easyvibegate 0.4.4 → 0.6.2

package/dist/engine/checkers/static/secrets.js

@@ -1,9 +1,51 @@
 import { decodeJwtPayload, lineAt, looksLikePlaceholder, redact, shannonEntropy } from '../../util/text.js';
+import { createExposure } from '../../util/git-exposure.js';
+import { partitionIgnores } from '../../config.js';
+/** No project-wide rules — used to run ONLY the inline-marker half of partitionIgnores. */
+const EMPTY_CONFIG = { ignore: [], ignorePaths: [] };
+/** Lower number = more severe. One copy, used both to cap a severity and to rank duplicates. */
+const SEVERITY_RANK = { critical: 0, warning: 1, info: 2, advisory: 3 };
+const atMost = (sev, cap) => (SEVERITY_RANK[sev] < SEVERITY_RANK[cap] ? cap : sev);
 /** Real tokens mix case and digits; kebab-case identifiers do not. */
 function looksRandom(s) {
     const body = s.replace(/^[a-z]+[-_]/i, '');
     return /[A-Z]/.test(body) && /[0-9]/.test(body) && shannonEntropy(body) >= 3.2;
 }
+/**
+ * Detectors whose match is key MATERIAL by structure (a vendor prefix plus a
+ * random body, a PEM block, a DB password), as opposed to the name-based
+ * heuristics (generic_secret / env_secret). A hit from one of these in a
+ * docs/fixtures path is still a leak if the value is real — a fresh RSA key
+ * pasted into docs/deploy.md was once downgraded to info and PASSed the gate.
+ */
+const HIGH_CONFIDENCE = new Set([
+    'openai_key', 'anthropic_key', 'aws_key', 'stripe_live', 'github_token', 'slack_token',
+    'sendgrid_key', 'hf_token', 'npm_token', 'db_url_password', 'supabase_secret_key', 'private_key',
+]);
+const PEM_END = /-----END (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/;
+/**
+ * Whether a high-confidence hit has the body of a real credential, so a
+ * docs/example path alone must not silence it. Anything obviously hand-typed
+ * (a PEM with no base64 body, a DB URL whose password is a plain word, a key
+ * with no digits) is treated as a sample and may still go to info.
+ */
+function looksLikeRealMaterial(id, hit, content, index, group) {
+    if (id === 'private_key') {
+        // The regex only matches the header; the material is what follows it.
+        const rest = content.slice(index + hit.length);
+        const endAt = rest.search(PEM_END);
+        const body = (endAt >= 0 ? rest.slice(0, endAt) : rest.slice(0, 4096)).replace(/\s+/g, '');
+        return body.length >= 64 && /^[A-Za-z0-9+/=]+$/.test(body);
+    }
+    if (id === 'db_url_password') {
+        const pw = group ?? '';
+        return /[0-9]/.test(pw) && /[A-Za-z]/.test(pw) && shannonEntropy(pw) >= 3.0;
+    }
+    if (id === 'aws_key')
+        return /[0-9]/.test(hit);
+    return looksRandom(hit);
+}
+const DEFAULT_PASSWORDS = new Set(['postgres', 'password', 'passw0rd', 'secret', 'root', 'admin', 'test', 'dev', 'changeme', 'example', 'mysql', 'redis', 'mongo', 'user', 'guest', '123456', '12345678']);
 const PATTERNS = [
     {
         id: 'openai_key',
@@ -91,6 +133,22 @@ const PATTERNS = [
         re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|mssql):\/\/[^\s:/@"']+:([^\s:/@"']{4,})@[^\s"']+/gi,
         severity: 'critical',
         fix: 'Move the connection string to a server-side env var and rotate the database password — a committed DB URL grants full data access.',
+        // `postgres://opencut:opencut@localhost` in docker-compose / CI / a Dockerfile
+        // is a local container's default login, not a credential. A password that
+        // equals the user name, or is a well-known default, is never reported; a
+        // weak password on a local/single-label host (a compose service name) is
+        // not either. A real-looking password on a real host still is.
+        validate: (hit) => {
+            const m = /^[a-z+]+:\/\/([^\s:/@"']+):([^\s:/@"']+)@([^/\s:"']+)/i.exec(hit);
+            if (!m)
+                return true;
+            const [, user = '', pw = '', host = ''] = m;
+            if (pw.toLowerCase() === user.toLowerCase() || DEFAULT_PASSWORDS.has(pw.toLowerCase()))
+                return false;
+            const local = /^(localhost|127\.0\.0\.1|0\.0\.0\.0|host\.docker\.internal|[a-z0-9_-]+)$/i.test(host);
+            const strong = /[0-9]/.test(pw) && /[A-Za-z]/.test(pw) && shannonEntropy(pw) >= 3.0;
+            return !(local && !strong);
+        },
     },
     {
         id: 'supabase_secret_key',
@@ -107,11 +165,37 @@ const PATTERNS = [
         fix: 'Remove the private key from the repo, rotate the key pair, and store secrets outside source control.',
     },
 ];
-const GENERIC = /(?:api[_-]?key|secret|token|passwd|password|pwd|auth[_-]?token|access[_-]?token|client[_-]?secret|credential)["']?\s*[:=]\s*["']([^"']{8,})["']/gi;
+const GENERIC = /\b([A-Za-z0-9_-]*(?:api[_-]?key|secret|token|passwd|password|pwd|credential))["']?\s*[:=]\s*["']([^"']{8,})["']/gi;
+/**
+ * Names that contain "token"/"secret" but are not credentials: API cursors,
+ * tracking ids, CSRF nonces, push tokens. 559 of 569 generic hits in one real
+ * project were `tracking_token` / `pagination_token` inside cached API
+ * responses.
+ */
+const NON_SECRET_NAME = /(pagination|tracking|page|next|prev|continuation|cursor|csrf|xsrf|cancel|request|device|push|fcm|expo|invite|share|verification|unsubscribe|reset|confirm|session)/i;
+/** Base64 blobs (thumbnails, binary) and anything longer than a real token. */
+const looksLikeBlob = (v) => v.length > 200 || /^(\/9j\/|iVBOR|data:|R0lGOD|UklGR)/.test(v);
 const JWT = /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g;
 // KEY=value / key: value / Dockerfile ENV|ARG KEY=value, with a secret-looking NAME.
 const ASSIGN = /^[ \t]*(?:export[ \t]+|ENV[ \t]+|ARG[ \t]+)?([A-Za-z_][A-Za-z0-9_.-]*)[ \t]*[:=][ \t]*(.+)$/gm;
 const SECRET_NAME = /(secret|token|password|passwd|private[_-]?key|api[_-]?key|access[_-]?key|credential)/i;
+/**
+ * Shell-style `NAME=value` anywhere in a line, in any file: `PGPASSWORD=… psql`,
+ * `TOKEN=… curl`, a permission rule in .claude/settings.local.json. Upper-case
+ * names only, so prose like "password=…" in docs does not count.
+ *
+ * The leading class is `*` (zero or more), not `+`: a bare name that IS one of
+ * the keywords (`SECRET=…`, `TOKEN=…`, `API_KEY=…`, no prefix at all — an
+ * extremely common shape in real scripts) needs zero characters before the
+ * keyword, and requiring at least one meant those never matched at all. There
+ * is deliberately no trailing lookahead: `{8,}` on a fixed character class
+ * already stops at the first character outside it, so a value followed by
+ * `;`, `)`, `,` or `]` (`export TOKEN=abc123;`, `foo(SECRET=abc123)`) still
+ * matches correctly — an earlier version's trailing negative lookahead
+ * rejected exactly those common shell/call-site endings.
+ */
+// Values are ASCII token characters: `PASSWORD=та_же_что_и_выше` in a README is prose.
+const INLINE_ENV = /\b([A-Z0-9_]*(?:PASSWORD|PASSWD|SECRET|TOKEN|API_KEY|ACCESS_KEY|PRIVATE_KEY)[A-Z0-9_]*)=([A-Za-z0-9_\-./+=:@]{8,})/g;
 /** Only .env* files are "server env by design" — a secret there is a warning
  *  (env-git flags committing it). In real code/config it stays a source leak. */
 function isEnvFile(rel) {
@@ -138,22 +222,100 @@ export const secretsChecker = {
     level: 0,
     run(ctx) {
         const findings = [];
+        const exposure = createExposure(ctx.root);
+        // Values from the REAL env files, per directory. A committed .env.example
+        // that carries the same value as its sibling .env is not an example — it is
+        // the key, published. (Seen in the wild: OPENAI/ANTHROPIC keys identical
+        // in .env and a committed .env.example.)
+        const realEnvValues = new Map();
+        for (const f of ctx.files) {
+            if (!isEnvFile(f.rel))
+                continue;
+            const dir = f.rel.includes('/') ? f.rel.slice(0, f.rel.lastIndexOf('/')) : '';
+            const set = realEnvValues.get(dir) ?? new Set();
+            for (const m of f.content.matchAll(ASSIGN)) {
+                const v = (m[2] ?? '').trim().replace(/^["']|["']$/g, '').replace(/["'].*$/, '');
+                if (v.length >= 8)
+                    set.add(v);
+            }
+            realEnvValues.set(dir, set);
+        }
+        const dirOf = (rel) => (rel.includes('/') ? rel.slice(0, rel.lastIndexOf('/')) : '');
+        const isExampleEnv = (rel) => /(^|\/)\.env[^/]*\.(example|sample|template|dist)$/i.test(rel) || /(^|\/)(example|sample)\.env$/i.test(rel);
         for (const file of ctx.files) {
             const { rel } = file;
             const content = file.content.replace(/^\uFEFF/, ''); // a BOM must not eat line 1
             const env = isEnvFile(rel);
             const example = isExampleContext(rel);
-            const push = (f) => {
-                if (example) {
-                    findings.push({
+            const ex = exposure(rel);
+            // `proven` = the hit is structurally real key material (see
+            // looksLikeRealMaterial). A docs/fixture path may only downgrade a
+            // heuristic or sample-looking hit to info; proven material stays at
+            // warning there — the path lowers confidence, it does not make it safe.
+            /**
+             * Severity = what the value is × how it can leak. The pattern says what it
+             * is; the example/docs path lowers confidence; git exposure decides how
+             * bad it is. `raw` is the unredacted value, only compared, never stored.
+             */
+            const push = (f, proven = false, raw) => {
+                let out = f;
+                const realValueInExample = !!raw && isExampleEnv(rel) && (realEnvValues.get(dirOf(rel))?.has(raw) ?? false);
+                if (realValueInExample) {
+                    // Not an example at all: the live value copied into the example file.
+                    out = {
+                        ...f,
+                        severity: ex === 'committed' ? 'critical' : 'warning',
+                        title: `${f.title} — the REAL value from .env, in an example file${ex === 'committed' ? ' that is committed' : ''}`,
+                        detail: `${f.detail} This value is identical to the one in the sibling .env: the example file carries the real credential${ex === 'committed' ? ', and it is committed to git' : ''}.`,
+                        fix: 'Replace the value in the example file with a placeholder, and rotate the credential — it has been published.',
+                    };
+                }
+                else if (example && proven) {
+                    out = {
+                        ...f,
+                        severity: f.severity === 'critical' ? 'warning' : f.severity,
+                        title: `${f.title} (in docs/example path — looks real)`,
+                        detail: `${f.detail} The path suggests documentation or a fixture, but the value has the structure of real key material — verify it, and rotate it if it is genuine.`,
+                    };
+                }
+                else if (example) {
+                    out = {
                         ...f,
                         severity: 'info',
                         title: `${f.title} (in docs/example file)`,
                         detail: `${f.detail} This looks like documentation or a fixture — confirm it is not a real credential.`,
-                    });
+                    };
                 }
-                else
-                    findings.push(f);
+                // Git exposure. A committed secret keeps its full severity. Everything
+                // else cannot leak through the repository right now: an ignored file is
+                // doing exactly what it should (advisory); an untracked file in a repo
+                // or a folder that is not a repo is hygiene, capped at warning.
+                if (!realValueInExample && out.severity !== 'info') {
+                    // A .env that is not committed is doing its job: secrets belong there.
+                    // Whether it WILL be committed (untracked, no .gitignore entry) is the
+                    // env-git check's finding, not this one's — reporting it twice at
+                    // warning is what made people stop reading.
+                    if (env && ex !== 'committed') {
+                        // This also covers `ex === 'ignored'`: an env file is always the
+                        // right place for a secret whether or not it's ALSO gitignored, so
+                        // there is nothing a separate ignored-env-file branch would add.
+                        out = { ...out, severity: 'advisory', detail: `${out.detail} Not committed — this is where the value belongs; keep the file out of git and out of client bundles.` };
+                    }
+                    else if (ex === 'ignored') {
+                        // Gitignored, but not an env file: a credential pasted into a tool
+                        // config or a script (a prod DB password inside a permission rule in
+                        // .claude/settings.local.json was reported as a mere advisory). It
+                        // cannot leak through git today; it still does not belong there.
+                        out = { ...out, severity: atMost(out.severity, 'warning'), detail: `${out.detail} The file is gitignored, so this cannot leak through git — but it is a credential pasted into a config/source file, not an env var. Move it to .env (also gitignored) so one \`git add -A\` or a shared zip never carries it.` };
+                    }
+                    else if (ex === 'untracked') {
+                        out = { ...out, severity: atMost(out.severity, 'warning'), detail: `${out.detail} The file is not committed yet — it is one \`git add -A\` away from being. Add it to .gitignore or move the value to an env var.` };
+                    }
+                    else if (ex === 'no-git') {
+                        out = { ...out, severity: atMost(out.severity, 'warning'), detail: `${out.detail} This folder is not a git repository, so nothing leaks through git; the risk is copying or zipping the folder. Move the value to an env var before this becomes a repo.` };
+                    }
+                }
+                findings.push(out);
             };
             for (const p of PATTERNS) {
                 for (const m of content.matchAll(p.re)) {
@@ -165,6 +327,7 @@ export const secretsChecker = {
                     // A secret in a server env/config file is expected — the risk is
                     // committing it (env-git flags that), so it is a warning, not a leak.
                     const severity = env && p.severity === 'critical' ? 'warning' : p.severity;
+                    const proven = HIGH_CONFIDENCE.has(p.id) && looksLikeRealMaterial(p.id, hit, content, m.index ?? 0, m[1]);
                     push({
                         id: p.id,
                         severity,
@@ -178,10 +341,11 @@ export const secretsChecker = {
                         file: rel,
                         line: lineAt(content, m.index ?? 0),
                         evidence: redact(hit),
-                    });
+                    }, proven, hit);
                 }
             }
             // Supabase service_role key (a JWT whose payload role is service_role).
+            // The decoded role proves what it is, so it is never a docs-only info.
             for (const m of content.matchAll(JWT)) {
                 const payload = decodeJwtPayload(m[0]);
                 if (payload && payload['role'] === 'service_role') {
@@ -200,12 +364,19 @@ export const secretsChecker = {
                         file: rel,
                         line: lineAt(content, m.index ?? 0),
                         evidence: redact(m[0]),
-                    });
+                    }, true, m[0]);
                 }
             }
             // Quoted key/secret assignments in code, filtered by placeholder + entropy.
             for (const m of content.matchAll(GENERIC)) {
-                const value = m[1] ?? '';
+                const name = m[1] ?? '';
+                const value = m[2] ?? '';
+                if (NON_SECRET_NAME.test(name) || looksLikeBlob(value))
+                    continue;
+                // Credentials have no whitespace ("Show password" is UI text) and carry
+                // digits or real length ("build-time-secret" is a label).
+                if (/\s/.test(value) || (!/[0-9]/.test(value) && value.length < 24))
+                    continue;
                 if (looksLikePlaceholder(value) || shannonEntropy(value) < 3.2)
                     continue;
                 push({
@@ -219,7 +390,32 @@ export const secretsChecker = {
                     file: rel,
                     line: lineAt(content, m.index ?? 0),
                     evidence: redact(value),
-                });
+                }, false, value);
+            }
+            // Inline shell-style assignments mid-line, outside env/config files (those
+            // go through ASSIGN below). A prod DB password inside a permission rule in
+            // .claude/settings.local.json was invisible to both other name-based rules.
+            if (!isConfigish(rel)) {
+                for (const m of content.matchAll(INLINE_ENV)) {
+                    const name = m[1] ?? '';
+                    const value = m[2] ?? '';
+                    if (looksLikePlaceholder(value) || shannonEntropy(value) < 3.0)
+                        continue;
+                    if (!/[0-9]/.test(value) && value.length < 24)
+                        continue;
+                    push({
+                        id: 'env_secret',
+                        severity: 'warning',
+                        title: 'Secret in an inline assignment',
+                        detail: `"${name}" is assigned a high-entropy value inline in ${rel}: ${redact(value)}`,
+                        fix: 'Move the value to a gitignored .env and reference it by name; rotate it if the file was ever shared.',
+                        checker: 'secrets',
+                        level: 0,
+                        file: rel,
+                        line: lineAt(content, m.index ?? 0),
+                        evidence: redact(value),
+                    }, false, value);
+                }
             }
             // name=value / key: value assignments (env, config, Dockerfile ENV/ARG).
             if (isConfigish(rel)) {
@@ -230,6 +426,9 @@ export const secretsChecker = {
                     const value = (m[2] ?? '').trim().replace(/^["']|["']$/g, '').replace(/["'].*$/, '');
                     if (value.length < 8 || looksLikePlaceholder(value) || shannonEntropy(value) < 3.0)
                         continue;
+                    // "build-time-secret" is a label, not a credential: real values carry digits or length.
+                    if (!/[0-9]/.test(value) && value.length < 24)
+                        continue;
                     push({
                         id: 'env_secret',
                         severity: 'warning',
@@ -243,20 +442,65 @@ export const secretsChecker = {
                         file: rel,
                         line: lineAt(content, m.index ?? 0),
                         evidence: redact(value),
-                    });
+                    }, false, value);
                 }
             }
         }
         // De-duplicate only true repeats: the same secret, same place, same rule.
         // (Keying on file:line alone hid every extra key on a minified line.)
-        const rank = { critical: 0, warning: 1, info: 2, advisory: 3 };
         const seen = new Map();
         for (const f of findings) {
             const key = `${f.file ?? ''}:${f.line ?? 0}:${f.id}:${f.evidence ?? ''}`;
             const cur = seen.get(key);
-            if (!cur || rank[f.severity] < rank[cur.severity])
+            if (!cur || SEVERITY_RANK[f.severity] < SEVERITY_RANK[cur.severity])
                 seen.set(key, f);
         }
-        return [...seen.values()];
+        // A vendor pattern or a decoded JWT already identifies the value on a line;
+        // the name-based env_secret / generic_secret there is the same fact twice.
+        const NAME_BASED = new Set(['env_secret', 'generic_secret']);
+        const specificAt = new Set([...seen.values()].filter((f) => !NAME_BASED.has(f.id)).map((f) => `${f.file ?? ''}:${f.line ?? 0}`));
+        const kept = [...seen.values()].filter((f) => !(NAME_BASED.has(f.id) && specificAt.has(`${f.file ?? ''}:${f.line ?? 0}`)));
+        // Eleven advisories saying "secret in gitignored .env.local — fine" are one
+        // observation printed eleven times. Fold them into one line per file that
+        // names the variables; anything above advisory stays line by line.
+        //
+        // The final `applyIgnores` pass (scan.ts) only sees whatever this checker
+        // returns — once N findings become one summary Finding with a single
+        // `line`, a `// easyvibegate-ignore` comment placed above any secret but
+        // the first in the group can no longer reach it. Filter each candidate
+        // through the SAME inline-marker check first (an empty config so only the
+        // marker, not project-wide `ignore`/`ignorePaths` rules, applies here —
+        // those still run again, correctly, against whatever this returns), so an
+        // individually silenced secret is dropped before folding, not after.
+        const byFile = new Map();
+        for (const f of kept) {
+            if (f.id !== 'env_secret' || f.severity !== 'advisory' || !isEnvFile(f.file ?? ''))
+                continue;
+            byFile.set(f.file ?? '', [...(byFile.get(f.file ?? '') ?? []), f]);
+        }
+        const folded = new Set();
+        const summaries = [];
+        for (const [file, allCandidates] of byFile) {
+            const group = partitionIgnores(allCandidates, EMPTY_CONFIG, ctx.files).kept;
+            // A member the marker silenced must not reappear individually either —
+            // it is done with, not merely "too few left to fold".
+            for (const f of allCandidates)
+                if (!group.includes(f))
+                    folded.add(f);
+            if (group.length < 2)
+                continue;
+            for (const f of group)
+                folded.add(f);
+            const names = group.map((f) => /^"([^"]+)"/.exec(f.detail)?.[1] ?? '?');
+            const first = group.reduce((a, b) => ((a.line ?? 0) <= (b.line ?? 0) ? a : b));
+            summaries.push({
+                ...first,
+                title: `${group.length} secrets in ${file} (not committed — where they belong)`,
+                detail: `${file} holds ${group.length} secret-looking values (${names.join(', ')}). The file is not committed, so nothing leaks through git; keep it that way and out of client bundles.`,
+                fix: 'Nothing to change here. Keep the file gitignored; rotate any value that may ever have been committed or shared.',
+                evidence: undefined,
+            });
+        }
+        return [...kept.filter((f) => !folded.has(f)), ...summaries];
     },
 };

package/dist/engine/config.js

@@ -1,35 +1,119 @@
-import { readFileSync } from 'node:fs';
+import { existsSync, readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
+import { langForFile, lexCode } from './util/code-lex.js';
+import { lineAt } from './util/text.js';
 const DEFAULT_CONFIG = { ignore: [], ignorePaths: [] };
 const CONFIG_NAMES = ['easyvibegate.config.json', '.easyvibegaterc.json'];
+const KNOWN_KEYS = ['ignore', 'ignorePaths'];
+/**
+ * Validate a parsed config object. Returns a problem message or null.
+ * One validator for the explicit `--config` file and the auto-discovered one:
+ * a typo like "ignorePath" must be rejected the same way in both, otherwise it
+ * silently does nothing and the user believes their rules are in effect.
+ */
+export function validateConfig(parsed) {
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+        return 'must be a JSON object';
+    const cfg = parsed;
+    for (const key of KNOWN_KEYS) {
+        const v = cfg[key];
+        if (v === undefined)
+            continue;
+        if (!Array.isArray(v) || v.some((x) => typeof x !== 'string'))
+            return `"${key}" must be an array of strings`;
+    }
+    const unknown = Object.keys(cfg).filter((k) => !KNOWN_KEYS.includes(k));
+    if (unknown.length)
+        return `unknown key(s): ${unknown.join(', ')} (expected ${KNOWN_KEYS.join(', ')})`;
+    return null;
+}
+/** Read + parse + validate one config file. Every failure is a message, never a silent default. */
+function readConfigFile(path) {
+    try {
+        if (!existsSync(path))
+            return { problem: 'file not found' };
+        if (!statSync(path).isFile())
+            return { problem: 'not a file' };
+    }
+    catch (e) {
+        return { problem: `cannot read (${e instanceof Error ? e.message : String(e)})` };
+    }
+    let text;
+    try {
+        text = readFileSync(path, 'utf8');
+    }
+    catch (e) {
+        return { problem: `cannot read (${e instanceof Error ? e.message : String(e)})` };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (e) {
+        return { problem: `invalid JSON (${e instanceof Error ? e.message : String(e)})` };
+    }
+    const problem = validateConfig(parsed);
+    if (problem)
+        return { problem };
+    const raw = parsed;
+    return { config: { ignore: raw.ignore ?? [], ignorePaths: raw.ignorePaths ?? [] } };
+}
+/** Problem with a config file the user pointed at (missing, directory, bad JSON, bad shape), or null. */
+export function validateConfigFile(path) {
+    const r = readConfigFile(path);
+    return 'problem' in r ? r.problem : null;
+}
 export function loadConfig(root, explicitPath) {
     const candidates = explicitPath ? [explicitPath] : CONFIG_NAMES.map((n) => join(root, n));
     for (const p of candidates) {
-        let text;
-        try {
-            text = readFileSync(p, 'utf8');
-        }
-        catch {
-            continue; // no such config here — try the next candidate
-        }
-        try {
-            const raw = JSON.parse(text);
-            return {
-                ignore: Array.isArray(raw.ignore) ? raw.ignore : [],
-                ignorePaths: Array.isArray(raw.ignorePaths) ? raw.ignorePaths : [],
-            };
-        }
-        catch (e) {
-            // The file exists but is broken: say so instead of silently ignoring every rule.
-            return { ...DEFAULT_CONFIG, problem: `${p}: invalid JSON (${e instanceof Error ? e.message : String(e)})` };
-        }
+        // An auto-discovered name that is simply absent means "no config here".
+        // Anything else (present but unreadable, a directory, broken, misspelled
+        // keys) is a problem to report — the user's rules were NOT applied.
+        if (!explicitPath && !existsSync(p))
+            continue;
+        const r = readConfigFile(p);
+        return 'problem' in r ? { ...DEFAULT_CONFIG, problem: `${p}: ${r.problem}` } : r.config;
     }
     return DEFAULT_CONFIG;
 }
 const INLINE_MARKER = 'easyvibegate-ignore';
-/** Drop findings suppressed by config rules or inline `// easyvibegate-ignore` markers. */
-export function applyIgnores(findings, config, files) {
-    const byRel = new Map(files.map((f) => [f.rel, f.content.split('\n')]));
+/** Optional scope right after the marker: `easyvibegate-ignore: jwt_alg_none, config-risks`. */
+const SCOPE_RE = /^:[ \t]*([\w-]+(?:[ \t]*,[ \t]*[\w-]+)*)/;
+/**
+ * Lines that carry a suppression directive, with the ids it is scoped to
+ * (null = everything). Only a COMMENT token counts: the marker inside a string
+ * literal (`const label = "easyvibegate-ignore"`) is data and must not switch
+ * the scanner off for the next line. The lexer decides what a comment is per
+ * language: `//`, `#`, a block comment, `--` for SQL.
+ */
+function inlineDirectives(file) {
+    const lines = new Map();
+    for (const t of lexCode(file.content, langForFile(file.rel))) {
+        if (t.type !== 'comment' || !t.value.includes(INLINE_MARKER))
+            continue;
+        let at = t.value.indexOf(INLINE_MARKER);
+        while (at !== -1) {
+            const line = lineAt(file.content, t.start + at);
+            const scope = SCOPE_RE.exec(t.value.slice(at + INLINE_MARKER.length));
+            const ids = scope?.[1] ? scope[1].split(',').map((s) => s.trim()) : null;
+            const prev = lines.get(line);
+            if (ids === null || prev === null)
+                lines.set(line, null);
+            else
+                lines.set(line, new Set([...(prev ?? []), ...ids]));
+            at = t.value.indexOf(INLINE_MARKER, at + INLINE_MARKER.length);
+        }
+    }
+    return lines;
+}
+/**
+ * Split findings into kept and suppressed (config rules or inline markers).
+ * The suppressed half is returned so it can be counted — a rule that silences
+ * a finding should be visible somewhere, never just make it disappear.
+ */
+export function partitionIgnores(findings, config, files) {
+    const byRel = new Map(files.map((f) => [f.rel, f]));
+    const directives = new Map();
     const isConfigIgnored = (f) => {
         const keys = [f.id, f.checker];
         if (f.file)
@@ -43,12 +127,31 @@ export function applyIgnores(findings, config, files) {
     const isInlineIgnored = (f) => {
         if (!f.file || !f.line)
             return false;
-        const lines = byRel.get(f.file);
-        if (!lines)
+        const file = byRel.get(f.file);
+        if (!file)
             return false;
-        const current = lines[f.line - 1] ?? '';
-        const prev = f.line >= 2 ? lines[f.line - 2] ?? '' : '';
-        return current.includes(INLINE_MARKER) || prev.includes(INLINE_MARKER);
+        let lines = directives.get(f.file);
+        if (!lines) {
+            lines = inlineDirectives(file);
+            directives.set(f.file, lines);
+        }
+        // The marker applies to its own line or the line right below it.
+        for (const line of [f.line, f.line - 1]) {
+            if (!lines.has(line))
+                continue;
+            const scope = lines.get(line) ?? null;
+            if (scope === null || scope.has(f.id) || scope.has(f.checker))
+                return true;
+        }
+        return false;
     };
-    return findings.filter((f) => !isConfigIgnored(f) && !isInlineIgnored(f));
+    const kept = [];
+    const suppressed = [];
+    for (const f of findings)
+        (isConfigIgnored(f) || isInlineIgnored(f) ? suppressed : kept).push(f);
+    return { kept, suppressed };
+}
+/** Drop findings suppressed by config rules or inline `// easyvibegate-ignore` markers. */
+export function applyIgnores(findings, config, files) {
+    return partitionIgnores(findings, config, files).kept;
 }

package/dist/engine/detect.js

@@ -1,5 +1,7 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
+import { DNS_LABEL } from './util/text.js';
+const SUPABASE_URL_FALLBACK = new RegExp(`https?://${DNS_LABEL}\\.supabase\\.co`, 'i');
 /** Infer the project's frameworks, backends, languages and package managers. */
 export function detect(root, files) {
     const relSet = new Set(files.map((f) => f.rel));
@@ -26,30 +28,37 @@ export function detect(root, files) {
         else if (f.ext === '.rs')
             languages.add('rust');
     }
-    if (has('pnpm-lock.yaml'))
-        pms.add('pnpm');
-    if (has('package-lock.json'))
-        pms.add('npm');
-    if (has('yarn.lock'))
-        pms.add('yarn');
-    if (has('bun.lockb') || has('bun.lock'))
-        pms.add('bun');
     const pkg = files.find((f) => f.rel === 'package.json');
     let deps = {};
+    let declaredPackageManager;
     if (pkg) {
         try {
             const j = JSON.parse(pkg.content);
             deps = { ...(j.dependencies ?? {}), ...(j.devDependencies ?? {}) };
-            // The `packageManager` field (Corepack) is authoritative when present.
             const pmField = j.packageManager?.split('@')[0];
             if (pmField === 'pnpm' || pmField === 'yarn' || pmField === 'npm' || pmField === 'bun')
-                pms.add(pmField);
+                declaredPackageManager = pmField;
         }
         catch {
             /* ignore malformed package.json */
         }
     }
     const dep = (n) => n in deps;
+    // The `packageManager` field (Corepack) is authoritative, so it goes FIRST:
+    // `packageManagers[0]` is the manager the audit runs with. Adding it after
+    // the lockfiles let a stale pnpm-lock.yaml win over `packageManager: npm@10`.
+    // Lockfiles follow in preference order (a leftover package-lock.json beside
+    // pnpm-lock.yaml is the common stale one).
+    if (declaredPackageManager)
+        pms.add(declaredPackageManager);
+    if (has('pnpm-lock.yaml'))
+        pms.add('pnpm');
+    if (has('yarn.lock'))
+        pms.add('yarn');
+    if (has('bun.lockb') || has('bun.lock'))
+        pms.add('bun');
+    if (has('package-lock.json'))
+        pms.add('npm');
     if (dep('next'))
         frameworks.add('next');
     if (dep('react'))
@@ -92,8 +101,10 @@ export function detect(root, files) {
             frameworks.add('rails');
     }
     // Content fallback for projects without a package.json — kept strict to avoid
-    // false positives from code that merely mentions a backend by name.
-    if (!backends.has('supabase') && files.some((f) => /https?:\/\/[a-z0-9-]+\.supabase\.co/i.test(f.content))) {
+    // false positives from code that merely mentions a backend by name. Uses the
+    // shared bounded DNS_LABEL (see util/text.ts) so this cannot go quadratic on
+    // a long run of matching characters in a large file.
+    if (!backends.has('supabase') && files.some((f) => SUPABASE_URL_FALLBACK.test(f.content))) {
         backends.add('supabase');
     }
     if (!backends.has('firebase') && files.some((f) => /\binitializeApp\s*\(/.test(f.content) && /firebase/i.test(f.content))) {
@@ -104,6 +115,7 @@ export function detect(root, files) {
         backends: [...backends],
         languages: [...languages],
         packageManagers: [...pms],
+        declaredPackageManager,
         hasEnv: files.some((f) => f.rel === '.env' || /(^|\/)\.env(\.|$)/.test(f.rel)),
         hasGitignore: has('.gitignore'),
     };