canship 0.8.0 → 0.8.1

package/README-zh-CN.md

@@ -6,20 +6,20 @@
 
 [English](./README.md) · [使用参考](./docs/reference-zh-CN.md) · [发布说明](https://github.com/Tasomei/canship/releases) · [npm](https://www.npmjs.com/package/canship)
 
-> 本文对应 npm `latest` 渠道的 `0.8.0`。其他版本见[发布说明](https://github.com/Tasomei/canship/releases)。
+> 本文对应 npm `latest` 渠道的 `0.8.1`。其他版本见[发布说明](https://github.com/Tasomei/canship/releases)。
 
 ## 快速开始
 
 要求 Node.js 18 及以上，无运行时依赖。
 
 ```powershell
-npx canship@0.8.0
+npx canship@0.8.1
 ```
 
 扫描指定目录：
 
 ```powershell
-npx canship@0.8.0 "./my-app"
+npx canship@0.8.1 "./my-app"
 ```
 
 合成项目的输出示例：
@@ -39,7 +39,7 @@ npx canship@0.8.0 "./my-app"
 路由分析覆盖 Next.js、SvelteKit、Nuxt、Remix / React Router、Astro、Express、Hono、Fastify 的指定入口，详见[入口及限制](./docs/reference-zh-CN.md#服务端入口)。
 
 ```powershell
-npx canship@0.8.0 --list-rules
+npx canship@0.8.1 --list-rules
 ```
 
 ## 审阅结果
@@ -47,11 +47,11 @@ npx canship@0.8.0 --list-rules
 每条结果标为 `certain`（静态证据充分）或 `likely`（需人工审阅），默认只显示 `certain`。两者都不代表凭据有效或问题可被利用。
 
 ```powershell
-npx canship@0.8.0 --all --verbose
+npx canship@0.8.1 --all --verbose
 ```
 
 ```powershell
-npx canship@0.8.0 --all --report
+npx canship@0.8.1 --all --report
 ```
 
 ![HTML 报告](https://raw.githubusercontent.com/Tasomei/canship/main/docs/images/report.png)
@@ -82,9 +82,9 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: Tasomei/canship@8ae4d5f4508fbd68fc2cf440e138c1217064a0e0
+      - uses: Tasomei/canship@8f09ad58fca369060e5333b325765ff7870aa92f
         with:
-          version: '0.8.0'
+          version: '0.8.1'
           honor-ignore-markers: false
 ```
 
@@ -92,7 +92,7 @@ jobs:
 
 | 输入 | 固定 Action 的默认值 | 含义 |
 |---|---|---|
-| `version` | `0.8.0` | 精确的 npm 扫描器版本；请如上例显式设置 |
+| `version` | `0.8.1` | 精确的 npm 扫描器版本；请如上例显式设置 |
 | `fail-on` | `blocking` | `blocking`：`certain` 的 P0/P1；`any`：全部结果；`none`：仅报告 |
 
 完整说明见 [Action 输入](https://github.com/Tasomei/canship/blob/main/action.yml)。

package/README.md

@@ -6,20 +6,20 @@ Static scans run locally: they are read-only, execute no project code and make n
 
 [简体中文](./README-zh-CN.md) · [Reference](./docs/reference.md) · [Releases](https://github.com/Tasomei/canship/releases) · [npm](https://www.npmjs.com/package/canship)
 
-> Documentation for `0.8.0` on npm `latest`. Other versions are listed under [Releases](https://github.com/Tasomei/canship/releases).
+> Documentation for `0.8.1` on npm `latest`. Other versions are listed under [Releases](https://github.com/Tasomei/canship/releases).
 
 ## Quick start
 
 Requires Node.js 18 or later; no runtime dependencies.
 
 ```powershell
-npx canship@0.8.0
+npx canship@0.8.1
 ```
 
 Scan a specific directory:
 
 ```powershell
-npx canship@0.8.0 "./my-app"
+npx canship@0.8.1 "./my-app"
 ```
 
 Example output for a synthetic project:
@@ -39,7 +39,7 @@ Example output for a synthetic project:
 Route analysis covers documented entry points in Next.js, SvelteKit, Nuxt, Remix / React Router, Astro, Express, Hono and Fastify. See [entry points and limits](./docs/reference.md#server-entry-points).
 
 ```powershell
-npx canship@0.8.0 --list-rules
+npx canship@0.8.1 --list-rules
 ```
 
 ## Reviewing findings
@@ -47,11 +47,11 @@ npx canship@0.8.0 --list-rules
 Each finding is rated `certain` (strong static evidence) or `likely` (needs review); only `certain` findings are shown by default. Neither rating proves that a credential is valid or that an issue is exploitable.
 
 ```powershell
-npx canship@0.8.0 --all --verbose
+npx canship@0.8.1 --all --verbose
 ```
 
 ```powershell
-npx canship@0.8.0 --all --report
+npx canship@0.8.1 --all --report
 ```
 
 ![HTML report](https://raw.githubusercontent.com/Tasomei/canship/main/docs/images/report.png)
@@ -82,9 +82,9 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: Tasomei/canship@8ae4d5f4508fbd68fc2cf440e138c1217064a0e0
+      - uses: Tasomei/canship@8f09ad58fca369060e5333b325765ff7870aa92f
         with:
-          version: '0.8.0'
+          version: '0.8.1'
           honor-ignore-markers: false
 ```
 
@@ -92,7 +92,7 @@ The commit hash pins the Action and `version` pins the npm scanner. The Action d
 
 | Input | Default in the pinned Action | Meaning |
 |---|---|---|
-| `version` | `0.8.0` | Exact npm scanner version; set explicitly as above |
+| `version` | `0.8.1` | Exact npm scanner version; set explicitly as above |
 | `fail-on` | `blocking` | `blocking`: `certain` P0/P1; `any`: all findings; `none`: report only |
 
 See all [Action inputs](https://github.com/Tasomei/canship/blob/main/action.yml).

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // <define:__CANSHIP_BUILD_INFO__>
-var define_CANSHIP_BUILD_INFO_default = { version: "0.8.0", channel: "release", revision: "0700a3d119573b1d13c5f5b60f4e93ab87244b35", dirty: false };
+var define_CANSHIP_BUILD_INFO_default = { version: "0.8.1", channel: "release", revision: "25d115c41e1a9a9455d19f448fc2265d87843b74", dirty: false };
 
 // src/cli.ts
 import { resolve as resolve7 } from "path";
@@ -8138,8 +8138,8 @@ var InputFlow = class {
     if (expr.length > MAX_EXPRESSION) this.limited = true;
     const text = expr.trim();
     if (text === "" || CLEAN_EXPRESSION.some((pattern) => pattern.test(text)) || isComparison(text)) return null;
-    const lookup = new RegExp(`^([A-Za-z_$][\\w$]*)\\s*\\[[^\\]]*\\]\\s*(?:(?:\\?\\?|\\|\\|)\\s*${LITERAL})?\\s*$`).exec(text);
-    if (lookup && this.isFixedTable(lookup[1], exprAt)) return null;
+    const lookup2 = new RegExp(`^([A-Za-z_$][\\w$]*)\\s*\\[[^\\]]*\\]\\s*(?:(?:\\?\\?|\\|\\|)\\s*${LITERAL})?\\s*$`).exec(text);
+    if (lookup2 && this.isFixedTable(lookup2[1], exprAt)) return null;
     const observed = expr.replace(/\[\s*['"][^'"]*['"]\s*\]/g, (part, offset) => {
       const raw = this.source.slice(exprAt + offset, exprAt + offset + part.length);
       const key = /^\[\s*['"]([A-Za-z_$][\w$]*)['"]\s*\]$/.exec(raw)?.[1];
@@ -11736,7 +11736,7 @@ function openReport(path, onError, options = {}) {
 }
 
 // src/build-info.ts
-var VERSION = true ? "0.8.0" : "0.0.0-dev";
+var VERSION = true ? "0.8.1" : "0.0.0-dev";
 var identity = typeof define_CANSHIP_BUILD_INFO_default === "object" ? define_CANSHIP_BUILD_INFO_default : { version: VERSION, channel: "development", revision: null, dirty: null };
 function getBuildInfo() {
   return { ...identity };
@@ -12072,7 +12072,7 @@ ${matrix}    runs-on: ubuntu-latest
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: Tasomei/canship@8ae4d5f4508fbd68fc2cf440e138c1217064a0e0
+      - uses: Tasomei/canship@8f09ad58fca369060e5333b325765ff7870aa92f
         with:
           version: '${version}'
 ${target}          honor-ignore-markers: false
@@ -12761,7 +12761,7 @@ function createProbePlan(input, expectAuth = false, canarySha256) {
 }
 
 // src/probe-network.ts
-import { Resolver } from "dns/promises";
+import { Resolver, lookup } from "dns/promises";
 import { isIP as isIP2 } from "net";
 import { Agent, request } from "https";
 import { createHash as createHash7 } from "crypto";
@@ -12778,10 +12778,38 @@ function checkProbeRuntime(env = process.env, args = process.execArgv) {
     throw new ProbeError("PROBE_RUNTIME_UNSUPPORTED", "Network tracing or TLS overrides are active. No probe was sent; use static scanning or an approved standard runtime.");
   }
 }
-async function resolveProbeAddresses(hostname, signal, createResolver = () => new Resolver({ timeout: PROBE_LIMITS.dnsTimeoutMs, tries: 1 })) {
+var DNS_FAILED = () => new ProbeError("PROBE_DNS_FAILED", "DNS resolution did not complete for the requested target.");
+var DNS_TIMEOUT = () => new ProbeError("PROBE_DNS_TIMEOUT", "DNS resolution exceeded the probe time limit.");
+var DNS_UNREACHABLE = ["ECONNREFUSED", "ETIMEOUT"];
+async function systemAddresses(hostname, signal, remainingMs, systemLookup) {
+  if (remainingMs <= 0) throw DNS_TIMEOUT();
+  let timer;
+  let onAbort;
+  try {
+    const entries = await Promise.race([
+      systemLookup(hostname).catch(() => {
+        throw DNS_FAILED();
+      }),
+      new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(DNS_TIMEOUT()), remainingMs);
+      }),
+      new Promise((_resolve, reject) => {
+        onAbort = () => reject(new ProbeError("PROBE_CANCELLED", "Probe cancelled; no complete validation result was produced."));
+        signal?.addEventListener("abort", onAbort, { once: true });
+      })
+    ]);
+    if (!Array.isArray(entries)) throw DNS_FAILED();
+    return entries.filter((entry) => entry && (entry.family === 4 || entry.family === 6) && typeof entry.address === "string").map((entry) => ({ address: entry.address, family: entry.family }));
+  } finally {
+    clearTimeout(timer);
+    if (onAbort) signal?.removeEventListener("abort", onAbort);
+  }
+}
+async function resolveProbeAddresses(hostname, signal, createResolver = () => new Resolver({ timeout: PROBE_LIMITS.dnsTimeoutMs, tries: 1 }), systemLookup = (name) => lookup(name, { all: true, verbatim: true })) {
   checkProbeCancelled(signal);
   const literal2 = isIP2(hostname);
   if (literal2 === 4 || literal2 === 6) return [{ address: hostname, family: literal2 }];
+  const started = Date.now();
   const resolver = createResolver();
   let timedOut = false, stopped = false;
   const cancel = () => {
@@ -12807,11 +12835,14 @@ async function resolveProbeAddresses(hostname, signal, createResolver = () => ne
       })
     ]);
     checkProbeCancelled(signal);
-    if (timedOut) throw new ProbeError("PROBE_DNS_TIMEOUT", "DNS resolution exceeded the probe time limit.");
+    if (timedOut) throw DNS_TIMEOUT();
+    if (a.status === "rejected" && aaaa.status === "rejected" && [a.reason?.code, aaaa.reason?.code].every((code) => DNS_UNREACHABLE.includes(String(code)))) {
+      return await systemAddresses(hostname, signal, PROBE_LIMITS.dnsTimeoutMs - (Date.now() - started), systemLookup);
+    }
     const addresses = [];
     for (const [result, family] of [[a, 4], [aaaa, 6]]) {
       if (result.status === "fulfilled") addresses.push(...result.value.map((address) => ({ address, family })));
-      else if (!["ENODATA", "ENOTFOUND"].includes(String(result.reason?.code))) throw new ProbeError("PROBE_DNS_FAILED", "DNS resolution did not complete for the requested target.");
+      else if (!["ENODATA", "ENOTFOUND"].includes(String(result.reason?.code))) throw DNS_FAILED();
     }
     return addresses;
   } finally {

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // <define:__CANSHIP_BUILD_INFO__>
-var define_CANSHIP_BUILD_INFO_default = { version: "0.8.0", channel: "release", revision: "0700a3d119573b1d13c5f5b60f4e93ab87244b35", dirty: false };
+var define_CANSHIP_BUILD_INFO_default = { version: "0.8.1", channel: "release", revision: "25d115c41e1a9a9455d19f448fc2265d87843b74", dirty: false };
 
 // src/index.ts
 import { statSync as statSync3 } from "fs";
@@ -9987,7 +9987,7 @@ function summarize(result) {
 }
 
 // src/build-info.ts
-var VERSION = true ? "0.8.0" : "0.0.0-dev";
+var VERSION = true ? "0.8.1" : "0.0.0-dev";
 var identity = typeof define_CANSHIP_BUILD_INFO_default === "object" ? define_CANSHIP_BUILD_INFO_default : { version: VERSION, channel: "development", revision: null, dirty: null };
 function getBuildInfo() {
   return { ...identity };

package/docs/reference-zh-CN.md

@@ -2,7 +2,7 @@
 
 [概览](../README-zh-CN.md) · [English](./reference.md)
 
-本文对应 `0.8.0`。其他版本见[发布说明](https://github.com/Tasomei/canship/releases)。
+本文对应 `0.8.1`。其他版本见[发布说明](https://github.com/Tasomei/canship/releases)。
 
 ## 服务端入口
 
@@ -129,11 +129,11 @@ OpenAPI 配置支持内联对象、常量及静态 ESM 导入与重导出，路
 
 `--probe=https://app.example.com/status` 预览 HEAD 和携带固定测试 Origin 的 OPTIONS 请求。使用前替换为获授权的目标。审阅目标、限制及隐私提示后，保留原选项并附加展示的 `--confirm-probe` 摘要执行。摘要仅绑定选项，不证明域名所有权。此独立 CLI 模式支持 `--json`，不读取项目配置，也不会让 `scan()` 或编辑器自动联网。
 
-仅接受 443 端口的 HTTPS 和简单字面路径，不支持凭据、查询、片段或路径编码。DNS 返回的地址须全部为普通公网地址；连接固定到已验证地址，并保留主机名及 TLS 校验。不跟随重定向，不携带认证信息。检测到代理、网络调试或不安全 TLS 选项时拒绝执行，不绕过配置。DNS 限时 3 秒，单请求 5 秒，响应头上限 16 KiB。
+仅接受 443 端口的 HTTPS 和简单字面路径，不支持凭据、查询、片段或路径编码。DNS 返回的地址须全部为普通公网地址。若 A 与 AAAA 查询都无法连接配置的 DNS 服务器（常见于 VPN 或代理的虚拟网卡），在同一时限内改用系统解析器；否定回答不回退。连接固定到已验证地址，并保留主机名及 TLS 校验。不跟随重定向，不携带认证信息。检测到代理、网络调试或不安全 TLS 选项时拒绝执行，不绕过配置。DNS 限时 3 秒，单请求 5 秒，响应头上限 16 KiB。
 
 可选 `--probe-canary-sha256` 仅对名为 `canship-canary`、`canship-canary.txt` 或 `canship-canary.json` 的资源增加 GET。资源须为 16–4096 字节的专用合成内容；正文仅在内存中计算散列，报告只保留匹配状态与字节数，不保留正文或计算出的摘要。压缩或超限正文判失败。不支持 Supabase/Firebase 管理员密钥或业务记录导出。
 
-执行会向目标暴露连接 IP 和请求路径，请求仍可能有副作用。响应头、状态码及 canary 可读性均不证明整体应用安全。预览退出 `0`；执行完成且无待审阅观察时退出 `0`，需审阅时退出 `2`，参数无效或执行不完整时退出 `3`。JSON 使用 `probe-plan` 或 `probe-report`，不属于扫描报告格式。真实目标验收尚未完成。
+执行会向目标暴露连接 IP 和请求路径，请求仍可能有副作用。响应头、状态码及 canary 可读性均不证明整体应用安全。预览退出 `0`；执行完成且无待审阅观察时退出 `0`，需审阅时退出 `2`，参数无效或执行不完整时退出 `3`。JSON 使用 `probe-plan` 或 `probe-report`，不属于扫描报告格式。已在专用 GitHub Pages 目标上完成验收，覆盖 HEAD、OPTIONS、canary 匹配与不匹配、期望拒绝的复核提示及不跟随重定向。
 
 地址策略依据：[IANA IPv4](https://www.iana.org/assignments/iana-ipv4-special-registry)、[IANA IPv6](https://www.iana.org/assignments/iana-ipv6-special-registry)及 [Azure 平台地址](https://learn.microsoft.com/en-us/azure/virtual-network/what-is-ip-address-168-63-129-16)。应用层过滤不能替代网络出口控制。
 

package/docs/reference.md

@@ -2,7 +2,7 @@
 
 [Overview](../README.md) · [简体中文](./reference-zh-CN.md)
 
-This reference covers `0.8.0`. Other versions are listed under [Releases](https://github.com/Tasomei/canship/releases).
+This reference covers `0.8.1`. Other versions are listed under [Releases](https://github.com/Tasomei/canship/releases).
 
 ## Server entry points
 
@@ -129,11 +129,11 @@ Default paths are relative to the scan directory; explicit paths are relative to
 
 `--probe=https://app.example.com/status` previews two requests: HEAD and OPTIONS with a fixed probe Origin. Replace the example with an authorized target. Review the target, limits and privacy notice; repeat the same options with the displayed `--confirm-probe` digest to execute. The digest binds options, not domain ownership. This standalone CLI mode supports `--json`; it never reads project configuration or enables networking in `scan()` or the editor.
 
-Only HTTPS on port 443 with a simple literal path is accepted: no credentials, queries, fragments or encoded path components. DNS answers must all be ordinary public addresses; connections are pinned while preserving hostname/TLS verification. No redirects or authenticated requests are made. Configured proxies, network debug settings and insecure TLS overrides are refused rather than bypassed. Limits: DNS 3 seconds, each request 5 seconds, response headers 16 KiB.
+Only HTTPS on port 443 with a simple literal path is accepted: no credentials, queries, fragments or encoded path components. DNS answers must all be ordinary public addresses. If both A and AAAA queries cannot reach the configured DNS servers (common with VPN or proxy adapters), the system resolver is used within the same time limit; negative answers do not fall back. Connections are pinned while preserving hostname/TLS verification. No redirects or authenticated requests are made. Configured proxies, network debug settings and insecure TLS overrides are refused rather than bypassed. Limits: DNS 3 seconds, each request 5 seconds, response headers 16 KiB.
 
 Optional `--probe-canary-sha256` adds GET only for a resource named `canship-canary`, `canship-canary.txt` or `canship-canary.json`. Use dedicated synthetic content of 16–4096 bytes. The response is hashed in memory; only match state and byte count are reported, never the body or computed digest. Compressed and oversized bodies fail. No Supabase/Firebase admin key or business-record export is supported.
 
-Execution reveals the connecting IP and requested path to the target; requests can have side effects. Header presence, status codes and a readable canary do not prove general application security. Preview exits `0`; execution exits `0` for completed requests without review items, `2` for observations requiring review, or `3` for invalid/incomplete execution. JSON uses `probe-plan` or `probe-report`, not the scan-report schema. Live-target acceptance remains pending.
+Execution reveals the connecting IP and requested path to the target; requests can have side effects. Header presence, status codes and a readable canary do not prove general application security. Preview exits `0`; execution exits `0` for completed requests without review items, `2` for observations requiring review, or `3` for invalid/incomplete execution. JSON uses `probe-plan` or `probe-report`, not the scan-report schema. Acceptance has been run against a dedicated GitHub Pages target, covering HEAD, OPTIONS, canary matching and mismatch, expected-denial review and an unfollowed redirect.
 
 Address policy references: [IANA IPv4](https://www.iana.org/assignments/iana-ipv4-special-registry), [IANA IPv6](https://www.iana.org/assignments/iana-ipv6-special-registry), and [Azure platform address](https://learn.microsoft.com/en-us/azure/virtual-network/what-is-ip-address-168-63-129-16). Application filtering does not replace network egress controls.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "canship",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Pre-deployment security checks for JS/TS web apps: offline static scanning for credentials, access rules and unsafe request input, with opt-in deployment probes.",
   "keywords": [
     "security",