correctover-scan 3.1.1 → 3.2.0

package/core/skillpay.js

@@ -2,8 +2,10 @@
  * SkillPay (Alipay) acquisition bridge for users in mainland China.
  *
  * One public shelf URL covers every purchasable product; single-product deep
- * links, if later provided, take precedence automatically. No prices are
- * printed anywhere here — only a pointer to the shelf.
+ * links, if later provided, take precedence automatically.
+ *
+ * Prices ARE printed by checkoutBlock() — explicitly authorized 2026-09-27 to
+ * close the scan→payment gap. Keep them in sync with the live Alipay shelf.
  */
 
 'use strict';
@@ -18,6 +20,12 @@ const PRODUCTS = {
   audit: { name: 'CCS收据批量审计', url: '' },
 };
 
+// Shelf prices (CNY). Owner-supplied 2026-09-27; keep identical to the shelf.
+const OFFERS = {
+  cert: { label: 'CCS 运行时认证 · 正式合规凭证', price: '¥699/年' },
+  checkup: { label: 'MCP 安全体检 · 持续监控 + 月报', price: '¥49.9/月' },
+};
+
 function isChinaUser() {
   if (process.env.CORRECTOVER_REGION === 'CN') return true;
   if (process.env.CORRECTOVER_REGION === 'GLOBAL') return false;
@@ -36,6 +44,30 @@ function shelfUrlFor(key) {
   return (p && p.url) || STORE_URL;
 }
 
+/**
+ * Scan→payment checkout block. Personalized by the number of risks found so the
+ * user moves from "you're at risk" straight to a payable next step.
+ *
+ * @param {number} riskCount fail-level findings in this scan
+ * @returns {string} multi-line block, or '' for non-China users
+ */
+function checkoutBlock(riskCount) {
+  if (!isChinaUser()) return '';
+  const n = Number.isFinite(riskCount) ? riskCount : 0;
+  const url = shelfUrlFor('scan');
+  const out = [];
+  out.push('🇨🇳 支付宝 SkillPay · 检出风险后直接处理');
+  if (n > 0) {
+    out.push(`   本次有 ${n} 项风险提示。别让它停在「你完蛋了」——`);
+  } else {
+    out.push('   本次未发现风险。趁现在拿到正式凭证——');
+  }
+  out.push(`   · ${OFFERS.cert.label}   ${OFFERS.cert.price}`);
+  out.push(`   · ${OFFERS.checkup.label}   ${OFFERS.checkup.price}`);
+  out.push(`   打开即扫码付款：${url}`);
+  return out.join('\n');
+}
+
 /**
  * Full China acquisition block. Returns '' for non-China users so behaviour is
  * identical to pre-bridge releases unless a CN user is detected.
@@ -66,7 +98,9 @@ function ctaLine(productKey) {
 module.exports = {
   STORE_URL,
   PRODUCTS,
+  OFFERS,
   isChinaUser,
+  checkoutBlock,
   block,
   ctaLine,
 };

package/index.js

@@ -15,7 +15,7 @@ const { recordCall, getUpgradeMessage } = require('./core/license');
 const skillpay = require('./core/skillpay');
 const { formatHTMLReport, normalizeConfigFindings, normalizeBundleFindings, failHint } = require('./core/report');
 
-const VERSION = '3.1.1';
+const VERSION = '3.2.0';
 const PRODUCT = 'correctover-scan';
 const JS_EXT = new Set(['.js', '.mjs', '.cjs', '.ts']);
 
@@ -133,7 +133,7 @@ function formatResults(results, stats, filename) {
   lines.push('');
   lines.push(`${c.dim}Free automated scan covers surface-level checks. A manual Correctover audit goes deeper: 116 semantic intent rules, 5-day turnaround, findings grounded in real MCP ecosystem CVEs. First customers: if we find no critical-severity issue, you pay nothing. \u2192 ${c.cyan}https://dshcorrectover.github.io/agent-audit/${c.reset}`);
 
-  const cnBlock = skillpay.block('scan');
+  const cnBlock = skillpay.checkoutBlock(stats.fail + stats.warn);
   if (cnBlock) {
     lines.push('');
     lines.push(cnBlock);
@@ -212,7 +212,7 @@ function formatBundleResults(bundle, baseLabel) {
   lines.push('');
   lines.push(`${c.dim}Web: https://correctover.com/scan/ | GitHub: https://github.com/DSHCorrectover${c.reset}`);
 
-  const cnBundleBlock = skillpay.block('scan');
+  const cnBundleBlock = skillpay.checkoutBlock(activeRiskCount(bundle));
   if (cnBundleBlock) {
     lines.push('');
     lines.push(cnBundleBlock);
@@ -220,6 +220,21 @@ function formatBundleResults(bundle, baseLabel) {
   return lines.join('\n');
 }
 
+function activeRiskCount(bundle) {
+  // Every unsuppressed warn/fail finding is something the user should act on,
+  // not just confirmed fails (the bundle engine suppresses known-benign
+  // signals and can under-classify simple variable args as static).
+  let n = 0;
+  for (const fr of bundle.files) {
+    for (const r of fr.results) {
+      for (const f of r.findings) {
+        if (!f.suppressed && (f.severity === 'fail' || f.severity === 'warn')) n++;
+      }
+    }
+  }
+  return n;
+}
+
 function formatBundleJSON(bundle, target) {
   return JSON.stringify({
     scanner: 'correctover-scan', version: VERSION, mode: 'bundle', target,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "correctover-scan",
-  "version": "3.1.1",
+  "version": "3.2.0",
   "description": "Correctover Security Scanner — CCS audit for MCP configurations AND published JS bundles/npm packages. Detects hardcoded secrets, RCE, SSRF, credential hijacking against OWASP AISVS 1.0.",
   "main": "index.js",
   "bin": {