euthyna 0.2.0 → 0.3.0

package/src/facts/history.js

@@ -11,6 +11,7 @@
  */
 import { git, commitSummaries } from '../git.js';
 import { makeFact, notEvaluated as notEvaluatedEntry, KIND, STATUS, shellQuote } from '../contract.js';
+import { T, DEFAULT_LANG } from '../lang.js';
 
 /**
  * Strong signal: the commit is about security.
@@ -216,8 +217,10 @@ export async function collectHistoryFacts({
   origins = false,
   maxOrigins = 40,
   securityPattern = SECURITY_PATTERN,
-  fixPattern = FIX_PATTERN
+  fixPattern = FIX_PATTERN,
+  lang = DEFAULT_LANG
 } = {}) {
+  const t = T(lang);
   const facts = [];
   const evaluated = [];
   const notEvaluated = [];
@@ -229,7 +232,13 @@ export async function collectHistoryFacts({
 
   if (files.length === 0) {
     notEvaluated.push(
-      notEvaluatedEntry('history', `范围 ${base}..${head} 内没有文件变更，没有可归属的删除行`)
+      notEvaluatedEntry(
+        'history',
+        t(
+          `范围 ${base}..${head} 内没有文件变更，没有可归属的删除行`,
+          `No file changes in ${base}..${head}; no deleted lines to attribute`
+        )
+      )
     );
     return { facts, evaluated, notEvaluated, files, measured: true };
   }
@@ -271,8 +280,12 @@ export async function collectHistoryFacts({
     notEvaluated.push(
       notEvaluatedEntry(
         'history',
-        `范围 ${base}..${head} 内有 ${files.length} 个文件变更，但没有任何一行被删除，` +
-          '因此没有可归属的历史来源'
+        t(
+          `范围 ${base}..${head} 内有 ${files.length} 个文件变更，但没有任何一行被删除，` +
+            '因此没有可归属的历史来源',
+          `Range ${base}..${head} changes ${files.length} file(s) but deletes no lines; ` +
+            'there is no attributable history source'
+        )
       )
     );
   }
@@ -369,7 +382,10 @@ export async function collectHistoryFacts({
       notEvaluated.push(
         notEvaluatedEntry(
           'history-origins',
-          `git log -S 来源探针上限 ${maxOrigins} 已用尽，其余删除行保留 blame 归属`
+          t(
+            `git log -S 来源探针上限 ${maxOrigins} 已用尽，其余删除行保留 blame 归属`,
+            `git log -S origin probe cap (${maxOrigins}) exhausted; remaining deleted lines keep their blame attribution`
+          )
         )
       );
     }
@@ -377,8 +393,12 @@ export async function collectHistoryFacts({
       notEvaluated.push(
         notEvaluatedEntry(
           'history-origins',
-          `${shortSkipped} 行内容过短（< ${MIN_PICKAXE_LINE_LENGTH} 字符），` +
-            '未做来源追溯（太通用时 -S 会指向整个历史的第一个提交而非真实来源），保留 blame 归属'
+          t(
+            `${shortSkipped} 行内容过短（< ${MIN_PICKAXE_LINE_LENGTH} 字符），` +
+              '未做来源追溯（太通用时 -S 会指向整个历史的第一个提交而非真实来源），保留 blame 归属',
+            `${shortSkipped} line(s) too short (< ${MIN_PICKAXE_LINE_LENGTH} chars); ` +
+              'no origin tracing done (for generic content, -S points at the first commit of the whole history rather than a real origin); blame attribution kept'
+          )
         )
       );
     }
@@ -386,8 +406,12 @@ export async function collectHistoryFacts({
     notEvaluated.push(
       notEvaluatedEntry(
         'history-origins',
-        '未启用 --origins，删除行的归属基于 git blame 的「最后修改」语义；' +
-          '被删行本身或提交 diff 含安全关键词时仍会标为 security'
+        t(
+          '未启用 --origins，删除行的归属基于 git blame 的「最后修改」语义；' +
+            '被删行本身或提交 diff 含安全关键词时仍会标为 security',
+          '--origins not enabled; deleted lines are attributed by git blame\'s "last modified" semantics; ' +
+            'lines whose content or commit diff contains security vocabulary are still classified security'
+        )
       )
     );
   }
@@ -395,8 +419,9 @@ export async function collectHistoryFacts({
   // Split every blame group into its remainder (blame attribution) and its
   // refined subsets (one fact per origin commit). Each becomes a fact.
   const pending = [];
+  const unreadableSubject = () => t('(提交信息不可读)', '(unreadable commit message)');
   for (const [hash, entry] of blameByCommit) {
-    const summary = summaries.get(hash) ?? { subject: '(提交信息不可读)', author: null, date: null };
+    const summary = summaries.get(hash) ?? { subject: unreadableSubject(), author: null, date: null };
     const groups = originGroups.get(hash);
     if (!groups) {
       pending.push({ hash, entry, summary, originMethod: 'blame' });
@@ -436,7 +461,7 @@ export async function collectHistoryFacts({
           lines: [...group.byFile.values()].reduce((sum, a) => sum + a.length, 0),
           byFile: group.byFile
         },
-        summary: group.summary ?? { subject: '(提交信息不可读)', author: null, date: null },
+        summary: group.summary ?? { subject: unreadableSubject(), author: null, date: null },
         originMethod: 'pickaxe',
         blameCommit: hash,
         contents: group.contents
@@ -493,13 +518,25 @@ export async function collectHistoryFacts({
     // the wrong place and makes an accurate attribution look wrong.
     const originPhrase =
       originMethod === 'pickaxe'
-        ? `本次变更删除了 ${entry.lines} 行代码，其内容最初由提交 ${hash.slice(0, 10)} 引入` +
-          `（git blame 的最后修改者是 ${blameCommit.slice(0, 10)}）`
-        : `本次变更删除了 ${entry.lines} 行来自提交 ${hash.slice(0, 10)} 的代码`;
+        ? t(
+            `本次变更删除了 ${entry.lines} 行代码，其内容最初由提交 ${hash.slice(0, 10)} 引入` +
+              `（git blame 的最后修改者是 ${blameCommit.slice(0, 10)}）`,
+            `This change deleted ${entry.lines} lines whose content was first introduced by commit ${hash.slice(0, 10)} ` +
+              `(git blame's last modifier is ${blameCommit.slice(0, 10)})`
+          )
+        : t(
+            `本次变更删除了 ${entry.lines} 行来自提交 ${hash.slice(0, 10)} 的代码`,
+            `This change deleted ${entry.lines} lines of code from commit ${hash.slice(0, 10)}`
+          );
     const statement =
       originPhrase +
-      (fileCount > 1 ? `，分布在 ${fileCount} 个文件` : `（文件：${byFile[0].file}）`) +
-      `。提交信息：${JSON.stringify(summary.subject)}，分类：${classification}`;
+      (fileCount > 1
+        ? t(`，分布在 ${fileCount} 个文件`, `, spread across ${fileCount} files`)
+        : t(`（文件：${byFile[0].file}）`, ` (file: ${byFile[0].file})`)) +
+      t(
+        `。提交信息：${JSON.stringify(summary.subject)}，分类：${classification}`,
+        `. Commit message: ${JSON.stringify(summary.subject)}, classification: ${classification}`
+      );
 
     const detail = {
       classification,
@@ -514,8 +551,14 @@ export async function collectHistoryFacts({
       // covers lines in the other files too.
       reproductionNote:
         fileCount > 1
-          ? `上面的命令只复现「${primary.file}」中的归属；其余 ${fileCount - 1} 个文件的行区间见 byFile`
-          : '上面的命令复现本事实涉及的全部行'
+          ? t(
+              `上面的命令只复现「${primary.file}」中的归属；其余 ${fileCount - 1} 个文件的行区间见 byFile`,
+              `The command above only reproduces the attribution for "${primary.file}"; the other ${fileCount - 1} file(s) line ranges are in byFile`
+            )
+          : t(
+              '上面的命令复现本事实涉及的全部行',
+              'The command above reproduces every line this fact covers'
+            )
     };
 
     if (originMethod === 'pickaxe') {
@@ -552,7 +595,13 @@ export async function collectHistoryFacts({
 
   if (ranked.length === 0 && linesByFile.size > 0) {
     notEvaluated.push(
-      notEvaluatedEntry('history', '有删除行但 blame 未能归属到任何提交（可能是二进制文件或路径异常）')
+      notEvaluatedEntry(
+        'history',
+        t(
+          '有删除行但 blame 未能归属到任何提交（可能是二进制文件或路径异常）',
+          'Deleted lines exist but blame could not attribute them to any commit (possibly binary files or path anomalies)'
+        )
+      )
     );
   }
 
@@ -565,7 +614,8 @@ export async function collectHistoryFacts({
       maxPickaxe,
       securityPattern,
       fixPattern,
-      startCounter: counter
+      startCounter: counter,
+      lang
     });
     facts.push(...reintro.facts);
     counter = reintro.counter;
@@ -573,7 +623,10 @@ export async function collectHistoryFacts({
     notEvaluated.push(...reintro.notEvaluated);
   } else {
     notEvaluated.push(
-      notEvaluatedEntry('reintroduction', '未启用 --pickaxe，未检查「被移除又加回」的代码行')
+      notEvaluatedEntry(
+        'reintroduction',
+        t('未启用 --pickaxe，未检查「被移除又加回」的代码行', '--pickaxe not enabled; reintroduced lines were not checked')
+      )
     );
   }
 
@@ -602,8 +655,10 @@ async function collectReintroductionFacts({
   maxPickaxe,
   securityPattern,
   fixPattern,
-  startCounter
+  startCounter,
+  lang = DEFAULT_LANG
 }) {
+  const t = T(lang);
   const facts = [];
   const notEvaluated = [];
   let counter = startCounter;
@@ -654,9 +709,15 @@ async function collectReintroductionFacts({
           id: `reintroduction-${++counter}`,
           kind: KIND.REINTRODUCTION,
           statement:
-            `本次变更加回了一行在 ${base} 中不存在的代码，而该行的出现次数曾被 ${hashes.length} 个提交改变` +
+            t(
+              `本次变更加回了一行在 ${base} 中不存在的代码，而该行的出现次数曾被 ${hashes.length} 个提交改变`,
+              `This change re-adds a line that did not exist at ${base}, and whose occurrence count was changed by ${hashes.length} commit(s)`
+            ) +
             (securityOrigin
-              ? `，其中提交 ${securityOrigin.hash.slice(0, 10)} 的提交信息含安全关键词`
+              ? t(
+                  `，其中提交 ${securityOrigin.hash.slice(0, 10)} 的提交信息含安全关键词`,
+                  `, and commit ${securityOrigin.hash.slice(0, 10)} has security vocabulary in its message`
+                )
               : ''),
           status: STATUS.ESTABLISHED,
           evidence: { file, snippet: line.slice(0, 160), commit: hashes[0] },
@@ -682,7 +743,10 @@ async function collectReintroductionFacts({
     notEvaluated.push(
       notEvaluatedEntry(
         'reintroduction',
-        `pickaxe 探针上限 ${maxPickaxe} 已用尽，另有 ${candidates - probed} 行新增代码未检查`
+        t(
+          `pickaxe 探针上限 ${maxPickaxe} 已用尽，另有 ${candidates - probed} 行新增代码未检查`,
+          `pickaxe probe cap (${maxPickaxe}) exhausted; ${candidates - probed} added line(s) were not checked`
+        )
       )
     );
   }

package/src/gate.js

@@ -25,6 +25,7 @@
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { safeTextLines } from './contract.js';
+import { T, DEFAULT_LANG } from './lang.js';
 
 const execFileAsync = promisify(execFile);
 
@@ -40,6 +41,30 @@ export const GATE_NAMES = Object.freeze({
   6: '环境'
 });
 
+/** The gate statuses as written in a report, in either language. */
+const GATE_STATUSES = Object.freeze({
+  PASS: 'PASS',
+  FAIL: 'FAIL',
+  PASS_ZH: '通过',
+  NOT_EVALUATED_ZH: '未评估',
+  NOT_EVALUATED_EN: 'NOT EVALUATED'
+});
+
+/** True when a parsed status means "the gate passed". */
+export function isPassStatus(status) {
+  return status === GATE_STATUSES.PASS || status === GATE_STATUSES.PASS_ZH;
+}
+
+/** True when a parsed status means "the gate failed". */
+export function isFailStatus(status) {
+  return status === GATE_STATUSES.FAIL;
+}
+
+/** True when a parsed status means "the gate could not be evaluated". */
+export function isNotEvaluatedStatus(status) {
+  return status === GATE_STATUSES.NOT_EVALUATED_ZH || /^not evaluated$/i.test(status);
+}
+
 /**
  * A finding header: `BUG #N <VERDICT> — <claim>`. The em dash is the skill's
  * form, a hyphen is tolerated, and the claim may be empty (that is itself a
@@ -50,16 +75,23 @@ const HEADER = /^BUG\s+#?(\d+)\s+(TRUE POSITIVE|FALSE POSITIVE|INCONCLUSIVE)\s*(
 /** A line that starts like a finding but does not parse - reported, not dropped. */
 const BUGLIKE = /^BUG\b/i;
 
+/**
+ * Field markers, accepted in either language. The parser is bilingual on
+ * purpose and independent of the output language: a report is data, and a
+ * Chinese-written report must validate under an English session and vice
+ * versa. The English keywords are case-insensitive; the Chinese ones are
+ * unaffected by the flag.
+ */
 const FIELDS = {
-  evidence: /^证据\s*[:：]\s*(.+)$/,
-  reproduce: /^复现\s*[:：]\s*(.+)$/,
-  impact: /^影响\s*[:：]\s*(.+)$/,
-  exploitability: /^可利用性\s*[:：]\s*(.+)$/,
-  gate: /^门禁\s*(\d+)\s*(?:[（(]([^）)]*)[）)])?\s*(PASS|通过|FAIL|未评估)\s*[:：]?\s*(.*)$/
+  evidence: /^(?:证据|Evidence)\s*[:：]\s*(.+)$/i,
+  reproduce: /^(?:复现|Reproduce)\s*[:：]\s*(.+)$/i,
+  impact: /^(?:影响|Impact)\s*[:：]\s*(.+)$/i,
+  exploitability: /^(?:可利用性|Exploitability)\s*[:：]\s*(.+)$/i,
+  gate: /^(?:门禁|Gate)\s*(\d+)\s*(?:[（(]([^）)]*)[）)])?\s*(PASS|通过|FAIL|未评估|NOT EVALUATED|Not evaluated)\s*[:：]?\s*(.*)$/i
 };
 
-/** `门禁全部通过。` may share its line with the evidence that follows it. */
-const ALL_PASS = /^门禁全部通过[。.]?/;
+/** `门禁全部通过。` / `All gates passed.` may share its line with the evidence that follows it. */
+const ALL_PASS = /^(?:门禁全部通过|All gates passed)[。.]?\s*/i;
 
 /**
  * Extract {file, line, commit} from an evidence string. Both `src/a.js:123`
@@ -178,43 +210,113 @@ export function parseGateReport(text) {
  * `violations` names every way it fails, `downgraded` is true when any fail.
  * Unparseable BUG-like lines are returned separately as downgrade candidates.
  */
-export function validateFindings(findings) {
+export function validateFindings(findings, { lang = DEFAULT_LANG } = {}) {
+  const t = T(lang);
   return findings.map((finding) => {
     const violations = [];
-    const fails = finding.gates.filter((g) => g.status === 'FAIL');
-    const notEval = finding.gates.filter((g) => g.status === '未评估');
-    const passes = finding.gates.filter((g) => g.status === 'PASS' || g.status === '通过');
+    const fails = finding.gates.filter((g) => isFailStatus(g.status));
+    const notEval = finding.gates.filter((g) => isNotEvaluatedStatus(g.status));
+    const passes = finding.gates.filter((g) => isPassStatus(g.status));
 
     for (const gate of finding.gates) {
       if (!(gate.number in GATE_NAMES)) {
-        violations.push(`门禁编号 ${gate.number} 不在 1..6 内`);
+        violations.push(
+          t(`门禁编号 ${gate.number} 不在 1..6 内`, `gate number ${gate.number} is not in 1..6`)
+        );
       }
-      if ((gate.status === 'FAIL' || gate.status === '未评估') && !gate.reason.trim()) {
-        violations.push(`门禁 ${gate.number} ${gate.status} 缺少理由`);
+      if ((isFailStatus(gate.status) || isNotEvaluatedStatus(gate.status)) && !gate.reason.trim()) {
+        violations.push(
+          t(`门禁 ${gate.number} ${gate.status} 缺少理由`, `gate ${gate.number} ${gate.status} lacks a reason`)
+        );
       }
     }
 
-    if (!finding.claim.trim()) violations.push('缺少结论描述（BUG 标题后的说明）');
+    if (!finding.claim.trim()) {
+      violations.push(
+        t('缺少结论描述（BUG 标题后的说明）', 'missing claim description (the note after the BUG header)')
+      );
+    }
 
     if (finding.verdict === 'TRUE POSITIVE') {
       if (!finding.evidence) {
-        violations.push('缺少证据（TRUE POSITIVE 必须带 证据：path:L123）');
+        violations.push(
+          t(
+            '缺少证据（TRUE POSITIVE 必须带 证据：path:L123）',
+            'missing evidence (a TRUE POSITIVE must carry Evidence: path:L123)'
+          )
+        );
       } else if (finding.evidence.line === null) {
-        violations.push('证据缺少行号（需要 path:L123 形式，禁止只写文件名）');
+        violations.push(
+          t(
+            '证据缺少行号（需要 path:L123 形式，禁止只写文件名）',
+            'evidence lacks a line number (path:L123 form required; a bare file name is not allowed)'
+          )
+        );
       }
       if (!finding.reproduce) {
-        violations.push('缺少复现命令（TRUE POSITIVE 必须带 复现：<命令> 或 PoC）');
+        violations.push(
+          t(
+            '缺少复现命令（TRUE POSITIVE 必须带 复现：<命令> 或 PoC）',
+            'missing reproduce command (a TRUE POSITIVE must carry Reproduce: <command> or a PoC)'
+          )
+        );
+      }
+      if (!finding.impact) {
+        violations.push(
+          t('缺少影响说明（门禁 3 的证据）', 'missing impact statement (the evidence for gate 3)')
+        );
       }
-      if (!finding.impact) violations.push('缺少影响说明（门禁 3 的证据）');
       const allPassed = finding.allPass || passes.length === 6;
-      if (!allPassed) violations.push('门禁未全部通过（需要 门禁全部通过。 或六条 PASS）');
-      if (fails.length) violations.push(`TRUE POSITIVE 含 FAIL 门禁（${fails.map((g) => g.number).join(', ')}）——应裁定为 FALSE POSITIVE`);
-      if (notEval.length) violations.push(`TRUE POSITIVE 含未评估门禁（${notEval.map((g) => g.number).join(', ')}）——应裁定为 INCONCLUSIVE`);
+      if (!allPassed) {
+        violations.push(
+          t(
+            '门禁未全部通过（需要 门禁全部通过。 或六条 PASS）',
+            'not all gates pass (requires "All gates passed." or six PASS lines)'
+          )
+        );
+      }
+      if (fails.length) {
+        violations.push(
+          t(
+            `TRUE POSITIVE 含 FAIL 门禁（${fails.map((g) => g.number).join(', ')}）——应裁定为 FALSE POSITIVE`,
+            `TRUE POSITIVE contains FAIL gates (${fails.map((g) => g.number).join(', ')}) — should be ruled FALSE POSITIVE`
+          )
+        );
+      }
+      if (notEval.length) {
+        violations.push(
+          t(
+            `TRUE POSITIVE 含未评估门禁（${notEval.map((g) => g.number).join(', ')}）——应裁定为 INCONCLUSIVE`,
+            `TRUE POSITIVE contains not-evaluated gates (${notEval.map((g) => g.number).join(', ')}) — should be ruled INCONCLUSIVE`
+          )
+        );
+      }
     } else if (finding.verdict === 'FALSE POSITIVE') {
-      if (fails.length === 0) violations.push('FALSE POSITIVE 必须至少有一条 门禁 N FAIL：<具体证据>');
+      if (fails.length === 0) {
+        violations.push(
+          t(
+            'FALSE POSITIVE 必须至少有一条 门禁 N FAIL：<具体证据>',
+            'a FALSE POSITIVE must have at least one Gate N FAIL: <specific evidence>'
+          )
+        );
+      }
     } else {
-      if (notEval.length === 0) violations.push('INCONCLUSIVE 必须至少有一条 门禁 N 未评估：<为什么>');
-      if (fails.length) violations.push('INCONCLUSIVE 含 FAIL 门禁——应裁定为 FALSE POSITIVE');
+      if (notEval.length === 0) {
+        violations.push(
+          t(
+            'INCONCLUSIVE 必须至少有一条 门禁 N 未评估：<为什么>',
+            'an INCONCLUSIVE must have at least one Gate N NOT EVALUATED: <why>'
+          )
+        );
+      }
+      if (fails.length) {
+        violations.push(
+          t(
+            'INCONCLUSIVE 含 FAIL 门禁——应裁定为 FALSE POSITIVE',
+            'INCONCLUSIVE contains FAIL gates — should be ruled FALSE POSITIVE'
+          )
+        );
+      }
     }
 
     return { finding, violations, downgraded: violations.length > 0 };
@@ -321,27 +423,48 @@ export async function verifyFinding(
  * Render the gate result for a terminal reader. Report-derived text passes the
  * render boundary here exactly once, like the fact report channel.
  */
-export function renderGateReport(result, { write: rawWrite = console.log } = {}) {
+export function renderGateReport(result, { write: rawWrite = console.log, lang = DEFAULT_LANG } = {}) {
+  const t = T(lang);
   const write = (line) => rawWrite(safeTextLines(line));
   const { file, findings, unparseable, downgraded, verify } = result;
 
   write('');
-  write('euthyna gate — 6 门禁契约校验（不测量，只核对报告的自我声明）');
-  write(`报告: ${file}`);
+  write(
+    t(
+      'euthyna gate — 6 门禁契约校验（不测量，只核对报告的自我声明）',
+      'euthyna gate — six-gate contract check (no measurement; only the report\'s own claims are checked)'
+    )
+  );
+  write(`${t('报告: ', 'Report: ')}${file}`);
   if (verify) {
-    write('⚠ --verify 以当前用户权限执行报告中的复现命令（按 argv 执行，不经过 shell）。');
-    write('  默认只执行 git 命令；解释器命令（node/npm/python）需要显式 --allow-exec。');
-    write('  它不是一个安全沙箱：只对你自己信任的报告使用。');
+    write(
+      t(
+        '⚠ --verify 以当前用户权限执行报告中的复现命令（按 argv 执行，不经过 shell）。',
+        '⚠ --verify runs the report\'s reproduce commands with your privileges (as argv, no shell).'
+      )
+    );
+    write(
+      t(
+        '  默认只执行 git 命令；解释器命令（node/npm/python）需要显式 --allow-exec。',
+        '  Only git commands run by default; interpreter commands (node/npm/python) need explicit --allow-exec.'
+      )
+    );
+    write(
+      t(
+        '  它不是一个安全沙箱：只对你自己信任的报告使用。',
+        '  It is not a sandbox: use it only on reports you trust.'
+      )
+    );
   }
   write('');
 
   for (const entry of findings) {
     const f = entry.finding;
-    const head = `  BUG #${f.number} ${f.verdict} — ${f.claim || '(无结论描述)'}`;
+    const head = `  BUG #${f.number} ${f.verdict} — ${f.claim || t('(无结论描述)', '(no claim)')}`;
     if (entry.downgraded) {
-      write(`${head} — ✗ 降级为「观察」`);
+      write(`${head} — ✗ ${t('降级为「观察」', 'downgraded to "observation"')}`);
     } else {
-      write(`${head} — ✓ 通过`);
+      write(`${head} — ✓ ${t('通过', 'passed')}`);
     }
     if (entry.verification && f.verdict === 'TRUE POSITIVE') {
       const v = entry.verification;
@@ -352,30 +475,35 @@ export function renderGateReport(result, { write: rawWrite = console.log } = {})
           : v.status === 'failed'
             ? `(exit ${v.exitCode ?? '?'}${v.detail ? `: ${v.detail}` : ''})`
             : v.status === 'refused'
-              ? `(拒绝运行 ${v.tool} —— 不在白名单)`
+              ? t(`(拒绝运行 ${v.tool} —— 不在白名单)`, `(refused to run ${v.tool} — not on the allowlist)`)
               : v.status === 'needs-consent'
-                ? `(未执行 ${v.tool} 解释器命令 —— 需要 --allow-exec)`
+                ? t(`(未执行 ${v.tool} 解释器命令 —— 需要 --allow-exec)`, `(interpreter command ${v.tool} not run — needs --allow-exec)`)
                 : v.status === 'unparseable'
-                  ? '(命令无法拆分为 argv)'
-                  : '(无复现命令)';
-      write(`     复现核验 ${mark} ${how}`);
+                  ? t('(命令无法拆分为 argv)', '(command could not be split into argv)')
+                  : t('(无复现命令)', '(no reproduce command)');
+      write(`${t('     复现核验 ', '     Reproduce check ')}${mark} ${how}`);
     }
     for (const violation of entry.violations) {
-      write(`     缺: ${violation}`);
+      write(`${t('     缺: ', '     missing: ')}${violation}`);
     }
   }
 
   if (unparseable.length) {
     write('');
-    write('⚠ 无法解析的 BUG 行（计入降级）：');
+    write(t('⚠ 无法解析的 BUG 行（计入降级）：', '⚠ Unparseable BUG lines (counted as downgrades):'));
     for (const line of unparseable) write(`  • ${line}`);
   }
 
   write('');
   if (downgraded === 0) {
-    write('全部 finding 通过门禁契约。');
+    write(t('全部 finding 通过门禁契约。', 'All findings pass the gate contract.'));
   } else {
-    write(`⚠ ${downgraded} 个 finding 被降级为「观察」——缺证据、缺复现或门禁不一致，不得当作已确证的结论。`);
+    write(
+      t(
+        `⚠ ${downgraded} 个 finding 被降级为「观察」——缺证据、缺复现或门禁不一致，不得当作已确证的结论。`,
+        `⚠ ${downgraded} finding${downgraded === 1 ? '' : 's'} downgraded to "observation" — missing evidence, missing reproduction, or inconsistent gates; must not be read as established findings.`
+      )
+    );
   }
   write('');
 }

package/src/lang.js

@@ -0,0 +1,55 @@
+/**
+ * Language selection for the CLI (i18n).
+ *
+ * Zero-dependency on purpose, like everything else in this project: no i18n
+ * framework is pulled in. The CLI currently ships two languages, chosen by an
+ * explicit switch rather than by locale sniffing, because a locale-derived
+ * answer can surprise ("I asked for English and got Chinese") and is hard to
+ * reproduce in CI.
+ *
+ * Precedence: an explicit `--lang` flag beats the EUTHYNA_LANG environment
+ * variable, which beats the default (Chinese). The default stays Chinese so a
+ * user who never asks for English sees exactly the output they saw before.
+ */
+
+export const LANGS = Object.freeze(['zh', 'en']);
+export const DEFAULT_LANG = 'zh';
+
+/** True for a value the CLI accepts as a language. */
+export function isLang(value) {
+  return value === 'zh' || value === 'en';
+}
+
+/**
+ * Resolve the effective language.
+ *
+ * Precedence: an explicit flag wins, then the environment variable, then the
+ * default. cli.js validates the flag value before calling this, so a non-zh/en
+ * flag never reaches here.
+ *
+ * @param {object} [options]
+ * @param {string|boolean} [options.flag]  the value of --lang (true when the
+ *                                         flag was passed without a value)
+ * @param {object} [options.env]  defaults to process.env
+ * @returns {'zh'|'en'}
+ */
+export function resolveLang({ flag, env = process.env } = {}) {
+  if (flag === 'en' || flag === 'zh') return flag;
+  if (env.EUTHYNA_LANG === 'en') return 'en';
+  return DEFAULT_LANG;
+}
+
+/**
+ * The translation helper. Call it once per scope with the active language:
+ *
+ *   const t = T(lang);
+ *   write(t('已确证', 'Established'));
+ *
+ * The Chinese text is always the first argument and stays the canonical form;
+ * the English is the second. Each call site keeps both strings next to the
+ * interpolation that builds them, so a translation cannot drift from the
+ * message it translates.
+ */
+export function T(lang) {
+  return (zh, en) => (lang === 'en' ? en : zh);
+}