dsh-code-security 0.3.6 → 0.3.8

package/lib/diff.js

@@ -5,16 +5,19 @@
  */
 import path from 'node:path';
 import { createHash } from 'node:crypto';
-import { scanLineSet } from './scanner.js';
+import { isExcludedPath, scanLineSet } from './scanner.js';
 /** 运行 git diff（默认 HEAD，工作区未提交改动）。 */
 export async function runGitDiff(runner, cwd, base, target, timeoutMs = 30000, staged = false) {
+    if (typeof base !== 'string' || base.trim() === '' || base.trim().startsWith('-') || base.includes('\0')) {
+        throw new Error('参数 base 必须是非空的 Git ref，不能是 Git 命令选项。');
+    }
     const argv = ['git', 'diff'];
     if (staged)
         argv.push('--cached');
-    argv.push('--no-ext-diff', '--unified=0', base);
+    argv.push('--no-ext-diff', '--no-textconv', '--no-color', '--relative', '--src-prefix=a/', '--dst-prefix=b/', '--unified=3', '--output-indicator-new=+', '--output-indicator-old=-', '--output-indicator-context= ', base.trim(), '--');
     if (target !== undefined && target.trim() !== '')
-        argv.push('--', target.trim());
-    const result = await runner.run(argv, { timeoutMs });
+        argv.push(target.trim());
+    const result = await runner.run(argv, { timeoutMs, cwd });
     if (result.exitCode !== 0 && result.exitCode !== 1) {
         throw new Error('git diff 失败（退出码 ' + String(result.exitCode) + '）：' + result.stderr.trim().split(/\r?\n/).slice(-4).join(' | '));
     }
@@ -22,48 +25,117 @@ export async function runGitDiff(runner, cwd, base, target, timeoutMs = 30000, s
         return '';
     return result.stdout;
 }
-function isNewFileHeader(line) {
-    const m = /^\+\+\+ b\/(.*)$/.exec(line);
-    if (m === null)
-        return null;
-    const file = m[1].replace(/\t.*$/, '');
-    if (file === '' || file === '/dev/null')
-        return null;
-    return file;
+function invalidDiff() {
+    return new Error('git diff 不完整或格式无效，无法确认已审查全部新增行。');
+}
+/** Git quotes unusual path bytes using C escapes, including octal UTF-8. */
+function decodeGitPath(value) {
+    if (!value.startsWith('"'))
+        return value.replace(/\t.*$/, '');
+    const chunks = [];
+    const escapes = { a: 7, b: 8, f: 12, n: 10, r: 13, t: 9, v: 11, '\\': 92, '"': 34 };
+    let literal = '';
+    for (let index = 1; index < value.length; index++) {
+        const char = value[index];
+        if (char === '"') {
+            if (!/^(?:\t.*)?$/.test(value.slice(index + 1)))
+                throw invalidDiff();
+            chunks.push(Buffer.from(literal));
+            try {
+                return new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks));
+            }
+            catch {
+                throw invalidDiff();
+            }
+        }
+        if (char !== '\\') {
+            literal += char;
+            continue;
+        }
+        chunks.push(Buffer.from(literal));
+        literal = '';
+        const octal = /^[0-7]{1,3}/.exec(value.slice(index + 1));
+        if (octal !== null) {
+            const byte = Number.parseInt(octal[0], 8);
+            if (byte > 255)
+                throw invalidDiff();
+            chunks.push(Buffer.from([byte]));
+            index += octal[0].length;
+        }
+        else {
+            const byte = escapes[value[++index]];
+            if (byte === undefined)
+                throw invalidDiff();
+            chunks.push(Buffer.from([byte]));
+        }
+    }
+    throw invalidDiff();
 }
 /** 解析 unified diff，返回每个文件的新增行与新行号。 */
 export function parseDiff(diff, cwd) {
     const files = [];
     let current = null;
     let newLine = 0;
+    let oldRemaining = 0;
+    let newRemaining = 0;
+    let hasFileHeader = false;
     for (const raw of diff.split(/\r?\n/)) {
-        const file = isNewFileHeader(raw);
-        if (file !== null) {
-            current = { file: file.replace(/\\/g, '/'), added: [] };
-            files.push(current);
-            newLine = 0;
+        // Interpret hunk bodies before headers: source text may itself start "+++".
+        if (oldRemaining > 0 || newRemaining > 0) {
+            if (raw.startsWith('\\'))
+                continue;
+            if (raw.startsWith('+') && newRemaining > 0) {
+                current?.added.push({ line: newLine, text: raw.slice(1) });
+                newRemaining--;
+                newLine++;
+            }
+            else if (raw.startsWith('-') && oldRemaining > 0) {
+                oldRemaining--;
+            }
+            else if (raw.startsWith(' ') && oldRemaining > 0 && newRemaining > 0) {
+                if (current !== null)
+                    (current.context ??= []).push({ line: newLine, text: raw.slice(1) });
+                oldRemaining--;
+                newRemaining--;
+                newLine++;
+            }
+            else {
+                throw invalidDiff();
+            }
             continue;
         }
-        const hunk = /^@@\s+-\d+(?:,\d+)?\s+\+(\d+)(?:,\d+)?\s+@@/.exec(raw);
-        if (hunk !== null && current !== null) {
-            newLine = Number(hunk[1]);
+        if (raw.startsWith('diff --git ')) {
+            current = null;
+            hasFileHeader = false;
             continue;
         }
-        if (current === null)
-            continue;
-        if (raw.startsWith('+++') || raw.startsWith('---'))
+        if (raw.startsWith('+++ ')) {
+            const file = decodeGitPath(raw.slice(4));
+            if (file !== '/dev/null' && (!file.startsWith('b/') || file.length <= 2))
+                throw invalidDiff();
+            current = file === '/dev/null' ? null : { file: file.slice(2), added: [] };
+            if (current !== null)
+                files.push(current);
+            hasFileHeader = true;
+            newLine = 0;
             continue;
-        if (raw.startsWith('+')) {
-            current.added.push({ line: newLine, text: raw.slice(1) });
-            newLine += 1;
-        }
-        else if (raw.startsWith('-')) {
-            // removed line: new line number stays
         }
-        else {
-            newLine += 1;
+        const hunk = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/.exec(raw);
+        if (hunk !== null) {
+            if (!hasFileHeader)
+                throw invalidDiff();
+            oldRemaining = Number(hunk[2] ?? 1);
+            newRemaining = Number(hunk[4] ?? 1);
+            newLine = Number(hunk[3]);
+            if (![oldRemaining, newRemaining, newLine].every(Number.isSafeInteger) || newRemaining > 0 && newLine < 1)
+                throw invalidDiff();
+            continue;
         }
+        if (raw.startsWith('@@') || raw.startsWith('+') || raw.startsWith('-') && !raw.startsWith('--- '))
+            throw invalidDiff();
     }
+    if (oldRemaining > 0 || newRemaining > 0)
+        throw invalidDiff();
     return files;
 }
 function makeDiffId(ruleId, file, line, snippet) {
@@ -75,13 +147,19 @@ export function scanDiff(diff, cwd, policy) {
     const parsed = parseDiff(diff, cwd);
     const findings = [];
     let addedLines = 0;
+    let filesSkipped = 0;
     for (const file of parsed) {
-        addedLines += file.added.length;
         const rel = path.isAbsolute(file.file) ? path.relative(cwd, file.file) : file.file;
-        findings.push(...scanLineSet(file.added, rel, policy).map((finding) => ({ ...finding, id: makeDiffId(finding.ruleId, rel, finding.line, finding.snippet) })));
+        if (isExcludedPath(rel, policy)) {
+            filesSkipped++;
+            continue;
+        }
+        addedLines += file.added.length;
+        const entries = [...(file.context ?? []), ...file.added].sort((a, b) => a.line - b.line);
+        findings.push(...scanLineSet(entries, rel, policy, new Set(file.added.map(line => line.line))).map((finding) => ({ ...finding, id: makeDiffId(finding.ruleId, rel, finding.line, finding.snippet) })));
     }
     findings.sort((a, b) => severityOrder(b.severity) - severityOrder(a.severity) || a.file.localeCompare(b.file) || a.line - b.line);
-    return { base: 'HEAD', filesChanged: parsed.length, addedLines, findings, diff };
+    return { base: 'HEAD', filesChanged: parsed.length, filesScanned: parsed.length - filesSkipped, filesSkipped, addedLines, findings, diff };
 }
 function severityOrder(severity) {
     return severity === 'critical' ? 4 : severity === 'high' ? 3 : severity === 'medium' ? 2 : 1;

package/lib/extra.d.ts

@@ -5,4 +5,4 @@
  */
 import { type ResolvedSecureConfig } from './config.js';
 import type { SecureToolDefinition } from './tools.js';
-export declare function buildExtraTools(cfg: ResolvedSecureConfig, cwd: string): SecureToolDefinition[];
+export declare function buildExtraTools(cfg: ResolvedSecureConfig, cwd: string, signal?: AbortSignal): SecureToolDefinition[];

package/lib/extra.js

@@ -6,7 +6,7 @@
 import path from 'node:path';
 import { optionalString, requiredString } from './config.js';
 import { scanDeps } from './deps.js';
-import { loadState, saveBaseline } from './state.js';
+import { findingFingerprint, loadState, saveBaseline } from './state.js';
 function compileParameters(spec) {
     const properties = {};
     const required = [];
@@ -22,7 +22,7 @@ function compileParameters(spec) {
     }
     return { type: 'object', properties, ...(required.length > 0 ? { required } : {}) };
 }
-export function buildExtraTools(cfg, cwd) {
+export function buildExtraTools(cfg, cwd, signal) {
     const stateDir = cfg.stateDir;
     const secureBaseline = {
         name: 'secure_baseline',
@@ -48,10 +48,10 @@ export function buildExtraTools(cfg, cwd) {
                 target: state.last.target,
                 reason,
                 findings: state.last.findings,
-                fingerprints: state.last.fingerprints,
+                fingerprints: state.last.findings.map(findingFingerprint),
                 counts: state.last.counts,
             };
-            const file = await saveBaseline(stateDir, baseline);
+            const file = await saveBaseline(stateDir, baseline, signal);
             return { file, acceptedCount: baseline.findings.length, baseline };
         },
         timeoutMs: 10000,

package/lib/index.d.ts

@@ -2,8 +2,9 @@
  * dsh-code-security —— AI 代码安全审查插件（node 半身，配置走 cordis.patch.yml）。
  *
  * 插件导出 apply(ctx, config)：注册 secure_scan / secure_diff / secure_fix_verify /
- * secure_report / secure_export / secure_policy_show / secure_policy_set 七个工具。扫描为纯确定性规则，
- * git diff 通过官方 subprocess 服务执行，零运行时依赖。
+ * secure_report / secure_export / secure_baseline / secure_deps / secure_policy_show /
+ * secure_policy_set / secure_health 十个工具。扫描为纯确定性规则，
+ * git diff 通过官方 subprocess 服务执行，仅依赖文件锁库。
  *
  * @module dsh-code-security
  */

package/lib/index.js

@@ -2,8 +2,9 @@
  * dsh-code-security —— AI 代码安全审查插件（node 半身，配置走 cordis.patch.yml）。
  *
  * 插件导出 apply(ctx, config)：注册 secure_scan / secure_diff / secure_fix_verify /
- * secure_report / secure_export / secure_policy_show / secure_policy_set 七个工具。扫描为纯确定性规则，
- * git diff 通过官方 subprocess 服务执行，零运行时依赖。
+ * secure_report / secure_export / secure_baseline / secure_deps / secure_policy_show /
+ * secure_policy_set / secure_health 十个工具。扫描为纯确定性规则，
+ * git diff 通过官方 subprocess 服务执行，仅依赖文件锁库。
  *
  * @module dsh-code-security
  */

package/lib/policy.d.ts

@@ -19,6 +19,6 @@ export declare const POLICY_FILE = ".code-security.json";
 export declare function policyPath(cwd: string): string;
 export declare function loadPolicy(cwd: string): Promise<SecurePolicy>;
 export declare function normalizePolicy(obj: Record<string, unknown>): SecurePolicy;
-export declare function savePolicy(cwd: string, policy: SecurePolicy): Promise<string>;
+export declare function savePolicy(cwd: string, policy: SecurePolicy, signal?: AbortSignal): Promise<string>;
 export declare function policyExcludesDir(policy: SecurePolicy, rel: string): boolean;
 export declare function policyIgnores(policy: SecurePolicy, ruleId: string, file: string): boolean;

package/lib/policy.js

@@ -5,6 +5,7 @@
  */
 import fs from 'node:fs/promises';
 import path from 'node:path';
+import { randomUUID } from 'node:crypto';
 export const DEFAULT_POLICY = Object.freeze({
     version: 1,
     exclude: [],
@@ -21,7 +22,9 @@ export async function loadPolicy(cwd) {
         const obj = (parsed ?? {});
         return normalizePolicy(obj);
     }
-    catch {
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw new Error('安全策略无法读取或格式无效，原文件已保留：' + (error instanceof Error ? error.message : String(error)));
         return { ...DEFAULT_POLICY, exclude: [...DEFAULT_POLICY.exclude], ignore: [] };
     }
 }
@@ -33,6 +36,8 @@ export function normalizePolicy(obj) {
         if (typeof item !== 'object' || item === null)
             continue;
         const rec = item;
+        if (!(typeof rec.ruleId === 'string' && rec.ruleId.trim() !== '') && !(typeof rec.file === 'string' && rec.file.trim() !== ''))
+            throw new Error('每条忽略规则必须指定 ruleId 或 file，空规则不能禁用全部检查。');
         ignore.push({
             ruleId: typeof rec.ruleId === 'string' && rec.ruleId !== '' ? rec.ruleId : undefined,
             file: typeof rec.file === 'string' && rec.file !== '' ? rec.file : undefined,
@@ -42,11 +47,18 @@ export function normalizePolicy(obj) {
     const failOn = obj.failOn === 'critical' || obj.failOn === 'high' || obj.failOn === 'medium' || obj.failOn === 'low' ? obj.failOn : undefined;
     return { version: 1, exclude, ignore, failOn };
 }
-export async function savePolicy(cwd, policy) {
+export async function savePolicy(cwd, policy, signal) {
+    signal?.throwIfAborted();
     const file = policyPath(cwd);
-    const tmp = file + '.tmp-' + process.pid;
-    await fs.writeFile(tmp, JSON.stringify(policy, null, 2) + '\n', 'utf8');
-    await fs.rename(tmp, file);
+    const tmp = file + '.tmp-' + randomUUID();
+    try {
+        await fs.writeFile(tmp, JSON.stringify(policy, null, 2) + '\n', { flag: 'wx', mode: 0o600, signal });
+        signal?.throwIfAborted();
+        await fs.rename(tmp, file);
+    }
+    finally {
+        await fs.unlink(tmp).catch(() => { });
+    }
     return file;
 }
 function globToRegex(glob) {

package/lib/runner.d.ts

@@ -12,6 +12,8 @@ export interface RunResult {
 export interface ProcessRunner {
     run(argv: readonly string[], options?: {
         timeoutMs?: number;
+        cwd?: string;
+        signal?: AbortSignal;
     }): Promise<RunResult>;
 }
 export interface SubprocessHandleLike {

package/lib/runner.js

@@ -9,14 +9,16 @@ export function createSubprocessRunner(spawn, graceMs, defaultTimeoutMs) {
         async run(argv, options) {
             const timeoutMs = options?.timeoutMs ?? defaultTimeoutMs;
             const controller = new AbortController();
+            const signal = options?.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal;
+            signal.throwIfAborted();
             const timer = setTimeout(() => controller.abort(new Error('git diff timed out')), timeoutMs);
             try {
                 const handle = spawn({
                     argv,
-                    cwd: process.cwd(),
+                    cwd: options?.cwd ?? process.cwd(),
                     stdio: { stdin: 'ignore', stdout: { maxBytes: COLLECT_BYTES }, stderr: { maxBytes: COLLECT_BYTES } },
                     graceMs,
-                    signal: controller.signal,
+                    signal,
                 });
                 const outcome = await handle.done;
                 return {

package/lib/scanner.d.ts

@@ -30,14 +30,17 @@ export interface ScanOptions {
     maxFiles: number;
     maxFileBytes: number;
     policy: SecurePolicy;
+    signal?: AbortSignal;
 }
 export interface LineEntry {
     line: number;
     text: string;
 }
 /** 对带行号的文本行应用规则（全量扫描与 git diff 增量扫描共用）。 */
-export declare function scanLineSet(entries: LineEntry[], rel: string, policy: SecurePolicy): Finding[];
+export declare function scanLineSet(entries: LineEntry[], rel: string, policy: SecurePolicy, selectedLines?: ReadonlySet<number>): Finding[];
 /** 扫描单个文件内容，按语言与行应用规则。 */
 export declare function scanText(content: string, file: string, rel: string, policy: SecurePolicy): Finding[];
+/** Apply the same exclusions to full scans, directly selected files and diffs. */
+export declare function isExcludedPath(rel: string, policy: SecurePolicy): boolean;
 /** 扫描目录或单个文件。 */
 export declare function scanPath(options: ScanOptions): Promise<ScanResult>;

package/lib/scanner.js

@@ -64,7 +64,7 @@ function shannon(text) {
 }
 const TOKEN_PATTERN = /['"]([A-Za-z0-9+/=_-]{24,})['"]/g;
 const HIGH_ENTROPY_THRESHOLD = 3.8;
-function detectHighEntropy(line, lineNumber, file, rel, rule) {
+function detectHighEntropy(line, lineNumber, rel, rule) {
     const findings = [];
     for (const match of line.matchAll(TOKEN_PATTERN)) {
         const token = match[1];
@@ -94,24 +94,68 @@ function makeId(ruleId, file, line, snippet) {
     const hash = createHash('sha256').update(ruleId + '|' + file + '|' + line + '|' + snippet.slice(0, 80)).digest('hex').slice(0, 10);
     return 'SR-' + hash;
 }
+function scanFileRule(entries, rel, rule, disabledNext, selectedLines) {
+    let block = [];
+    const checkBlock = () => {
+        if (block.length === 0)
+            return undefined;
+        const text = block.map(entry => entry.text).join('\n');
+        let best;
+        for (const pattern of rule.patterns) {
+            const regex = new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : pattern.flags + 'g');
+            for (const match of text.matchAll(regex)) {
+                const index = match.index;
+                const start = text.slice(0, index).split('\n').length - 1;
+                const end = start + match[0].split('\n').length - 1;
+                if (selectedLines !== undefined && !block.slice(start, end + 1).some(entry => selectedLines.has(entry.line)))
+                    continue;
+                if (best === undefined || index < best.index)
+                    best = { index, start, end };
+                break;
+            }
+        }
+        if (best === undefined)
+            return undefined;
+        const line = block[best.start].line;
+        const snippet = block.slice(best.start, best.end + 1).map(entry => entry.text).join('\n');
+        return {
+            id: makeId(rule.id, rel, line, snippet), ruleId: rule.id, title: rule.title,
+            cwe: rule.cwe, severity: rule.severity, confidence: rule.confidence,
+            file: rel, line, snippet: snippet.trim().slice(0, 200), message: rule.message,
+        };
+    };
+    for (const entry of entries) {
+        const suppressed = isComment(entry.text) || shouldSkipLine(rule, disabledNext.get(entry.line));
+        if (suppressed || block.length > 0 && entry.line !== block.at(-1).line + 1) {
+            const finding = checkBlock();
+            if (finding !== undefined)
+                return finding;
+            block = [];
+        }
+        if (!suppressed)
+            block.push(entry);
+    }
+    return checkBlock();
+}
 /** 对带行号的文本行应用规则（全量扫描与 git diff 增量扫描共用）。 */
-export function scanLineSet(entries, rel, policy) {
+export function scanLineSet(entries, rel, policy, selectedLines) {
     const language = languageForFile(rel);
     const findings = [];
-    const applied = RULES.filter((rule) => rule.languages.includes(language) || rule.languages.includes('any'));
+    const applied = RULES.filter((rule) => (rule.languages.includes(language) || rule.languages.includes('any')) && !policyIgnores(policy, rule.id, rel));
+    const entropyRule = applied.find((rule) => rule.id === 'SEC-304');
     const prevDisable = new Map();
     for (const entry of entries) {
         if (isComment(entry.text))
             prevDisable.set(entry.line + 1, disabledRules(entry.text, DISABLE_NEXT));
     }
     for (const entry of entries) {
+        if (selectedLines !== undefined && !selectedLines.has(entry.line))
+            continue;
         const isCommentLine = isComment(entry.text);
         const currentDisable = isCommentLine ? disabledRules(entry.text, DISABLE_LINE) : null;
         for (const rule of applied) {
             if (rule.id === 'SEC-304')
                 continue;
-            if (policyIgnores(policy, rule.id, rel))
-                continue;
             if (shouldSkipLine(rule, currentDisable) || shouldSkipLine(rule, prevDisable.get(entry.line)))
                 continue;
             if (rule.fileLevel === true)
@@ -133,41 +177,30 @@ export function scanLineSet(entries, rel, policy) {
                 message: rule.message,
             });
         }
-        const entropyRule = RULES.find((rule) => rule.id === 'SEC-304');
-        if (entropyRule !== undefined && !policyIgnores(policy, entropyRule.id, rel) && !isCommentLine && !shouldSkipLine(entropyRule, currentDisable) && !shouldSkipLine(entropyRule, prevDisable.get(entry.line))) {
-            findings.push(...detectHighEntropy(entry.text, entry.line, rel, rel, entropyRule));
+        if (entropyRule !== undefined && !isCommentLine && !shouldSkipLine(entropyRule, currentDisable) && !shouldSkipLine(entropyRule, prevDisable.get(entry.line))) {
+            findings.push(...detectHighEntropy(entry.text, entry.line, rel, entropyRule));
         }
     }
+    for (const rule of applied) {
+        if (rule.fileLevel !== true)
+            continue;
+        const finding = scanFileRule(entries, rel, rule, prevDisable, selectedLines);
+        if (finding !== undefined)
+            findings.push(finding);
+    }
     return findings;
 }
 /** 扫描单个文件内容，按语言与行应用规则。 */
 export function scanText(content, file, rel, policy) {
     const lines = content.split(/\r?\n/);
     const entries = lines.map((text, index) => ({ line: index + 1, text }));
-    const findings = scanLineSet(entries, rel, policy);
-    const language = languageForFile(rel);
-    const applied = RULES.filter((rule) => rule.languages.includes(language) || rule.languages.includes('any'));
-    for (const rule of applied) {
-        if (rule.fileLevel !== true)
-            continue;
-        if (policyIgnores(policy, rule.id, rel))
-            continue;
-        if (rule.patterns.some((pattern) => pattern.test(content))) {
-            findings.push({
-                id: makeId(rule.id, rel, 1, content.slice(0, 80)),
-                ruleId: rule.id,
-                title: rule.title,
-                cwe: rule.cwe,
-                severity: rule.severity,
-                confidence: rule.confidence,
-                file: rel,
-                line: 1,
-                snippet: content.slice(0, 200),
-                message: rule.message,
-            });
-        }
-    }
-    return findings;
+    // Match file rules over contiguous lines, sharing locations and suppressions
+    // with incremental scans without joining unrelated diff hunks.
+    return scanLineSet(entries, rel, policy);
+}
+/** Apply the same exclusions to full scans, directly selected files and diffs. */
+export function isExcludedPath(rel, policy) {
+    return rel.split('/').some((part) => DEFAULT_EXCLUDE_DIRS.includes(part)) || policyExcludesDir(policy, rel);
 }
 /** 扫描目录或单个文件。 */
 export async function scanPath(options) {
@@ -177,18 +210,28 @@ export async function scanPath(options) {
     let filesScanned = 0;
     let filesSkipped = 0;
     const findings = [];
-    const relRoot = path.relative(cwd, root) || '.';
+    const relRoot = path.relative(cwd, root).split(path.sep).join('/');
     const visit = async (absolute, rel) => {
+        options.signal?.throwIfAborted();
+        if (isExcludedPath(rel, policy)) {
+            filesSkipped += 1;
+            return;
+        }
         let stat;
         try {
-            stat = await fs.stat(absolute);
+            stat = await fs.lstat(absolute);
         }
         catch {
             filesSkipped += 1;
             return;
         }
+        options.signal?.throwIfAborted();
+        if (stat.isSymbolicLink()) {
+            filesSkipped += 1;
+            return;
+        }
         if (stat.isDirectory()) {
-            if (DEFAULT_EXCLUDE_DIRS.includes(path.basename(absolute)) || policyExcludesDir(policy, rel))
+            if (DEFAULT_EXCLUDE_DIRS.includes(path.basename(absolute)))
                 return;
             let entries;
             try {
@@ -226,6 +269,7 @@ export async function scanPath(options) {
             return;
         }
         filesScanned += 1;
+        options.signal?.throwIfAborted();
         const text = new TextDecoder('utf-8', { fatal: false }).decode(buffer);
         findings.push(...scanText(text, absolute, rel, policy));
     };

package/lib/state.d.ts

@@ -40,8 +40,8 @@ export interface StateDocument {
 export declare function findingFingerprint(finding: Finding): string;
 export declare function statePath(stateDir: string): string;
 export declare function loadState(stateDir: string): Promise<StateDocument>;
-export declare function saveState(stateDir: string, entry: ScanStateEntry): Promise<string>;
-export declare function saveBaseline(stateDir: string, baseline: BaselineEntry): Promise<string>;
+export declare function saveState(stateDir: string, entry: ScanStateEntry, signal?: AbortSignal): Promise<string>;
+export declare function saveBaseline(stateDir: string, baseline: BaselineEntry, signal?: AbortSignal): Promise<string>;
 export declare function countFindings(findings: Finding[]): {
     critical: number;
     high: number;