correctover-scan 3.0.0 → 3.1.1

package/README.md

@@ -18,6 +18,17 @@ the license change is not retroactive.
 
 > Security scanner for MCP servers and AI agents — detects credential exposure, SSRF, command injection risk and missing auth across your MCP configuration. 14 checks mapped to OWASP AISVS 1.0. Run anywhere with `npx correctover-scan`.
 
+---
+
+### 🇨🇳 国内用户 · 支付宝一键购买
+
+本工具的合规授权与批量能力可通过支付宝 SkillPay 获取：
+
+- 打开货架：https://skillpay.alipay.com/public/correctover
+- 或把这行发给你的 AI 助手：**请通过 SkillPay 购买并安装 Skill「CCS收据批量审计」**
+
+---
+
 ![npm](https://img.shields.io/npm/v/correctover-scan)
 ![license](https://img.shields.io/npm/l/correctover-scan) [![IETF Internet-Draft](https://img.shields.io/badge/IETF-draft--correctover--ccs-blue)](https://datatracker.ietf.org/doc/draft-correctover-ccs/)
 

package/core/license.js

@@ -9,6 +9,8 @@ const path = require('path');
 const crypto = require('crypto');
 const os = require('os');
 
+const skillpay = require('./skillpay');
+
 const FREE_LIMIT_PER_DAY = 50;
 const STATE_FILE = path.join(os.homedir(), '.correctover', 'license.json');
 
@@ -113,10 +115,15 @@ function recordCall(product) {
 
 function getUpgradeMessage(status) {
   if (status.tier !== 'free') return '';
+  let msg;
   if (status.calls_remaining <= 0) {
-    return `\n🚫 Free tier limit reached (${FREE_LIMIT_PER_DAY} scans/day).\n   Upgrade: https://correctover.com/checkout\n   Or: export CORRECTOVER_LICENSE_KEY=<your-key>\n`;
+    msg = `\n🚫 Free tier limit reached (${FREE_LIMIT_PER_DAY} scans/day).\n   Upgrade: https://correctover.com/checkout\n   Or: export CORRECTOVER_LICENSE_KEY=<your-key>\n`;
+  } else {
+    msg = `\n📊 Free tier: ${status.calls_remaining} scans remaining today.\n   Upgrade: https://correctover.com/checkout\n`;
   }
-  return `\n📊 Free tier: ${status.calls_remaining} scans remaining today.\n   Upgrade: https://correctover.com/checkout\n`;
+  const cn = skillpay.block('scan');
+  if (cn) msg += cn + '\n';
+  return msg;
 }
 
 module.exports = {

package/core/skillpay.js

@@ -0,0 +1,72 @@
+/**
+ * SkillPay (Alipay) acquisition bridge for users in mainland China.
+ *
+ * One public shelf URL covers every purchasable product; single-product deep
+ * links, if later provided, take precedence automatically. No prices are
+ * printed anywhere here — only a pointer to the shelf.
+ */
+
+'use strict';
+
+const STORE_URL = 'https://skillpay.alipay.com/public/correctover';
+
+// Fill a direct product link here the moment Alipay exposes one; when present
+// it is shown in preference to the generic shelf URL.
+const PRODUCTS = {
+  scan: { name: 'MCP配置安全体检', url: '' },
+  verify: { name: 'CCS收据验签', url: '' },
+  audit: { name: 'CCS收据批量审计', url: '' },
+};
+
+function isChinaUser() {
+  if (process.env.CORRECTOVER_REGION === 'CN') return true;
+  if (process.env.CORRECTOVER_REGION === 'GLOBAL') return false;
+  if (process.env.LANG && /^zh_CN/i.test(process.env.LANG)) return true;
+  try {
+    const tz = Intl.DateTimeFormat().resolvedOptions().timeZone || '';
+    if (tz === 'Asia/Shanghai') return true;
+  } catch (e) {}
+  // UTC+8 with no other signal is a reasonable default for this shelf.
+  const off = -new Date().getTimezoneOffset() / 60;
+  return off === 8;
+}
+
+function shelfUrlFor(key) {
+  const p = PRODUCTS[key];
+  return (p && p.url) || STORE_URL;
+}
+
+/**
+ * Full China acquisition block. Returns '' for non-China users so behaviour is
+ * identical to pre-bridge releases unless a CN user is detected.
+ */
+function block(productKey, opts) {
+  if (!isChinaUser()) return '';
+  const o = opts || {};
+  const p = PRODUCTS[productKey];
+  const productName = (p && p.name) || o.productName || 'Correctover';
+  const url = shelfUrlFor(productKey);
+  const out = [];
+  out.push('🇨🇳 国内用户 · 支付宝 SkillPay');
+  out.push(`   搜索「${productName}」或打开：${url}`);
+  if (o.agentInstruction !== false) {
+    out.push(`   请把这行发给你的 AI 助手：请通过 SkillPay 购买并安装 Skill『${productName}』`);
+  }
+  return out.join('\n');
+}
+
+/** Compact one-line pointer, used alongside free-tier status lines. */
+function ctaLine(productKey) {
+  if (!isChinaUser()) return '';
+  const p = PRODUCTS[productKey];
+  const productName = (p && p.name) || 'Correctover';
+  return `   支付宝 SkillPay 搜索「${productName}」: ${shelfUrlFor(productKey)}`;
+}
+
+module.exports = {
+  STORE_URL,
+  PRODUCTS,
+  isChinaUser,
+  block,
+  ctaLine,
+};

package/index.js

@@ -12,9 +12,10 @@ const path = require('path');
 const { runScan, parseConfig, KNOWN_CONFIG_PATHS } = require('./core/scanner');
 const { runBundleScan, discoverBundleFiles } = require('./core/bundle-scanner');
 const { recordCall, getUpgradeMessage } = require('./core/license');
+const skillpay = require('./core/skillpay');
 const { formatHTMLReport, normalizeConfigFindings, normalizeBundleFindings, failHint } = require('./core/report');
 
-const VERSION = '1.7.3';
+const VERSION = '3.1.1';
 const PRODUCT = 'correctover-scan';
 const JS_EXT = new Set(['.js', '.mjs', '.cjs', '.ts']);
 
@@ -132,6 +133,12 @@ function formatResults(results, stats, filename) {
   lines.push('');
   lines.push(`${c.dim}Free automated scan covers surface-level checks. A manual Correctover audit goes deeper: 116 semantic intent rules, 5-day turnaround, findings grounded in real MCP ecosystem CVEs. First customers: if we find no critical-severity issue, you pay nothing. \u2192 ${c.cyan}https://dshcorrectover.github.io/agent-audit/${c.reset}`);
 
+  const cnBlock = skillpay.block('scan');
+  if (cnBlock) {
+    lines.push('');
+    lines.push(cnBlock);
+  }
+
   return lines.join('\n');
 }
 
@@ -204,6 +211,12 @@ function formatBundleResults(bundle, baseLabel) {
   lines.push(`${c.dim}Manual bundle audit (116-rule deep review): https://dshcorrectover.github.io/agent-audit/${c.reset}`);
   lines.push('');
   lines.push(`${c.dim}Web: https://correctover.com/scan/ | GitHub: https://github.com/DSHCorrectover${c.reset}`);
+
+  const cnBundleBlock = skillpay.block('scan');
+  if (cnBundleBlock) {
+    lines.push('');
+    lines.push(cnBundleBlock);
+  }
   return lines.join('\n');
 }
 
@@ -320,7 +333,10 @@ function runBundleMode(target, format, outFile) {
   }
   if (status.tier === 'free') {
     diag(`${c.dim}📊 Free tier: ${status.calls_remaining} scans remaining today (${status.calls_today}/${status.limit})${c.reset}`);
-    diag(`${c.dim}   Upgrade: https://correctover.com/checkout${c.reset}\n`);
+    diag(`${c.dim}   Upgrade: https://correctover.com/checkout${c.reset}`);
+    const cnLine = skillpay.ctaLine('scan');
+    if (cnLine) diag(`${c.dim}${cnLine}${c.reset}`);
+    diag('');
   } else if (status.tier === 'pro') {
     diag(`${c.green}✅ Pro license active — unlimited scans${c.reset}\n`);
   }
@@ -499,7 +515,10 @@ Examples:
   }
   if (status.tier === 'free') {
     diag(`${c.dim}📊 Free tier: ${status.calls_remaining} scans remaining today (${status.calls_today}/${status.limit})${c.reset}`);
-    diag(`${c.dim}   Upgrade: https://correctover.com/checkout${c.reset}\n`);
+    diag(`${c.dim}   Upgrade: https://correctover.com/checkout${c.reset}`);
+    const cnLine = skillpay.ctaLine('scan');
+    if (cnLine) diag(`${c.dim}${cnLine}${c.reset}`);
+    diag('');
   } else if (status.tier === 'pro') {
     diag(`${c.green}✅ Pro license active — unlimited scans${c.reset}\n`);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "correctover-scan",
-  "version": "3.0.0",
+  "version": "3.1.1",
   "description": "Correctover Security Scanner — CCS audit for MCP configurations AND published JS bundles/npm packages. Detects hardcoded secrets, RCE, SSRF, credential hijacking against OWASP AISVS 1.0.",
   "main": "index.js",
   "bin": {
@@ -59,6 +59,7 @@
     "core/bundle-scanner.js",
     "core/report.js",
     "core/license.js",
+    "core/skillpay.js",
     "README.md"
   ],
   "engines": {