correctover-scan 1.5.0 → 1.6.0

package/core/license.js

@@ -1,11 +1,7 @@
 /**
- * License validator — freemium hook model.
- *
- * Free: unlimited scanning (see all risks)
- * Pro: fix recommendations, auto-heal, reports, history
- *
- * The hook: users see ALL their problems for free.
- * The paywall: solutions are locked.
+ * License validator for correctover-scan NPM.
+ * Mirrors the Python LicenseValidator: 50 free scans/day, CORRECTOVER_LICENSE_KEY unlocks.
+ * Supports CV-TRL/CV-PRO (FC) and COV- (Cloud) key formats.
  */
 
 const fs = require('fs');
@@ -13,8 +9,8 @@ const path = require('path');
 const crypto = require('crypto');
 const os = require('os');
 
+const FREE_LIMIT_PER_DAY = 50;
 const STATE_FILE = path.join(os.homedir(), '.correctover', 'license.json');
-const FREE_FIX_PREVIEW = 2;
 
 function loadState() {
   try {
@@ -22,7 +18,7 @@ function loadState() {
       return JSON.parse(fs.readFileSync(STATE_FILE, 'utf-8'));
     }
   } catch (e) {}
-  return { products: {}, license_key: null, installed_at: Date.now() / 1000, scan_history: [] };
+  return { products: {}, license_key: null, installed_at: Date.now() / 1000 };
 }
 
 function saveState(state) {
@@ -33,8 +29,13 @@ function saveState(state) {
 }
 
 function getProductState(state, product) {
+  const today = new Date().toISOString().slice(0, 10);
   if (!state.products[product]) {
-    state.products[product] = { total_scans: 0, total_risks_found: 0, first_scan: Date.now()/1000, last_scan: null };
+    state.products[product] = { calls_today: 0, date: today, total_calls: 0 };
+  }
+  if (state.products[product].date !== today) {
+    state.products[product].calls_today = 0;
+    state.products[product].date = today;
   }
   return state.products[product];
 }
@@ -42,6 +43,7 @@ function getProductState(state, product) {
 function verifyLicenseKey(key) {
   if (!key || key.length < 12) return false;
 
+  // COV-<product>-<hash> (Cloud HMAC)
   if (key.startsWith('COV-')) {
     const parts = key.split('-');
     if (parts.length < 3) return false;
@@ -51,6 +53,7 @@ function verifyLicenseKey(key) {
     return parts[parts.length - 1].startsWith(expected);
   }
 
+  // CV-TRL-<base64> / CV-PRO-<base64> (FC XunhuPay)
   if (key.startsWith('CV-')) {
     const parts = key.split('-', 2);
     if (parts.length < 3) return false;
@@ -70,94 +73,56 @@ function verifyLicenseKey(key) {
 
 function checkLicense(product) {
   const state = loadState();
+  const ps = getProductState(state, product);
   const licenseKey = state.license_key || process.env.CORRECTOVER_LICENSE_KEY;
 
   if (licenseKey && verifyLicenseKey(licenseKey)) {
     return {
+      authorized: true,
       tier: 'pro',
-      can_scan: true,
-      can_fix: true,
-      can_report: true,
-      can_heal: true,
-      can_history: true,
-      fix_preview: Infinity,
+      calls_remaining: Infinity,
+      calls_today: ps.calls_today,
+      limit: Infinity,
     };
   }
 
+  const remaining = Math.max(0, FREE_LIMIT_PER_DAY - ps.calls_today);
   return {
+    authorized: remaining > 0,
     tier: 'free',
-    can_scan: true,
-    can_fix: false,
-    can_report: false,
-    can_heal: false,
-    can_history: false,
-    fix_preview: FREE_FIX_PREVIEW,
+    calls_remaining: remaining,
+    calls_today: ps.calls_today,
+    limit: FREE_LIMIT_PER_DAY,
   };
 }
 
-function recordScan(product, risksFound) {
+function recordCall(product) {
   const state = loadState();
-  const ps = getProductState(state, product);
-  ps.total_scans += 1;
-  ps.total_risks_found += risksFound || 0;
-  ps.last_scan = Date.now() / 1000;
-
-  const history = state.scan_history || [];
-  history.push({ time: Date.now()/1000, product, risks: risksFound || 0 });
-
   const status = checkLicense(product);
-  if (status.tier === 'free' && history.length > 1) {
-    state.scan_history = history.slice(-1);
-  } else {
-    state.scan_history = history;
-  }
+  if (!status.authorized) return status;
 
+  const ps = getProductState(state, product);
+  ps.calls_today += 1;
+  ps.total_calls = (ps.total_calls || 0) + 1;
   saveState(state);
-  return checkLicense(product);
-}
 
-function getFixCTA(totalRisks, hiddenRisks) {
-  if (hiddenRisks <= 0) return '';
-  const shown = totalRisks - hiddenRisks;
-  return [
-    '',
-    '━'.repeat(55),
-    `🔒 ${hiddenRisks} fix recommendation(s) locked.`,
-    `   You have ${totalRisks} risk(s) but can only see ${shown} fix(es).`,
-    '',
-    '🛡️  Upgrade to Pro to unlock:',
-    `   ✓ Fix recommendations for all ${totalRisks} risk(s)`,
-    '   ✓ Auto-heal (84.1% issues resolved automatically)',
-    '   ✓ HTML/PDF audit reports',
-    '   ✓ Scan history & tracking',
-    '━'.repeat(55),
-    '   → https://correctover.com/checkout',
-    '   → export CORRECTOVER_LICENSE_KEY=<your-key>',
-    '━'.repeat(55),
-  ].join('\n');
+  status.calls_remaining = Math.max(0, status.limit - ps.calls_today);
+  status.calls_today = ps.calls_today;
+  return status;
 }
 
-function getNoRiskCTA() {
-  return [
-    '',
-    '━'.repeat(55),
-    '✅ No risks found in this scan.',
-    '',
-    '🛡️  Stay protected with Pro:',
-    '   ✓ Continuous monitoring (auto-scan on changes)',
-    '   ✓ Auto-heal when risks appear',
-    '   ✓ Compliance reports (OAuth 2.1, CCS v1.0)',
-    '━'.repeat(55),
-    '   → https://correctover.com/checkout',
-    '━'.repeat(55),
-  ].join('\n');
+function getUpgradeMessage(status) {
+  if (status.tier !== 'free') return '';
+  if (status.calls_remaining <= 0) {
+    return `\n🚫 Free tier limit reached (${FREE_LIMIT_PER_DAY} scans/day).\n   Upgrade: https://correctover.com/checkout\n   Or: export CORRECTOVER_LICENSE_KEY=<your-key>\n`;
+  }
+  return `\n📊 Free tier: ${status.calls_remaining} scans remaining today.\n   Upgrade: https://correctover.com/checkout\n`;
 }
 
 module.exports = {
-  FREE_FIX_PREVIEW,
+  FREE_LIMIT_PER_DAY,
   checkLicense,
-  recordScan,
+  recordCall,
+  getUpgradeMessage,
   verifyLicenseKey,
-  getFixCTA,
-  getNoRiskCTA,
 };

package/index.js

@@ -10,10 +10,12 @@
 const fs = require('fs');
 const path = require('path');
 const { runScan, parseConfig, KNOWN_CONFIG_PATHS } = require('./core/scanner');
+const { runBundleScan, discoverBundleFiles } = require('./core/bundle-scanner');
 const { recordCall, getUpgradeMessage } = require('./core/license');
 
-const VERSION = '1.2.0';
+const VERSION = '1.6.0';
 const PRODUCT = 'correctover-scan';
+const JS_EXT = new Set(['.js', '.mjs', '.cjs', '.ts']);
 
 // Colors
 const c = {
@@ -27,13 +29,14 @@ const icons = { pass: '✅', warn: '⚠️', fail: '❌', info: 'ℹ️' };
 const sevColors = { critical: c.red, high: c.yellow, medium: c.cyan, low: c.gray };
 const sevLabels = { critical: 'CRITICAL', high: 'HIGH', medium: 'MEDIUM', low: 'LOW' };
 
-function printBanner() {
-  console.log(`
+function printBanner(stream) {
+  const out = stream === 'stderr' ? console.error : console.log;
+  out(`
 ${c.bold}${c.blue}  ╔══════════════════════════════════════════╗
   ║   CCS Security Scanner by Correctover    ║
   ║   AI Agent Runtime Assurance             ║
   ╚══════════════════════════════════════════╝${c.reset}
-  ${c.dim}v${VERSION} | OWASP AISVS 1.0 | 14 security checks${c.reset}
+  ${c.dim}v${VERSION} | OWASP AISVS 1.0 | 14 checks · MCP config + JS bundle modes${c.reset}
 `);
 }
 
@@ -122,11 +125,139 @@ function formatResults(results, stats, filename) {
   }
   lines.push(`${c.dim}Enterprise: runtime SDK + Token guarantee → https://correctover.com${c.reset}`);
   lines.push('');
-  lines.push(`${c.dim}Web: https://correctover.com/scan/ | GitHub: https://github.com/Correctover${c.reset}`);
+  lines.push(`${c.dim}Web: https://correctover.com/scan/ | GitHub: https://github.com/DSHCorrectover${c.reset}`);
 
+  // Manual audit CTA
+  lines.push('');
+  lines.push(`${c.dim}Free automated scan covers surface-level checks. A manual Correctover audit goes deeper: 116 semantic intent rules, 5-day turnaround, findings grounded in real MCP ecosystem CVEs. First customers: if we find no critical-severity issue, you pay nothing. \u2192 ${c.cyan}https://dshcorrectover.github.io/agent-audit/${c.reset}`);
+
+  return lines.join('\n');
+}
+
+/* ------------------------------------------------------------------ */
+/* Bundle mode output                                                  */
+/* ------------------------------------------------------------------ */
+
+function formatBundleResults(bundle, baseLabel) {
+  const lines = [];
+  const stats = bundle.stats;
+  lines.push(`${c.bold}📦 Bundle/code scan: ${baseLabel}${c.reset}`);
+  lines.push(`  ${c.dim}files: ${bundle.files.length} · code-layer checks: ${bundle.checks.length} (12 automatic verdicts + 5 semi-automatic signal enums; check ids continue the 14-check config scheme)${c.reset}`);
+  lines.push('─'.repeat(50));
+
+  const scoreColor = stats.score >= 80 ? c.green : stats.score >= 60 ? c.yellow : c.red;
+  lines.push(`\n${c.bold}Security Score: ${scoreColor}${c.bold}${stats.score}/100${c.reset}`);
+  lines.push(`  ${c.green}✓ ${stats.pass} checks passed${c.reset}  ${c.yellow}⚠ ${stats.warn} checks with warnings${c.reset}  ${c.red}✗ ${stats.fail} checks with critical findings${c.reset}  ${c.blue}ℹ ${stats.info} checks info-only${c.reset}`);
+  lines.push(`  ${c.dim}findings: ${stats.findings.fail} fail · ${stats.findings.warn} warn · ${stats.findings.info} info · ${stats.findings.suppressed} suppressed by context heuristics${c.reset}\n`);
+
+  for (const fr of bundle.files) {
+    const active = [];
+    const suppressedCount = fr.results.reduce((n, r) => n + r.findings.filter(f => f.suppressed).length, 0);
+    for (const r of fr.results) {
+      for (const f of r.findings) {
+        if (!f.suppressed) active.push({ check: r, f });
+      }
+    }
+    if (active.length === 0) {
+      lines.push(`${c.green}✅ ${fr.file} — no fail/warn findings (${suppressedCount} known-benign signals suppressed, see JSON for detail)${c.reset}\n`);
+      continue;
+    }
+    lines.push(`${c.bold}📄 ${fr.file}${c.reset}`);
+    for (const { check, f } of active) {
+      const icon = icons[f.severity === 'fail' ? 'fail' : f.severity === 'warn' ? 'warn' : 'info'];
+      const statusStr = f.severity === 'fail' ? c.red + 'FAIL' : f.severity === 'warn' ? c.yellow + 'WARN' : c.blue + 'INFO';
+      lines.push(`  ${icon} ${c.dim}[${check.id} · ${check.aisvs}]${c.reset} ${statusStr}${c.reset} ${c.bold}L${f.line}${c.reset}`);
+      lines.push(`     ${f.message}`);
+      if (f.snippet) lines.push(`     ${c.gray}${f.snippet}${c.reset}`);
+      lines.push('');
+    }
+  }
+
+  // Semi-automatic checks summary
+  const semiIds = ['budget-limit', 'logging', 'version-pin', 'error-handling', 'output-validation'];
+  lines.push(`${c.dim}── Semi-automatic checks (signals enumerated; conclusion needs manual review) ──${c.reset}`);
+  for (const id of semiIds) {
+    let n = 0;
+    for (const fr of bundle.files) {
+      const r = fr.results.find(x => x.id === id);
+      if (r) n += r.findings.length;
+    }
+    lines.push(`  ${c.blue}ℹ${c.reset} ${c.dim}${id}: ${n} signal(s) listed in JSON output${c.reset}`);
+  }
+
+  lines.push('');
+  lines.push(`${c.dim}Note: bundle mode is signal scanning over published/minified code. It locates every${c.reset}`);
+  lines.push(`${c.dim}risk-bearing string/API call with file+line; it does not prove reachability or intent —${c.reset}`);
+  lines.push(`${c.dim}fail/warn items and the semi-automatic signals are the input for manual deep review.${c.reset}`);
+
+  lines.push('');
+  lines.push(`${c.dim}── Upgrade ─────────────────────────────────${c.reset}`);
+  if (stats.fail > 0 || stats.score < 60) {
+    lines.push(`${c.yellow}${c.bold}⚡ Critical findings present. CCS Pro generates formal compliance reports.${c.reset}`);
+    lines.push(`${c.dim}   Enterprise: real-time runtime protection + Token guarantee${c.reset}`);
+    lines.push(`${c.cyan}   → Upgrade: https://correctover.com/checkout${c.reset}`);
+  } else {
+    lines.push(`${c.green}✓ No critical signals! Get a formal compliance certificate with CCS Pro.${c.reset}`);
+    lines.push(`${c.cyan}  → https://correctover.com/checkout${c.reset}`);
+  }
+  lines.push(`${c.dim}Manual bundle audit (116-rule deep review): https://dshcorrectover.github.io/agent-audit/${c.reset}`);
+  lines.push('');
+  lines.push(`${c.dim}Web: https://correctover.com/scan/ | GitHub: https://github.com/DSHCorrectover${c.reset}`);
   return lines.join('\n');
 }
 
+function formatBundleJSON(bundle, target) {
+  return JSON.stringify({
+    scanner: 'correctover-scan', version: VERSION, mode: 'bundle', target,
+    stats: bundle.stats,
+    files: bundle.files.map(fr => ({
+      file: fr.file,
+      results: fr.results.map(r => ({
+        id: r.id, name: r.name, category: r.category, aisvs: r.aisvs,
+        severity: r.severity, status: r.status, fix: r.fix,
+        findings: r.findings.map(f => ({ line: f.line, severity: f.severity, suppressed: f.suppressed, message: f.message, snippet: f.snippet })),
+      })),
+    })),
+  }, null, 2);
+}
+
+function formatBundleSARIF(bundle, target) {
+  const rules = [];
+  const results = [];
+  for (const fr of bundle.files) {
+    for (const r of fr.results) {
+      if (!rules.some(x => x.id === r.id)) {
+        rules.push({
+          id: r.id, name: r.name,
+          shortDescription: { text: `${r.category}: ${r.name}` },
+          helpUri: `https://correctover.com/scan/#check-${r.id}`,
+          properties: { aisvs: r.aisvs, severity: r.severity, mode: 'bundle' },
+        });
+      }
+      for (const f of r.findings) {
+        if (f.suppressed || f.severity === 'info') continue;
+        results.push({
+          ruleId: r.id,
+          level: f.severity === 'fail' ? 'error' : 'warning',
+          message: { text: f.message },
+          locations: [{ physicalLocation: {
+            artifactLocation: { uri: fr.file },
+            region: f.line ? { startLine: f.line } : undefined,
+          } }],
+        });
+      }
+    }
+  }
+  return {
+    version: '2.1.0',
+    $schema: 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json',
+    runs: [{
+      tool: { driver: { name: 'correctover-scan', version: VERSION, informationUri: 'https://correctover.com', rules } },
+      results,
+    }],
+  };
+}
+
 function formatSARIF(results, filename) {
   return {
     version: '2.1.0',
@@ -160,12 +291,81 @@ function formatJSON(results, stats, filename) {
   return JSON.stringify({ scanner: 'correctover-scan', version: VERSION, file: filename, stats, results }, null, 2);
 }
 
+function runBundleMode(target, format, outFile) {
+  // All diagnostics/banners go to stderr so that stdout carries only the
+  // machine-readable payload for json/sarif consumers.
+  const diag = (...a) => console.error(...a);
+  printBanner(format === 'text' && !outFile ? 'stdout' : 'stderr');
+
+  // License check (same 50/day free tier counting as config mode)
+  const status = recordCall(PRODUCT);
+  if (!status.authorized) {
+    diag(getUpgradeMessage(status));
+    process.exit(1);
+  }
+  if (status.tier === 'free') {
+    diag(`${c.dim}📊 Free tier: ${status.calls_remaining} scans remaining today (${status.calls_today}/${status.limit})${c.reset}`);
+    diag(`${c.dim}   Upgrade: https://correctover.com/checkout${c.reset}\n`);
+  } else if (status.tier === 'pro') {
+    diag(`${c.green}✅ Pro license active — unlimited scans${c.reset}\n`);
+  }
+
+  if (!fs.existsSync(target)) {
+    diag(`${c.red}Error: path not found: ${target}${c.reset}`);
+    process.exit(1);
+  }
+
+  const abs = path.resolve(target);
+  const isDir = fs.statSync(abs).isDirectory();
+  const baseDir = isDir ? abs : path.dirname(abs);
+  let files;
+  try {
+    files = discoverBundleFiles(abs);
+  } catch (e) {
+    diag(`${c.red}Error discovering bundle files: ${e.message}${c.reset}`);
+    process.exit(1);
+  }
+  if (files.length === 0) {
+    diag(`${c.yellow}No JavaScript files (.js/.mjs/.cjs) found under ${target}.${c.reset}`);
+    process.exit(0);
+  }
+  diag(`${c.dim}Bundle mode: ${files.length} JS file(s) under ${target}${c.reset}\n`);
+
+  const bundle = runBundleScan(files, baseDir);
+  const label = path.relative(process.cwd(), abs) || abs;
+
+  let payload;
+  if (format === 'json') {
+    payload = formatBundleJSON(bundle, label);
+  } else if (format === 'sarif') {
+    payload = JSON.stringify(formatBundleSARIF(bundle, label), null, 2);
+  } else {
+    payload = formatBundleResults(bundle, label);
+  }
+  if (outFile) {
+    try {
+      fs.writeFileSync(outFile, payload + '\n');
+      diag(`${c.green}✅ Report written to ${outFile}${c.reset}`);
+    } catch (e) {
+      console.error(`${c.red}Error writing output file: ${e.message}${c.reset}`);
+      process.exit(1);
+    }
+  } else {
+    console.log(payload);
+  }
+
+  // Exit code: 1 if any check has fail-level findings
+  if (bundle.stats.findings.fail > 0) process.exit(1);
+}
+
 function main() {
   const args = process.argv.slice(2);
   let configPath = null;
+  let bundlePath = null;
   let format = 'text'; // text, json, sarif
   let scanDir = process.cwd();
   let recursive = false;
+  let outFile = null;
 
   // Parse args
   for (let i = 0; i < args.length; i++) {
@@ -175,20 +375,38 @@ function main() {
       process.exit(0);
     } else if (arg === '--help' || arg === '-h') {
       console.log(`
-Usage: correctover-scan [config-file] [options]
+Usage: correctover-scan [target] [options]
+
+MCP config mode (default for .json/.yaml/mcp.json):
+  correctover-scan mcp.json                    Scan a specific MCP config
+  correctover-scan -d ./project                Auto-detect configs in directory
+  correctover-scan -d ./project -r             Recursively find config files
+
+Bundle / published-package code mode (v1.4.0+):
+  correctover-scan --bundle ./pkg              Audit an unpacked npm package
+                                               (reads package.json entry + all .js/.mjs/.cjs)
+  correctover-scan --bundle dist/app.min.js    Audit a single minified/bundled JS file
+  correctover-scan ./cli.js                    Auto-detected: .js/.mjs/.cjs target → bundle mode
+  correctover-scan --bundle ./pkg -f sarif     SARIF with file+line locations
 
 Options:
+  --bundle <path>       Explicitly run bundle/code scan on a JS file or directory
   -f, --format <type>   Output format: text, json, sarif (default: text)
   -d, --dir <path>      Directory to scan for MCP configs (default: cwd)
   -r, --recursive       Recursively find MCP config files
+  -o, --output <file>   Write the report to a file (text/json/sarif) instead of stdout
   -v, --version         Show version
   -h, --help            Show this help
 
+Bundle mode performs signal scanning of shipped/minified code (hardcoded secrets,
+plaintext endpoints, cloud metadata/SSRF, shell:true/exec, eval/Function/vm, env
+credential flow, permission gates, MCP transport auth, timeouts, kill switch,
+sandbox, input validation) with context-based false-positive suppression. It
+locates signals at file+line; reachability/intent conclusions need manual review.
+
 Examples:
-  correctover-scan mcp.json                    Scan a specific file
-  correctover-scan -d ./project                Auto-detect configs in directory
-  correctover-scan -f sarif -o report.sarif    Output SARIF format
-  npx correctover-scan                         Auto-detect in current directory
+  npx correctover-scan                         Auto-detect MCP configs in cwd
+  npx correctover-scan --bundle .              Audit the current package's code
 `);
       process.exit(0);
     } else if (arg === '--format' || arg === '-f') {
@@ -197,26 +415,60 @@ Examples:
       scanDir = args[++i];
     } else if (arg === '--recursive' || arg === '-r') {
       recursive = true;
+    } else if (arg === '--bundle' || arg === '-b') {
+      bundlePath = args[++i];
     } else if (arg === '--output' || arg === '-o') {
-      // Output file - handled below
+      outFile = args[++i] || null;
     } else if (!arg.startsWith('-')) {
       configPath = arg;
     }
   }
 
-  printBanner();
+  // Auto-detect bundle mode: positional .js/.mjs/.cjs file, or a directory
+  // that contains JS but no MCP config and looks like a package.
+  if (!bundlePath && configPath && fs.existsSync(configPath)) {
+    const st = fs.statSync(configPath);
+    if (st.isFile() && JS_EXT.has(path.extname(configPath).toLowerCase())) {
+      bundlePath = configPath;
+      configPath = null;
+    } else if (st.isDirectory() && !configPath.endsWith('.json')) {
+      // directory positional: prefer config mode only if a known config exists
+      const hasConfig = KNOWN_CONFIG_PATHS.some(rel => fs.existsSync(path.join(configPath, rel)));
+      if (!hasConfig) {
+        let hasJS = false;
+        try { hasJS = fs.readdirSync(configPath).some(f => JS_EXT.has(path.extname(f).toLowerCase())); } catch (e) {}
+        if (hasJS || fs.existsSync(path.join(configPath, 'package.json'))) {
+          bundlePath = configPath;
+          configPath = null;
+        }
+      }
+    }
+  }
+
+  if (bundlePath) {
+    return runBundleMode(bundlePath, format, outFile);
+  }
+
+  // In json/sarif mode all diagnostics go to stderr, keeping stdout clean.
+  const diag = (format === 'text' && !outFile) ? console.log : (...a) => console.error(...a);
+  printBanner(format === 'text' && !outFile ? 'stdout' : 'stderr');
+
+  // Text-mode payload buffer: when -o writes a report file, the report text is
+  // collected instead of being streamed to stdout (diagnostics stay on stderr).
+  const textBuffer = outFile ? [] : null;
+  const emit = textBuffer ? (s) => textBuffer.push(s) : (s) => console.log(s);
 
   // License check
   const status = recordCall(PRODUCT);
   if (!status.authorized) {
-    console.log(getUpgradeMessage(status));
+    diag(getUpgradeMessage(status));
     process.exit(1);
   }
   if (status.tier === 'free') {
-    console.log(`${c.dim}📊 Free tier: ${status.calls_remaining} scans remaining today (${status.calls_today}/${status.limit})${c.reset}`);
-    console.log(`${c.dim}   Upgrade: https://correctover.com/checkout${c.reset}\n`);
+    diag(`${c.dim}📊 Free tier: ${status.calls_remaining} scans remaining today (${status.calls_today}/${status.limit})${c.reset}`);
+    diag(`${c.dim}   Upgrade: https://correctover.com/checkout${c.reset}\n`);
   } else if (status.tier === 'pro') {
-    console.log(`${c.green}✅ Pro license active — unlimited scans${c.reset}\n`);
+    diag(`${c.green}✅ Pro license active — unlimited scans${c.reset}\n`);
   }
 
   const filesToScan = [];
@@ -230,7 +482,7 @@ Examples:
     filesToScan.push(configPath);
   } else {
     // Auto-detect
-    console.log(`${c.dim}Auto-detecting MCP configs in ${scanDir}...${c.reset}\n`);
+    diag(`${c.dim}Auto-detecting MCP configs in ${scanDir}...${c.reset}\n`);
     const found = findConfigFiles(scanDir);
     if (recursive) {
       // Walk directory tree
@@ -254,13 +506,19 @@ Examples:
   }
 
   if (filesToScan.length === 0) {
-    console.log(`${c.yellow}No MCP configuration files found.${c.reset}`);
-    console.log(`${c.dim}Searched paths: ${KNOWN_CONFIG_PATHS.join(', ')}${c.reset}`);
-    console.log(`\n${c.dim}Create a config file or specify one: correctover-scan path/to/mcp.json${c.reset}`);
+    diag(`${c.yellow}No MCP configuration files found.${c.reset}`);
+    diag(`${c.dim}Searched paths: ${KNOWN_CONFIG_PATHS.join(', ')}${c.reset}`);
+    diag(`\n${c.dim}Config mode: correctover-scan path/to/mcp.json${c.reset}`);
+    const cwdHasPkg = fs.existsSync(path.join(scanDir, 'package.json'));
+    if (cwdHasPkg) {
+      diag(`${c.cyan}Detected package.json here — audit published/bundled code with: correctover-scan --bundle ${scanDir}${c.reset}`);
+    } else {
+      diag(`${c.dim}Audit an npm package / JS bundle instead: correctover-scan --bundle <path-to-package-or-js>${c.reset}`);
+    }
     process.exit(0);
   }
 
-  console.log(`${c.dim}Found ${filesToScan.length} config file(s)${c.reset}\n`);
+  diag(`${c.dim}Found ${filesToScan.length} config file(s)${c.reset}\n`);
 
   let totalPass = 0, totalWarn = 0, totalFail = 0, totalInfo = 0;
   let allResults = [];
@@ -273,8 +531,8 @@ Examples:
       const relPath = path.relative(process.cwd(), fp) || fp;
 
       if (format === 'text') {
-        console.log(formatResults(results, stats, relPath));
-        console.log('');
+        emit(formatResults(results, stats, relPath));
+        emit('');
       }
 
       totalPass += stats.pass;
@@ -288,21 +546,36 @@ Examples:
   }
 
   // JSON/SARIF output
+  let machinePayload = null;
   if (format === 'json') {
     const output = allResults.map(r => formatJSON(r.results, r.stats, r.file));
-    console.log(output.join('\n'));
+    machinePayload = output.join('\n');
   } else if (format === 'sarif') {
     const sarifResults = allResults.map(r => formatSARIF(r.results, r.file));
-    console.log(JSON.stringify(sarifResults.length === 1 ? sarifResults[0] : { runs: sarifResults.flatMap(s => s.runs) }, null, 2));
+    machinePayload = JSON.stringify(sarifResults.length === 1 ? sarifResults[0] : { runs: sarifResults.flatMap(s => s.runs) }, null, 2);
   }
 
   // Summary
   if (filesToScan.length > 1 && format === 'text') {
     const totalScore = Math.round(((totalPass * 10 + totalWarn * 5 + totalInfo * 7) / ((totalPass + totalWarn + totalFail + totalInfo) * 10)) * 100);
-    console.log(`${c.bold}═══ Summary ═══${c.reset}`);
-    console.log(`  Files scanned: ${filesToScan.length}`);
-    console.log(`  Total score: ${totalScore}/100`);
-    console.log(`  ${c.green}✓ ${totalPass}${c.reset}  ${c.yellow}⚠ ${totalWarn}${c.reset}  ${c.red}✗ ${totalFail}${c.reset}  ${c.blue}ℹ ${totalInfo}${c.reset}`);
+    emit(`${c.bold}═══ Summary ═══${c.reset}`);
+    emit(`  Files scanned: ${filesToScan.length}`);
+    emit(`  Total score: ${totalScore}/100`);
+    emit(`  ${c.green}✓ ${totalPass}${c.reset}  ${c.yellow}⚠ ${totalWarn}${c.reset}  ${c.red}✗ ${totalFail}${c.reset}  ${c.blue}ℹ ${totalInfo}${c.reset}`);
+  }
+
+  // -o: write the report payload to a file; otherwise stream to stdout
+  if (outFile) {
+    const payload = machinePayload || textBuffer.join('\n');
+    try {
+      fs.writeFileSync(outFile, payload + '\n');
+      diag(`${c.green}✅ Report written to ${outFile}${c.reset}`);
+    } catch (e) {
+      console.error(`${c.red}Error writing output file: ${e.message}${c.reset}`);
+      process.exit(1);
+    }
+  } else if (machinePayload) {
+    console.log(machinePayload);
   }
 
   // Exit code: 1 if any critical failures