corpus-cli 0.1.0

package/dist/commands/report.js

@@ -0,0 +1,93 @@
+import { readPolicyFile, readEnvFile } from '../utils/config.js';
+import { green, amber, red, dim, bold, cyan } from '../utils/colors.js';
+import { progressBar } from '../utils/table.js';
+export async function runReport() {
+    const args = process.argv.slice(3);
+    if (args.includes('--help') || args.includes('-h')) {
+        process.stdout.write(`
+  corpus report
+
+  Fetch and display trust-score statistics for your project from the
+  Corpus API (last 30 days). Requires a corpus.policy.yaml with an
+  agent name and an optional .env.corpus with CORPUS_API_ENDPOINT.
+
+  Options:
+    --help    Show this help
+
+  Examples:
+    corpus report
+
+`);
+        return;
+    }
+    const policy = readPolicyFile();
+    if (!policy) {
+        process.stdout.write(red('  No corpus.policy.yaml found. Run corpus init first.\n'));
+        process.exit(1);
+    }
+    const env = readEnvFile();
+    const slug = String(policy.agent ?? 'unknown');
+    const endpoint = env.CORPUS_API_ENDPOINT ?? 'https://corpus.run';
+    process.stdout.write('\n');
+    process.stdout.write(bold(`  CORPUS REPORT   ${cyan(slug)}   last 30 days\n`));
+    process.stdout.write('  ' + '\u2550'.repeat(51) + '\n\n');
+    // Fetch stats
+    try {
+        const url = `${endpoint}/api/project/${slug}`;
+        const res = await fetch(url);
+        if (!res.ok) {
+            if (res.status === 404) {
+                process.stdout.write(`  Project '${slug}' not found on ${endpoint}\n`);
+                process.stdout.write(`  Start sending events with the SDK to see data here.\n\n`);
+                return;
+            }
+            process.stdout.write(red(`  API returned ${res.status}\n`));
+            process.exit(1);
+        }
+        const data = await res.json();
+        const s = data.stats;
+        // Pass rate bar
+        const barColor = s.passRate >= 95 ? green : s.passRate >= 80 ? amber : red;
+        process.stdout.write(`  Pass rate      ${barColor(s.passRate.toFixed(1) + '%')}   ${barColor(progressBar(s.passRate))}\n`);
+        process.stdout.write(`  Total actions  ${s.totalRuns.toLocaleString()}\n`);
+        process.stdout.write(`  Confirmed      ${s.confirmCount}      ${dim('user saw and approved')}\n`);
+        process.stdout.write(`  Blocked        ${s.blockCount}       ${dim('stopped by hard policy')}\n`);
+        process.stdout.write(`  Cancelled      ${s.cancelledCount}       ${dim('user saw and declined')}\n`);
+        // Policy breakdown
+        if (data.policyBreakdown.length > 0) {
+            process.stdout.write('\n');
+            process.stdout.write(bold('  POLICY BREAKDOWN\n'));
+            for (const p of data.policyBreakdown) {
+                const pColor = p.passRate >= 95 ? green : p.passRate >= 80 ? amber : red;
+                const name = p.policyTriggered.padEnd(22);
+                const extra = [];
+                if (p.blockCount > 0)
+                    extra.push(`${p.blockCount} blocked`);
+                if (p.confirmCount > 0)
+                    extra.push(`${p.confirmCount} confirmed`);
+                const detail = extra.length > 0 ? `[${extra.join(', ')}]` : '';
+                process.stdout.write(`  ${name} ${pColor(p.passRate + '%')}   (${p.totalRuns} runs)   ${dim(detail)}\n`);
+            }
+        }
+        // Recent activity
+        if (data.recentActivity.length > 0) {
+            process.stdout.write('\n');
+            process.stdout.write(bold('  RECENT ACTIVITY (last 10)\n'));
+            for (const a of data.recentActivity.slice(0, 10)) {
+                const vColor = a.verdict === 'PASS' ? green : a.verdict === 'BLOCK' ? red : amber;
+                const verdict = vColor(a.verdict.padEnd(8));
+                const action = a.actionType.padEnd(18).slice(0, 18);
+                const policy = a.policyTriggered.padEnd(16).slice(0, 16);
+                const dur = `${a.durationMs}ms`.padStart(6);
+                process.stdout.write(`  ${verdict} ${action} ${policy} ${dur}\n`);
+            }
+        }
+        process.stdout.write('\n');
+        process.stdout.write(dim(`  View full dashboard: ${endpoint}/${slug}\n`));
+        process.stdout.write('\n');
+    }
+    catch (e) {
+        process.stdout.write(red(`  Failed to fetch stats: ${e instanceof Error ? e.message : String(e)}\n`));
+        process.exit(1);
+    }
+}

package/dist/commands/scan.d.ts

@@ -0,0 +1 @@
+export declare function runScan(): Promise<void>;

package/dist/commands/scan.js

@@ -0,0 +1,481 @@
+import { readFileSync, writeFileSync, readdirSync, statSync, existsSync } from 'fs';
+import { execSync } from 'child_process';
+import path from 'path';
+import { green, amber, red, dim, bold } from '../utils/colors.js';
+import { checkForCVEs } from '@corpus/core';
+import { checkDependencies } from '@corpus/core';
+// ── Secret detection patterns ────────────────────────────────────────────────
+const SECRET_PATTERNS = [
+    { name: 'AWS Access Key', regex: /AKIA[0-9A-Z]{16}/g, severity: 'CRITICAL' },
+    { name: 'GitHub Token', regex: /gh[pousr]_[A-Za-z0-9_]{36,255}/g, severity: 'CRITICAL' },
+    { name: 'OpenAI Key', regex: /sk-[A-Za-z0-9]{20,}/g, severity: 'CRITICAL' },
+    { name: 'Anthropic Key', regex: /sk-ant-[A-Za-z0-9-]{20,}/g, severity: 'CRITICAL' },
+    { name: 'Stripe Key', regex: /[sr]k_live_[A-Za-z0-9]{20,}/g, severity: 'CRITICAL' },
+    { name: 'Database URL', regex: /(?:postgres|mysql|mongodb|redis):\/\/[^\s'"]+:[^\s'"]+@[^\s'"]+/g, severity: 'CRITICAL' },
+    { name: 'Private Key', regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g, severity: 'CRITICAL' },
+    { name: 'Slack Token', regex: /xox[baprs]-[0-9a-zA-Z-]{10,}/g, severity: 'CRITICAL' },
+    { name: 'SendGrid Key', regex: /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g, severity: 'CRITICAL' },
+    { name: 'Generic Secret', regex: /(?:api_key|apikey|api_secret|secret_key|auth_token|access_token)\s*[=:]\s*['"]([A-Za-z0-9_\-]{16,})['"]/gi, severity: 'WARNING' },
+    { name: 'Password', regex: /(?:password|passwd|pwd)\s*[=:]\s*['"]([^'"]{8,})['"]/gi, severity: 'WARNING' },
+];
+const PLACEHOLDER_SKIP = [
+    /^sk-(?:test|fake|dummy|placeholder|example|xxx|your)/i,
+    /^(?:test|fake|dummy|placeholder|example|changeme|TODO|your_)/i,
+    /^(?:xxx|aaa|123|abc)/i,
+    /<[A-Z_]+>/,
+    /^pk_test_/,
+];
+// AI-specific patterns
+const AI_PATTERNS = [
+    { name: 'Inlined Env Var', regex: /(?:const|let|var)\s+\w+\s*=\s*['"](?:postgres|mysql|mongodb|redis|https?):\/\/[^'"]+['"]/g, severity: 'WARNING', message: 'URL hardcoded instead of read from environment variable' },
+    { name: 'Disabled SSL', regex: /rejectUnauthorized\s*:\s*false/g, severity: 'INFO', message: 'SSL verification disabled' },
+    { name: 'Wildcard CORS', regex: /(?:cors|origin)\s*[=:]\s*['"]\*['"]/gi, severity: 'WARNING', message: 'CORS set to wildcard (*)' },
+    { name: 'chmod 777', regex: /chmod\s+777/g, severity: 'WARNING', message: 'Overly permissive file permissions' },
+    { name: 'eval()', regex: /\beval\s*\(/g, severity: 'CRITICAL', message: 'eval() enables arbitrary code execution' },
+    { name: 'Debug Endpoint', regex: /(?:app|router)\.\s*(?:get|post|use)\s*\(\s*['"]\/(?:debug|test|admin)/g, severity: 'WARNING', message: 'Debug/admin endpoint may be accessible in production' },
+];
+// PII patterns
+const PII_PATTERNS = [
+    { name: 'Email', regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g },
+    { name: 'SSN', regex: /\b\d{3}-\d{2}-\d{4}\b/g },
+    { name: 'Credit Card', regex: /\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b/g },
+];
+// Injection patterns
+const INJECTION_PATTERNS = [
+    'ignore previous instructions', 'ignore all previous', 'you are now',
+    'system prompt', 'developer mode', 'jailbreak', 'bypass safety',
+    'override:', 'new instructions:', 'forget everything',
+];
+// ── File scanning ────────────────────────────────────────────────────────────
+function isPlaceholder(val) {
+    return PLACEHOLDER_SKIP.some((p) => p.test(val));
+}
+function isTestFile(f) {
+    const l = f.toLowerCase();
+    return l.includes('test') || l.includes('spec') || l.includes('mock') || l.includes('fixture') || l.includes('__tests__');
+}
+function isScannable(f) {
+    const ext = path.extname(f).toLowerCase();
+    const name = path.basename(f).toLowerCase();
+    const codeExts = ['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.py', '.go', '.rs', '.java', '.kt', '.swift', '.rb', '.php', '.c', '.cpp', '.h', '.cs', '.json', '.yaml', '.yml', '.toml', '.sh', '.bash', '.sql', '.tf', '.hcl', '.xml', '.vue', '.svelte', '.ini', '.cfg', '.conf', '.plist', '.md'];
+    return codeExts.includes(ext) || name.startsWith('.env') || name === 'dockerfile' || name === 'makefile';
+}
+function getFilesToScan(paths, staged) {
+    if (staged) {
+        try {
+            const output = execSync('git diff --cached --name-only --diff-filter=ACMR', { encoding: 'utf-8' });
+            return output.trim().split('\n').filter((f) => f && isScannable(f));
+        }
+        catch {
+            return [];
+        }
+    }
+    const files = [];
+    for (const p of paths) {
+        if (!existsSync(p))
+            continue;
+        const stat = statSync(p);
+        if (stat.isFile() && isScannable(p)) {
+            files.push(p);
+        }
+        else if (stat.isDirectory()) {
+            walkDir(p, files);
+        }
+    }
+    return files;
+}
+function walkDir(dir, files) {
+    const skip = ['node_modules', '.git', 'dist', '.next', '__pycache__', '.venv', 'venv'];
+    try {
+        for (const entry of readdirSync(dir)) {
+            if (skip.includes(entry))
+                continue;
+            const full = path.join(dir, entry);
+            try {
+                const stat = statSync(full);
+                if (stat.isDirectory())
+                    walkDir(full, files);
+                else if (stat.isFile() && isScannable(full))
+                    files.push(full);
+            }
+            catch { /* permission errors */ }
+        }
+    }
+    catch { /* permission errors */ }
+}
+function scanFile(filepath, opts) {
+    const findings = [];
+    let content;
+    try {
+        content = readFileSync(filepath, 'utf-8');
+    }
+    catch {
+        return findings;
+    }
+    if (isTestFile(filepath))
+        return findings;
+    // Secrets
+    if (opts.secrets) {
+        for (const pat of SECRET_PATTERNS) {
+            pat.regex.lastIndex = 0;
+            let m;
+            while ((m = pat.regex.exec(content)) !== null) {
+                const val = m[1] ?? m[0];
+                if (isPlaceholder(val))
+                    continue;
+                const line = content.slice(0, m.index).split('\n').length;
+                findings.push({
+                    severity: pat.severity,
+                    type: pat.name,
+                    file: filepath,
+                    line,
+                    message: `${pat.name} detected`,
+                    value: val.length > 12 ? val.slice(0, 6) + '...' + val.slice(-4) : '***',
+                });
+            }
+        }
+        // AI patterns
+        for (const pat of AI_PATTERNS) {
+            pat.regex.lastIndex = 0;
+            let m;
+            while ((m = pat.regex.exec(content)) !== null) {
+                const line = content.slice(0, m.index).split('\n').length;
+                findings.push({
+                    severity: pat.severity,
+                    type: pat.name,
+                    file: filepath,
+                    line,
+                    message: pat.message,
+                    isAiPattern: true,
+                });
+            }
+        }
+    }
+    // PII
+    if (opts.pii) {
+        for (const pat of PII_PATTERNS) {
+            pat.regex.lastIndex = 0;
+            let m;
+            while ((m = pat.regex.exec(content)) !== null) {
+                const line = content.slice(0, m.index).split('\n').length;
+                findings.push({
+                    severity: 'WARNING',
+                    type: `PII: ${pat.name}`,
+                    file: filepath,
+                    line,
+                    message: `${pat.name} found in source code`,
+                });
+            }
+        }
+    }
+    // Injection
+    if (opts.injection) {
+        const lower = content.toLowerCase();
+        for (const pattern of INJECTION_PATTERNS) {
+            if (lower.includes(pattern)) {
+                const idx = lower.indexOf(pattern);
+                const line = content.slice(0, idx).split('\n').length;
+                findings.push({
+                    severity: 'CRITICAL',
+                    type: 'Injection Pattern',
+                    file: filepath,
+                    line,
+                    message: `Prompt injection pattern found: "${pattern}"`,
+                });
+            }
+        }
+    }
+    // CVE patterns
+    if (opts.safety) {
+        try {
+            const cveFindings = checkForCVEs(content, filepath);
+            for (const cve of cveFindings) {
+                findings.push({
+                    severity: cve.severity === 'HIGH' ? 'CRITICAL' : cve.severity === 'MEDIUM' ? 'WARNING' : cve.severity,
+                    type: `CVE: ${cve.cveId}`,
+                    file: filepath,
+                    line: cve.line,
+                    message: `${cve.name}: ${cve.description}`,
+                    suggestion: cve.fixExample,
+                });
+            }
+        }
+        catch { }
+    }
+    return findings;
+}
+// ── Output formatting ────────────────────────────────────────────────────────
+function formatPretty(findings, fileCount, timeMs) {
+    const critical = findings.filter((f) => f.severity === 'CRITICAL');
+    const warning = findings.filter((f) => f.severity === 'WARNING');
+    const info = findings.filter((f) => f.severity === 'INFO');
+    process.stdout.write('\n');
+    process.stdout.write(bold(`  CORPUS SCAN  ${fileCount} files scanned in ${(timeMs / 1000).toFixed(1)}s\n`));
+    process.stdout.write('  ' + '\u2550'.repeat(46) + '\n\n');
+    if (findings.length === 0) {
+        process.stdout.write(green('  No issues found. Your code is clean.\n\n'));
+        return;
+    }
+    for (const f of findings) {
+        const sev = f.severity === 'CRITICAL' ? red('CRITICAL') :
+            f.severity === 'WARNING' ? amber('WARNING ') :
+                dim('INFO    ');
+        const ai = f.isAiPattern ? amber(' [AI]') : '';
+        process.stdout.write(`  ${sev}  ${f.file}:${f.line}${ai}\n`);
+        process.stdout.write(`    ${f.message}\n`);
+        if (f.value)
+            process.stdout.write(`    Value: ${dim(f.value)}\n`);
+        if (f.suggestion)
+            process.stdout.write(`    Fix: ${dim(f.suggestion)}\n`);
+        process.stdout.write('\n');
+    }
+    const summary = [];
+    if (critical.length > 0)
+        summary.push(red(`${critical.length} critical`));
+    if (warning.length > 0)
+        summary.push(amber(`${warning.length} warning`));
+    if (info.length > 0)
+        summary.push(dim(`${info.length} info`));
+    process.stdout.write(`  ${summary.join(', ')}\n\n`);
+}
+function formatJson(findings, fileCount, timeMs) {
+    process.stdout.write(JSON.stringify({
+        scannedFiles: fileCount,
+        scanTimeMs: timeMs,
+        findings: findings.map((f) => ({
+            severity: f.severity,
+            type: f.type,
+            file: f.file,
+            line: f.line,
+            message: f.message,
+            isAiPattern: f.isAiPattern ?? false,
+        })),
+        summary: {
+            critical: findings.filter((f) => f.severity === 'CRITICAL').length,
+            warning: findings.filter((f) => f.severity === 'WARNING').length,
+            info: findings.filter((f) => f.severity === 'INFO').length,
+        },
+    }, null, 2) + '\n');
+}
+// ── Auto-fix ─────────────────────────────────────────────────────────────────
+function autoFix(findings) {
+    // Types that have actual auto-fix logic implemented
+    const AUTO_FIXABLE_TYPES = new Set(['Disabled SSL', 'Wildcard CORS']);
+    // Types that look fixable but require manual intervention
+    const MANUAL_FIX_TYPES = new Set(['Generic Secret', 'Password', 'Inlined Env Var']);
+    const fixable = findings.filter((f) => AUTO_FIXABLE_TYPES.has(f.type));
+    const manualOnly = findings.filter((f) => MANUAL_FIX_TYPES.has(f.type));
+    if (fixable.length === 0 && manualOnly.length === 0) {
+        process.stdout.write(dim('  No auto-fixable issues found.\n'));
+        process.stdout.write(dim('  Auto-fix works on: disabled SSL, wildcard CORS.\n\n'));
+        return;
+    }
+    if (manualOnly.length > 0) {
+        process.stdout.write(dim(`  ${manualOnly.length} issue(s) require manual fix (Generic Secret, Password, Inlined Env Var).\n`));
+    }
+    if (fixable.length === 0) {
+        process.stdout.write(dim('  No auto-fixable issues found.\n\n'));
+        return;
+    }
+    process.stdout.write(bold(`  AUTO-FIX: ${fixable.length} fixable issue(s)\n\n`));
+    // Group by file
+    const byFile = new Map();
+    for (const f of fixable) {
+        if (!byFile.has(f.file))
+            byFile.set(f.file, []);
+        byFile.get(f.file).push(f);
+    }
+    let fixed = 0;
+    const envEntries = [];
+    for (const [filepath, fileFindings] of byFile) {
+        let content = readFileSync(filepath, 'utf-8');
+        const lines = content.split('\n');
+        for (const finding of fileFindings) {
+            if (finding.type === 'Disabled SSL') {
+                // Replace rejectUnauthorized: false with true
+                content = content.replace(/rejectUnauthorized\s*:\s*false/g, 'rejectUnauthorized: true');
+                process.stdout.write(`  ${green('\u2714')} ${filepath}:${finding.line} - Enabled SSL verification\n`);
+                fixed++;
+            }
+            else if (finding.type === 'Wildcard CORS') {
+                // Replace wildcard with env var reference
+                content = content.replace(/((?:cors|origin)\s*[=:]\s*)['"]?\*['"]?/gi, '$1process.env.CORS_ORIGIN || "http://localhost:3000"');
+                envEntries.push('CORS_ORIGIN=http://localhost:3000');
+                process.stdout.write(`  ${green('\u2714')} ${filepath}:${finding.line} - Replaced wildcard CORS with env var\n`);
+                fixed++;
+            }
+        }
+        writeFileSync(filepath, content);
+    }
+    // Write env entries if any
+    if (envEntries.length > 0) {
+        const envPath = '.env';
+        let envContent = '';
+        if (existsSync(envPath)) {
+            envContent = readFileSync(envPath, 'utf-8');
+        }
+        for (const entry of envEntries) {
+            const key = entry.split('=')[0];
+            if (!envContent.includes(key)) {
+                envContent += `\n# Added by corpus scan --fix\n${entry}\n`;
+            }
+        }
+        writeFileSync(envPath, envContent);
+    }
+    process.stdout.write(`\n  ${green(`${fixed} issue(s) auto-fixed.`)}\n`);
+    if (fixed < fixable.length) {
+        process.stdout.write(dim(`  ${fixable.length - fixed} issue(s) need manual review.\n`));
+    }
+    process.stdout.write('\n');
+}
+// ── Main ─────────────────────────────────────────────────────────────────────
+export async function runScan() {
+    const args = process.argv.slice(3);
+    const opts = {
+        paths: ['.'],
+        format: 'pretty',
+        staged: false,
+        secrets: false,
+        pii: false,
+        injection: false,
+        safety: false,
+        fix: false,
+        cve: false,
+        deps: false,
+    };
+    // Parse args — individual flags are collected first; if none are set we
+    // default to scanning everything.
+    let anyFilterFlag = false;
+    const paths = [];
+    for (let i = 0; i < args.length; i++) {
+        switch (args[i]) {
+            case '--format':
+                opts.format = args[++i] ?? 'pretty';
+                break;
+            case '--staged':
+                opts.staged = true;
+                break;
+            case '--json':
+                opts.format = 'json';
+                break;
+            case '--fix':
+                opts.fix = true;
+                break;
+            case '--secrets':
+                opts.secrets = true;
+                anyFilterFlag = true;
+                break;
+            case '--pii':
+                opts.pii = true;
+                anyFilterFlag = true;
+                break;
+            case '--injection':
+                opts.injection = true;
+                anyFilterFlag = true;
+                break;
+            case '--cve':
+                opts.cve = true;
+                anyFilterFlag = true;
+                break;
+            case '--deps':
+                opts.deps = true;
+                anyFilterFlag = true;
+                break;
+            case '--help':
+            case '-h':
+                process.stdout.write(`
+  corpus scan [paths...] [options]
+
+  Scan files for secrets, PII, injection patterns, and unsafe code.
+
+  Options:
+    --staged       Scan only git staged files (for pre-commit hooks)
+    --fix          Auto-fix: replace hardcoded secrets with env var references
+    --json         Output as JSON
+    --secrets      Scan for secrets only
+    --pii          Scan for PII only
+    --injection    Scan for injection patterns only
+    --cve          Scan for CVE-linked vulnerability patterns
+    --deps         Check imports for hallucinated/typosquatted packages
+    --format <fmt> Output format: pretty (default) or json
+    --help         Show this help
+
+  Examples:
+    corpus scan                  Scan current directory
+    corpus scan src/ config/     Scan specific directories
+    corpus scan --staged         Scan staged git changes (pre-commit)
+    corpus scan --fix            Scan and auto-fix secrets
+    corpus scan --json           Machine-readable output for CI
+
+`);
+                return;
+            default:
+                if (!args[i].startsWith('-'))
+                    paths.push(args[i]);
+        }
+    }
+    // If no filter flags were provided, enable all scan categories (default).
+    if (!anyFilterFlag) {
+        opts.secrets = true;
+        opts.pii = true;
+        opts.injection = true;
+        opts.safety = true;
+        opts.cve = true;
+        opts.deps = true;
+    }
+    if (paths.length > 0)
+        opts.paths = paths;
+    const start = Date.now();
+    const files = getFilesToScan(opts.paths, opts.staged);
+    if (files.length === 0) {
+        if (opts.format === 'json') {
+            process.stdout.write(JSON.stringify({ scannedFiles: 0, findings: [], summary: { critical: 0, warning: 0, info: 0 } }) + '\n');
+        }
+        else {
+            process.stdout.write(dim('\n  No scannable files found.\n\n'));
+        }
+        return;
+    }
+    const allFindings = [];
+    for (const filepath of files) {
+        allFindings.push(...scanFile(filepath, opts));
+    }
+    // Dependency checking (async - runs after file scan)
+    if (opts.deps) {
+        for (const filepath of files) {
+            try {
+                const content = readFileSync(filepath, 'utf-8');
+                const depFindings = await checkDependencies(content, filepath, { projectRoot: opts.paths[0] || '.' });
+                for (const d of depFindings) {
+                    allFindings.push({
+                        severity: d.severity,
+                        type: `Hallucinated Dep: ${d.package}`,
+                        file: filepath,
+                        line: d.line,
+                        message: `Package '${d.package}' ${d.reason === 'nonexistent' ? 'does not exist on npm' : d.reason === 'typosquat' ? 'may be a typosquat' : 'is suspiciously unpopular'}`,
+                        suggestion: d.suggestion,
+                    });
+                }
+            }
+            catch { }
+        }
+    }
+    const timeMs = Date.now() - start;
+    if (opts.format === 'json') {
+        formatJson(allFindings, files.length, timeMs);
+    }
+    else {
+        formatPretty(allFindings, files.length, timeMs);
+    }
+    // Auto-fix mode
+    if (opts.fix && allFindings.length > 0) {
+        autoFix(allFindings);
+    }
+    // Exit code: 2 for critical, 1 for warnings, 0 for clean
+    const hasCritical = allFindings.some((f) => f.severity === 'CRITICAL');
+    const hasWarning = allFindings.some((f) => f.severity === 'WARNING');
+    if (hasCritical)
+        process.exit(2);
+    if (hasWarning)
+        process.exit(1);
+}

package/dist/commands/verify.d.ts

@@ -0,0 +1 @@
+export declare function runVerify(): Promise<void>;