclusive");
@@ -4625,7 +4861,7 @@ async function main() {
   if (!existsSync3(args.root) || !statSync5(args.root).isDirectory()) {
     process.stderr.write(`${red("canship:")} not a directory: ${cleanForOutput(args.root)}
 `);
-    return process.exit(3);
+    return finish(3);
   }
   let config;
   try {
@@ -4634,7 +4870,7 @@ async function main() {
     if (err instanceof ConfigError) {
       process.stderr.write(`${red("canship:")} ${cleanForOutput(err.message)}
 `);
-      return process.exit(3);
+      return finish(3);
     }
     throw err;
   }
@@ -4657,7 +4893,7 @@ async function main() {
   const showAll = args.showAll || config.all === true;
   const bestEffort = args.bestEffort;
   const baselinePath = args.baseline !== null ? resolve2(args.baseline) : args.baselineDefault ? resolve2(args.root, DEFAULT_BASELINE_PATH) : config.baseline !== void 0 ? insideProject(args.root, config.baseline) : null;
-  const scanned = await scan(args.root, { only, skip });
+  const scanned = await scan(args.root, { only, skip, honorIgnoreMarkers: !args.noIgnoreMarkers });
   if (args.baselineWrite !== null || args.baselineWriteDefault) {
     const target = args.baselineWrite !== null ? resolve2(args.baselineWrite) : resolve2(args.root, DEFAULT_BASELINE_PATH);
     const baseline = buildBaseline(scanned.findings);
@@ -4669,7 +4905,7 @@ async function main() {
 ${cleanForOutput(String(err))}
 `
       );
-      return process.exit(3);
+      return finish(3);
     }
     const accepted = scanned.findings.length;
     process.stdout.write(
@@ -4696,7 +4932,7 @@ ${cleanForOutput(String(err))}
 `
       );
     }
-    return process.exit(0);
+    return finish(0);
   }
   let baselineSuppressed = 0;
   let baselineStale = 0;
@@ -4712,12 +4948,13 @@ ${cleanForOutput(String(err))}
       if (err instanceof BaselineError) {
         process.stderr.write(`${red("canship:")} ${cleanForOutput(err.message)}
 `);
-        return process.exit(3);
+        return finish(3);
       }
       throw err;
     }
   }
   const displayRoot = cleanForOutput(args.root);
+  if (args.noExcerpts) result = { ...result, findings: result.findings.map((finding) => ({ ...finding, excerpt: null })) };
   const shown = showAll ? result.findings : result.findings.filter((f) => f.confidence === "certain");
   const hiddenLikely = showAll ? 0 : result.findings.filter((f) => f.confidence === "likely").length;
   if (args.fixPrompt) {
@@ -4737,26 +4974,14 @@ ${cleanForOutput(String(err))}
   } else if (args.json) {
     process.stdout.write(
       `${JSON.stringify(
-        {
+        createJsonReport({ ...result, findings: shown }, {
           version: VERSION,
           root: displayRoot,
-          filesScanned: result.filesScanned,
-          durationMs: result.durationMs,
-          // 空结果不能掩盖扫描未完成。
-          partial: result.partial,
-          errors: result.errors,
-          skipped: result.skipped,
-          ignored: result.ignored,
-          ignoredFindings: result.ignoredFindings,
-          ruleSelection: result.ruleSelection,
-          vendored: result.vendored,
-          // 隐藏详情时仍披露疑似结果数量。
           hiddenLikely,
-          // 明确披露基线抑制和过期条目数量。
           baselineSuppressed,
           baselineStale,
-          findings: shown
-        },
+          excerptsOmitted: args.noExcerpts
+        }),
         null,
         2
       )}
@@ -4805,7 +5030,7 @@ ${cleanForOutput(String(err))}
 ${cleanForOutput(String(err))}
 `
       );
-      return process.exit(3);
+      return finish(3);
     }
   }
   if (args.report) {
@@ -4837,17 +5062,19 @@ ${cleanForOutput(String(err))}
 ${cleanForOutput(String(err))}
 `
       );
-      return process.exit(3);
+      return finish(3);
     }
   }
-  if (verdictOf(result.findings).blocking > 0) return process.exit(1);
-  if (result.findings.length > 0) return process.exit(2);
-  if (result.partial && !bestEffort) return process.exit(3);
-  return process.exit(0);
+  if (verdictOf(result.findings).blocking > 0) return finish(1);
+  if (result.findings.length > 0) return finish(2);
+  if (result.partial && !bestEffort) return finish(3);
+  return finish(0);
 }
 main().catch((err) => {
-  process.stderr.write(`${red("canship: unexpected error")}
+  if (err instanceof ArgumentError) process.stderr.write(`canship: ${err.message}
+`);
+  else process.stderr.write(`${red("canship: unexpected error")}
 ${cleanForOutput(String(err))}
 `);
-  process.exit(3);
+  finish(3);
 });