fullshield 0.1.3 → 0.2.6

package/dist/cli/index.js

@@ -2,12 +2,13 @@
 import { createHash } from 'crypto';
 import { writeFile, mkdir, readFile, stat, mkdtemp, unlink, readdir } from 'fs/promises';
 import { resolve, join, dirname, relative, basename, posix } from 'path';
-import { readFileSync, cpSync, existsSync, mkdirSync, rmSync, readdirSync, statSync, writeFileSync, mkdtempSync, unlinkSync } from 'fs';
-import { tmpdir, homedir } from 'os';
+import { readFileSync, existsSync, readdirSync, cpSync, mkdirSync, rmSync, statSync, writeFileSync, mkdtempSync, unlinkSync } from 'fs';
+import { homedir, tmpdir, availableParallelism } from 'os';
+import { fileURLToPath } from 'url';
+import { Worker } from 'worker_threads';
 import ignoreModule from 'ignore';
 import { execFile, spawnSync, execFileSync, spawn } from 'child_process';
 import { promisify } from 'util';
-import { fileURLToPath } from 'url';
 import { createInterface } from 'readline';
 import { performance } from 'perf_hooks';
 import { createRequire } from 'module';
@@ -188,6 +189,9 @@ function classesEnabled() {
 function mcpCfgEnabled() {
   return process.env.FULLSHIELD_EXPERIMENTAL_MCPCFG === "1";
 }
+function taintV2Enabled() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_TAINT_V2 === "1";
+}
 var init_experimental = __esm({
   "src/modules/sast/experimental.ts"() {
   }
@@ -1077,6 +1081,105 @@ var init_pins = __esm({
   }
 });
 
+// src/modules/deps/symbol-reachability.ts
+function affectedFunctionNames(vuln) {
+  const names = /* @__PURE__ */ new Set();
+  for (const affected of vuln.affected ?? []) {
+    const list = affected.ecosystem_specific?.affected_functions;
+    if (!Array.isArray(list)) continue;
+    for (const item of list) {
+      if (typeof item === "string" && item.length > 0) names.add(item);
+    }
+  }
+  return [...names];
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function called(source, local) {
+  return new RegExp(`\\b${escapeRegExp(local)}\\s*\\(`).test(source);
+}
+function memberCalled(source, object, member) {
+  return new RegExp(`\\b${escapeRegExp(object)}\\s*\\.\\s*${escapeRegExp(member)}\\s*\\(`).test(source);
+}
+function sourceCallsAffectedSymbol(source, symbol) {
+  const esc2 = escapeRegExp(symbol);
+  const named = new RegExp(
+    `import\\s*\\{([^}]+)\\}\\s*from\\s*['"][^'"]+['"]`,
+    "g"
+  );
+  let match;
+  while ((match = named.exec(source)) !== null) {
+    const parts = (match[1] ?? "").split(",");
+    for (const part of parts) {
+      const bits = part.trim().split(/\s+as\s+/);
+      const imported = bits[0]?.trim();
+      const local = (bits[1] ?? bits[0])?.trim();
+      if (imported === symbol && local !== void 0 && called(source, local)) return true;
+    }
+  }
+  const star = /import\s+\*\s+as\s+([A-Za-z_$][\w$]*)\s+from\s+['"][^'"]+['"]/g;
+  while ((match = star.exec(source)) !== null) {
+    const local = match[1];
+    if (local !== void 0 && memberCalled(source, local, symbol)) return true;
+  }
+  const subDefault = new RegExp(
+    `import\\s+([A-Za-z_$][\\w$]*)\\s+from\\s+['"][^'"]+/${esc2}['"]`
+  );
+  const sub = subDefault.exec(source);
+  if (sub?.[1] !== void 0 && called(source, sub[1])) return true;
+  const reqMember = new RegExp(
+    `(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*require\\(\\s*['"][^'"]+['"]\\s*\\)\\s*\\.\\s*${esc2}`
+  );
+  const reqHit = reqMember.exec(source);
+  if (reqHit?.[1] !== void 0 && called(source, reqHit[1])) return true;
+  const reqNs = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\(\s*['"][^'"]+['"]\s*\)/g;
+  while ((match = reqNs.exec(source)) !== null) {
+    const local = match[1];
+    if (local !== void 0 && memberCalled(source, local, symbol)) return true;
+  }
+  const reqNamed = /(?:const|let|var)\s*\{([^}]+)\}\s*=\s*require\(\s*['"][^'"]+['"]\s*\)/g;
+  while ((match = reqNamed.exec(source)) !== null) {
+    const parts = (match[1] ?? "").split(",");
+    for (const part of parts) {
+      const bits = part.trim().split(/\s*:\s*/);
+      const imported = bits[0]?.trim();
+      const local = (bits[1] ?? bits[0])?.trim();
+      if (imported === symbol && local !== void 0 && called(source, local)) return true;
+    }
+  }
+  const reqSub = new RegExp(
+    `(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*require\\(\\s*['"][^'"]+/${esc2}['"]\\s*\\)`
+  );
+  const subReq = reqSub.exec(source);
+  if (subReq?.[1] !== void 0 && called(source, subReq[1])) return true;
+  const barrel = new RegExp(`export\\s*\\{([^}]+)\\}\\s*from\\s*['"][^'"]+['"]`, "g");
+  while ((match = barrel.exec(source)) !== null) {
+    const parts = (match[1] ?? "").split(",");
+    for (const part of parts) {
+      const bits = part.trim().split(/\s+as\s+/);
+      const exported = (bits[1] ?? bits[0])?.trim();
+      if (exported === symbol) {
+        const local = bits[0]?.trim();
+        if (local !== void 0 && called(source, local)) return true;
+      }
+    }
+  }
+  return false;
+}
+function classifySymbolUse(symbols, sources) {
+  for (const symbol of symbols) {
+    for (const source of sources.values()) {
+      if (sourceCallsAffectedSymbol(source, symbol)) return "symbol-reachable";
+    }
+  }
+  return "symbol-not-called";
+}
+var init_symbol_reachability = __esm({
+  "src/modules/deps/symbol-reachability.ts"() {
+  }
+});
+
 // src/modules/deps/reachability.ts
 function packageNameFromSnippet(snippet) {
   if (snippet.startsWith("@")) {
@@ -1106,9 +1209,9 @@ function isProductionSource(rel) {
 }
 function indexPackageUsage(sources) {
   const usage = /* @__PURE__ */ new Map();
-  const bump = (pkg, called) => {
+  const bump = (pkg, called2) => {
     const prev = usage.get(pkg) ?? { called: false };
-    usage.set(pkg, { imported: true, called: prev.called || called });
+    usage.set(pkg, { imported: true, called: prev.called || called2 });
   };
   const nsRe = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\(\s*['"]([^'"]+)['"]\s*\)/g;
   const namedRe = /(?:const|let|var)\s*\{([^}]+)\}\s*=\s*require\(\s*['"]([^'"]+)['"]\s*\)/g;
@@ -1196,10 +1299,10 @@ function classifyReachability(pkgName, productionUsage, graph) {
   return { reachability: "not-imported" };
 }
 function reachabilitySteps(reachability) {
-  if (reachability === "reachable" || reachability === "reachable-via-dependency" || reachability === "reachability-unknown") {
+  if (reachability === "reachable" || reachability === "reachable-via-dependency" || reachability === "reachability-unknown" || reachability === "symbol-reachable") {
     return 0;
   }
-  if (reachability === "imported-not-called") return 1;
+  if (reachability === "imported-not-called" || reachability === "symbol-not-called") return 1;
   return 2;
 }
 function downgradeSeverity(severity, steps) {
@@ -1216,7 +1319,7 @@ function isDevOnly(pkgName, ctx) {
   if (inProd) return false;
   return directDev.has(pkgName) || reachableFrom(pkgName, directDev, edges);
 }
-function applyReachability(findings, ctx) {
+function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
   return findings.map((finding6) => {
     if (finding6.ruleId === "DEPS-MALICIOUS-001") {
       if (finding6.snippet === void 0) return finding6;
@@ -1233,7 +1336,12 @@ function applyReachability(findings, ctx) {
     if (finding6.ruleId !== "DEPS-VULN-001" || finding6.snippet === void 0) return finding6;
     const pkg = packageNameFromSnippet(finding6.snippet);
     if (pkg === void 0 || pkg.length === 0) return finding6;
-    const classified = classifyReachability(pkg, ctx.productionUsage, ctx.graph);
+    let classified = classifyReachability(pkg, ctx.productionUsage, ctx.graph);
+    const named = symbols.get(finding6.id) ?? [];
+    if (named.length > 0 && ctx.sources !== void 0) {
+      const symbolClass = classifySymbolUse(named, ctx.sources);
+      classified = { reachability: symbolClass, path: classified.path };
+    }
     const steps = reachabilitySteps(classified.reachability);
     let severity = steps === 0 ? finding6.severity : downgradeSeverity(finding6.severity, steps);
     let message = finding6.message;
@@ -1258,6 +1366,7 @@ function applyReachability(findings, ctx) {
 var init_reachability = __esm({
   "src/modules/deps/reachability.ts"() {
     init_finding();
+    init_symbol_reachability();
   }
 });
 
@@ -3822,7 +3931,7 @@ async function reachabilityCtx(cwd, files, graph) {
     } catch {
     }
   }
-  return { productionUsage: indexPackageUsage(prodSources), graph };
+  return { productionUsage: indexPackageUsage(prodSources), graph, sources: prodSources };
 }
 var LOCKFILE_NAMES, MANIFEST_FIELDS2, MALICIOUS_REMEDIATION, depsModule;
 var init_deps = __esm({
@@ -3832,6 +3941,7 @@ var init_deps = __esm({
     init_osv();
     init_pins();
     init_reachability();
+    init_symbol_reachability();
     init_semver();
     init_typosquat();
     init_experimental2();
@@ -3871,14 +3981,17 @@ var init_deps = __esm({
             findings2.push(typosquatFinding("package.json", hit));
           }
           const osvHits2 = await queryOsv(pins, osvOpts);
+          const symbols2 = /* @__PURE__ */ new Map();
           for (const hit of osvHits2) {
             for (const vuln of hit.vulns) {
-              findings2.push(
-                isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit.pkg, vuln) : vulnFinding("package.json", hit.pkg, vuln, depLoc(hit.pkg.name))
-              );
+              const finding6 = isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit.pkg, vuln) : vulnFinding("package.json", hit.pkg, vuln, depLoc(hit.pkg.name));
+              const names = affectedFunctionNames(vuln);
+              if (names.length > 0 && finding6.ruleId === "DEPS-VULN-001") symbols2.set(finding6.id, names);
+              findings2.push(finding6);
             }
           }
-          return applyReachability(findings2, await reachabilityCtx(ctx.cwd, ctx.files, graphFromManifest(manifest)));
+          const noLockCtx = await reachabilityCtx(ctx.cwd, ctx.files, graphFromManifest(manifest));
+          return applyReachability(findings2, noLockCtx, symbols2);
         }
         let contents;
         try {
@@ -3899,14 +4012,16 @@ var init_deps = __esm({
           }
         }
         const osvHits = await queryOsv(packages, osvOpts);
+        const symbols = /* @__PURE__ */ new Map();
         for (const hit of osvHits) {
           for (const vuln of hit.vulns) {
-            findings.push(
-              isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit.pkg, vuln) : vulnFinding(lockFile, hit.pkg, vuln, depLoc(hit.pkg.name))
-            );
+            const finding6 = isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit.pkg, vuln) : vulnFinding(lockFile, hit.pkg, vuln, depLoc(hit.pkg.name));
+            const names = affectedFunctionNames(vuln);
+            if (names.length > 0 && finding6.ruleId === "DEPS-VULN-001") symbols.set(finding6.id, names);
+            findings.push(finding6);
           }
         }
-        let reached = applyReachability(findings, await reachabilityCtx(ctx.cwd, ctx.files, graph));
+        let reached = applyReachability(findings, await reachabilityCtx(ctx.cwd, ctx.files, graph), symbols);
         if (experimentalVex()) {
           reached = attachOverrideProposals(reached, graph, lockFile, manifestRaw);
           reached.push(...scanInstalledPackages(ctx.cwd, packages));
@@ -4489,6 +4604,14 @@ function isXssSanitizerCall(node) {
   }
   return false;
 }
+function enclosingClass(node) {
+  let current = node.parent;
+  while (current !== void 0) {
+    if (current.type === "ClassDeclaration" || current.type === "ClassExpression") return current;
+    current = current.parent;
+  }
+  return void 0;
+}
 function exprIsTainted(node, tainted, returners = NO_RETURNERS) {
   if (node === void 0) return false;
   if (isTaintSource(node) || isFrameworkMemberTaint(node) || isFrameworkTaintCall(node) || isMcpArgsTaintSource(node)) {
@@ -4500,8 +4623,34 @@ function exprIsTainted(node, tainted, returners = NO_RETURNERS) {
     case "Identifier":
       return tainted.has(node.name);
     case "MemberExpression":
+      if (taintV2Enabled() && node.object.type === "ThisExpression") {
+        const cls = enclosingClass(node);
+        const name = propName(node);
+        if (cls !== void 0 && name !== void 0 && taintedThisFields.get(cls)?.has(name) === true) {
+          return true;
+        }
+      }
       return exprIsTainted(node.object, tainted, returners);
+    case "ArrayExpression":
+      if (!taintV2Enabled()) return false;
+      return node.elements.some((el) => {
+        if (el === null) return false;
+        if (el.type === "SpreadElement") return exprIsTainted(el.argument, tainted, returners);
+        return exprIsTainted(el, tainted, returners);
+      });
+    case "ObjectExpression":
+      if (!taintV2Enabled()) return false;
+      return node.properties.some((prop) => {
+        if (prop.type === "SpreadElement") return exprIsTainted(prop.argument, tainted, returners);
+        if (prop.type !== "Property") return false;
+        return exprIsTainted(prop.value, tainted, returners);
+      });
     case "CallExpression":
+      if (taintV2Enabled() && node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "Object" && propName(node.callee) === "assign") {
+        return node.arguments.some(
+          (arg) => arg.type !== "SpreadElement" && exprIsTainted(arg, tainted, returners)
+        );
+      }
       if (isSchemaValidatorCall(node)) return false;
       if (node.callee.type === "Identifier" && returners.has(node.callee.name)) return true;
       if (node.callee.type === "MemberExpression" && exprIsTainted(node.callee.object, tainted, returners)) {
@@ -4731,6 +4880,65 @@ function scopeReturnsTaint(scope, tainted, returners) {
   });
   return yes;
 }
+function seedTaintV2(functions, facts, seeds, returners, nameToFn) {
+  let changed = false;
+  const mark = (fn, name) => {
+    if (name === void 0) return;
+    const set = seeds.get(fn) ?? /* @__PURE__ */ new Set();
+    if (set.has(name)) return;
+    set.add(name);
+    seeds.set(fn, set);
+    changed = true;
+  };
+  for (const fn of functions) {
+    const f = facts.get(fn);
+    if (f === void 0) continue;
+    let parent = fn.parent;
+    while (parent !== void 0 && !isFunctionNode(parent)) {
+      parent = parent.parent;
+    }
+    if (parent !== void 0 && isFunctionNode(parent)) {
+      const outer = facts.get(parent);
+      if (outer !== void 0) {
+        for (const name of outer.tainted) mark(fn, name);
+      }
+    }
+    walkScope(fn, (node) => {
+      if (node.type === "AssignmentExpression" && node.left.type === "MemberExpression") {
+        if (node.left.object.type === "ThisExpression" && exprIsTainted(node.right, f.tainted, returners)) {
+          const cls = enclosingClass(node);
+          const field = propName(node.left);
+          if (cls !== void 0 && field !== void 0) {
+            const fields = taintedThisFields.get(cls) ?? /* @__PURE__ */ new Set();
+            if (!fields.has(field)) {
+              fields.add(field);
+              taintedThisFields.set(cls, fields);
+              changed = true;
+            }
+          }
+        }
+      }
+      if (node.type !== "CallExpression" || node.callee.type !== "MemberExpression") return;
+      const method = propName(node.callee);
+      if (method === void 0) return;
+      if (CALLBACK_METHODS.has(method) && exprIsTainted(node.callee.object, f.tainted, returners)) {
+        const callback = node.arguments[0];
+        if (callback !== void 0 && isFunctionNode(callback)) {
+          mark(callback, boundNames(callback.params[0])[0]);
+        }
+      }
+      if ((method === "call" || method === "apply") && node.callee.object.type === "Identifier") {
+        const target = nameToFn.get(node.callee.object.name);
+        if (target === void 0 || !isFunctionNode(target)) return;
+        const arg = node.arguments[1];
+        if (arg !== void 0 && arg.type !== "SpreadElement" && exprIsTainted(arg, f.tainted, returners)) {
+          mark(target, boundNames(target.params[0])[0]);
+        }
+      }
+    });
+  }
+  return changed;
+}
 function analyzeFile(ast, extraReturners = NO_RETURNERS) {
   attachParents(ast);
   const facts = /* @__PURE__ */ new WeakMap();
@@ -4785,6 +4993,9 @@ function analyzeFile(ast, extraReturners = NO_RETURNERS) {
         });
       });
     }
+    if (taintV2Enabled() && seedTaintV2(functions, facts, seeds, returners, nameToFn)) {
+      changed = true;
+    }
     if (!changed) break;
   }
   return facts;
@@ -4843,7 +5054,7 @@ function nodeIsNosqlSanitized(node, map) {
   if (node.type === "Identifier") return factsFor(node, map).nosqlSanitized.has(node.name);
   return false;
 }
-var SCHEMA_ROOT, NO_RETURNERS, MAX_TAINT_HOPS;
+var SCHEMA_ROOT, NO_RETURNERS, CALLBACK_METHODS, taintedThisFields, MAX_TAINT_HOPS;
 var init_taint = __esm({
   "src/modules/sast/taint.ts"() {
     init_ast();
@@ -4852,6 +5063,18 @@ var init_taint = __esm({
     init_mcp2();
     SCHEMA_ROOT = /^(z|zod|joi|yup|schema)$/i;
     NO_RETURNERS = /* @__PURE__ */ new Set();
+    CALLBACK_METHODS = /* @__PURE__ */ new Set([
+      "then",
+      "catch",
+      "finally",
+      "map",
+      "forEach",
+      "filter",
+      "flatMap",
+      "find",
+      "reduce"
+    ]);
+    taintedThisFields = /* @__PURE__ */ new WeakMap();
     MAX_TAINT_HOPS = 5;
   }
 });
@@ -4936,6 +5159,21 @@ function requireCall(node) {
   }
   return void 0;
 }
+function reexportsOf(ast) {
+  const out = /* @__PURE__ */ new Map();
+  walk(ast, (node) => {
+    if (node.type !== "ExportNamedDeclaration" || node.source === null || node.source === void 0) return;
+    const spec = literalString(node.source);
+    if (spec === void 0) return;
+    for (const specNode of node.specifiers) {
+      if (specNode.type !== "ExportSpecifier") continue;
+      const exported = specNode.exported.type === "Identifier" ? specNode.exported.name : void 0;
+      const local = specNode.local.type === "Identifier" ? specNode.local.name : exported;
+      if (exported !== void 0 && local !== void 0) out.set(exported, { spec, name: local });
+    }
+  });
+  return out;
+}
 function resolveRelative(fromFile, spec, files) {
   if (!spec.startsWith(".")) return void 0;
   const base = posix.normalize(posix.join(posix.dirname(fromFile), spec));
@@ -5013,6 +5251,22 @@ function runInterproc(parsed) {
       functions.set(`${fn.file}#${fn.name}`, fn);
     }
   }
+  if (taintV2Enabled()) {
+    const barrels = /* @__PURE__ */ new Map();
+    for (const p of parsed) barrels.set(p.file, reexportsOf(p.ast));
+    for (const ns of requires.values()) {
+      for (const [local, target] of ns) {
+        const hash = target.indexOf("#");
+        if (hash < 0) continue;
+        const file = target.slice(0, hash);
+        const name = target.slice(hash + 1);
+        const re = barrels.get(file)?.get(name);
+        if (re === void 0) continue;
+        const resolved = resolveRelative(file, re.spec, files);
+        if (resolved !== void 0) ns.set(local, `${resolved}#${re.name}`);
+      }
+    }
+  }
   const queue = [];
   for (const p of parsed) {
     const facts = analyzeFile(p.ast);
@@ -5149,6 +5403,7 @@ var init_interproc = __esm({
   "src/modules/sast/interproc.ts"() {
     init_finding();
     init_ast();
+    init_experimental();
     init_taint();
     MAX_HOPS = 5;
   }
@@ -5546,7 +5801,10 @@ function isMongoReceiver(node, source) {
   const obj = node.callee.object;
   if (obj.type === "Identifier") {
     if (isCollectionName(obj.name)) return true;
-    if (isPascalModel(obj.name)) return !fileHasSqlOrm;
+    if (isPascalModel(obj.name)) {
+      if (/extends\s+BaseEntity\b/.test(source)) return false;
+      return !fileHasSqlOrm;
+    }
     return fileHasMongo;
   }
   if (obj.type === "MemberExpression") {
@@ -6686,6 +6944,80 @@ var init_injection = __esm({
     PHRASES = [/ignore previous/i, /mark as safe/i, /ai reviewer/i];
   }
 });
+function packageVersion() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (let depth = 0; depth < 6; depth += 1) {
+    try {
+      const raw = readFileSync(join(dir, "package.json"), "utf8");
+      const pkg = JSON.parse(raw);
+      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
+        return pkg.version;
+      }
+    } catch {
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error("fullshield package.json not found");
+}
+var init_version = __esm({
+  "src/core/version.ts"() {
+  }
+});
+function parsePoolEnabled() {
+  return process.env.FULLSHIELD_PARSE_POOL === "1";
+}
+function parsePoolSize() {
+  const raw = process.env.FULLSHIELD_PARSE_WORKERS;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
+  }
+  return Math.max(1, availableParallelism() - 1);
+}
+function parseCacheKey(code) {
+  return createHash("sha256").update(packageVersion()).update("\0").update(code).digest("hex");
+}
+function parseOne(code) {
+  const key = parseCacheKey(code);
+  const hit = cache.get(key);
+  if (hit !== void 0) return Promise.resolve(hit);
+  return new Promise((resolve8, reject) => {
+    const worker = new Worker(fileURLToPath(workerUrl), { workerData: { code } });
+    worker.once("message", (ast) => {
+      cache.set(key, ast);
+      resolve8(ast);
+    });
+    worker.once("error", reject);
+  });
+}
+async function parseWithPool(codes) {
+  const size = parsePoolSize();
+  const out = new Array(codes.length);
+  let next = 0;
+  async function run() {
+    for (; ; ) {
+      const index = next;
+      next += 1;
+      if (index >= codes.length) return;
+      const code = codes[index];
+      if (code === void 0) return;
+      out[index] = await parseOne(code);
+    }
+  }
+  const workers = Math.min(size, Math.max(1, codes.length));
+  await Promise.all(Array.from({ length: workers }, () => run()));
+  return out;
+}
+var workerUrl, cache;
+var init_parse_pool = __esm({
+  "src/core/parse-pool.ts"() {
+    init_version();
+    workerUrl = new URL("./parse-worker.mjs", import.meta.url);
+    cache = /* @__PURE__ */ new Map();
+  }
+});
 async function parseSource(code) {
   const { parse } = await import('@typescript-eslint/typescript-estree');
   return parse(code, {
@@ -6801,6 +7133,7 @@ var init_engine = __esm({
     init_xss();
     init_phase29();
     init_injection();
+    init_parse_pool();
     sastRules = [
       sqliRule,
       cmdiRule,
@@ -6838,7 +7171,8 @@ var init_engine = __esm({
             continue;
           }
           try {
-            const ast = await parseSource(source);
+            const ast = parsePoolEnabled() ? (await parseWithPool([source]))[0] : await parseSource(source);
+            if (ast === void 0) continue;
             parsed.push({ file: rel, source, ast });
           } catch {
           }
@@ -7690,7 +8024,7 @@ function createAiClient(options) {
   const useFixtures = options.useFixtures ?? !isLiveAi();
   const model = options.model ?? process.env.FULLSHIELD_AI_MODEL ?? (useFixtures ? "recorded-fixture" : "qwen2.5-coder:7b");
   const provider = options.provider ?? process.env.FULLSHIELD_AI_PROVIDER ?? (useFixtures ? "fixture" : "ollama");
-  const cache = /* @__PURE__ */ new Map();
+  const cache2 = /* @__PURE__ */ new Map();
   let spentUsd = 0;
   let networkCalls = 0;
   const liveCost = provider === "ollama" ? 0 : FIXTURE_COST;
@@ -7710,7 +8044,7 @@ function createAiClient(options) {
       const redactedPrompt = `${modeInstruction(req.mode)}
 ${wrapUntrustedCode(req.prompt)}`;
       const key = cacheKey(req.model ?? model, redactedPrompt);
-      const cached = cache.get(key);
+      const cached = cache2.get(key);
       if (cached !== void 0) {
         return { ...cached, cached: true, costUsd: 0 };
       }
@@ -7724,7 +8058,7 @@ ${wrapUntrustedCode(req.prompt)}`;
           cached: false,
           redactedPrompt
         };
-        cache.set(key, response2);
+        cache2.set(key, response2);
         return response2;
       }
       const fetchImpl = options.fetchImpl ?? fetch;
@@ -7774,7 +8108,7 @@ ${wrapUntrustedCode(req.prompt)}`;
         cached: false,
         redactedPrompt
       };
-      cache.set(key, response);
+      cache2.set(key, response);
       return response;
     }
   };
@@ -8050,27 +8384,6 @@ var init_suppression = __esm({
     IGNORE = /fullshield-ignore\s+([A-Z0-9-]+)\s*:\s*(\S+)/;
   }
 });
-function packageVersion() {
-  let dir = dirname(fileURLToPath(import.meta.url));
-  for (let depth = 0; depth < 6; depth += 1) {
-    try {
-      const raw = readFileSync(join(dir, "package.json"), "utf8");
-      const pkg = JSON.parse(raw);
-      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
-        return pkg.version;
-      }
-    } catch {
-    }
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  throw new Error("fullshield package.json not found");
-}
-var init_version = __esm({
-  "src/core/version.ts"() {
-  }
-});
 
 // src/policy/prSummary.ts
 function ruleDocsUrl(ruleId) {
@@ -10912,15 +11225,23 @@ function renderConsoleReport(result) {
     );
   }
   const bySeverityDesc = [...SEVERITIES].reverse();
+  const ordered = bySeverityDesc.flatMap((severity) => findings.filter((f) => f.severity === severity));
+  const shown = ordered.slice(0, 10);
+  const hidden = ordered.length - shown.length;
   for (const severity of bySeverityDesc) {
-    const group = findings.filter((f) => f.severity === severity);
+    const group = shown.filter((f) => f.severity === severity);
     if (group.length === 0) continue;
     lines.push("");
-    lines.push(SEVERITY_COLOR[severity](`${severity.toUpperCase()} (${group.length})`));
+    lines.push(SEVERITY_COLOR[severity](`${severity.toUpperCase()} (${findings.filter((f) => f.severity === severity).length})`));
     for (const finding6 of group) {
       lines.push(...renderFinding(finding6));
+      lines.push(`    docs: rules/${finding6.ruleId}.md`);
     }
   }
+  if (hidden > 0) {
+    lines.push("");
+    lines.push(`${hidden} more \u2014 use --json`);
+  }
   lines.push("");
   if (summary.total === 0) {
     lines.push(pc.green("\u2714 No findings."));
@@ -11803,6 +12124,98 @@ function stateForGrace(sshd) {
   return sshd.loginGraceTimeZero ? "logingracetime 0" : "logingracetime not 0";
 }
 
+// src/cli/commands/doctor.ts
+init_config2();
+var MIN_NODE = [22, 13, 0];
+var LOCKFILES = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"];
+var FLAGS = [
+  "FULLSHIELD_EXPERIMENTAL_SAST_GAPS",
+  "FULLSHIELD_EXPERIMENTAL_FRAMEWORKS",
+  "FULLSHIELD_EXPERIMENTAL_CLASSES",
+  "FULLSHIELD_EXPERIMENTAL_SECRETS_ADV",
+  "FULLSHIELD_EXPERIMENTAL_VEX",
+  "FULLSHIELD_EXPERIMENTAL_DLP",
+  "FULLSHIELD_EXPERIMENTAL_MCPCFG",
+  "FULLSHIELD_EXPERIMENTAL_POLICY",
+  "FULLSHIELD_EXPERIMENTAL_HOST",
+  "FULLSHIELD_EXPERIMENTAL_TAINT_V2",
+  "FULLSHIELD_PARSE_POOL"
+];
+function nodeOk(version) {
+  const parts = version.split(".").map((part) => Number(part));
+  for (let i = 0; i < MIN_NODE.length; i += 1) {
+    const got = parts[i] ?? 0;
+    const need = MIN_NODE[i] ?? 0;
+    if (got > need) return true;
+    if (got < need) return false;
+  }
+  return true;
+}
+async function runDoctor(cwd, options = {}) {
+  const lines = [];
+  const version = process.versions.node;
+  lines.push(`node: ${version} ${nodeOk(version) ? "ok" : "too old (need >= 22.13.0)"}`);
+  const locks = LOCKFILES.filter((name) => existsSync(join(cwd, name)));
+  lines.push(locks.length > 0 ? `lockfile: ${locks.join(", ")}` : "lockfile: none");
+  const cacheDir = join(homedir(), ".cache", "fullshield", "osv");
+  let cacheFiles = 0;
+  if (existsSync(cacheDir)) {
+    cacheFiles = readdirSync(cacheDir).length;
+  }
+  lines.push(`cache: ${existsSync(cacheDir) ? cacheDir : "absent"} (${cacheFiles} files)`);
+  const on = FLAGS.filter((name) => process.env[name] === "1");
+  lines.push(on.length > 0 ? `flags: ${on.join(", ")}` : "flags: none");
+  try {
+    const config = await loadConfig(cwd, options.config);
+    lines.push(`config: valid (failOn ${config.failOn}, offline ${config.deps.offline})`);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    lines.push(`config: invalid (${message})`);
+  }
+  const offline = options.offline === true;
+  lines.push(
+    offline ? "osv: network skipped (--offline); reachability uses the local lockfile only" : "osv: network allowed; reachability still uses the local lockfile"
+  );
+  return lines.join("\n");
+}
+
+// src/cli/errors.ts
+var KNOWN = [
+  {
+    test: /invalid --fail-on/,
+    code: "FS-E001",
+    hint: "Use one of critical, high, medium, low, info."
+  },
+  {
+    test: /unknown module/,
+    code: "FS-E002",
+    hint: "Pass a comma-separated list from `fullshield scan --help`."
+  },
+  {
+    test: /not a directory/,
+    code: "FS-E003",
+    hint: "Pass the project directory to scan."
+  },
+  {
+    test: /cannot read config/,
+    code: "FS-E004",
+    hint: "Check the path passed to --config."
+  }
+];
+var DOCS = "https://github.com/kathanp/fullshield/blob/main/docs/errors.md";
+function formatCliError(error, debug = process.argv.includes("--debug")) {
+  const message = error instanceof Error ? error.message : String(error);
+  const known = KNOWN.find((item) => item.test.test(message));
+  const code = known?.code ?? "FS-E000";
+  const hint = known !== void 0 ? ` \u2014 ${known.hint} ${DOCS}#${code.toLowerCase()}` : "";
+  const line = `fullshield: ${code} ${message}${hint}`;
+  if (debug && error instanceof Error && error.stack !== void 0) {
+    return `${line}
+${error.stack}`;
+  }
+  return line;
+}
+
 // src/cli/program.ts
 var defaultIO = {
   out: (text) => process.stdout.write(`${text}
@@ -11837,7 +12250,7 @@ function parseFailOn(value) {
 }
 function createProgram(io = defaultIO) {
   const program = new Command();
-  program.name("fullshield").description("Full-cycle security scanner for Node.js/TypeScript backends").version(packageVersion());
+  program.name("fullshield").description("Full-cycle security scanner for Node.js/TypeScript backends").version(packageVersion()).option("--debug", "print stack traces on CLI errors");
   program.command("scan").description("Scan a project directory for security findings").argument("[path]", "directory to scan", ".").option("--json", "machine-readable JSON output").option("--fail-on <severity>", "exit 1 if any finding is at or above this severity").option("--modules <modules>", "comma-separated subset of modules to run").option("--staged", "scan only files staged in git (pre-commit mode)").option("--offline", "use the OSV cache only (no network)").option("--offline-safe", "alias of --offline").option("--config <path>", "path to fullshield.config.json").option("--sarif <file>", "write a SARIF 2.1.0 report to this path").option("--markdown <file>", "write a Markdown report to this path").option("--html <file>", "write an HTML report to this path").option("--update-baseline", "record current findings as accepted (CI fails only on new ones)").option("--ai [mode]", "experimental: explain findings (off = zero AI network calls)").option("--emit-virtual-patches [file]", "experimental: write .fullshield/vpatches.json").option("--changed", "experimental: scan git staged/changed files only").option("--since <ref>", "experimental: scan files changed since a git ref").option(
     "--experimental-sast-gaps",
     "experimental: ORM raw / sh -c / execa / zx sinks (FULLSHIELD_EXPERIMENTAL_SAST_GAPS=1)"
@@ -11950,7 +12363,7 @@ function createProgram(io = defaultIO) {
         process.exitCode = 1;
       }
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -11995,7 +12408,7 @@ function createProgram(io = defaultIO) {
         io.out("Dry run. Re-run with --apply to write safe fixes.");
       }
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12008,7 +12421,7 @@ function createProgram(io = defaultIO) {
         io.out(`Wrote ${result.written.join(", ")}`);
       }
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12037,7 +12450,7 @@ function createProgram(io = defaultIO) {
       }
       io.out(formatSummary(summary));
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12057,7 +12470,7 @@ function createProgram(io = defaultIO) {
         io.out(json);
       }
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12076,7 +12489,7 @@ function createProgram(io = defaultIO) {
       }
       if (findings.some((f) => meetsThreshold(f.severity, "high"))) process.exitCode = 1;
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12111,7 +12524,7 @@ function createProgram(io = defaultIO) {
       const gate = failOn ?? result.config.failOn;
       if (fresh.some((f) => meetsThreshold(f.severity, gate))) process.exitCode = 1;
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12124,7 +12537,7 @@ function createProgram(io = defaultIO) {
       const model = buildThreatModel2(resolve(path), { experimental: true });
       io.out(JSON.stringify({ routes: model.routes.length, stride: model.stride, mermaid: model.mermaid }));
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12154,7 +12567,7 @@ function createProgram(io = defaultIO) {
       const started = await startDashboard2({ dir: resolve(path), experimental: true });
       io.out(`dashboard listening on http://127.0.0.1:${started.port} (Host must be localhost or 127.0.0.1)`);
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12167,7 +12580,7 @@ function createProgram(io = defaultIO) {
       const findings = scanIac2(resolve(path), { experimental: true });
       io.out(JSON.stringify({ findings }));
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12196,7 +12609,7 @@ function createProgram(io = defaultIO) {
       const req = JSON.parse(text);
       io.out(JSON.stringify(await handleMcpRequest2(session, req)));
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12210,7 +12623,7 @@ function createProgram(io = defaultIO) {
       const result = await confirmTarget2(url, { experimental: true, routes: [] });
       io.out(JSON.stringify({ ok: true, confirmations: result.confirmations }));
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12233,7 +12646,7 @@ function createProgram(io = defaultIO) {
       }
       io.out(`static checks passed for ${pkg}; next step would be npm install --ignore-scripts`);
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12253,7 +12666,7 @@ function createProgram(io = defaultIO) {
       });
       io.out(JSON.stringify({ prs: result.prs, stoppedOnTestFailure: result.stoppedOnTestFailure, merged: result.merged }));
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12303,7 +12716,7 @@ function createProgram(io = defaultIO) {
       }
       if (result.findings.some((f) => meetsThreshold(f.severity, "high"))) process.exitCode = 1;
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12317,7 +12730,7 @@ function createProgram(io = defaultIO) {
       io.out(`wrote honeytokens (.env.backup). decoys: /admin.php /.git/config /wp-login.php`);
       io.out(`canary prefix ${canaries.awsKey.slice(0, 4)}****`);
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12353,7 +12766,15 @@ function createProgram(io = defaultIO) {
         io.out(json);
       }
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
+      process.exitCode = 2;
+    }
+  });
+  program.command("doctor").description("Report Node, lockfile, cache, flags, config, and whether OSV is offline").argument("[path]", "project directory", ".").option("--offline", "do not describe OSV as allowed to use the network").option("--config <file>", "explicit config file").action(async (path, opts) => {
+    try {
+      io.out(await runDoctor(resolve(path), opts));
+    } catch (error) {
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });