fullshield 0.1.3 → 0.2.6

package/dist/index.d.ts

@@ -42,7 +42,7 @@ interface Finding {
         note: string;
     }>;
     /** Dependency reachability (Phase 13 / harden-3). */
-    reachability?: 'reachable' | 'imported-not-called' | 'reachable-via-dependency' | 'not-imported' | 'reachability-unknown';
+    reachability?: 'reachable' | 'imported-not-called' | 'reachable-via-dependency' | 'not-imported' | 'reachability-unknown' | 'symbol-reachable' | 'symbol-not-called';
     /** Lockfile path from an imported direct dependency, e.g. express > body-parser > qs. */
     dependencyPath?: string[];
     /** Deterministic (default) vs AI-added. AI findings never fail CI. */

package/dist/index.js

@@ -1,14 +1,15 @@
 import { createHash } from 'crypto';
 import { readFile, mkdir, writeFile, stat, unlink, readdir, mkdtemp } from 'fs/promises';
-import { resolve, join, basename, dirname, relative, posix } from 'path';
+import { resolve, join, basename, dirname, posix, relative } from 'path';
 import { execFile, spawnSync, spawn, execFileSync } from 'child_process';
 import { createInterface } from 'readline';
 import { promisify } from 'util';
 import { performance } from 'perf_hooks';
-import { homedir, tmpdir } from 'os';
+import { homedir, availableParallelism, tmpdir } from 'os';
 import { existsSync, statSync, readFileSync, readdirSync, cpSync, mkdirSync, rmSync } from 'fs';
-import ignoreModule from 'ignore';
+import { Worker } from 'worker_threads';
 import { fileURLToPath } from 'url';
+import ignoreModule from 'ignore';
 import pc from 'picocolors';
 
 var __defProp = Object.defineProperty;
@@ -1147,6 +1148,9 @@ function classesEnabled() {
 function mcpCfgEnabled() {
   return process.env.FULLSHIELD_EXPERIMENTAL_MCPCFG === "1";
 }
+function taintV2Enabled() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_TAINT_V2 === "1";
+}
 
 // src/modules/config/finding.ts
 init_finding();
@@ -1956,6 +1960,103 @@ function exactPinsFromManifest(pkg) {
 
 // src/modules/deps/reachability.ts
 init_finding();
+
+// src/modules/deps/symbol-reachability.ts
+function affectedFunctionNames(vuln) {
+  const names = /* @__PURE__ */ new Set();
+  for (const affected of vuln.affected ?? []) {
+    const list = affected.ecosystem_specific?.affected_functions;
+    if (!Array.isArray(list)) continue;
+    for (const item of list) {
+      if (typeof item === "string" && item.length > 0) names.add(item);
+    }
+  }
+  return [...names];
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function called(source, local) {
+  return new RegExp(`\\b${escapeRegExp(local)}\\s*\\(`).test(source);
+}
+function memberCalled(source, object, member) {
+  return new RegExp(`\\b${escapeRegExp(object)}\\s*\\.\\s*${escapeRegExp(member)}\\s*\\(`).test(source);
+}
+function sourceCallsAffectedSymbol(source, symbol) {
+  const esc2 = escapeRegExp(symbol);
+  const named = new RegExp(
+    `import\\s*\\{([^}]+)\\}\\s*from\\s*['"][^'"]+['"]`,
+    "g"
+  );
+  let match;
+  while ((match = named.exec(source)) !== null) {
+    const parts = (match[1] ?? "").split(",");
+    for (const part of parts) {
+      const bits = part.trim().split(/\s+as\s+/);
+      const imported = bits[0]?.trim();
+      const local = (bits[1] ?? bits[0])?.trim();
+      if (imported === symbol && local !== void 0 && called(source, local)) return true;
+    }
+  }
+  const star = /import\s+\*\s+as\s+([A-Za-z_$][\w$]*)\s+from\s+['"][^'"]+['"]/g;
+  while ((match = star.exec(source)) !== null) {
+    const local = match[1];
+    if (local !== void 0 && memberCalled(source, local, symbol)) return true;
+  }
+  const subDefault = new RegExp(
+    `import\\s+([A-Za-z_$][\\w$]*)\\s+from\\s+['"][^'"]+/${esc2}['"]`
+  );
+  const sub = subDefault.exec(source);
+  if (sub?.[1] !== void 0 && called(source, sub[1])) return true;
+  const reqMember = new RegExp(
+    `(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*require\\(\\s*['"][^'"]+['"]\\s*\\)\\s*\\.\\s*${esc2}`
+  );
+  const reqHit = reqMember.exec(source);
+  if (reqHit?.[1] !== void 0 && called(source, reqHit[1])) return true;
+  const reqNs = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\(\s*['"][^'"]+['"]\s*\)/g;
+  while ((match = reqNs.exec(source)) !== null) {
+    const local = match[1];
+    if (local !== void 0 && memberCalled(source, local, symbol)) return true;
+  }
+  const reqNamed = /(?:const|let|var)\s*\{([^}]+)\}\s*=\s*require\(\s*['"][^'"]+['"]\s*\)/g;
+  while ((match = reqNamed.exec(source)) !== null) {
+    const parts = (match[1] ?? "").split(",");
+    for (const part of parts) {
+      const bits = part.trim().split(/\s*:\s*/);
+      const imported = bits[0]?.trim();
+      const local = (bits[1] ?? bits[0])?.trim();
+      if (imported === symbol && local !== void 0 && called(source, local)) return true;
+    }
+  }
+  const reqSub = new RegExp(
+    `(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*require\\(\\s*['"][^'"]+/${esc2}['"]\\s*\\)`
+  );
+  const subReq = reqSub.exec(source);
+  if (subReq?.[1] !== void 0 && called(source, subReq[1])) return true;
+  const barrel = new RegExp(`export\\s*\\{([^}]+)\\}\\s*from\\s*['"][^'"]+['"]`, "g");
+  while ((match = barrel.exec(source)) !== null) {
+    const parts = (match[1] ?? "").split(",");
+    for (const part of parts) {
+      const bits = part.trim().split(/\s+as\s+/);
+      const exported = (bits[1] ?? bits[0])?.trim();
+      if (exported === symbol) {
+        const local = bits[0]?.trim();
+        if (local !== void 0 && called(source, local)) return true;
+      }
+    }
+  }
+  return false;
+}
+function classifySymbolUse(symbols, sources) {
+  for (const symbol of symbols) {
+    for (const source of sources.values()) {
+      if (sourceCallsAffectedSymbol(source, symbol)) return "symbol-reachable";
+    }
+  }
+  return "symbol-not-called";
+}
+
+// src/modules/deps/reachability.ts
 function packageNameFromSnippet(snippet) {
   if (snippet.startsWith("@")) {
     const second = snippet.indexOf("@", 1);
@@ -1984,9 +2085,9 @@ function isProductionSource(rel) {
 }
 function indexPackageUsage(sources) {
   const usage = /* @__PURE__ */ new Map();
-  const bump = (pkg, called) => {
+  const bump = (pkg, called2) => {
     const prev = usage.get(pkg) ?? { called: false };
-    usage.set(pkg, { imported: true, called: prev.called || called });
+    usage.set(pkg, { imported: true, called: prev.called || called2 });
   };
   const nsRe = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\(\s*['"]([^'"]+)['"]\s*\)/g;
   const namedRe = /(?:const|let|var)\s*\{([^}]+)\}\s*=\s*require\(\s*['"]([^'"]+)['"]\s*\)/g;
@@ -2074,10 +2175,10 @@ function classifyReachability(pkgName, productionUsage, graph) {
   return { reachability: "not-imported" };
 }
 function reachabilitySteps(reachability) {
-  if (reachability === "reachable" || reachability === "reachable-via-dependency" || reachability === "reachability-unknown") {
+  if (reachability === "reachable" || reachability === "reachable-via-dependency" || reachability === "reachability-unknown" || reachability === "symbol-reachable") {
     return 0;
   }
-  if (reachability === "imported-not-called") return 1;
+  if (reachability === "imported-not-called" || reachability === "symbol-not-called") return 1;
   return 2;
 }
 function downgradeSeverity(severity, steps) {
@@ -2094,7 +2195,7 @@ function isDevOnly(pkgName, ctx) {
   if (inProd) return false;
   return directDev.has(pkgName) || reachableFrom(pkgName, directDev, edges);
 }
-function applyReachability(findings, ctx) {
+function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
   return findings.map((finding3) => {
     if (finding3.ruleId === "DEPS-MALICIOUS-001") {
       if (finding3.snippet === void 0) return finding3;
@@ -2111,7 +2212,12 @@ function applyReachability(findings, ctx) {
     if (finding3.ruleId !== "DEPS-VULN-001" || finding3.snippet === void 0) return finding3;
     const pkg = packageNameFromSnippet(finding3.snippet);
     if (pkg === void 0 || pkg.length === 0) return finding3;
-    const classified = classifyReachability(pkg, ctx.productionUsage, ctx.graph);
+    let classified = classifyReachability(pkg, ctx.productionUsage, ctx.graph);
+    const named = symbols.get(finding3.id) ?? [];
+    if (named.length > 0 && ctx.sources !== void 0) {
+      const symbolClass = classifySymbolUse(named, ctx.sources);
+      classified = { reachability: symbolClass, path: classified.path };
+    }
     const steps = reachabilitySteps(classified.reachability);
     let severity = steps === 0 ? finding3.severity : downgradeSeverity(finding3.severity, steps);
     let message = finding3.message;
@@ -4451,14 +4557,17 @@ var depsModule = {
         findings2.push(typosquatFinding("package.json", hit));
       }
       const osvHits2 = await queryOsv(pins, osvOpts);
+      const symbols2 = /* @__PURE__ */ new Map();
       for (const hit of osvHits2) {
         for (const vuln of hit.vulns) {
-          findings2.push(
-            isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit.pkg, vuln) : vulnFinding("package.json", hit.pkg, vuln, depLoc(hit.pkg.name))
-          );
+          const finding3 = isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit.pkg, vuln) : vulnFinding("package.json", hit.pkg, vuln, depLoc(hit.pkg.name));
+          const names = affectedFunctionNames(vuln);
+          if (names.length > 0 && finding3.ruleId === "DEPS-VULN-001") symbols2.set(finding3.id, names);
+          findings2.push(finding3);
         }
       }
-      return applyReachability(findings2, await reachabilityCtx(ctx.cwd, ctx.files, graphFromManifest(manifest)));
+      const noLockCtx = await reachabilityCtx(ctx.cwd, ctx.files, graphFromManifest(manifest));
+      return applyReachability(findings2, noLockCtx, symbols2);
     }
     let contents;
     try {
@@ -4479,14 +4588,16 @@ var depsModule = {
       }
     }
     const osvHits = await queryOsv(packages, osvOpts);
+    const symbols = /* @__PURE__ */ new Map();
     for (const hit of osvHits) {
       for (const vuln of hit.vulns) {
-        findings.push(
-          isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit.pkg, vuln) : vulnFinding(lockFile, hit.pkg, vuln, depLoc(hit.pkg.name))
-        );
+        const finding3 = isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit.pkg, vuln) : vulnFinding(lockFile, hit.pkg, vuln, depLoc(hit.pkg.name));
+        const names = affectedFunctionNames(vuln);
+        if (names.length > 0 && finding3.ruleId === "DEPS-VULN-001") symbols.set(finding3.id, names);
+        findings.push(finding3);
       }
     }
-    let reached = applyReachability(findings, await reachabilityCtx(ctx.cwd, ctx.files, graph));
+    let reached = applyReachability(findings, await reachabilityCtx(ctx.cwd, ctx.files, graph), symbols);
     if (experimentalVex()) {
       reached = attachOverrideProposals(reached, graph, lockFile, manifestRaw);
       reached.push(...scanInstalledPackages(ctx.cwd, packages));
@@ -4520,7 +4631,7 @@ async function reachabilityCtx(cwd, files, graph) {
     } catch {
     }
   }
-  return { productionUsage: indexPackageUsage(prodSources), graph };
+  return { productionUsage: indexPackageUsage(prodSources), graph, sources: prodSources };
 }
 
 // src/modules/mcp/index.ts
@@ -5081,6 +5192,26 @@ function isXssSanitizerCall(node) {
   return false;
 }
 var NO_RETURNERS = /* @__PURE__ */ new Set();
+var CALLBACK_METHODS = /* @__PURE__ */ new Set([
+  "then",
+  "catch",
+  "finally",
+  "map",
+  "forEach",
+  "filter",
+  "flatMap",
+  "find",
+  "reduce"
+]);
+var taintedThisFields = /* @__PURE__ */ new WeakMap();
+function enclosingClass(node) {
+  let current = node.parent;
+  while (current !== void 0) {
+    if (current.type === "ClassDeclaration" || current.type === "ClassExpression") return current;
+    current = current.parent;
+  }
+  return void 0;
+}
 function exprIsTainted(node, tainted, returners = NO_RETURNERS) {
   if (node === void 0) return false;
   if (isTaintSource(node) || isFrameworkMemberTaint(node) || isFrameworkTaintCall(node) || isMcpArgsTaintSource(node)) {
@@ -5092,8 +5223,34 @@ function exprIsTainted(node, tainted, returners = NO_RETURNERS) {
     case "Identifier":
       return tainted.has(node.name);
     case "MemberExpression":
+      if (taintV2Enabled() && node.object.type === "ThisExpression") {
+        const cls = enclosingClass(node);
+        const name = propName(node);
+        if (cls !== void 0 && name !== void 0 && taintedThisFields.get(cls)?.has(name) === true) {
+          return true;
+        }
+      }
       return exprIsTainted(node.object, tainted, returners);
+    case "ArrayExpression":
+      if (!taintV2Enabled()) return false;
+      return node.elements.some((el) => {
+        if (el === null) return false;
+        if (el.type === "SpreadElement") return exprIsTainted(el.argument, tainted, returners);
+        return exprIsTainted(el, tainted, returners);
+      });
+    case "ObjectExpression":
+      if (!taintV2Enabled()) return false;
+      return node.properties.some((prop) => {
+        if (prop.type === "SpreadElement") return exprIsTainted(prop.argument, tainted, returners);
+        if (prop.type !== "Property") return false;
+        return exprIsTainted(prop.value, tainted, returners);
+      });
     case "CallExpression":
+      if (taintV2Enabled() && node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "Object" && propName(node.callee) === "assign") {
+        return node.arguments.some(
+          (arg) => arg.type !== "SpreadElement" && exprIsTainted(arg, tainted, returners)
+        );
+      }
       if (isSchemaValidatorCall(node)) return false;
       if (node.callee.type === "Identifier" && returners.has(node.callee.name)) return true;
       if (node.callee.type === "MemberExpression" && exprIsTainted(node.callee.object, tainted, returners)) {
@@ -5324,6 +5481,65 @@ function scopeReturnsTaint(scope, tainted, returners) {
   return yes;
 }
 var MAX_TAINT_HOPS = 5;
+function seedTaintV2(functions, facts, seeds, returners, nameToFn) {
+  let changed = false;
+  const mark = (fn, name) => {
+    if (name === void 0) return;
+    const set = seeds.get(fn) ?? /* @__PURE__ */ new Set();
+    if (set.has(name)) return;
+    set.add(name);
+    seeds.set(fn, set);
+    changed = true;
+  };
+  for (const fn of functions) {
+    const f = facts.get(fn);
+    if (f === void 0) continue;
+    let parent = fn.parent;
+    while (parent !== void 0 && !isFunctionNode(parent)) {
+      parent = parent.parent;
+    }
+    if (parent !== void 0 && isFunctionNode(parent)) {
+      const outer = facts.get(parent);
+      if (outer !== void 0) {
+        for (const name of outer.tainted) mark(fn, name);
+      }
+    }
+    walkScope(fn, (node) => {
+      if (node.type === "AssignmentExpression" && node.left.type === "MemberExpression") {
+        if (node.left.object.type === "ThisExpression" && exprIsTainted(node.right, f.tainted, returners)) {
+          const cls = enclosingClass(node);
+          const field = propName(node.left);
+          if (cls !== void 0 && field !== void 0) {
+            const fields = taintedThisFields.get(cls) ?? /* @__PURE__ */ new Set();
+            if (!fields.has(field)) {
+              fields.add(field);
+              taintedThisFields.set(cls, fields);
+              changed = true;
+            }
+          }
+        }
+      }
+      if (node.type !== "CallExpression" || node.callee.type !== "MemberExpression") return;
+      const method = propName(node.callee);
+      if (method === void 0) return;
+      if (CALLBACK_METHODS.has(method) && exprIsTainted(node.callee.object, f.tainted, returners)) {
+        const callback = node.arguments[0];
+        if (callback !== void 0 && isFunctionNode(callback)) {
+          mark(callback, boundNames(callback.params[0])[0]);
+        }
+      }
+      if ((method === "call" || method === "apply") && node.callee.object.type === "Identifier") {
+        const target = nameToFn.get(node.callee.object.name);
+        if (target === void 0 || !isFunctionNode(target)) return;
+        const arg = node.arguments[1];
+        if (arg !== void 0 && arg.type !== "SpreadElement" && exprIsTainted(arg, f.tainted, returners)) {
+          mark(target, boundNames(target.params[0])[0]);
+        }
+      }
+    });
+  }
+  return changed;
+}
 function analyzeFile(ast, extraReturners = NO_RETURNERS) {
   attachParents(ast);
   const facts = /* @__PURE__ */ new WeakMap();
@@ -5378,6 +5594,9 @@ function analyzeFile(ast, extraReturners = NO_RETURNERS) {
         });
       });
     }
+    if (taintV2Enabled() && seedTaintV2(functions, facts, seeds, returners, nameToFn)) {
+      changed = true;
+    }
     if (!changed) break;
   }
   return facts;
@@ -5520,6 +5739,21 @@ function requireCall(node) {
   }
   return void 0;
 }
+function reexportsOf(ast) {
+  const out = /* @__PURE__ */ new Map();
+  walk(ast, (node) => {
+    if (node.type !== "ExportNamedDeclaration" || node.source === null || node.source === void 0) return;
+    const spec = literalString(node.source);
+    if (spec === void 0) return;
+    for (const specNode of node.specifiers) {
+      if (specNode.type !== "ExportSpecifier") continue;
+      const exported = specNode.exported.type === "Identifier" ? specNode.exported.name : void 0;
+      const local = specNode.local.type === "Identifier" ? specNode.local.name : exported;
+      if (exported !== void 0 && local !== void 0) out.set(exported, { spec, name: local });
+    }
+  });
+  return out;
+}
 function resolveRelative(fromFile, spec, files) {
   if (!spec.startsWith(".")) return void 0;
   const base = posix.normalize(posix.join(posix.dirname(fromFile), spec));
@@ -5597,6 +5831,22 @@ function runInterproc(parsed) {
       functions.set(`${fn.file}#${fn.name}`, fn);
     }
   }
+  if (taintV2Enabled()) {
+    const barrels = /* @__PURE__ */ new Map();
+    for (const p of parsed) barrels.set(p.file, reexportsOf(p.ast));
+    for (const ns of requires.values()) {
+      for (const [local, target] of ns) {
+        const hash = target.indexOf("#");
+        if (hash < 0) continue;
+        const file = target.slice(0, hash);
+        const name = target.slice(hash + 1);
+        const re = barrels.get(file)?.get(name);
+        if (re === void 0) continue;
+        const resolved = resolveRelative(file, re.spec, files);
+        if (resolved !== void 0) ns.set(local, `${resolved}#${re.name}`);
+      }
+    }
+  }
   const queue = [];
   for (const p of parsed) {
     const facts = analyzeFile(p.ast);
@@ -6112,7 +6362,10 @@ function isMongoReceiver(node, source) {
   const obj = node.callee.object;
   if (obj.type === "Identifier") {
     if (isCollectionName(obj.name)) return true;
-    if (isPascalModel(obj.name)) return !fileHasSqlOrm;
+    if (isPascalModel(obj.name)) {
+      if (/extends\s+BaseEntity\b/.test(source)) return false;
+      return !fileHasSqlOrm;
+    }
     return fileHasMongo;
   }
   if (obj.type === "MemberExpression") {
@@ -7173,6 +7426,72 @@ function scanPromptInjection(file, source) {
   });
   return findings;
 }
+function packageVersion() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (let depth = 0; depth < 6; depth += 1) {
+    try {
+      const raw = readFileSync(join(dir, "package.json"), "utf8");
+      const pkg = JSON.parse(raw);
+      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
+        return pkg.version;
+      }
+    } catch {
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error("fullshield package.json not found");
+}
+
+// src/core/parse-pool.ts
+var workerUrl = new URL("./parse-worker.mjs", import.meta.url);
+var cache = /* @__PURE__ */ new Map();
+function parsePoolEnabled() {
+  return process.env.FULLSHIELD_PARSE_POOL === "1";
+}
+function parsePoolSize() {
+  const raw = process.env.FULLSHIELD_PARSE_WORKERS;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
+  }
+  return Math.max(1, availableParallelism() - 1);
+}
+function parseCacheKey(code) {
+  return createHash("sha256").update(packageVersion()).update("\0").update(code).digest("hex");
+}
+function parseOne(code) {
+  const key = parseCacheKey(code);
+  const hit = cache.get(key);
+  if (hit !== void 0) return Promise.resolve(hit);
+  return new Promise((resolve5, reject) => {
+    const worker = new Worker(fileURLToPath(workerUrl), { workerData: { code } });
+    worker.once("message", (ast) => {
+      cache.set(key, ast);
+      resolve5(ast);
+    });
+    worker.once("error", reject);
+  });
+}
+async function parseWithPool(codes) {
+  const size = parsePoolSize();
+  const out = new Array(codes.length);
+  let next = 0;
+  async function run() {
+    for (; ; ) {
+      const index = next;
+      next += 1;
+      if (index >= codes.length) return;
+      const code = codes[index];
+      if (code === void 0) return;
+      out[index] = await parseOne(code);
+    }
+  }
+  const workers = Math.min(size, Math.max(1, codes.length));
+  await Promise.all(Array.from({ length: workers }, () => run()));
+  return out;
+}
 
 // src/modules/sast/engine.ts
 var sastRules = [
@@ -7306,7 +7625,8 @@ var sastModule = {
         continue;
       }
       try {
-        const ast = await parseSource(source);
+        const ast = parsePoolEnabled() ? (await parseWithPool([source]))[0] : await parseSource(source);
+        if (ast === void 0) continue;
         parsed.push({ file: rel, source, ast });
       } catch {
       }
@@ -7701,7 +8021,7 @@ function createAiClient(options) {
   const useFixtures = options.useFixtures ?? !isLiveAi();
   const model = options.model ?? process.env.FULLSHIELD_AI_MODEL ?? (useFixtures ? "recorded-fixture" : "qwen2.5-coder:7b");
   const provider = options.provider ?? process.env.FULLSHIELD_AI_PROVIDER ?? (useFixtures ? "fixture" : "ollama");
-  const cache = /* @__PURE__ */ new Map();
+  const cache2 = /* @__PURE__ */ new Map();
   let spentUsd = 0;
   let networkCalls = 0;
   const liveCost = provider === "ollama" ? 0 : FIXTURE_COST;
@@ -7721,7 +8041,7 @@ function createAiClient(options) {
       const redactedPrompt = `${modeInstruction(req.mode)}
 ${wrapUntrustedCode(req.prompt)}`;
       const key = cacheKey(req.model ?? model, redactedPrompt);
-      const cached = cache.get(key);
+      const cached = cache2.get(key);
       if (cached !== void 0) {
         return { ...cached, cached: true, costUsd: 0 };
       }
@@ -7735,7 +8055,7 @@ ${wrapUntrustedCode(req.prompt)}`;
           cached: false,
           redactedPrompt
         };
-        cache.set(key, response2);
+        cache2.set(key, response2);
         return response2;
       }
       const fetchImpl = options.fetchImpl ?? fetch;
@@ -7785,7 +8105,7 @@ ${wrapUntrustedCode(req.prompt)}`;
         cached: false,
         redactedPrompt
       };
-      cache.set(key, response);
+      cache2.set(key, response);
       return response;
     }
   };
@@ -8012,23 +8332,6 @@ async function listStagedFiles(cwd) {
 // src/core/engine.ts
 init_suppression();
 init_finding();
-function packageVersion() {
-  let dir = dirname(fileURLToPath(import.meta.url));
-  for (let depth = 0; depth < 6; depth += 1) {
-    try {
-      const raw = readFileSync(join(dir, "package.json"), "utf8");
-      const pkg = JSON.parse(raw);
-      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
-        return pkg.version;
-      }
-    } catch {
-    }
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  throw new Error("fullshield package.json not found");
-}
 
 // src/policy/index.ts
 init_finding();
@@ -8815,15 +9118,23 @@ function renderConsoleReport(result) {
     );
   }
   const bySeverityDesc = [...SEVERITIES].reverse();
+  const ordered = bySeverityDesc.flatMap((severity) => findings.filter((f) => f.severity === severity));
+  const shown = ordered.slice(0, 10);
+  const hidden = ordered.length - shown.length;
   for (const severity of bySeverityDesc) {
-    const group = findings.filter((f) => f.severity === severity);
+    const group = shown.filter((f) => f.severity === severity);
     if (group.length === 0) continue;
     lines.push("");
-    lines.push(SEVERITY_COLOR[severity](`${severity.toUpperCase()} (${group.length})`));
+    lines.push(SEVERITY_COLOR[severity](`${severity.toUpperCase()} (${findings.filter((f) => f.severity === severity).length})`));
     for (const finding3 of group) {
       lines.push(...renderFinding(finding3));
+      lines.push(`    docs: rules/${finding3.ruleId}.md`);
     }
   }
+  if (hidden > 0) {
+    lines.push("");
+    lines.push(`${hidden} more \u2014 use --json`);
+  }
   lines.push("");
   if (summary.total === 0) {
     lines.push(pc.green("\u2714 No findings."));