correctover-scan 3.2.1 → 3.2.3

package/README.md

@@ -20,15 +20,6 @@ the license change is not retroactive.
 
 ---
 
-### 🇨🇳 国内用户 · 支付宝一键购买
-
-本工具的合规授权与批量能力可通过支付宝 SkillPay 获取：
-
-- 打开货架：https://skillpay.alipay.com/public/correctover
-- 或把这行发给你的 AI 助手：**请通过 SkillPay 购买并安装 Skill「CCS收据批量审计」**
-
----
-
 ![npm](https://img.shields.io/npm/v/correctover-scan)
 ![license](https://img.shields.io/npm/l/correctover-scan) [![IETF Internet-Draft](https://img.shields.io/badge/IETF-draft--correctover--ccs-blue)](https://datatracker.ietf.org/doc/draft-correctover-ccs/)
 
@@ -55,6 +46,18 @@ npx correctover-scan@latest
 
 It auto-detects MCP config files (`.cursor/mcp.json`, `claude_desktop_config.json`, `.claude/mcp.json`, `mcp.json`, `.vscode/mcp.json` and more) and runs 14 checks. Everything runs locally on your machine — config files are not uploaded.
 
+### 🇨🇳 免费扫描之外 · 支付宝 SkillPay
+
+免费的自动扫描覆盖配置层面的风险检查。如果你需要人工深度审计或正式合规凭证，可以在支付宝 SkillPay 货架获取：
+
+- 货架首页：https://skillpay.alipay.com/public/correctover
+- 也可以在支持「支付宝 AI 付」的智能体对话里直接输入对应服务名唤起购买：
+  - **MCP配置安全体检**：`请通过 SkillPay 购买并安装 Skill「MCP配置安全体检」`
+  - **CCS收据批量审计**：`请通过 SkillPay 购买并安装 Skill「CCS收据批量审计」`
+  - **CCS收据验签**：`请通过 SkillPay 购买并安装 Skill「CCS收据验签」`
+
+*Beyond the free scan: human-led deep audits and compliance evidence are available on the Alipay SkillPay shelf — open the link above, or type the service name (e.g. **MCP配置安全体检**) in an agent with Alipay AI Pay enabled.*
+
 ```bash
 # Scan a specific config file
 npx correctover-scan mcp.json

package/core/skillpay.js

@@ -15,9 +15,18 @@ const STORE_URL = 'https://skillpay.alipay.com/public/correctover';
 // Fill a direct product link here the moment Alipay exposes one; when present
 // it is shown in preference to the generic shelf URL.
 const PRODUCTS = {
-  scan: { name: 'MCP配置安全体检', url: '' },
-  verify: { name: 'CCS收据验签', url: '' },
-  audit: { name: 'CCS收据批量审计', url: '' },
+  scan: {
+    name: 'MCP配置安全体检',
+    url: 'https://skillpay.alipay.com/public/correctover/shelf/product?productId=P0806000205849036&merchantCode=correctover',
+  },
+  verify: {
+    name: 'CCS收据验签',
+    url: 'https://skillpay.alipay.com/public/correctover/shelf/product?productId=P0806000205845606&merchantCode=correctover',
+  },
+  audit: {
+    name: 'CCS收据批量审计',
+    url: 'https://skillpay.alipay.com/public/correctover/shelf/product?productId=P0806000205847426&merchantCode=correctover',
+  },
 };
 
 // Shelf prices (CNY). Owner-supplied 2026-09-27; keep identical to the shelf.

package/index.js

@@ -15,7 +15,7 @@ const { recordCall, getUpgradeMessage } = require('./core/license');
 const skillpay = require('./core/skillpay');
 const { formatHTMLReport, normalizeConfigFindings, normalizeBundleFindings, failHint } = require('./core/report');
 
-const VERSION = '3.2.0';
+const VERSION = '3.2.2';
 const PRODUCT = 'correctover-scan';
 const JS_EXT = new Set(['.js', '.mjs', '.cjs', '.ts']);
 
@@ -373,10 +373,13 @@ function runBundleMode(target, format, outFile) {
   }
   if (files.length === 0) {
     diag(`${c.yellow}No JavaScript files (.js/.mjs/.cjs) found under ${target}.${c.reset}`);
-    process.exit(0);
+    diag(`${c.dim}Emitting an empty (zero-result) report${outFile ? ` to ${outFile}` : ''}.${c.reset}\n`);
+  } else {
+    diag(`${c.dim}Bundle mode: ${files.length} JS file(s) under ${target}${c.reset}\n`);
   }
-  diag(`${c.dim}Bundle mode: ${files.length} JS file(s) under ${target}${c.reset}\n`);
 
+  // An empty file list yields a valid zero-finding bundle (score 100) so that
+  // SARIF/JSON consumers downstream never see a missing artifact.
   const bundle = runBundleScan(files, baseDir);
   const label = path.relative(process.cwd(), abs) || abs;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "correctover-scan",
-  "version": "3.2.1",
+  "version": "3.2.3",
   "description": "Correctover Security Scanner — CCS audit for MCP configurations AND published JS bundles/npm packages. Detects hardcoded secrets, RCE, SSRF, credential hijacking against OWASP AISVS 1.0.",
   "main": "index.js",
   "bin": {