easyvibegate 0.4.4 → 0.6.2

package/dist/engine/endpoints.js

@@ -1,10 +1,28 @@
-// Any receiver: app/router/api/server/v1/`this.x` … .get('/path')
-const JS_ROUTE = /[\w$)\]]\s*\.(get|post|put|patch|delete|all|options|head)\s*\(\s*["'`](\/[^"'`]*)["'`]/gi;
+// Any receiver: app/router/api/server/v1/`this.x` … .get('/path'). Group 1 is the
+// receiver identifier when it is a plain name (so a router can be tied to its mount).
+const JS_ROUTE = /(?:\b([\w$]+)|[)\]])\s*\.(get|post|put|patch|delete|all|options|head)\s*\(\s*["'`](\/[^"'`]*)["'`]/gi;
 const PY_ROUTE = /@\w+\.(get|post|put|patch|delete|route)\s*\(\s*["']([^"']+)["']/gi;
-// NestJS: @Get('users') on a controller method.
-const NEST_ROUTE = /@(Get|Post|Put|Patch|Delete|All)\s*\(\s*["'`]([^"'`]*)["'`]?\s*\)/g;
+// NestJS: @Get('users') on a controller method, @Controller('api/orders') on the class.
+const NEST_ROUTE = /@(Get|Post|Put|Patch|Delete|All)\s*\(\s*(?:["'`]([^"'`]*)["'`])?\s*\)/g;
+const NEST_CONTROLLER = /@Controller\s*\(([^)]*)\)/g;
+const NEST_GLOBAL_PREFIX = /\.setGlobalPrefix\s*\(\s*["'`]([^"'`]*)["'`]/g;
 // Django: path('users/', ...) / re_path(r'^users/$', ...)
 const DJANGO_ROUTE = /\b(?:re_)?path\s*\(\s*r?["']([^"']+)["']/gi;
+// Express/Koa mounts: app.use('/api', router) / app.use('/api', auth, router) /
+// app.use(router) / app.use(router.routes()). Single-line only — that is the
+// common shape and a missed mount degrades to "unresolved", never to a wrong path.
+const JS_MOUNT = /\b([\w$]+)\s*\.use\s*\(\s*(?:["'`](\/[^"'`]*)["'`]\s*,\s*)?([^;\n]*?)\)\s*;?\s*$/gm;
+// const router = Router() / express.Router() / new Router({ prefix: '/api' }) (koa).
+// `new Hono()` / `new Elysia()` are NOT here: those are usually the app itself.
+const JS_ROUTER_DECL = /\b(?:const|let|var)\s+([\w$]+)(?:\s*:\s*[\w$.<>]+)?\s*=\s*(?:new\s+)?(?:express\.)?Router\s*\(\s*(\{[^}]*\})?/g;
+const JS_IMPORT_DEFAULT = /\bimport\s+(?:([\w$]+)|\*\s+as\s+([\w$]+))\s+from\s+["']([^"']+)["']|\b(?:const|let|var)\s+([\w$]+)\s*=\s*require\(\s*["']([^"']+)["']\s*\)/g;
+const JS_IMPORT_NAMED = /\bimport\s+\{([^}]*)\}\s+from\s+["']([^"']+)["']|\b(?:const|let|var)\s+\{([^}]*)\}\s*=\s*require\(\s*["']([^"']+)["']\s*\)/g;
+// Next.js route handlers: export async function GET / export const POST = / export { GET, POST }
+const NEXT_HANDLER = /\bexport\s+(?:async\s+)?(?:function|const|let)\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b|\bexport\s*(?:(?:const|let)\s*)?\{([^}]*)\}/g;
+const HTTP_VERBS = new Set(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS']);
+// Documentation is not code: `app.get('/delete-everything')` in a README must
+// never become a live target.
+const DOC_FILE = /\.(md|mdx|markdown|txt|rst|adoc)$/i;
 function normalizeMethod(m) {
     const up = m.toUpperCase();
     // Flask's @app.route and Express's .all cover every verb → treat as ANY so
@@ -13,11 +31,78 @@ function normalizeMethod(m) {
         return 'ANY';
     return up;
 }
+/** Join a mount/controller prefix and a route path without doubling slashes. */
+function joinPath(prefix, path) {
+    const joined = `/${prefix}/${path}`.replace(/\/+/g, '/');
+    return joined.length > 1 ? joined.replace(/\/$/, '') : joined;
+}
+/** Flask converters: `<int:id>` / `<string:x>` / `<path:p>` / `<id>` → `{id}` (probe-able). */
+function flaskToTemplate(path) {
+    return path.replace(/<(?:\w+(?:\([^)]*\))?:)?(\w+)>/g, '{$1}');
+}
+/** Resolve a relative import specifier to one of the scanned files, if present. */
+function resolveModule(fromRel, spec, rels) {
+    if (!spec.startsWith('.'))
+        return undefined;
+    const dir = fromRel.split('/').slice(0, -1);
+    for (const part of spec.split('/')) {
+        if (part === '.' || part === '')
+            continue;
+        if (part === '..')
+            dir.pop();
+        else
+            dir.push(part);
+    }
+    const base = dir.join('/').replace(/\.(m|c)?jsx?$/, '').replace(/\.tsx?$/, '');
+    const candidates = [base, ...['.ts', '.tsx', '.js', '.mjs', '.cjs', '.jsx'].map((e) => base + e),
+        ...['/index.ts', '/index.tsx', '/index.js', '/index.mjs'].map((e) => base + e)];
+    return candidates.find((c) => rels.has(c));
+}
+/** Every `x.use([prefix,] …, target)` in a file — the target is its last argument. */
+function findMounts(content) {
+    const out = [];
+    for (const m of content.matchAll(JS_MOUNT)) {
+        const args = (m[3] ?? '').split(',').map((s) => s.trim()).filter(Boolean);
+        const last = args[args.length - 1];
+        if (!last)
+            continue;
+        const mount = { onIdent: m[1] ?? '', prefix: m[2] ?? '' };
+        const req = last.match(/^require\(\s*["']([^"']+)["']\s*\)$/);
+        const koa = last.match(/^([\w$]+)\.(?:routes|middleware|allowedMethods)\(\)$/);
+        if (req)
+            mount.targetModule = req[1];
+        else if (koa)
+            mount.targetIdent = koa[1];
+        else if (/^[\w$]+$/.test(last))
+            mount.targetIdent = last;
+        else
+            continue; // a call/expression — nothing we can tie a router to
+        out.push(mount);
+    }
+    return out;
+}
+/** The prefix a NestJS @Controller(...) argument declares, or null if unreadable. */
+function nestControllerPrefix(rawArg) {
+    const arg = rawArg.trim();
+    if (arg === '')
+        return '';
+    const str = arg.match(/^["'`]([^"'`]*)["'`]$/);
+    if (str)
+        return str[1] ?? '';
+    if (arg.startsWith('{')) {
+        const p = arg.match(/\bpath\s*:\s*["'`]([^"'`]*)["'`]/);
+        if (p)
+            return p[1] ?? '';
+        // Options without `path` (e.g. host-only) mean no prefix; a computed path is unreadable.
+        return /\bpath\s*:/.test(arg) ? null : '';
+    }
+    return null; // array / variable / anything computed
+}
 /** Extract HTTP endpoints declared across the project, any framework. */
 export function collectEndpoints(files) {
     const out = [];
     const seen = new Set();
-    const add = (method, path, where) => {
+    const add = (method, path, where, unresolvedNote) => {
         if (!path)
             return;
         // A path built from variables cannot be probed — reporting it is noise.
@@ -27,13 +112,96 @@ export function collectEndpoints(files) {
         if (seen.has(key))
             return;
         seen.add(key);
-        out.push({ method, path, where });
+        out.push(unresolvedNote ? { method, path, where, unresolved: true, note: unresolvedNote } : { method, path, where });
+    };
+    const code = files.filter((f) => !DOC_FILE.test(f.rel));
+    const rels = new Set(code.map((f) => f.rel));
+    // Pass 1 — routers and where they are mounted. A router imported from another
+    // file is followed through its import so `app.use('/api', ordersRouter)` reaches
+    // `router.get('/')` in routes/orders.ts.
+    const mountsByFile = new Map();
+    const importsByFile = new Map(); // ident → resolved module rel
+    const routerDecls = new Map(); // `${file}#${ident}` → prefix declared inline (koa)
+    for (const f of code) {
+        mountsByFile.set(f.rel, findMounts(f.content));
+        const imports = new Map();
+        for (const m of f.content.matchAll(JS_IMPORT_DEFAULT)) {
+            const ident = m[1] ?? m[2] ?? m[4];
+            const spec = m[3] ?? m[5];
+            const target = spec ? resolveModule(f.rel, spec, rels) : undefined;
+            if (ident && target)
+                imports.set(ident, target);
+        }
+        for (const m of f.content.matchAll(JS_IMPORT_NAMED)) {
+            const spec = m[2] ?? m[4];
+            const target = spec ? resolveModule(f.rel, spec, rels) : undefined;
+            if (!target)
+                continue;
+            for (const name of (m[1] ?? m[3] ?? '').split(',')) {
+                const ident = name.trim().split(/\s+as\s+/).pop()?.trim();
+                if (ident)
+                    imports.set(ident, target);
+            }
+        }
+        importsByFile.set(f.rel, imports);
+        for (const m of f.content.matchAll(JS_ROUTER_DECL)) {
+            const inline = m[2]?.match(/\bprefix\s*:\s*["'`]([^"'`]*)["'`]/)?.[1] ?? '';
+            routerDecls.set(`${f.rel}#${m[1]}`, inline);
+        }
+    }
+    // Prefixes at which router `ident` (declared in `file`) is reachable, following
+    // nested mounts a few levels up. null = not mounted anywhere we can see, or a
+    // parent in the chain is not — either way the prefix is unknown.
+    const prefixesOf = (file, ident, depth) => {
+        if (depth > 4)
+            return null;
+        const found = [];
+        let mounted = false;
+        for (const [mFile, mounts] of mountsByFile) {
+            for (const mt of mounts) {
+                const hits = (mFile === file && mt.targetIdent === ident)
+                    || (mt.targetIdent !== undefined && importsByFile.get(mFile)?.get(mt.targetIdent) === file)
+                    || (mt.targetModule !== undefined && resolveModule(mFile, mt.targetModule, rels) === file);
+                if (!hits)
+                    continue;
+                mounted = true;
+                // Whatever the receiver is mounted at applies on top (router.use inside a router).
+                const parents = routerDecls.has(`${mFile}#${mt.onIdent}`) ? prefixesOf(mFile, mt.onIdent, depth + 1) : [''];
+                if (parents === null)
+                    return null;
+                for (const parent of parents)
+                    found.push(joinPath(parent, mt.prefix));
+            }
+        }
+        return mounted ? found : null;
     };
-    for (const f of files) {
-        // Next.js App Router: app/**/route.ts — the file path is the endpoint.
+    // NestJS global prefix (app.setGlobalPrefix('api')) applies to every controller.
+    let nestGlobal = '';
+    for (const f of code) {
+        const g = [...f.content.matchAll(NEST_GLOBAL_PREFIX)];
+        if (g.length === 1)
+            nestGlobal = g[0]?.[1] ?? '';
+    }
+    for (const f of code) {
+        // Next.js App Router: app/**/route.ts — the file path is the endpoint, the
+        // exported handler names are the methods (a POST-only route must not be GET-probed).
         if (/(^|\/)app\/.*\/route\.(t|j)sx?$/.test(f.rel)) {
             const p = '/' + f.rel.replace(/^.*?app\//, '').replace(/\/route\.(t|j)sx?$/, '');
-            add('ANY', p.replace(/\/\((?:[^)]+)\)/g, ''), f.rel); // strip Next route groups
+            const clean = p.replace(/\/\((?:[^)]+)\)/g, ''); // strip Next route groups
+            const methods = new Set();
+            for (const m of f.content.matchAll(NEXT_HANDLER)) {
+                if (m[1])
+                    methods.add(m[1]);
+                for (const name of (m[2] ?? '').split(',')) {
+                    const ident = name.trim().split(/\s+as\s+/).pop()?.trim() ?? '';
+                    if (HTTP_VERBS.has(ident))
+                        methods.add(ident);
+                }
+            }
+            if (methods.size === 0)
+                add('ANY', clean, f.rel); // re-exported / not parseable → as before
+            for (const method of methods)
+                add(method, clean, f.rel);
             continue;
         }
         // Next.js Pages API: strip extension first, then a trailing /index.
@@ -42,12 +210,50 @@ export function collectEndpoints(files) {
             add('ANY', p, f.rel);
             continue;
         }
-        for (const m of f.content.matchAll(JS_ROUTE))
-            add(normalizeMethod(m[1] ?? 'any'), m[2] ?? '', f.rel);
+        // Python decorators (`@app.get("/x/<int:id>")`) also look like JS calls to
+        // JS_ROUTE; only PY_ROUTE knows how to template their converters.
+        const isPython = /\.py$/i.test(f.rel);
+        for (const m of isPython ? [] : f.content.matchAll(JS_ROUTE)) {
+            const method = normalizeMethod(m[2] ?? 'any');
+            const path = m[3] ?? '';
+            const ident = m[1];
+            const inline = ident !== undefined ? routerDecls.get(`${f.rel}#${ident}`) : undefined;
+            // Routes on a Router() live under its mount point; `app.get` (no Router
+            // declaration) is top-level, as before.
+            if (ident !== undefined && inline !== undefined) {
+                const prefixes = prefixesOf(f.rel, ident, 0);
+                if (prefixes === null) {
+                    add(method, joinPath(inline, path), f.rel, `router "${ident}" (${f.rel}) is not mounted anywhere in the scanned code — its URL prefix is unknown`);
+                }
+                else {
+                    for (const prefix of prefixes)
+                        add(method, joinPath(joinPath(prefix, inline), path), f.rel);
+                }
+                continue;
+            }
+            add(method, path, f.rel);
+        }
         for (const m of f.content.matchAll(PY_ROUTE))
-            add(normalizeMethod(m[1] ?? 'any'), m[2] ?? '', f.rel);
+            add(normalizeMethod(m[1] ?? 'any'), flaskToTemplate(m[2] ?? ''), f.rel);
+        // NestJS: walk decorators in source order so each @Get sits under the nearest
+        // preceding @Controller prefix.
+        const events = [];
+        for (const m of f.content.matchAll(NEST_CONTROLLER))
+            events.push({ at: m.index ?? 0, ctrl: nestControllerPrefix(m[1] ?? '') });
         for (const m of f.content.matchAll(NEST_ROUTE))
-            add(normalizeMethod(m[1] ?? 'any'), '/' + (m[2] ?? '').replace(/^\//, ''), f.rel);
+            events.push({ at: m.index ?? 0, method: m[1] ?? 'any', path: m[2] ?? '' });
+        events.sort((x, y) => x.at - y.at);
+        let ctrl = '';
+        for (const ev of events) {
+            if (ev.ctrl !== undefined) {
+                ctrl = ev.ctrl;
+                continue;
+            }
+            const full = joinPath(joinPath(nestGlobal, ctrl ?? ''), ev.path ?? '');
+            add(normalizeMethod(ev.method ?? 'any'), full, f.rel, ctrl === null
+                ? `@Controller(...) argument in ${f.rel} could not be read — its URL prefix is unknown`
+                : undefined);
+        }
         if (/(^|\/)urls?\.py$/.test(f.rel) || /urlpatterns/.test(f.content)) {
             for (const m of f.content.matchAll(DJANGO_ROUTE))
                 add('ANY', '/' + (m[1] ?? '').replace(/^\^/, '').replace(/^\//, '').replace(/\$$/, ''), f.rel);

package/dist/engine/i18n.js

@@ -68,6 +68,8 @@ const EN = {
     'wiz.urlInvalid': '"{input}" is not a valid address. Use e.g. https://myapp.com, or press Enter to skip.',
     'wiz.answerUnclear': 'Please answer y or n (got "{input}").',
     'wiz.qOwn': '  Confirm {url} is YOUR app and you allow live requests to it?',
+    'wiz.sbFromFlag': '  Supabase target from the command line: {url}',
+    'wiz.notRun': '  Not confirmed — {target} will be listed as a requested check that did not run.',
     // ai-fix
     'aifix.title': '# Security fix task for this codebase',
     'aifix.intro': 'You are a senior application-security engineer. EasyVibeGate scanned this project and found {crit} critical and {warn} warning issue(s) (score {score}/100, gate {gate}). Fix them one by one, most severe first, without breaking existing functionality.',
@@ -87,7 +89,7 @@ const EN = {
     'aifix.done': 'When done',
     'aifix.done1': '- List which secrets I must rotate myself.',
     'aifix.done2': '- List any migration I must run and where.',
-    'aifix.done3': '- Summarize what is fixed and what still needs a live re-scan (`npx github:valedol190387/easyvibegate . --url <app> --i-own-this`).',
+    'aifix.done3': '- Summarize what is fixed and what still needs a live re-scan (`npx easyvibegate . --url <app> --i-own-this`).',
 };
 const RU = {
     'console.filesLine': 'файлов: {n}',
@@ -154,6 +156,8 @@ const RU = {
     'wiz.urlInvalid': '«{input}» — это не похоже на адрес. Например: https://myapp.com, или Enter чтобы пропустить.',
     'wiz.answerUnclear': 'Ответь «д» или «н» (получено «{input}»).',
     'wiz.qOwn': '  Подтверди: {url} — ТВОЁ приложение и ты разрешаешь слать к нему запросы?',
+    'wiz.sbFromFlag': '  Supabase из командной строки: {url}',
+    'wiz.notRun': '  Не подтверждено — {target} попадёт в отчёт как запрошенная, но не выполненная проверка.',
     'aifix.title': '# Задача: починить безопасность этого проекта',
     'aifix.intro': 'Ты — старший инженер по безопасности приложений. EasyVibeGate просканировал проект и нашёл {crit} критичных и {warn} предупреждений (оценка {score}/100, итог {gate}). Чини их по одному, начиная с самых серьёзных, не ломая существующую функциональность.',
     'aifix.rules': 'Правила',
@@ -172,7 +176,7 @@ const RU = {
     'aifix.done': 'Когда закончишь',
     'aifix.done1': '- Перечисли, какие секреты я должен сменить сам.',
     'aifix.done2': '- Перечисли, какие миграции нужно прогнать и где.',
-    'aifix.done3': '- Подведи итог: что починено и что ещё требует живой перепроверки (`npx github:valedol190387/easyvibegate . --url <app> --i-own-this`).',
+    'aifix.done3': '- Подведи итог: что починено и что ещё требует живой перепроверки (`npx easyvibegate . --url <app> --i-own-this`).',
 };
 const TABLES = { en: EN, ru: RU };
 export function t(lang, key, vars = {}) {

package/dist/engine/net/http.js

@@ -106,3 +106,71 @@ export async function requestFollow(url, init = {}, timeoutMs = 8000, maxHops =
 export function sleep(ms) {
     return new Promise((r) => setTimeout(r, ms));
 }
+export function looksLikeHtml(body) {
+    return /<!doctype html|<html[\s>]|<head[\s>]|<body[\s>]/i.test(body.slice(0, 600));
+}
+/** A parsed JSON value with content. Error envelopes are handled by the caller. */
+function jsonHasContent(v) {
+    if (v === null || v === undefined)
+        return false;
+    if (Array.isArray(v))
+        return v.length > 0;
+    if (typeof v === 'object')
+        return Object.keys(v).length > 0;
+    if (typeof v === 'string')
+        return v.length > 0;
+    return true; // a bare number/boolean is content
+}
+/**
+ * The ONE place a probe response is turned into a verdict, so every live check
+ * applies the same rules (a truncated or unparseable body is never "clean").
+ * `expect: 'json'` requires a parsable JSON body; `'any'` accepts any bytes.
+ */
+export function classifyBody(res, expect) {
+    if (isErr(res))
+        return { kind: 'unknown', reason: res.error };
+    const { status } = res;
+    if (status === 429 || status >= 500)
+        return { kind: 'unknown', reason: `HTTP ${status}` };
+    // A redirect is never evidence of absence — the resource may sit behind the hop.
+    if (status >= 300 && status < 400)
+        return { kind: 'unknown', reason: `HTTP ${status} redirect not followed` };
+    if (status === 401 || status === 403)
+        return { kind: 'denied', reason: `HTTP ${status}` };
+    if (status === 404 || status === 405 || status === 410)
+        return { kind: 'absent', reason: `HTTP ${status}` };
+    if (status < 200 || status >= 300)
+        return { kind: 'unknown', reason: `HTTP ${status}` };
+    // Anything past the cap was not seen, so neither "no data" nor "no signature" holds.
+    if (res.truncated)
+        return { kind: 'unknown', reason: 'body truncated at the 2 MB cap' };
+    if (status === 204)
+        return { kind: 'empty', reason: 'HTTP 204' };
+    const body = res.body;
+    if (expect === 'any') {
+        return body.trim().length > 0 ? { kind: 'data', reason: `HTTP ${status}` } : { kind: 'empty', reason: 'empty body' };
+    }
+    const ctype = (res.headers.get('content-type') ?? '').toLowerCase();
+    if (ctype.includes('text/html') || looksLikeHtml(body))
+        return { kind: 'unknown', reason: 'HTML page where JSON was expected' };
+    const t = body.trim();
+    if (t.length === 0)
+        return { kind: 'empty', reason: 'empty body' };
+    let json;
+    try {
+        json = JSON.parse(t);
+    }
+    catch {
+        return { kind: 'unknown', reason: 'body is not JSON' };
+    }
+    // `{"error": …}` with a 2xx is the server telling us something went wrong,
+    // not an (empty) resource — it cannot be counted as checked.
+    if (json && typeof json === 'object' && !Array.isArray(json)) {
+        const o = json;
+        if ('error' in o || 'errors' in o)
+            return { kind: 'unknown', reason: 'error envelope in a 2xx body', json };
+    }
+    return jsonHasContent(json)
+        ? { kind: 'data', reason: `HTTP ${status}`, json }
+        : { kind: 'empty', reason: 'empty JSON', json };
+}

package/dist/engine/report.js

@@ -3,6 +3,13 @@ import { color } from './util/color.js';
 import { t } from './i18n.js';
 import { VERSION } from './version.js';
 const WEIGHTS = { critical: 25, warning: 8, info: 2, advisory: 0 };
+/**
+ * How many findings of a severity may move the score. Beyond the cap the count
+ * still shows in the report, but the grade stops falling: 562 warnings once
+ * produced 0/100 next to a project with real critical leaks at the same 0/100,
+ * which told the reader nothing. Criticals can still zero the score.
+ */
+const SCORE_CAP = { critical: 4, warning: 5, info: 5, advisory: 0 };
 const EMOJI = { critical: '🔴', warning: '🟡', info: '🔵', advisory: '⚪' };
 export function coverage(runs) {
     const c = { completed: 0, partial: 0, failed: 0, skipped: 0, unsupported: 0 };
@@ -18,9 +25,12 @@ export function coverage(runs) {
 export function summarize(findings, runs = []) {
     const counts = { critical: 0, warning: 0, info: 0, advisory: 0 };
     let score = 100;
+    const counted = { critical: 0, warning: 0, info: 0, advisory: 0 };
     for (const f of findings) {
         counts[f.severity]++;
-        score -= WEIGHTS[f.severity];
+        if (counted[f.severity] < SCORE_CAP[f.severity])
+            score -= WEIGHTS[f.severity];
+        counted[f.severity]++;
     }
     const cov = coverage(runs);
     const gate = counts.critical > 0 ? 'fail'

package/dist/engine/scan.js

@@ -4,7 +4,7 @@ import { staticCheckers } from './checkers/index.js';
 import { applyIgnores, loadConfig } from './config.js';
 /** Run all Level 0 (static, read-only) checkers over a project directory. */
 export async function scanStatic(root, opts = {}) {
-    const { files, skippedOversized, skippedUnreadable } = walk(root);
+    const { files, skippedOversized, skippedUnreadable, skippedDirs, skippedSymlinks } = walk(root, { excludeAbs: opts.excludeAbs });
     const detection = detect(root, files);
     const ctx = { root, files, detection };
     let findings = [];
@@ -20,19 +20,28 @@ export async function scanStatic(root, opts = {}) {
         return { root, detection, findings, fileCount: 0, files, runs };
     }
     // Files we could not read are missing coverage, not a clean result.
-    const lost = skippedOversized + skippedUnreadable;
+    const lost = skippedOversized + skippedUnreadable + skippedDirs + skippedSymlinks;
     if (lost > 0) {
         const parts = [];
         if (skippedOversized)
-            parts.push(`${skippedOversized} over the 1 MB limit`);
+            parts.push(`${skippedOversized} file(s) over the 1 MB limit`);
         if (skippedUnreadable)
-            parts.push(`${skippedUnreadable} unreadable`);
-        runs.push({ id: 'walk', level: 0, status: 'partial', note: `${lost} file(s) not scanned (${parts.join(', ')})` });
+            parts.push(`${skippedUnreadable} unreadable file(s)`);
+        if (skippedDirs)
+            parts.push(`${skippedDirs} unreadable director(y/ies) — their whole subtree went unchecked`);
+        if (skippedSymlinks)
+            parts.push(`${skippedSymlinks} symlink(s) skipped — their targets were not scanned`);
+        runs.push({ id: 'walk', level: 0, status: 'partial', note: `not scanned: ${parts.join(', ')}` });
     }
     for (const checker of staticCheckers) {
         try {
-            findings.push(...(await checker.run(ctx)));
-            runs.push({ id: `static:${checker.id}`, level: 0, status: 'completed' });
+            const res = await checker.run(ctx);
+            const { findings: got, partial } = Array.isArray(res) ? { findings: res, partial: undefined } : res;
+            findings.push(...got);
+            // A checker that could not interpret part of its input did not fully run.
+            runs.push(partial
+                ? { id: `static:${checker.id}`, level: 0, status: 'partial', note: partial }
+                : { id: `static:${checker.id}`, level: 0, status: 'completed' });
         }
         catch (err) {
             // A broken checker is a failed check, not a clean pass.