fullshield 0.1.3 → 0.3.0

package/dist/cli/index.js

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
 import { createHash } from 'crypto';
-import { writeFile, mkdir, readFile, stat, mkdtemp, unlink, readdir } from 'fs/promises';
+import { writeFile, readFile, mkdir, stat, mkdtemp, unlink, readdir } from 'fs/promises';
 import { resolve, join, dirname, relative, basename, posix } from 'path';
-import { readFileSync, cpSync, existsSync, mkdirSync, rmSync, readdirSync, statSync, writeFileSync, mkdtempSync, unlinkSync } from 'fs';
-import { tmpdir, homedir } from 'os';
+import { readFileSync, existsSync, readdirSync, cpSync, mkdirSync, rmSync, statSync, writeFileSync, mkdtempSync, unlinkSync } from 'fs';
+import { homedir, tmpdir, availableParallelism } from 'os';
+import { fileURLToPath } from 'url';
+import { Worker } from 'worker_threads';
 import ignoreModule from 'ignore';
 import { execFile, spawnSync, execFileSync, spawn } from 'child_process';
 import { promisify } from 'util';
-import { fileURLToPath } from 'url';
 import { createInterface } from 'readline';
 import { performance } from 'perf_hooks';
 import { createRequire } from 'module';
@@ -112,7 +113,8 @@ function walk(node, visit) {
   }
 }
 function attachParents(node, parent) {
-  node.parent = parent;
+  const current = node;
+  if (parent !== void 0 || current.parent === void 0) current.parent = parent;
   for (const key of Object.keys(node)) {
     if (SKIP_KEYS.has(String(key))) continue;
     const value = node[key];
@@ -188,8 +190,21 @@ function classesEnabled() {
 function mcpCfgEnabled() {
   return process.env.FULLSHIELD_EXPERIMENTAL_MCPCFG === "1";
 }
+function taintV2Enabled() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_TAINT_V2 === "1";
+}
+function licenseEnabled() {
+  return process.env[LICENSE_FLAG] === "1";
+}
+function diffEnabled() {
+  return process.env[DIFF_FLAG] === "1";
+}
+var CI_REPORTS_FLAG, DIFF_FLAG, LICENSE_FLAG;
 var init_experimental = __esm({
   "src/modules/sast/experimental.ts"() {
+    CI_REPORTS_FLAG = "FULLSHIELD_EXPERIMENTAL_CI_REPORTS";
+    DIFF_FLAG = "FULLSHIELD_EXPERIMENTAL_DIFF";
+    LICENSE_FLAG = "FULLSHIELD_EXPERIMENTAL_LICENSE";
   }
 });
 function isSeverity(value) {
@@ -1077,6 +1092,105 @@ var init_pins = __esm({
   }
 });
 
+// src/modules/deps/symbol-reachability.ts
+function affectedFunctionNames(vuln) {
+  const names = /* @__PURE__ */ new Set();
+  for (const affected of vuln.affected ?? []) {
+    const list = affected.ecosystem_specific?.affected_functions;
+    if (!Array.isArray(list)) continue;
+    for (const item of list) {
+      if (typeof item === "string" && item.length > 0) names.add(item);
+    }
+  }
+  return [...names];
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function called(source, local) {
+  return new RegExp(`\\b${escapeRegExp(local)}\\s*\\(`).test(source);
+}
+function memberCalled(source, object, member) {
+  return new RegExp(`\\b${escapeRegExp(object)}\\s*\\.\\s*${escapeRegExp(member)}\\s*\\(`).test(source);
+}
+function sourceCallsAffectedSymbol(source, symbol) {
+  const esc2 = escapeRegExp(symbol);
+  const named = new RegExp(
+    `import\\s*\\{([^}]+)\\}\\s*from\\s*['"][^'"]+['"]`,
+    "g"
+  );
+  let match;
+  while ((match = named.exec(source)) !== null) {
+    const parts = (match[1] ?? "").split(",");
+    for (const part of parts) {
+      const bits = part.trim().split(/\s+as\s+/);
+      const imported = bits[0]?.trim();
+      const local = (bits[1] ?? bits[0])?.trim();
+      if (imported === symbol && local !== void 0 && called(source, local)) return true;
+    }
+  }
+  const star = /import\s+\*\s+as\s+([A-Za-z_$][\w$]*)\s+from\s+['"][^'"]+['"]/g;
+  while ((match = star.exec(source)) !== null) {
+    const local = match[1];
+    if (local !== void 0 && memberCalled(source, local, symbol)) return true;
+  }
+  const subDefault = new RegExp(
+    `import\\s+([A-Za-z_$][\\w$]*)\\s+from\\s+['"][^'"]+/${esc2}['"]`
+  );
+  const sub = subDefault.exec(source);
+  if (sub?.[1] !== void 0 && called(source, sub[1])) return true;
+  const reqMember = new RegExp(
+    `(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*require\\(\\s*['"][^'"]+['"]\\s*\\)\\s*\\.\\s*${esc2}`
+  );
+  const reqHit = reqMember.exec(source);
+  if (reqHit?.[1] !== void 0 && called(source, reqHit[1])) return true;
+  const reqNs = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\(\s*['"][^'"]+['"]\s*\)/g;
+  while ((match = reqNs.exec(source)) !== null) {
+    const local = match[1];
+    if (local !== void 0 && memberCalled(source, local, symbol)) return true;
+  }
+  const reqNamed = /(?:const|let|var)\s*\{([^}]+)\}\s*=\s*require\(\s*['"][^'"]+['"]\s*\)/g;
+  while ((match = reqNamed.exec(source)) !== null) {
+    const parts = (match[1] ?? "").split(",");
+    for (const part of parts) {
+      const bits = part.trim().split(/\s*:\s*/);
+      const imported = bits[0]?.trim();
+      const local = (bits[1] ?? bits[0])?.trim();
+      if (imported === symbol && local !== void 0 && called(source, local)) return true;
+    }
+  }
+  const reqSub = new RegExp(
+    `(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*require\\(\\s*['"][^'"]+/${esc2}['"]\\s*\\)`
+  );
+  const subReq = reqSub.exec(source);
+  if (subReq?.[1] !== void 0 && called(source, subReq[1])) return true;
+  const barrel = new RegExp(`export\\s*\\{([^}]+)\\}\\s*from\\s*['"][^'"]+['"]`, "g");
+  while ((match = barrel.exec(source)) !== null) {
+    const parts = (match[1] ?? "").split(",");
+    for (const part of parts) {
+      const bits = part.trim().split(/\s+as\s+/);
+      const exported = (bits[1] ?? bits[0])?.trim();
+      if (exported === symbol) {
+        const local = bits[0]?.trim();
+        if (local !== void 0 && called(source, local)) return true;
+      }
+    }
+  }
+  return false;
+}
+function classifySymbolUse(symbols, sources) {
+  for (const symbol of symbols) {
+    for (const source of sources.values()) {
+      if (sourceCallsAffectedSymbol(source, symbol)) return "symbol-reachable";
+    }
+  }
+  return "symbol-not-called";
+}
+var init_symbol_reachability = __esm({
+  "src/modules/deps/symbol-reachability.ts"() {
+  }
+});
+
 // src/modules/deps/reachability.ts
 function packageNameFromSnippet(snippet) {
   if (snippet.startsWith("@")) {
@@ -1106,9 +1220,9 @@ function isProductionSource(rel) {
 }
 function indexPackageUsage(sources) {
   const usage = /* @__PURE__ */ new Map();
-  const bump = (pkg, called) => {
+  const bump = (pkg, called2) => {
     const prev = usage.get(pkg) ?? { called: false };
-    usage.set(pkg, { imported: true, called: prev.called || called });
+    usage.set(pkg, { imported: true, called: prev.called || called2 });
   };
   const nsRe = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\(\s*['"]([^'"]+)['"]\s*\)/g;
   const namedRe = /(?:const|let|var)\s*\{([^}]+)\}\s*=\s*require\(\s*['"]([^'"]+)['"]\s*\)/g;
@@ -1164,6 +1278,29 @@ function shortestDependencyPath(target, starts, edges) {
   }
   return void 0;
 }
+function collectDependencyPaths(target, starts, edges, limit = 8) {
+  const out = [];
+  const queue = [];
+  let steps = 0;
+  for (const start of starts) queue.push([start]);
+  while (queue.length > 0 && out.length < limit && steps < 4e3) {
+    steps += 1;
+    const path = queue.shift();
+    if (path === void 0) continue;
+    const last = path[path.length - 1];
+    if (last === void 0) continue;
+    if (last === target) {
+      if (path.length >= 2) out.push(path);
+      continue;
+    }
+    if (path.length >= 12) continue;
+    for (const next of edges.get(last) ?? []) {
+      if (path.includes(next)) continue;
+      queue.push([...path, next]);
+    }
+  }
+  return out;
+}
 function reachableFrom(target, roots, edges) {
   if (roots.has(target)) return true;
   return shortestDependencyPath(target, roots, edges) !== void 0;
@@ -1184,9 +1321,10 @@ function classifyReachability(pkgName, productionUsage, graph) {
   }
   if (graph !== void 0 && graph.edgesKnown) {
     const roots = importedDirectNames(productionUsage, graph);
-    const path = shortestDependencyPath(pkgName, roots, graph.edges);
+    const paths = collectDependencyPaths(pkgName, roots, graph.edges);
+    const path = paths[0];
     if (path !== void 0 && path.length >= 2) {
-      return { reachability: "reachable-via-dependency", path };
+      return { reachability: "reachable-via-dependency", path, paths };
     }
     return { reachability: "not-imported" };
   }
@@ -1196,10 +1334,10 @@ function classifyReachability(pkgName, productionUsage, graph) {
   return { reachability: "not-imported" };
 }
 function reachabilitySteps(reachability) {
-  if (reachability === "reachable" || reachability === "reachable-via-dependency" || reachability === "reachability-unknown") {
+  if (reachability === "reachable" || reachability === "reachable-via-dependency" || reachability === "reachability-unknown" || reachability === "symbol-reachable") {
     return 0;
   }
-  if (reachability === "imported-not-called") return 1;
+  if (reachability === "imported-not-called" || reachability === "symbol-not-called") return 1;
   return 2;
 }
 function downgradeSeverity(severity, steps) {
@@ -1216,8 +1354,99 @@ function isDevOnly(pkgName, ctx) {
   if (inProd) return false;
   return directDev.has(pkgName) || reachableFrom(pkgName, directDev, edges);
 }
-function applyReachability(findings, ctx) {
-  return findings.map((finding6) => {
+function versionFromSnippet(snippet) {
+  const name = packageNameFromSnippet(snippet);
+  if (name === void 0) return snippet;
+  return snippet.slice(name.length + 1);
+}
+function pathFields(classified) {
+  const paths = classified.paths ?? (classified.path !== void 0 ? [classified.path] : []);
+  if (paths.length === 0) return {};
+  return {
+    dependencyPath: paths[0],
+    ...paths.length > 1 ? { dependencyPaths: paths } : {}
+  };
+}
+function appendOtherPaths(message, paths) {
+  if (paths === void 0 || paths.length < 2) return message;
+  const rest = paths.slice(1).map((p) => p.join(" > ")).join("; ");
+  return `${message} Other paths: ${rest}.`;
+}
+function groupPackageAdvisories(findings) {
+  const passthrough = [];
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding6 of findings) {
+    if (finding6.ruleId !== "DEPS-VULN-001" && finding6.ruleId !== "DEPS-MALICIOUS-001") {
+      passthrough.push(finding6);
+      continue;
+    }
+    const name = packageNameFromSnippet(finding6.snippet ?? "") ?? finding6.snippet ?? finding6.id;
+    const advisory = finding6.references?.[0] ?? finding6.id;
+    const key = `${finding6.ruleId}\0${name}\0${advisory}`;
+    const list = groups.get(key);
+    if (list === void 0) groups.set(key, [finding6]);
+    else list.push(finding6);
+  }
+  const merged = [];
+  for (const list of groups.values()) {
+    const only = list[0];
+    if (list.length === 1 && only !== void 0) {
+      merged.push(only);
+      continue;
+    }
+    merged.push(mergeAdvisory(list));
+  }
+  return [...passthrough, ...merged];
+}
+function mergeAdvisory(list) {
+  const ranked = [...list].sort(
+    (a, b) => severityRank(b.severity) - severityRank(a.severity) || (REACH_RANK[a.reachability ?? "not-imported"] ?? 9) - (REACH_RANK[b.reachability ?? "not-imported"] ?? 9)
+  );
+  const primary = ranked[0];
+  if (primary === void 0) {
+    throw new Error("empty advisory group");
+  }
+  const name = packageNameFromSnippet(primary.snippet ?? "") ?? "package";
+  const versions = [...new Set(list.map((f) => versionFromSnippet(f.snippet ?? "")))].filter((v) => v.length > 0).sort();
+  const paths = [];
+  const seenPath = /* @__PURE__ */ new Set();
+  for (const finding6 of list) {
+    const candidates = finding6.dependencyPaths ?? (finding6.dependencyPath !== void 0 ? [finding6.dependencyPath] : []);
+    for (const path of candidates) {
+      const key = path.join("\0");
+      if (seenPath.has(key)) continue;
+      seenPath.add(key);
+      paths.push(path);
+    }
+  }
+  paths.sort((a, b) => a.length - b.length || a.join(">").localeCompare(b.join(">")));
+  const advisory = primary.references?.[0] ?? "";
+  const onManifest = list.find((f) => f.file === "package.json");
+  const file = onManifest?.file ?? primary.file;
+  const line = onManifest?.line ?? primary.line;
+  const snippet = versions.length > 0 ? `${name}@${versions.join(",")}` : primary.snippet ?? name;
+  let message = primary.message;
+  if (versions.length > 1) {
+    message = `${message} Versions: ${versions.join(", ")}.`;
+  }
+  if (paths.length > 1) {
+    message = `${message} Dependency paths: ${paths.map((p) => p.join(" > ")).join("; ")}.`;
+  }
+  return {
+    ...primary,
+    id: makeFindingId(primary.ruleId, file, `${name}|${advisory}|${versions.join(",")}`),
+    file,
+    line,
+    snippet,
+    message,
+    severity: primary.severity,
+    reachability: primary.reachability,
+    ...paths[0] !== void 0 ? { dependencyPath: paths[0] } : {},
+    ...paths.length > 1 ? { dependencyPaths: paths } : {}
+  };
+}
+function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
+  const mapped = findings.map((finding6) => {
     if (finding6.ruleId === "DEPS-MALICIOUS-001") {
       if (finding6.snippet === void 0) return finding6;
       const pkg2 = packageNameFromSnippet(finding6.snippet);
@@ -1227,19 +1456,25 @@ function applyReachability(findings, ctx) {
         ...finding6,
         severity: "critical",
         reachability: classified2.reachability,
-        ...classified2.path !== void 0 ? { dependencyPath: classified2.path } : {}
+        ...pathFields(classified2)
       };
     }
     if (finding6.ruleId !== "DEPS-VULN-001" || finding6.snippet === void 0) return finding6;
     const pkg = packageNameFromSnippet(finding6.snippet);
     if (pkg === void 0 || pkg.length === 0) return finding6;
-    const classified = classifyReachability(pkg, ctx.productionUsage, ctx.graph);
+    let classified = classifyReachability(pkg, ctx.productionUsage, ctx.graph);
+    const named = symbols.get(finding6.id) ?? [];
+    if (named.length > 0 && ctx.sources !== void 0) {
+      const symbolClass = classifySymbolUse(named, ctx.sources);
+      classified = { reachability: symbolClass, path: classified.path, paths: classified.paths };
+    }
     const steps = reachabilitySteps(classified.reachability);
     let severity = steps === 0 ? finding6.severity : downgradeSeverity(finding6.severity, steps);
     let message = finding6.message;
     if (classified.path !== void 0) {
       const shown = classified.path.join(" > ");
       message = `${message} Reachable via ${shown}.`;
+      message = appendOtherPaths(message, classified.paths);
     }
     const devOnly = isDevOnly(pkg, ctx);
     if (devOnly) {
@@ -1249,15 +1484,27 @@ function applyReachability(findings, ctx) {
     return {
       ...finding6,
       reachability: classified.reachability,
-      ...classified.path !== void 0 ? { dependencyPath: classified.path } : {},
+      ...pathFields(classified),
       severity,
       message
     };
   });
+  return groupPackageAdvisories(mapped);
 }
+var REACH_RANK;
 var init_reachability = __esm({
   "src/modules/deps/reachability.ts"() {
     init_finding();
+    init_symbol_reachability();
+    REACH_RANK = {
+      reachable: 0,
+      "symbol-reachable": 1,
+      "reachable-via-dependency": 2,
+      "imported-not-called": 3,
+      "symbol-not-called": 4,
+      "reachability-unknown": 5,
+      "not-imported": 6
+    };
   }
 });
 
@@ -3185,6 +3432,62 @@ var init_experimental2 = __esm({
   "src/supply/experimental.ts"() {
   }
 });
+function isCopyleftLicense(license) {
+  return COPYLEFT.test(license);
+}
+function licenseText(value) {
+  if (typeof value === "string") return value;
+  if (typeof value === "object" && value !== null && "type" in value) {
+    const type = value.type;
+    if (typeof type === "string") return type;
+  }
+  return void 0;
+}
+async function readJson(path) {
+  try {
+    return JSON.parse(await readFile(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+async function scanCopyleftLicenses(cwd) {
+  const manifest = await readJson(join(cwd, "package.json"));
+  if (typeof manifest !== "object" || manifest === null) return [];
+  const names = /* @__PURE__ */ new Set();
+  for (const field of ["dependencies", "devDependencies", "optionalDependencies"]) {
+    const block = manifest[field];
+    if (typeof block === "object" && block !== null && !Array.isArray(block)) {
+      for (const name of Object.keys(block)) names.add(name);
+    }
+  }
+  const findings = [];
+  for (const name of names) {
+    const pkg = await readJson(join(cwd, "node_modules", name, "package.json"));
+    if (typeof pkg !== "object" || pkg === null) continue;
+    const license = licenseText(pkg.license);
+    if (license === void 0 || !isCopyleftLicense(license)) continue;
+    findings.push({
+      id: makeFindingId("DEPS-LICENSE-001", "package.json", `${name}|${license}`),
+      ruleId: "DEPS-LICENSE-001",
+      module: "deps",
+      title: `Copyleft dependency ${name}`,
+      severity: "medium",
+      confidence: "high",
+      file: "package.json",
+      snippet: `${name} ${license}`,
+      message: `${name} is licensed ${license}.`,
+      remediation: "Replace the dependency or get a legal review before shipping it in a commercial product."
+    });
+  }
+  return findings;
+}
+var COPYLEFT;
+var init_license = __esm({
+  "src/modules/deps/license.ts"() {
+    init_finding();
+    COPYLEFT = /(?:^|[^\w])(?:AGPL|GPL)(?:-|[^\w]|$)/i;
+  }
+});
 
 // src/fixer/eol.ts
 function detectEol(text) {
@@ -3350,7 +3653,7 @@ function walkJs(dir, out = []) {
   }
   return out;
 }
-function readJson(path) {
+function readJson2(path) {
   return JSON.parse(readFileSync(path, "utf8"));
 }
 function installScriptKeys(scripts) {
@@ -3361,7 +3664,7 @@ function analyzePackageDir(dir) {
   const findings = [];
   const manifestPath = join(dir, "package.json");
   if (!existsSync(manifestPath) || !statSync(manifestPath).isFile()) return findings;
-  const pkg = readJson(manifestPath);
+  const pkg = readJson2(manifestPath);
   const scripts = pkg.scripts ?? {};
   const keys = installScriptKeys(scripts);
   if (keys.length > 0) {
@@ -3411,8 +3714,8 @@ function analyzePackageDir(dir) {
   return findings;
 }
 function diffPackageVersions(oldDir, newDir) {
-  const oldManifest = existsSync(join(oldDir, "package.json")) ? readJson(join(oldDir, "package.json")) : {};
-  const nextManifest = existsSync(join(newDir, "package.json")) ? readJson(join(newDir, "package.json")) : {};
+  const oldManifest = existsSync(join(oldDir, "package.json")) ? readJson2(join(oldDir, "package.json")) : {};
+  const nextManifest = existsSync(join(newDir, "package.json")) ? readJson2(join(newDir, "package.json")) : {};
   const oldScripts = oldManifest.scripts ?? {};
   const nextScripts = nextManifest.scripts ?? {};
   const added = INSTALL_SCRIPT_KEYS.filter((k) => typeof nextScripts[k] === "string" && oldScripts[k] === void 0);
@@ -3453,14 +3756,24 @@ function checkLockfileIntegrity(lock) {
     if (name === "") continue;
     const resolved = entry.resolved;
     if (!resolved) continue;
+    if (entry.integrity === void 0 || entry.integrity.length === 0) {
+      findings.push(
+        finding(
+          "SUPPLY-LOCKINTEGRITY-001",
+          "Lockfile entry has no integrity hash",
+          `${name} resolved without an integrity hash`,
+          "package-lock.json"
+        )
+      );
+    }
     try {
-      const host = new URL(resolved).hostname;
-      if (host !== REGISTRY_HOST) {
+      const url = new URL(resolved);
+      if (url.protocol !== "https:" || url.hostname !== REGISTRY_HOST) {
         findings.push(
           finding(
             "SUPPLY-LOCKURL-001",
             "Lockfile entry resolves from a non-npm registry host",
-            `${name} resolved host ${host}`,
+            `${name} resolved host ${url.hostname || resolved}`,
             "package-lock.json"
           )
         );
@@ -3523,7 +3836,7 @@ function packageSources(dir) {
   let scripts = "";
   if (existsSync(manifestPath) && statSync(manifestPath).isFile()) {
     try {
-      const pkg = readJson(manifestPath);
+      const pkg = readJson2(manifestPath);
       const block = pkg.scripts ?? {};
       scripts = Object.values(block).join("\n");
     } catch {
@@ -3822,7 +4135,7 @@ async function reachabilityCtx(cwd, files, graph) {
     } catch {
     }
   }
-  return { productionUsage: indexPackageUsage(prodSources), graph };
+  return { productionUsage: indexPackageUsage(prodSources), graph, sources: prodSources };
 }
 var LOCKFILE_NAMES, MANIFEST_FIELDS2, MALICIOUS_REMEDIATION, depsModule;
 var init_deps = __esm({
@@ -3832,9 +4145,12 @@ var init_deps = __esm({
     init_osv();
     init_pins();
     init_reachability();
+    init_symbol_reachability();
     init_semver();
     init_typosquat();
     init_experimental2();
+    init_experimental();
+    init_license();
     init_phase31();
     LOCKFILE_NAMES = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"];
     MANIFEST_FIELDS2 = ["dependencies", "devDependencies", "optionalDependencies"];
@@ -3871,14 +4187,17 @@ var init_deps = __esm({
             findings2.push(typosquatFinding("package.json", hit));
           }
           const osvHits2 = await queryOsv(pins, osvOpts);
+          const symbols2 = /* @__PURE__ */ new Map();
           for (const hit of osvHits2) {
             for (const vuln of hit.vulns) {
-              findings2.push(
-                isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit.pkg, vuln) : vulnFinding("package.json", hit.pkg, vuln, depLoc(hit.pkg.name))
-              );
+              const finding6 = isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit.pkg, vuln) : vulnFinding("package.json", hit.pkg, vuln, depLoc(hit.pkg.name));
+              const names = affectedFunctionNames(vuln);
+              if (names.length > 0 && finding6.ruleId === "DEPS-VULN-001") symbols2.set(finding6.id, names);
+              findings2.push(finding6);
             }
           }
-          return applyReachability(findings2, await reachabilityCtx(ctx.cwd, ctx.files, graphFromManifest(manifest)));
+          const noLockCtx = await reachabilityCtx(ctx.cwd, ctx.files, graphFromManifest(manifest));
+          return applyReachability(findings2, noLockCtx, symbols2);
         }
         let contents;
         try {
@@ -3899,18 +4218,21 @@ var init_deps = __esm({
           }
         }
         const osvHits = await queryOsv(packages, osvOpts);
+        const symbols = /* @__PURE__ */ new Map();
         for (const hit of osvHits) {
           for (const vuln of hit.vulns) {
-            findings.push(
-              isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit.pkg, vuln) : vulnFinding(lockFile, hit.pkg, vuln, depLoc(hit.pkg.name))
-            );
+            const finding6 = isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit.pkg, vuln) : vulnFinding(lockFile, hit.pkg, vuln, depLoc(hit.pkg.name));
+            const names = affectedFunctionNames(vuln);
+            if (names.length > 0 && finding6.ruleId === "DEPS-VULN-001") symbols.set(finding6.id, names);
+            findings.push(finding6);
           }
         }
-        let reached = applyReachability(findings, await reachabilityCtx(ctx.cwd, ctx.files, graph));
+        let reached = applyReachability(findings, await reachabilityCtx(ctx.cwd, ctx.files, graph), symbols);
         if (experimentalVex()) {
           reached = attachOverrideProposals(reached, graph, lockFile, manifestRaw);
           reached.push(...scanInstalledPackages(ctx.cwd, packages));
         }
+        if (licenseEnabled()) reached.push(...await scanCopyleftLicenses(ctx.cwd));
         return reached;
       }
     };
@@ -4489,6 +4811,14 @@ function isXssSanitizerCall(node) {
   }
   return false;
 }
+function enclosingClass(node) {
+  let current = node.parent;
+  while (current !== void 0) {
+    if (current.type === "ClassDeclaration" || current.type === "ClassExpression") return current;
+    current = current.parent;
+  }
+  return void 0;
+}
 function exprIsTainted(node, tainted, returners = NO_RETURNERS) {
   if (node === void 0) return false;
   if (isTaintSource(node) || isFrameworkMemberTaint(node) || isFrameworkTaintCall(node) || isMcpArgsTaintSource(node)) {
@@ -4500,8 +4830,34 @@ function exprIsTainted(node, tainted, returners = NO_RETURNERS) {
     case "Identifier":
       return tainted.has(node.name);
     case "MemberExpression":
+      if (taintV2Enabled() && node.object.type === "ThisExpression") {
+        const cls = enclosingClass(node);
+        const name = propName(node);
+        if (cls !== void 0 && name !== void 0 && taintedThisFields.get(cls)?.has(name) === true) {
+          return true;
+        }
+      }
       return exprIsTainted(node.object, tainted, returners);
+    case "ArrayExpression":
+      if (!taintV2Enabled()) return false;
+      return node.elements.some((el) => {
+        if (el === null) return false;
+        if (el.type === "SpreadElement") return exprIsTainted(el.argument, tainted, returners);
+        return exprIsTainted(el, tainted, returners);
+      });
+    case "ObjectExpression":
+      if (!taintV2Enabled()) return false;
+      return node.properties.some((prop) => {
+        if (prop.type === "SpreadElement") return exprIsTainted(prop.argument, tainted, returners);
+        if (prop.type !== "Property") return false;
+        return exprIsTainted(prop.value, tainted, returners);
+      });
     case "CallExpression":
+      if (taintV2Enabled() && node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "Object" && propName(node.callee) === "assign") {
+        return node.arguments.some(
+          (arg) => arg.type !== "SpreadElement" && exprIsTainted(arg, tainted, returners)
+        );
+      }
       if (isSchemaValidatorCall(node)) return false;
       if (node.callee.type === "Identifier" && returners.has(node.callee.name)) return true;
       if (node.callee.type === "MemberExpression" && exprIsTainted(node.callee.object, tainted, returners)) {
@@ -4731,7 +5087,66 @@ function scopeReturnsTaint(scope, tainted, returners) {
   });
   return yes;
 }
-function analyzeFile(ast, extraReturners = NO_RETURNERS) {
+function seedTaintV2(functions, facts, seeds, returners, nameToFn) {
+  let changed = false;
+  const mark = (fn, name) => {
+    if (name === void 0) return;
+    const set = seeds.get(fn) ?? /* @__PURE__ */ new Set();
+    if (set.has(name)) return;
+    set.add(name);
+    seeds.set(fn, set);
+    changed = true;
+  };
+  for (const fn of functions) {
+    const f = facts.get(fn);
+    if (f === void 0) continue;
+    let parent = fn.parent;
+    while (parent !== void 0 && !isFunctionNode(parent)) {
+      parent = parent.parent;
+    }
+    if (parent !== void 0 && isFunctionNode(parent)) {
+      const outer = facts.get(parent);
+      if (outer !== void 0) {
+        for (const name of outer.tainted) mark(fn, name);
+      }
+    }
+    walkScope(fn, (node) => {
+      if (node.type === "AssignmentExpression" && node.left.type === "MemberExpression") {
+        if (node.left.object.type === "ThisExpression" && exprIsTainted(node.right, f.tainted, returners)) {
+          const cls = enclosingClass(node);
+          const field = propName(node.left);
+          if (cls !== void 0 && field !== void 0) {
+            const fields = taintedThisFields.get(cls) ?? /* @__PURE__ */ new Set();
+            if (!fields.has(field)) {
+              fields.add(field);
+              taintedThisFields.set(cls, fields);
+              changed = true;
+            }
+          }
+        }
+      }
+      if (node.type !== "CallExpression" || node.callee.type !== "MemberExpression") return;
+      const method = propName(node.callee);
+      if (method === void 0) return;
+      if (CALLBACK_METHODS.has(method) && exprIsTainted(node.callee.object, f.tainted, returners)) {
+        const callback = node.arguments[0];
+        if (callback !== void 0 && isFunctionNode(callback)) {
+          mark(callback, boundNames(callback.params[0])[0]);
+        }
+      }
+      if ((method === "call" || method === "apply") && node.callee.object.type === "Identifier") {
+        const target = nameToFn.get(node.callee.object.name);
+        if (target === void 0 || !isFunctionNode(target)) return;
+        const arg = node.arguments[1];
+        if (arg !== void 0 && arg.type !== "SpreadElement" && exprIsTainted(arg, f.tainted, returners)) {
+          mark(target, boundNames(target.params[0])[0]);
+        }
+      }
+    });
+  }
+  return changed;
+}
+function analyzeFile(ast, extraReturners2 = NO_RETURNERS) {
   attachParents(ast);
   const facts = /* @__PURE__ */ new WeakMap();
   const functions = [];
@@ -4745,7 +5160,7 @@ function analyzeFile(ast, extraReturners = NO_RETURNERS) {
   }
   const seeds = /* @__PURE__ */ new Map();
   for (const fn of functions) seeds.set(fn, /* @__PURE__ */ new Set());
-  const returners = new Set(extraReturners);
+  const returners = new Set(extraReturners2);
   for (let hop = 0; hop < MAX_TAINT_HOPS; hop += 1) {
     let changed = false;
     facts.set(ast, analyzeScope(ast, [], returners));
@@ -4785,6 +5200,9 @@ function analyzeFile(ast, extraReturners = NO_RETURNERS) {
         });
       });
     }
+    if (taintV2Enabled() && seedTaintV2(functions, facts, seeds, returners, nameToFn)) {
+      changed = true;
+    }
     if (!changed) break;
   }
   return facts;
@@ -4843,7 +5261,7 @@ function nodeIsNosqlSanitized(node, map) {
   if (node.type === "Identifier") return factsFor(node, map).nosqlSanitized.has(node.name);
   return false;
 }
-var SCHEMA_ROOT, NO_RETURNERS, MAX_TAINT_HOPS;
+var SCHEMA_ROOT, NO_RETURNERS, CALLBACK_METHODS, taintedThisFields, MAX_TAINT_HOPS;
 var init_taint = __esm({
   "src/modules/sast/taint.ts"() {
     init_ast();
@@ -4852,6 +5270,18 @@ var init_taint = __esm({
     init_mcp2();
     SCHEMA_ROOT = /^(z|zod|joi|yup|schema)$/i;
     NO_RETURNERS = /* @__PURE__ */ new Set();
+    CALLBACK_METHODS = /* @__PURE__ */ new Set([
+      "then",
+      "catch",
+      "finally",
+      "map",
+      "forEach",
+      "filter",
+      "flatMap",
+      "find",
+      "reduce"
+    ]);
+    taintedThisFields = /* @__PURE__ */ new WeakMap();
     MAX_TAINT_HOPS = 5;
   }
 });
@@ -4936,6 +5366,21 @@ function requireCall(node) {
   }
   return void 0;
 }
+function reexportsOf(ast) {
+  const out = /* @__PURE__ */ new Map();
+  walk(ast, (node) => {
+    if (node.type !== "ExportNamedDeclaration" || node.source === null || node.source === void 0) return;
+    const spec = literalString(node.source);
+    if (spec === void 0) return;
+    for (const specNode of node.specifiers) {
+      if (specNode.type !== "ExportSpecifier") continue;
+      const exported = specNode.exported.type === "Identifier" ? specNode.exported.name : void 0;
+      const local = specNode.local.type === "Identifier" ? specNode.local.name : exported;
+      if (exported !== void 0 && local !== void 0) out.set(exported, { spec, name: local });
+    }
+  });
+  return out;
+}
 function resolveRelative(fromFile, spec, files) {
   if (!spec.startsWith(".")) return void 0;
   const base = posix.normalize(posix.join(posix.dirname(fromFile), spec));
@@ -5013,6 +5458,22 @@ function runInterproc(parsed) {
       functions.set(`${fn.file}#${fn.name}`, fn);
     }
   }
+  if (taintV2Enabled()) {
+    const barrels = /* @__PURE__ */ new Map();
+    for (const p of parsed) barrels.set(p.file, reexportsOf(p.ast));
+    for (const ns of requires.values()) {
+      for (const [local, target] of ns) {
+        const hash = target.indexOf("#");
+        if (hash < 0) continue;
+        const file = target.slice(0, hash);
+        const name = target.slice(hash + 1);
+        const re = barrels.get(file)?.get(name);
+        if (re === void 0) continue;
+        const resolved = resolveRelative(file, re.spec, files);
+        if (resolved !== void 0) ns.set(local, `${resolved}#${re.name}`);
+      }
+    }
+  }
   const queue = [];
   for (const p of parsed) {
     const facts = analyzeFile(p.ast);
@@ -5149,6 +5610,7 @@ var init_interproc = __esm({
   "src/modules/sast/interproc.ts"() {
     init_finding();
     init_ast();
+    init_experimental();
     init_taint();
     MAX_HOPS = 5;
   }
@@ -5546,7 +6008,10 @@ function isMongoReceiver(node, source) {
   const obj = node.callee.object;
   if (obj.type === "Identifier") {
     if (isCollectionName(obj.name)) return true;
-    if (isPascalModel(obj.name)) return !fileHasSqlOrm;
+    if (isPascalModel(obj.name)) {
+      if (/extends\s+BaseEntity\b/.test(source)) return false;
+      return !fileHasSqlOrm;
+    }
     return fileHasMongo;
   }
   if (obj.type === "MemberExpression") {
@@ -6686,6 +7151,150 @@ var init_injection = __esm({
     PHRASES = [/ignore previous/i, /mark as safe/i, /ai reviewer/i];
   }
 });
+
+// src/runtime/lru.ts
+var LruMap;
+var init_lru = __esm({
+  "src/runtime/lru.ts"() {
+    LruMap = class {
+      constructor(max) {
+        this.max = max;
+        if (max < 1) throw new Error("LruMap max must be >= 1");
+      }
+      max;
+      map = /* @__PURE__ */ new Map();
+      get size() {
+        return this.map.size;
+      }
+      has(key) {
+        return this.map.has(key);
+      }
+      get(key) {
+        if (!this.map.has(key)) return void 0;
+        const value = this.map.get(key);
+        this.map.delete(key);
+        this.map.set(key, value);
+        return value;
+      }
+      set(key, value) {
+        if (this.map.has(key)) this.map.delete(key);
+        this.map.set(key, value);
+        while (this.map.size > this.max) {
+          const oldest = this.map.keys().next().value;
+          if (oldest === void 0) break;
+          this.map.delete(oldest);
+        }
+        return this;
+      }
+    };
+  }
+});
+function packageVersion() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (let depth = 0; depth < 6; depth += 1) {
+    try {
+      const raw = readFileSync(join(dir, "package.json"), "utf8");
+      const pkg = JSON.parse(raw);
+      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
+        return pkg.version;
+      }
+    } catch {
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error("fullshield package.json not found");
+}
+var init_version = __esm({
+  "src/core/version.ts"() {
+  }
+});
+function parsePoolEnabled() {
+  return process.env.FULLSHIELD_PARSE_POOL === "1";
+}
+function parsePoolSize() {
+  const raw = process.env.FULLSHIELD_PARSE_WORKERS;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.min(4, Math.floor(parsed));
+  }
+  return Math.min(2, Math.max(1, availableParallelism() - 1));
+}
+function workerMemoryMb() {
+  const raw = process.env.FULLSHIELD_PARSE_WORKER_MB;
+  const parsed = raw !== void 0 && raw !== "" ? Number(raw) : 512;
+  if (Number.isFinite(parsed) && parsed >= 64) return Math.floor(parsed);
+  return 512;
+}
+function parseCacheKey(code) {
+  return createHash("sha256").update(packageVersion()).update("\0").update(code).digest("hex");
+}
+function parseOne(code) {
+  const key = parseCacheKey(code);
+  const hit = cache.get(key);
+  if (hit !== void 0) return Promise.resolve(hit);
+  return new Promise((resolve8, reject) => {
+    const worker = new Worker(fileURLToPath(workerUrl), {
+      workerData: { code },
+      resourceLimits: { maxOldGenerationSizeMb: workerMemoryMb() }
+    });
+    let settled = false;
+    const finish = () => {
+      void worker.terminate();
+    };
+    const succeed = (ast) => {
+      if (settled) return;
+      settled = true;
+      cache.set(key, ast);
+      finish();
+      resolve8(ast);
+    };
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      finish();
+      reject(error);
+    };
+    worker.once("message", (ast) => {
+      succeed(ast);
+    });
+    worker.once("error", (error) => {
+      fail(error);
+    });
+    worker.once("exit", (code2) => {
+      if (settled) return;
+      fail(new Error(`parse worker exited ${code2 ?? "null"}`));
+    });
+  });
+}
+async function parseWithPool(codes) {
+  const size = parsePoolSize();
+  const out = new Array(codes.length);
+  let next = 0;
+  async function run() {
+    for (; ; ) {
+      const index = next;
+      next += 1;
+      if (index >= codes.length) return;
+      const code = codes[index];
+      if (code === void 0) return;
+      out[index] = await parseOne(code);
+    }
+  }
+  const workers = Math.min(size, Math.max(1, codes.length));
+  await Promise.all(Array.from({ length: workers }, () => run()));
+  return out;
+}
+var workerUrl, cache;
+var init_parse_pool = __esm({
+  "src/core/parse-pool.ts"() {
+    init_lru();
+    init_version();
+    workerUrl = new URL("./parse-worker.mjs", import.meta.url);
+    cache = new LruMap(64);
+  }
+});
 async function parseSource(code) {
   const { parse } = await import('@typescript-eslint/typescript-estree');
   return parse(code, {
@@ -6701,8 +7310,8 @@ function snippetOf(source, node) {
   if (node.range === void 0) return "";
   return source.slice(node.range[0], node.range[1]).replace(/\s+/g, " ").trim().slice(0, 120);
 }
-function findingsFromAst(filename, source, ast, extraReturners = /* @__PURE__ */ new Set(), projectCsrfProtected = false) {
-  const facts = analyzeFile(ast, extraReturners);
+function findingsFromAst(filename, source, ast, extraReturners2 = /* @__PURE__ */ new Set(), projectCsrfProtected = false) {
+  const facts = analyzeFile(ast, extraReturners2);
   const findings = [];
   for (const rule of sastRules) {
     const ctx = {
@@ -6780,6 +7389,158 @@ function findingsFromTemplate(filename, source) {
   xssRule.create(ctx);
   return findings;
 }
+function dedupeSastSinks(findings) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const finding6 of findings) {
+    if (finding6.module !== "sast" || finding6.line === void 0) {
+      out.push(finding6);
+      continue;
+    }
+    const key = `${finding6.ruleId}\0${finding6.file ?? ""}\0${finding6.line}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(finding6);
+  }
+  return out;
+}
+function sastStreamThreshold() {
+  const raw = process.env.FULLSHIELD_SAST_STREAM_AT;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
+  }
+  return 4e3;
+}
+function sastBatchSize() {
+  const raw = process.env.FULLSHIELD_SAST_BATCH;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
+  }
+  return 150;
+}
+function skipFinding(rel, message) {
+  return {
+    id: makeFindingId("SAST-SKIP-001", rel, message),
+    ruleId: "SAST-SKIP-001",
+    module: "sast",
+    title: "File skipped by SAST",
+    severity: "info",
+    confidence: "high",
+    file: rel,
+    message,
+    remediation: "Raise sast.maxFileBytes in fullshield.config.json to parse this file, or leave it skipped."
+  };
+}
+function skipReason(source, maxBytes) {
+  if (source.includes("\0")) return "it contains NUL bytes";
+  const bytes = Buffer.byteLength(source);
+  if (bytes > maxBytes) return `${bytes} bytes exceeds the SAST parse limit of ${maxBytes} bytes`;
+  return void 0;
+}
+async function readScanSource(cwd, rel) {
+  try {
+    return await readFile(join(cwd, rel), "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function cloneAst(value) {
+  if (value === null || typeof value !== "object") return void 0;
+  try {
+    return structuredClone(value);
+  } catch {
+    return void 0;
+  }
+}
+async function parseInProcess(source) {
+  try {
+    return await parseSource(source);
+  } catch {
+    return void 0;
+  }
+}
+async function parseCode(source) {
+  if (!parsePoolEnabled()) return parseInProcess(source);
+  try {
+    const cloned = cloneAst((await parseWithPool([source]))[0]);
+    if (cloned !== void 0) return cloned;
+  } catch {
+  }
+  return parseInProcess(source);
+}
+function releaseParsed(parsed) {
+  for (const entry of parsed) {
+    entry.source = "";
+    entry.ast = void 0;
+  }
+  parsed.length = 0;
+}
+function extraReturners(rel, ast, files, returning) {
+  const ns = collectRequires(rel, ast, files);
+  const extra = new Set(returning.get(rel));
+  for (const [local, spec] of ns) {
+    const hash = spec.indexOf("#");
+    const file = hash >= 0 ? spec.slice(0, hash) : spec;
+    const exp = hash >= 0 ? spec.slice(hash + 1) : local;
+    if (returning.get(file)?.has(exp)) extra.add(local);
+  }
+  return extra;
+}
+async function runSastStreaming(ctx) {
+  const maxBytes = ctx.config.sast.maxFileBytes;
+  const findings = [];
+  const returning = /* @__PURE__ */ new Map();
+  const parseable = [];
+  const fileSet = /* @__PURE__ */ new Set();
+  let projectCsrf = false;
+  for (const rel of ctx.files) {
+    const isSource = SOURCE_EXT.test(rel);
+    const isTemplate = TEMPLATE_EXT.test(rel);
+    if (!isSource && !isTemplate) continue;
+    const source = await readScanSource(ctx.cwd, rel);
+    if (source === void 0) continue;
+    const why = skipReason(source, maxBytes);
+    if (why !== void 0) {
+      findings.push(skipFinding(rel, `Skipped ${rel}: ${why}.`));
+      continue;
+    }
+    if (sourceHasCsrfGuard(source)) projectCsrf = true;
+    if (isTemplate) {
+      findings.push(...findingsFromTemplate(rel, source));
+      continue;
+    }
+    const ast = await parseCode(source);
+    if (ast === void 0) continue;
+    returning.set(rel, functionsThatReturnTaint(ast));
+    parseable.push(rel);
+    fileSet.add(rel);
+  }
+  for (const rel of parseable) {
+    const source = await readScanSource(ctx.cwd, rel);
+    if (source === void 0) continue;
+    const ast = await parseCode(source);
+    if (ast === void 0) continue;
+    findings.push(
+      ...findingsFromAst(rel, source, ast, extraReturners(rel, ast, fileSet, returning), projectCsrf)
+    );
+  }
+  const batch = sastBatchSize();
+  for (let i = 0; i < parseable.length; i += batch) {
+    const parsed = [];
+    for (const rel of parseable.slice(i, i + batch)) {
+      const source = await readScanSource(ctx.cwd, rel);
+      if (source === void 0) continue;
+      const ast = await parseCode(source);
+      if (ast === void 0) continue;
+      parsed.push({ file: rel, source, ast });
+    }
+    findings.push(...runInterproc(parsed));
+    releaseParsed(parsed);
+  }
+  return dedupeSastSinks(findings);
+}
 var sastRules, SOURCE_EXT, sastModule;
 var init_engine = __esm({
   "src/modules/sast/engine.ts"() {
@@ -6801,6 +7562,7 @@ var init_engine = __esm({
     init_xss();
     init_phase29();
     init_injection();
+    init_parse_pool();
     sastRules = [
       sqliRule,
       cmdiRule,
@@ -6820,48 +7582,48 @@ var init_engine = __esm({
     sastModule = {
       name: "sast",
       async run(ctx) {
+        const candidates = ctx.files.filter((rel) => SOURCE_EXT.test(rel) || TEMPLATE_EXT.test(rel));
+        if (candidates.length > sastStreamThreshold()) return runSastStreaming(ctx);
+        const maxBytes = ctx.config.sast.maxFileBytes;
         const findings = [];
         const parsed = [];
-        for (const rel of ctx.files) {
-          const isSource = SOURCE_EXT.test(rel);
-          const isTemplate = TEMPLATE_EXT.test(rel);
-          if (!isSource && !isTemplate) continue;
-          let source;
-          try {
-            source = await readFile(join(ctx.cwd, rel), "utf8");
-          } catch {
+        for (const rel of candidates) {
+          const source = await readScanSource(ctx.cwd, rel);
+          if (source === void 0) continue;
+          const why = skipReason(source, maxBytes);
+          if (why !== void 0) {
+            findings.push(skipFinding(rel, `Skipped ${rel}: ${why}.`));
             continue;
           }
-          if (source.length > 1024 * 1024 || source.includes("\0")) continue;
-          if (isTemplate) {
+          if (TEMPLATE_EXT.test(rel)) {
             findings.push(...findingsFromTemplate(rel, source));
             continue;
           }
-          try {
-            const ast = await parseSource(source);
-            parsed.push({ file: rel, source, ast });
-          } catch {
-          }
+          const ast = await parseCode(source);
+          if (ast === void 0) continue;
+          parsed.push({ file: rel, source, ast });
         }
         const files = new Set(parsed.map((p) => p.file));
         const projectCsrf = parsed.some((p) => sourceHasCsrfGuard(p.source));
         const returning = /* @__PURE__ */ new Map();
-        for (const p of parsed) {
-          returning.set(p.file, functionsThatReturnTaint(p.ast));
+        for (const entry of parsed) {
+          returning.set(entry.file, functionsThatReturnTaint(entry.ast));
         }
-        for (const p of parsed) {
-          const ns = collectRequires(p.file, p.ast, files);
-          const extra = new Set(returning.get(p.file));
-          for (const [local, spec] of ns) {
-            const hash = spec.indexOf("#");
-            const file = hash >= 0 ? spec.slice(0, hash) : spec;
-            const exp = hash >= 0 ? spec.slice(hash + 1) : local;
-            if (returning.get(file)?.has(exp)) extra.add(local);
-          }
-          findings.push(...findingsFromAst(p.file, p.source, p.ast, extra, projectCsrf));
+        for (const entry of parsed) {
+          findings.push(
+            ...findingsFromAst(
+              entry.file,
+              entry.source,
+              entry.ast,
+              extraReturners(entry.file, entry.ast, files, returning),
+              projectCsrf
+            )
+          );
         }
         findings.push(...runInterproc(parsed));
-        return findings;
+        const out = dedupeSastSinks(findings);
+        releaseParsed(parsed);
+        return out;
       }
     };
   }
@@ -7690,7 +8452,7 @@ function createAiClient(options) {
   const useFixtures = options.useFixtures ?? !isLiveAi();
   const model = options.model ?? process.env.FULLSHIELD_AI_MODEL ?? (useFixtures ? "recorded-fixture" : "qwen2.5-coder:7b");
   const provider = options.provider ?? process.env.FULLSHIELD_AI_PROVIDER ?? (useFixtures ? "fixture" : "ollama");
-  const cache = /* @__PURE__ */ new Map();
+  const cache2 = /* @__PURE__ */ new Map();
   let spentUsd = 0;
   let networkCalls = 0;
   const liveCost = provider === "ollama" ? 0 : FIXTURE_COST;
@@ -7710,7 +8472,7 @@ function createAiClient(options) {
       const redactedPrompt = `${modeInstruction(req.mode)}
 ${wrapUntrustedCode(req.prompt)}`;
       const key = cacheKey(req.model ?? model, redactedPrompt);
-      const cached = cache.get(key);
+      const cached = cache2.get(key);
       if (cached !== void 0) {
         return { ...cached, cached: true, costUsd: 0 };
       }
@@ -7724,7 +8486,7 @@ ${wrapUntrustedCode(req.prompt)}`;
           cached: false,
           redactedPrompt
         };
-        cache.set(key, response2);
+        cache2.set(key, response2);
         return response2;
       }
       const fetchImpl = options.fetchImpl ?? fetch;
@@ -7774,7 +8536,7 @@ ${wrapUntrustedCode(req.prompt)}`;
         cached: false,
         redactedPrompt
       };
-      cache.set(key, response);
+      cache2.set(key, response);
       return response;
     }
   };
@@ -7787,16 +8549,37 @@ var init_provider = __esm({
     FIXTURE_COST = 0.01;
   }
 });
+function isIsoDate(value) {
+  if (!/^\d{4}-\d{2}-\d{2}(T[\d:.+\-Z]+)?$/.test(value)) return false;
+  return Number.isFinite(Date.parse(value));
+}
+function expiresAtMs(expires) {
+  if (/^\d{4}-\d{2}-\d{2}$/.test(expires)) return Date.parse(`${expires}T23:59:59.999Z`);
+  return Date.parse(expires);
+}
+function validSuppression(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const row = value;
+  if (typeof row.ruleId !== "string" || row.ruleId.length === 0) return void 0;
+  if (typeof row.owner !== "string" || row.owner.length === 0) return void 0;
+  if (typeof row.reason !== "string" || row.reason.length === 0) return void 0;
+  if (typeof row.expires !== "string" || !isIsoDate(row.expires)) return void 0;
+  const file = row.file === void 0 ? void 0 : row.file.replace(/\\/g, "/");
+  if (row.file !== void 0 && (typeof row.file !== "string" || row.file.length === 0)) return void 0;
+  return { ruleId: row.ruleId, file, owner: row.owner, reason: row.reason, expires: row.expires };
+}
 async function readBaseline(path) {
   try {
     const raw = JSON.parse(await readFile(path, "utf8"));
     if (raw.version !== 1 || !Array.isArray(raw.findings)) return void 0;
+    if (raw.suppressions !== void 0 && !Array.isArray(raw.suppressions)) return void 0;
     return raw;
   } catch {
     return void 0;
   }
 }
 async function writeBaseline(path, findings) {
+  const existing = await readBaseline(path);
   const doc = {
     version: 1,
     findings: findings.map((f) => ({
@@ -7804,7 +8587,8 @@ async function writeBaseline(path, findings) {
       ruleId: f.ruleId,
       file: f.file,
       line: f.line
-    }))
+    })),
+    ...existing?.suppressions !== void 0 ? { suppressions: existing.suppressions } : {}
   };
   await writeFile(path, `${JSON.stringify(doc, null, 2)}
 `, "utf8");
@@ -7814,6 +8598,30 @@ function applyBaseline(findings, baseline) {
   const known = new Set(baseline.findings.map((f) => f.id));
   return findings.filter((f) => !known.has(f.id));
 }
+function applySuppressions(findings, rows, now = /* @__PURE__ */ new Date()) {
+  if (rows === void 0 || rows.length === 0) return { findings: [...findings], errors: [] };
+  const errors = [];
+  const active = [];
+  rows.forEach((row, index) => {
+    const parsed = validSuppression(row);
+    if (parsed === void 0) {
+      errors.push(`suppression ${index + 1} needs ruleId, owner, reason, and an ISO expires date`);
+      return;
+    }
+    if (expiresAtMs(parsed.expires) < now.getTime()) {
+      errors.push(
+        `suppression for ${parsed.ruleId} expired on ${parsed.expires} (owner: ${parsed.owner}); renew or remove it`
+      );
+      return;
+    }
+    active.push(parsed);
+  });
+  const kept = findings.filter((finding6) => {
+    const file = (finding6.file ?? "").replace(/\\/g, "/");
+    return !active.some((row) => row.ruleId === finding6.ruleId && (row.file === void 0 || row.file === file));
+  });
+  return { findings: kept, errors };
+}
 var init_baseline = __esm({
   "src/core/baseline.ts"() {
   }
@@ -7919,6 +8727,32 @@ function validate(raw, source) {
     }
     out.ai = ai;
   }
+  if (record.defaultExcludes !== void 0) {
+    if (typeof record.defaultExcludes !== "boolean") {
+      throw new ConfigError(`${source}: "defaultExcludes" must be a boolean`);
+    }
+    out.defaultExcludes = record.defaultExcludes;
+  }
+  if (record.excludes !== void 0) {
+    if (!Array.isArray(record.excludes) || record.excludes.some((p) => typeof p !== "string")) {
+      throw new ConfigError(`${source}: "excludes" must be an array of glob strings`);
+    }
+    out.excludes = record.excludes;
+  }
+  if (record.sast !== void 0) {
+    if (typeof record.sast !== "object" || record.sast === null || Array.isArray(record.sast)) {
+      throw new ConfigError(`${source}: "sast" must be an object`);
+    }
+    const rawSast = record.sast;
+    const sast = { maxFileBytes: 1024 * 1024 };
+    if (rawSast.maxFileBytes !== void 0) {
+      if (typeof rawSast.maxFileBytes !== "number" || rawSast.maxFileBytes < 1) {
+        throw new ConfigError(`${source}: "sast.maxFileBytes" must be a positive number`);
+      }
+      sast.maxFileBytes = rawSast.maxFileBytes;
+    }
+    out.sast = sast;
+  }
   return out;
 }
 async function loadConfig(cwd, configPath) {
@@ -7953,19 +8787,35 @@ var init_config2 = __esm({
       modules: [...MODULE_NAMES],
       failOn: "high",
       ignore: ["dist/**", "**/*.test.ts"],
+      defaultExcludes: true,
       baseline: ".fullshield-baseline.json",
       notify: { slackWebhookEnv: "FULLSHIELD_SLACK_WEBHOOK" },
       deps: { offline: false },
-      ai: { enabled: false, maxCostUsd: 1, maxFindings: 50 }
+      ai: { enabled: false, maxCostUsd: 1, maxFindings: 50 },
+      sast: { maxFileBytes: 1024 * 1024 }
     };
     ConfigError = class extends Error {
     };
-    KNOWN_KEYS = /* @__PURE__ */ new Set(["modules", "failOn", "ignore", "baseline", "notify", "deps", "ai"]);
+    KNOWN_KEYS = /* @__PURE__ */ new Set([
+      "modules",
+      "failOn",
+      "ignore",
+      "defaultExcludes",
+      "excludes",
+      "baseline",
+      "notify",
+      "deps",
+      "ai",
+      "sast"
+    ]);
   }
 });
 async function walkFiles(options) {
   const ig = ignoreFactory();
-  ig.add(ALWAYS_IGNORED);
+  ig.add(HARD_IGNORED);
+  if (options.defaultExcludes !== false) {
+    ig.add(options.excludes ?? DEFAULT_EXCLUDES);
+  }
   try {
     ig.add(await readFile(join(options.cwd, ".gitignore"), "utf8"));
   } catch {
@@ -7991,11 +8841,24 @@ async function walkFiles(options) {
   await walk5("");
   return files.sort();
 }
-var ignoreFactory, ALWAYS_IGNORED;
+var ignoreFactory, HARD_IGNORED, DEFAULT_EXCLUDES;
 var init_fileWalker = __esm({
   "src/core/fileWalker.ts"() {
     ignoreFactory = ignoreModule.default;
-    ALWAYS_IGNORED = [".git/", "node_modules/", ".fullshield/"];
+    HARD_IGNORED = [".git/", ".fullshield/"];
+    DEFAULT_EXCLUDES = [
+      "node_modules/",
+      "dist/",
+      "build/",
+      ".next/",
+      "coverage/",
+      "vendor/",
+      "vendored/",
+      "third_party/",
+      "third-party/",
+      "compiled/",
+      "*.min.js"
+    ];
   }
 });
 async function listStagedFiles(cwd) {
@@ -8050,27 +8913,6 @@ var init_suppression = __esm({
     IGNORE = /fullshield-ignore\s+([A-Z0-9-]+)\s*:\s*(\S+)/;
   }
 });
-function packageVersion() {
-  let dir = dirname(fileURLToPath(import.meta.url));
-  for (let depth = 0; depth < 6; depth += 1) {
-    try {
-      const raw = readFileSync(join(dir, "package.json"), "utf8");
-      const pkg = JSON.parse(raw);
-      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
-        return pkg.version;
-      }
-    } catch {
-    }
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  throw new Error("fullshield package.json not found");
-}
-var init_version = __esm({
-  "src/core/version.ts"() {
-  }
-});
 
 // src/policy/prSummary.ts
 function ruleDocsUrl(ruleId) {
@@ -8230,7 +9072,7 @@ function resolvePolicyBranch(cwd, env = process.env) {
     return "*";
   }
 }
-function expiresAtMs(expires) {
+function expiresAtMs2(expires) {
   if (/^\d{4}-\d{2}-\d{2}$/.test(expires)) {
     return Date.parse(`${expires}T23:59:59.999Z`);
   }
@@ -8252,7 +9094,7 @@ function applyPolicy(findings, policy, ctx = {}) {
   });
   const suppressed = /* @__PURE__ */ new Set();
   for (const exception of policy.exceptions ?? []) {
-    if (expiresAtMs(exception.expires) < now.getTime()) {
+    if (expiresAtMs2(exception.expires) < now.getTime()) {
       errors.push(
         `policy exception for ${exception.ruleId} expired on ${exception.expires} (owner: ${exception.owner}); renew or remove it`
       );
@@ -8321,6 +9163,7 @@ var init_incremental = __esm({
 // src/modules/secrets/history.ts
 var history_exports = {};
 __export(history_exports, {
+  historyCommitLimit: () => historyCommitLimit,
   scanGitHistory: () => scanGitHistory
 });
 function gitError(error) {
@@ -8363,7 +9206,13 @@ function remapHit(hit, file) {
     secret: hit.secret
   };
 }
-async function streamLogChanges(cwd) {
+function historyCommitLimit(raw = process.env.FULLSHIELD_HISTORY_MAX) {
+  if (raw === void 0 || raw.trim() === "") return 500;
+  const parsed = Number(raw);
+  if (!Number.isInteger(parsed) || parsed < 1) return 500;
+  return Math.min(parsed, 5e3);
+}
+async function streamLogChanges(cwd, maxCommits) {
   const changes = [];
   await gitOk(cwd, ["rev-parse", "--is-inside-work-tree"]);
   const child = spawn(
@@ -8380,6 +9229,8 @@ async function streamLogChanges(cwd) {
       "--format=FSCOMMIT:%H",
       "--no-textconv",
       "--no-ext-diff",
+      "-n",
+      String(maxCommits),
       "HEAD"
     ],
     { stdio: ["ignore", "pipe", "pipe"] }
@@ -8448,8 +9299,14 @@ async function headSecretKeys(cwd) {
   }
   return keys;
 }
-async function scanGitHistory(cwd) {
-  const changes = await streamLogChanges(cwd);
+async function commitCount(cwd) {
+  const raw = await gitOk(cwd, ["rev-list", "--count", "HEAD"]);
+  const total = Number(raw.trim());
+  return Number.isInteger(total) && total >= 0 ? total : 0;
+}
+async function scanGitHistory(cwd, maxCommits = historyCommitLimit()) {
+  const total = await commitCount(cwd);
+  const changes = await streamLogChanges(cwd, maxCommits);
   const blobHits = /* @__PURE__ */ new Map();
   const first = /* @__PURE__ */ new Map();
   for (const change of changes) {
@@ -8486,7 +9343,13 @@ async function scanGitHistory(cwd) {
       secret: hit.secret
     });
   }
-  return { findings: hits.map((h) => h.finding), hits };
+  const scanned = Math.min(maxCommits, total);
+  const history = total > maxCommits ? `scanned ${scanned} of ${total} commits` : void 0;
+  return {
+    findings: hits.map((h) => h.finding),
+    hits,
+    ...history !== void 0 ? { history } : {}
+  };
 }
 var execFileAsync2, ZERO_HASH, MAX_BLOB, RAW_LINE;
 var init_history = __esm({
@@ -8781,7 +9644,12 @@ async function runScan(options = {}, modules = builtinModules) {
     options.modules ?? config.modules,
     loadedPolicy?.requiredModules
   );
-  let files = await walkFiles({ cwd, ignore: config.ignore });
+  let files = await walkFiles({
+    cwd,
+    ignore: config.ignore,
+    defaultExcludes: config.defaultExcludes,
+    excludes: config.excludes
+  });
   if (options.staged === true) {
     const staged = new Set(await listStagedFiles(cwd));
     files = files.filter((file) => staged.has(file));
@@ -8815,6 +9683,7 @@ async function runScan(options = {}, modules = builtinModules) {
     );
   }
   const extraHits = [];
+  let historyNotice;
   const secretsWanted = modulesRequested.includes("secrets");
   if (secretsAdvEnabled() && secretsWanted) {
     if (options.history === true) {
@@ -8822,6 +9691,7 @@ async function runScan(options = {}, modules = builtinModules) {
       const hist = await scanGitHistory2(cwd);
       extraHits.push(...hist.hits);
       collected.push(...hist.findings);
+      historyNotice = hist.history;
     }
     if (options.bundle !== void 0 && options.bundle.length > 0) {
       const { scanBundle: scanBundle2 } = await Promise.resolve().then(() => (init_bundle(), bundle_exports));
@@ -8842,7 +9712,11 @@ async function runScan(options = {}, modules = builtinModules) {
   if (options.updateBaseline === true) {
     await writeBaseline(baselinePath, unsuppressed);
   }
-  let findings = sortFindings(applyBaseline(unsuppressed, await readBaseline(baselinePath)));
+  const baselineDoc = await readBaseline(baselinePath);
+  let findings = sortFindings(applyBaseline(unsuppressed, baselineDoc));
+  const suppressed = applySuppressions(findings, baselineDoc?.suppressions);
+  findings = sortFindings(suppressed.findings);
+  const suppressionErrors = suppressed.errors;
   if (secretsAdvEnabled() && secretsWanted && options.verifySecrets === true && options.iOwnTheseCredentials === true) {
     const { applyVerification: applyVerification2 } = await Promise.resolve().then(() => (init_verify(), verify_exports));
     const { scanTextForSecretHits: scanTextForSecretHits2 } = await Promise.resolve().then(() => (init_secrets(), secrets_exports));
@@ -8914,10 +9788,12 @@ async function runScan(options = {}, modules = builtinModules) {
       cwd,
       filesScanned: files.length,
       modulesRequested: [...modulesRequested],
-      modulesRun
+      modulesRun,
+      ...historyNotice !== void 0 ? { history: historyNotice } : {}
     },
     config,
-    policy: policyResult
+    policy: policyResult,
+    ...suppressionErrors.length > 0 ? { suppressionErrors } : {}
   };
 }
 function scan(options = {}) {
@@ -9233,6 +10109,32 @@ function finding4(ruleId, title, message, file, severity = "high") {
     remediation: "Pin actions by SHA, drop pull_request_target, tighten permissions, close 0.0.0.0/0, encrypt storage, drop privileged."
   };
 }
+function runBodies(text) {
+  const bodies = [];
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i += 1) {
+    const match = /^(\s*)(?:-\s+)?run:\s*(.*)$/.exec(lines[i] ?? "");
+    if (match === null) continue;
+    const indent = match[1]?.length ?? 0;
+    let body = match[2] ?? "";
+    if (body === "|" || body === ">") {
+      const block = [];
+      for (let j = i + 1; j < lines.length; j += 1) {
+        const line = lines[j] ?? "";
+        if (line.trim() === "") {
+          block.push(line);
+          continue;
+        }
+        const lead = line.match(/^\s*/)?.[0].length ?? 0;
+        if (lead <= indent) break;
+        block.push(line);
+      }
+      body = block.join("\n");
+    }
+    bodies.push(body);
+  }
+  return bodies;
+}
 function walk3(dir, out = []) {
   if (!existsSync(dir)) return out;
   for (const entry of readdirSync(dir, { withFileTypes: true })) {
@@ -9260,6 +10162,28 @@ function scanIac(dir, opts = {}) {
       if (/pull_request_target/.test(text)) {
         findings.push(finding4("IAC-GHA-PRTARGET-001", "pull_request_target workflow", "untrusted PR can run with base secrets", rel, "critical"));
       }
+      if (/pull_request_target/.test(text) && /actions\/checkout/.test(text) && /github\.event\.pull_request/.test(text)) {
+        findings.push(
+          finding4(
+            "IAC-GHA-PRCHECKOUT-001",
+            "pull_request_target checks out pull-request code",
+            "untrusted head can run with the base repository token",
+            rel,
+            "critical"
+          )
+        );
+      }
+      if (runBodies(text).some((body) => /\$\{\{\s*github\.event\./.test(body))) {
+        findings.push(
+          finding4(
+            "IAC-GHA-INJECT-001",
+            "Workflow run step interpolates github.event",
+            "untrusted event text is passed to the shell",
+            rel,
+            "critical"
+          )
+        );
+      }
       if (/permissions:\s*\n\s+contents:\s*write/.test(text) || /permissions:\s+write-all/.test(text)) {
         findings.push(finding4("IAC-GHA-PERMS-001", "Overly broad GitHub Actions permissions", "write-all or contents: write", rel));
       }
@@ -9410,6 +10334,7 @@ var init_compliance = __esm({
       ROW("SUPPLY-BEHAVIOR-001", "A06:2021 Vulnerable Components", "CWE-829", "V14.2.1", "PCI DSS 6.3.3"),
       ROW("SUPPLY-COOLDOWN-001", "A06:2021 Vulnerable Components", "CWE-1104", "V14.2.1", "PCI DSS 6.3.3"),
       ROW("SUPPLY-LOCKURL-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
+      ROW("SUPPLY-LOCKINTEGRITY-001", "A08:2021 Integrity Failures", "CWE-353", "V14.2.3", "PCI DSS 6.3.3"),
       ROW("SUPPLY-CONFUSION-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
       ROW("SUPPLY-PROVENANCE-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
       ROW("SUPPLY-WORM-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 6.3.3 / 12.10"),
@@ -9418,6 +10343,9 @@ var init_compliance = __esm({
       ROW("IAC-GHA-PRTARGET-001", "A01:2021 Broken Access Control", "CWE-269", "V4.1.1", "PCI DSS 7.2"),
       ROW("IAC-GHA-PERMS-001", "A01:2021 Broken Access Control", "CWE-250", "V4.1.1", "PCI DSS 7.2"),
       ROW("IAC-GHA-SECRETLOG-001", "A09:2021 Security Logging Failures", "CWE-532", "V7.1.1", "PCI DSS 3.2 / 10.2"),
+      ROW("IAC-GHA-INJECT-001", "A03:2021 Injection", "CWE-94", "V5.2.4", "PCI DSS 6.2.4"),
+      ROW("IAC-GHA-PRCHECKOUT-001", "A01:2021 Broken Access Control", "CWE-829", "V4.1.1", "PCI DSS 6.2.4"),
+      ROW("DEPS-LICENSE-001", "A06:2021 Vulnerable Components", "CWE-1104", "V14.2.1", "PCI DSS 6.3.3"),
       ROW("IAC-TF-S3PUBLIC-001", "A01:2021 Broken Access Control", "CWE-284", "V12.1.1", "PCI DSS 1.3 / 3.2"),
       ROW("IAC-TF-SGOPEN-001", "A05:2021 Security Misconfiguration", "CWE-284", "V1.4.1", "PCI DSS 1.2 / 1.3"),
       ROW("IAC-TF-UNENCRYPTED-001", "A02:2021 Cryptographic Failures", "CWE-311", "V6.2.1", "PCI DSS 3.4 / 4.2"),
@@ -9444,6 +10372,7 @@ var init_compliance = __esm({
       ROW("SAST-TIMING-001", "A07:2021 Identification Failures", "CWE-208", "V2.10.3", "PCI DSS 8.3"),
       ROW("SAST-HASH-001", "A02:2021 Cryptographic Failures", "CWE-916", "V6.2.2", "PCI DSS 8.3.1"),
       ROW("SAST-GQL-001", "A04:2021 Insecure Design", "CWE-770/200", "V13.1.1", "PCI DSS 6.2.4"),
+      ROW("SAST-SKIP-001", "A05:2021 Security Misconfiguration", "CWE-693", "V1.1.1", "PCI DSS 6.2.4"),
       ROW("CONFIG-TRUSTPROXY-001", "A07:2021 Identification Failures", "CWE-290", "V2.2.1", "PCI DSS 8.3.4"),
       ROW("SECRET-BUNDLE-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 3.2 / 8.3"),
       ROW("DLP-SECRET-001", "A02:2021 Cryptographic Failures", "CWE-200", "V8.3.4", "PCI DSS 3.2 / 8.3"),
@@ -9463,6 +10392,23 @@ var init_compliance = __esm({
     byId = new Map(RULE_MAP.map((r) => [r.ruleId, r]));
   }
 });
+function nodeSqliteAvailable() {
+  try {
+    require2("node:sqlite");
+    return true;
+  } catch {
+    return false;
+  }
+}
+function nodeSqliteUnavailableMessage(feature) {
+  return `${feature} requires Node 22.13+ (node:sqlite is not available on Node ${process.versions.node})`;
+}
+var require2;
+var init_sqlite = __esm({
+  "src/core/sqlite.ts"() {
+    require2 = createRequire(import.meta.url);
+  }
+});
 
 // src/dashboard/index.ts
 var dashboard_exports = {};
@@ -9476,7 +10422,7 @@ __export(dashboard_exports, {
   startDashboard: () => startDashboard
 });
 function sqliteDb(file) {
-  const { DatabaseSync } = require2("node:sqlite");
+  const { DatabaseSync } = require3("node:sqlite");
   let db;
   try {
     db = new DatabaseSync(file);
@@ -9527,6 +10473,9 @@ function sqliteDb(file) {
   };
 }
 function openHistory(dir) {
+  if (!nodeSqliteAvailable()) {
+    throw new Error(nodeSqliteUnavailableMessage("history"));
+  }
   const root = join(dir, ".fullshield");
   mkdirSync(root, { recursive: true });
   return sqliteDb(join(root, "history.db"));
@@ -9628,10 +10577,11 @@ function startDashboard(opts) {
     });
   });
 }
-var require2;
+var require3;
 var init_dashboard = __esm({
   "src/dashboard/index.ts"() {
-    require2 = createRequire(import.meta.url);
+    init_sqlite();
+    require3 = createRequire(import.meta.url);
   }
 });
 function finding5(ruleId, title, message, file, severity = "high") {
@@ -10856,6 +11806,153 @@ ${target.message}`
 // src/cli/program.ts
 init_version();
 
+// src/core/fingerprint.ts
+init_finding();
+function lineIndependentFingerprint(finding6) {
+  const file = (finding6.file ?? "").replace(/\\/g, "/");
+  const text = (finding6.snippet ?? finding6.message ?? "").replace(/\s+/g, " ").trim();
+  return makeFindingId(finding6.ruleId, file, `${finding6.severity}\0${text}`);
+}
+
+// src/reporters/ci.ts
+init_finding();
+
+// src/reporters/redact.ts
+init_mask();
+var SECRET = /\b(?:AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk_live_[A-Za-z0-9]{10,}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g;
+function redactSecrets2(text) {
+  return text.replace(SECRET, (match) => maskSecret(match));
+}
+function redactFinding(finding6) {
+  return {
+    ...finding6,
+    title: redactSecrets2(finding6.title),
+    message: redactSecrets2(finding6.message),
+    remediation: redactSecrets2(finding6.remediation),
+    snippet: finding6.snippet === void 0 ? void 0 : redactSecrets2(finding6.snippet)
+  };
+}
+function redactScan(result) {
+  return { ...result, findings: result.findings.map(redactFinding) };
+}
+
+// src/reporters/ci.ts
+var MESSAGE_CAP = 4e3;
+function posix2(file) {
+  return file.replace(/\\/g, "/");
+}
+function clip(text) {
+  return text.length <= MESSAGE_CAP ? text : `${text.slice(0, MESSAGE_CAP)}\u2026`;
+}
+function githubEscape(value, property) {
+  let out = value.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A").replace(/:/g, "%3A");
+  if (property) out = out.replace(/,/g, "%2C");
+  return out;
+}
+function githubLevel(severity) {
+  if (severity === "critical" || severity === "high") return "error";
+  if (severity === "medium") return "warning";
+  return "notice";
+}
+function gitlabSeverity(severity) {
+  if (severity === "info") return "info";
+  if (severity === "low") return "minor";
+  if (severity === "medium") return "major";
+  if (severity === "high") return "critical";
+  return "blocker";
+}
+function xmlEscape(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function oneLine(value) {
+  return value.replace(/\s+/g, " ").trim();
+}
+function renderGithubAnnotations(input) {
+  const result = redactScan(input);
+  if (result.findings.length === 0) {
+    return "::notice title=FullShield::No findings\n";
+  }
+  const lines = result.findings.map((finding6) => {
+    const props = [];
+    if (finding6.file !== void 0) props.push(`file=${githubEscape(posix2(finding6.file), true)}`);
+    if (finding6.line !== void 0) props.push(`line=${finding6.line}`);
+    if (finding6.column !== void 0) props.push(`col=${finding6.column + 1}`);
+    props.push(`title=${githubEscape(finding6.ruleId, true)}`);
+    const message = githubEscape(clip(finding6.message), false);
+    return `::${githubLevel(finding6.severity)} ${props.join(",")}::${message}`;
+  });
+  return `${lines.join("\n")}
+`;
+}
+function junitCase(finding6) {
+  const file = finding6.file !== void 0 ? posix2(finding6.file) : "fullshield";
+  const attrs = [
+    `name="${xmlEscape(finding6.ruleId)}"`,
+    `classname="${xmlEscape(file)}"`,
+    `file="${xmlEscape(file)}"`
+  ];
+  if (finding6.line !== void 0) attrs.push(`line="${finding6.line}"`);
+  const open = `<testcase ${attrs.join(" ")}>`;
+  if (!meetsThreshold(finding6.severity, "medium")) {
+    return `${open}<skipped message="${xmlEscape(oneLine(clip(finding6.message)))}"/></testcase>`;
+  }
+  const detail = clip(`${finding6.message}${finding6.remediation.length > 0 ? `
+Fix: ${finding6.remediation}` : ""}`);
+  return `${open}<failure type="${finding6.severity}" message="${xmlEscape(oneLine(clip(finding6.message)))}">${xmlEscape(detail)}</failure></testcase>`;
+}
+function renderJunitReport(input) {
+  const result = redactScan(input);
+  const header = '<?xml version="1.0" encoding="UTF-8"?>';
+  if (result.findings.length === 0) {
+    return `${header}
+<testsuites name="fullshield" tests="1" failures="0" skipped="0"><testsuite name="fullshield" tests="1" failures="0" skipped="0"><testcase name="scan" classname="fullshield"/></testsuite></testsuites>
+`;
+  }
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding6 of result.findings) {
+    const list = groups.get(finding6.module) ?? [];
+    list.push(finding6);
+    groups.set(finding6.module, list);
+  }
+  let failures = 0;
+  let skipped = 0;
+  const suites = [];
+  for (const [name, findings] of groups) {
+    let suiteFailures = 0;
+    let suiteSkipped = 0;
+    const cases = findings.map((finding6) => {
+      if (meetsThreshold(finding6.severity, "medium")) suiteFailures += 1;
+      else suiteSkipped += 1;
+      return junitCase(finding6);
+    });
+    failures += suiteFailures;
+    skipped += suiteSkipped;
+    suites.push(
+      `<testsuite name="${xmlEscape(name)}" tests="${findings.length}" failures="${suiteFailures}" skipped="${suiteSkipped}">${cases.join("")}</testsuite>`
+    );
+  }
+  return `${header}
+<testsuites name="fullshield" tests="${result.findings.length}" failures="${failures}" skipped="${skipped}">${suites.join("")}</testsuites>
+`;
+}
+function renderGitlabCodeQuality(input) {
+  const result = redactScan(input);
+  const report = result.findings.map((finding6) => {
+    const path = finding6.file !== void 0 ? posix2(finding6.file) : ".";
+    const location4 = { path };
+    if (finding6.line !== void 0) location4.lines = { begin: finding6.line };
+    return {
+      description: clip(finding6.message),
+      check_name: finding6.ruleId,
+      fingerprint: lineIndependentFingerprint(finding6),
+      severity: gitlabSeverity(finding6.severity),
+      location: location4
+    };
+  });
+  return `${JSON.stringify(report, null, 2)}
+`;
+}
+
 // src/reporters/console.ts
 init_finding();
 var SEVERITY_COLOR = {
@@ -10897,7 +11994,8 @@ function renderFinding(finding6) {
   }
   return lines;
 }
-function renderConsoleReport(result) {
+function renderConsoleReport(input) {
+  const result = redactScan(input);
   const { findings, summary, metadata } = result;
   const lines = [];
   lines.push(
@@ -10905,6 +12003,7 @@ function renderConsoleReport(result) {
       ` \u2014 scanned ${metadata.filesScanned} files in ${metadata.durationMs}ms (modules: ${metadata.modulesRun.length > 0 ? metadata.modulesRun.join(", ") : "none"})`
     )
   );
+  if (metadata.history !== void 0) lines.push(metadata.history);
   if (metadata.modulesRun.length < metadata.modulesRequested.length) {
     const pending = metadata.modulesRequested.filter((m) => !metadata.modulesRun.includes(m));
     lines.push(
@@ -10912,15 +12011,23 @@ function renderConsoleReport(result) {
     );
   }
   const bySeverityDesc = [...SEVERITIES].reverse();
+  const ordered = bySeverityDesc.flatMap((severity) => findings.filter((f) => f.severity === severity));
+  const shown = ordered.slice(0, 10);
+  const hidden = ordered.length - shown.length;
   for (const severity of bySeverityDesc) {
-    const group = findings.filter((f) => f.severity === severity);
+    const group = shown.filter((f) => f.severity === severity);
     if (group.length === 0) continue;
     lines.push("");
-    lines.push(SEVERITY_COLOR[severity](`${severity.toUpperCase()} (${group.length})`));
+    lines.push(SEVERITY_COLOR[severity](`${severity.toUpperCase()} (${findings.filter((f) => f.severity === severity).length})`));
     for (const finding6 of group) {
       lines.push(...renderFinding(finding6));
+      lines.push(`    docs: rules/${finding6.ruleId}.md`);
     }
   }
+  if (hidden > 0) {
+    lines.push("");
+    lines.push(`${hidden} more \u2014 use --json`);
+  }
   lines.push("");
   if (summary.total === 0) {
     lines.push(pc.green("\u2714 No findings."));
@@ -10940,7 +12047,8 @@ function location2(finding6) {
   if (finding6.file === void 0) return "(project)";
   return finding6.line !== void 0 ? `${finding6.file}:${finding6.line}` : finding6.file;
 }
-function renderHtmlReport(result) {
+function renderHtmlReport(input) {
+  const result = redactScan(input);
   const sections = [];
   const bySeverityDesc = [...SEVERITIES].reverse();
   for (const severity of bySeverityDesc) {
@@ -10987,7 +12095,7 @@ ${items}`);
 
 // src/reporters/json.ts
 function publicFinding(finding6) {
-  const copy = { ...finding6 };
+  const copy = redactFinding(finding6);
   delete copy.aiVerdict;
   delete copy.exploitScenario;
   delete copy.aiReasoning;
@@ -11011,7 +12119,8 @@ function location3(finding6) {
   if (finding6.file === void 0) return "(project)";
   return finding6.line !== void 0 ? `${finding6.file}:${finding6.line}` : finding6.file;
 }
-function renderMarkdownReport(result) {
+function renderMarkdownReport(input) {
+  const result = redactScan(input);
   const lines = [
     "# FullShield report",
     "",
@@ -11063,7 +12172,8 @@ function sarifLevel(severity) {
 function uri(file) {
   return (file ?? "").replace(/\\/g, "/");
 }
-function renderSarifReport(result) {
+function renderSarifReport(input) {
+  const result = redactScan(input);
   const rules = /* @__PURE__ */ new Map();
   for (const finding6 of result.findings) {
     if (!rules.has(finding6.ruleId)) {
@@ -11130,7 +12240,137 @@ function renderSarifReport(result) {
   return JSON.stringify(doc, null, 2);
 }
 
+// src/diff/index.ts
+init_finding();
+init_experimental();
+function posix3(file) {
+  return (file ?? "").replace(/\\/g, "/");
+}
+function diffKey(finding6) {
+  return lineIndependentFingerprint(finding6);
+}
+function groupById(findings) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding6 of findings) {
+    if (finding6.id === void 0 || finding6.id.length === 0) continue;
+    const list = groups.get(finding6.id) ?? [];
+    list.push(finding6);
+    groups.set(finding6.id, list);
+  }
+  return groups;
+}
+function pairMoves(removed, added) {
+  const removedIds = groupById(removed);
+  const addedIds = groupById(added);
+  const moved = [];
+  for (const [id, group] of removedIds) {
+    const match = addedIds.get(id);
+    if (group.length === 1 && match?.length === 1 && group[0] !== void 0 && match[0] !== void 0) {
+      moved.push({ before: group[0], after: match[0] });
+    }
+  }
+  return moved;
+}
+function byLocation(a, b) {
+  return (a.line ?? 0) - (b.line ?? 0) || a.id.localeCompare(b.id) || a.ruleId.localeCompare(b.ruleId);
+}
+function groupFindings(findings) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding6 of findings) {
+    const key = diffKey(finding6);
+    const list = groups.get(key) ?? [];
+    list.push(finding6);
+    groups.set(key, list);
+  }
+  return groups;
+}
+function diffScans(before, after) {
+  const beforeGroups = groupFindings(before);
+  const afterGroups = groupFindings(after);
+  const unchanged = [];
+  const added = [];
+  const removed = [];
+  const moved = [];
+  const keys = [];
+  for (const key of beforeGroups.keys()) keys.push(key);
+  for (const key of afterGroups.keys()) {
+    if (!beforeGroups.has(key)) keys.push(key);
+  }
+  for (const key of keys) {
+    const left = [...beforeGroups.get(key) ?? []].sort(byLocation);
+    const right = [...afterGroups.get(key) ?? []].sort(byLocation);
+    const paired = Math.min(left.length, right.length);
+    for (let i = 0; i < paired; i += 1) {
+      const earlier = left[i];
+      const later = right[i];
+      if (earlier === void 0 || later === void 0) continue;
+      if ((earlier.line ?? 0) === (later.line ?? 0)) unchanged.push(later);
+      else moved.push({ before: earlier, after: later });
+    }
+    for (const finding6 of left.slice(paired)) removed.push(finding6);
+    for (const finding6 of right.slice(paired)) added.push(finding6);
+  }
+  const idMoves = pairMoves(removed, added);
+  const movedBefore = new Set(idMoves.map((item) => item.before));
+  const movedAfter = new Set(idMoves.map((item) => item.after));
+  return {
+    unchanged,
+    added: added.filter((finding6) => !movedAfter.has(finding6)),
+    removed: removed.filter((finding6) => !movedBefore.has(finding6)),
+    moved: [...moved, ...idMoves]
+  };
+}
+function parseScanDocument(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error("scan JSON must be an object with a findings array or a findings array");
+  }
+  const list = Array.isArray(parsed) ? parsed : typeof parsed === "object" && parsed !== null && Array.isArray(parsed.findings) ? parsed.findings : void 0;
+  if (list === void 0) {
+    throw new Error("scan JSON must be an object with a findings array or a findings array");
+  }
+  return list.map((item) => {
+    if (typeof item !== "object" || item === null) {
+      throw new Error("scan JSON finding is missing ruleId or severity");
+    }
+    const record = item;
+    const ruleId = record.ruleId;
+    const severity = record.severity;
+    if (typeof ruleId !== "string" || ruleId.length === 0 || typeof severity !== "string") {
+      throw new Error("scan JSON finding is missing ruleId or severity");
+    }
+    if (!isSeverity(severity)) {
+      throw new Error(`scan JSON finding has an unknown severity "${severity}"`);
+    }
+    if (record.line !== void 0 && (typeof record.line !== "number" || !Number.isInteger(record.line) || record.line < 0)) {
+      throw new Error("scan JSON finding line must be an integer >= 0");
+    }
+    return item;
+  });
+}
+function addedFails(diff, failOn) {
+  return diff.added.some((finding6) => finding6.source !== "ai" && meetsThreshold(finding6.severity, failOn));
+}
+var ADDED_CAP = 20;
+function addedLine(finding6) {
+  const where = finding6.file !== void 0 ? ` ${posix3(finding6.file)}:${finding6.line ?? 0}` : "";
+  return `${finding6.severity} ${finding6.ruleId}${where}`;
+}
+function renderDiffText(diff) {
+  const lines = [
+    `fullshield diff: unchanged ${diff.unchanged.length}, added ${diff.added.length}, removed ${diff.removed.length}, moved ${diff.moved.length}`
+  ];
+  if (diff.added.length === 0) return lines.join("\n");
+  lines.push("added:");
+  for (const finding6 of diff.added.slice(0, ADDED_CAP)) lines.push(addedLine(finding6));
+  if (diff.added.length > ADDED_CAP) lines.push(`${diff.added.length - ADDED_CAP} more \u2014 use --json`);
+  return lines.join("\n");
+}
+
 // src/cli/program.ts
+init_experimental();
 init_policy();
 
 // src/sbom/index.ts
@@ -11803,6 +13043,111 @@ function stateForGrace(sshd) {
   return sshd.loginGraceTimeZero ? "logingracetime 0" : "logingracetime not 0";
 }
 
+// src/cli/commands/doctor.ts
+init_config2();
+var MIN_NODE = [20, 11, 0];
+var LOCKFILES = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"];
+var FLAGS = [
+  "FULLSHIELD_EXPERIMENTAL_SAST_GAPS",
+  "FULLSHIELD_EXPERIMENTAL_FRAMEWORKS",
+  "FULLSHIELD_EXPERIMENTAL_CLASSES",
+  "FULLSHIELD_EXPERIMENTAL_SECRETS_ADV",
+  "FULLSHIELD_EXPERIMENTAL_VEX",
+  "FULLSHIELD_EXPERIMENTAL_DLP",
+  "FULLSHIELD_EXPERIMENTAL_MCPCFG",
+  "FULLSHIELD_EXPERIMENTAL_POLICY",
+  "FULLSHIELD_EXPERIMENTAL_HOST",
+  "FULLSHIELD_EXPERIMENTAL_TAINT_V2",
+  "FULLSHIELD_EXPERIMENTAL_CI_REPORTS",
+  "FULLSHIELD_EXPERIMENTAL_DIFF",
+  "FULLSHIELD_EXPERIMENTAL_LICENSE",
+  "FULLSHIELD_PARSE_POOL"
+];
+function nodeOk(version) {
+  const parts = version.split(".").map((part) => Number(part));
+  for (let i = 0; i < MIN_NODE.length; i += 1) {
+    const got = parts[i] ?? 0;
+    const need = MIN_NODE[i] ?? 0;
+    if (got > need) return true;
+    if (got < need) return false;
+  }
+  return true;
+}
+async function runDoctor(cwd, options = {}) {
+  const lines = [];
+  const version = process.versions.node;
+  lines.push(`node: ${version} ${nodeOk(version) ? "ok" : "too old (need >= 20.11.0)"}`);
+  const locks = LOCKFILES.filter((name) => existsSync(join(cwd, name)));
+  lines.push(locks.length > 0 ? `lockfile: ${locks.join(", ")}` : "lockfile: none");
+  const cacheDir = join(homedir(), ".cache", "fullshield", "osv");
+  let cacheFiles = 0;
+  if (existsSync(cacheDir)) {
+    cacheFiles = readdirSync(cacheDir).length;
+  }
+  lines.push(`cache: ${existsSync(cacheDir) ? cacheDir : "absent"} (${cacheFiles} files)`);
+  const on = FLAGS.filter((name) => process.env[name] === "1");
+  lines.push(on.length > 0 ? `flags: ${on.join(", ")}` : "flags: none");
+  try {
+    const config = await loadConfig(cwd, options.config);
+    lines.push(`config: valid (failOn ${config.failOn}, offline ${config.deps.offline})`);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    lines.push(`config: invalid (${message})`);
+  }
+  const offline = options.offline === true;
+  lines.push(
+    offline ? "osv: network skipped (--offline); reachability uses the local lockfile only" : "osv: network allowed; reachability still uses the local lockfile"
+  );
+  return lines.join("\n");
+}
+
+// src/cli/errors.ts
+var KNOWN = [
+  {
+    test: /invalid --fail-on/,
+    code: "FS-E001",
+    hint: "Use one of critical, high, medium, low, info."
+  },
+  {
+    test: /unknown module/,
+    code: "FS-E002",
+    hint: "Pass a comma-separated list from `fullshield scan --help`."
+  },
+  {
+    test: /not a directory/,
+    code: "FS-E003",
+    hint: "Pass the project directory to scan."
+  },
+  {
+    test: /cannot read config/,
+    code: "FS-E004",
+    hint: "Check the path passed to --config."
+  },
+  {
+    test: /FULLSHIELD_EXPERIMENTAL_CI_REPORTS/,
+    code: "FS-E005",
+    hint: "Set FULLSHIELD_EXPERIMENTAL_CI_REPORTS=1 or pass --experimental-ci-reports."
+  },
+  {
+    test: /FULLSHIELD_EXPERIMENTAL_DIFF|scan JSON|cannot read diff/,
+    code: "FS-E006",
+    hint: "Set FULLSHIELD_EXPERIMENTAL_DIFF=1 or pass --experimental-diff. Both inputs must be scan --json files."
+  }
+];
+var DOCS = "https://github.com/kathanp/fullshield/blob/main/docs/errors.md";
+function formatCliError(error, debug = process.argv.includes("--debug")) {
+  const message = error instanceof Error ? error.message : String(error);
+  const known = KNOWN.find((item) => item.test.test(message));
+  const code = known?.code ?? "FS-E000";
+  const hint = known !== void 0 ? ` \u2014 ${known.hint} ${DOCS}#${code.toLowerCase()}` : "";
+  const line = `fullshield: ${code} ${message}${hint}`;
+  if (debug && error instanceof Error && error.stack !== void 0) {
+    return `${line}
+${error.stack}`;
+  }
+  return line;
+}
+
 // src/cli/program.ts
 var defaultIO = {
   out: (text) => process.stdout.write(`${text}
@@ -11837,8 +13182,17 @@ function parseFailOn(value) {
 }
 function createProgram(io = defaultIO) {
   const program = new Command();
-  program.name("fullshield").description("Full-cycle security scanner for Node.js/TypeScript backends").version(packageVersion());
-  program.command("scan").description("Scan a project directory for security findings").argument("[path]", "directory to scan", ".").option("--json", "machine-readable JSON output").option("--fail-on <severity>", "exit 1 if any finding is at or above this severity").option("--modules <modules>", "comma-separated subset of modules to run").option("--staged", "scan only files staged in git (pre-commit mode)").option("--offline", "use the OSV cache only (no network)").option("--offline-safe", "alias of --offline").option("--config <path>", "path to fullshield.config.json").option("--sarif <file>", "write a SARIF 2.1.0 report to this path").option("--markdown <file>", "write a Markdown report to this path").option("--html <file>", "write an HTML report to this path").option("--update-baseline", "record current findings as accepted (CI fails only on new ones)").option("--ai [mode]", "experimental: explain findings (off = zero AI network calls)").option("--emit-virtual-patches [file]", "experimental: write .fullshield/vpatches.json").option("--changed", "experimental: scan git staged/changed files only").option("--since <ref>", "experimental: scan files changed since a git ref").option(
+  program.name("fullshield").description("Full-cycle security scanner for Node.js/TypeScript backends").version(packageVersion()).option("--debug", "print stack traces on CLI errors");
+  program.command("scan").description("Scan a project directory for security findings").argument("[path]", "directory to scan", ".").option("--json", "machine-readable JSON output").option("--fail-on <severity>", "exit 1 if any finding is at or above this severity").option("--modules <modules>", "comma-separated subset of modules to run").option("--staged", "scan only files staged in git (pre-commit mode)").option("--offline", "use the OSV cache only (no network)").option("--offline-safe", "alias of --offline").option("--config <path>", "path to fullshield.config.json").option("--sarif <file>", "write a SARIF 2.1.0 report to this path").option("--markdown <file>", "write a Markdown report to this path").option("--html <file>", "write an HTML report to this path").option(
+    "--experimental-ci-reports",
+    "experimental: GitHub annotations, JUnit, and GitLab Code Quality (FULLSHIELD_EXPERIMENTAL_CI_REPORTS=1)"
+  ).option(
+    "--github-annotations <file>",
+    "experimental: GitHub Actions workflow commands (requires FULLSHIELD_EXPERIMENTAL_CI_REPORTS=1)"
+  ).option("--junit <file>", "experimental: JUnit XML (requires FULLSHIELD_EXPERIMENTAL_CI_REPORTS=1)").option(
+    "--gitlab <file>",
+    "experimental: GitLab Code Quality JSON (requires FULLSHIELD_EXPERIMENTAL_CI_REPORTS=1)"
+  ).option("--update-baseline", "record current findings as accepted (CI fails only on new ones)").option("--ai [mode]", "experimental: explain findings (off = zero AI network calls)").option("--emit-virtual-patches [file]", "experimental: write .fullshield/vpatches.json").option("--changed", "experimental: scan git staged/changed files only").option("--since <ref>", "experimental: scan files changed since a git ref").option(
     "--experimental-sast-gaps",
     "experimental: ORM raw / sh -c / execa / zx sinks (FULLSHIELD_EXPERIMENTAL_SAST_GAPS=1)"
   ).option(
@@ -11897,6 +13251,15 @@ function createProgram(io = defaultIO) {
       if (opts.prSummary === true && process.env[POLICY_FLAG] !== "1") {
         throw new Error(`--pr-summary requires ${POLICY_FLAG}=1`);
       }
+      if (opts.experimentalCiReports === true) {
+        process.env[CI_REPORTS_FLAG] = "1";
+      }
+      const wantsCiReport = opts.githubAnnotations !== void 0 || opts.junit !== void 0 || opts.gitlab !== void 0;
+      if (wantsCiReport && process.env[CI_REPORTS_FLAG] !== "1") {
+        throw new Error(
+          `--github-annotations, --junit, and --gitlab require ${CI_REPORTS_FLAG}=1`
+        );
+      }
       const result = await scan({
         cwd: resolve(path),
         modules,
@@ -11924,6 +13287,15 @@ function createProgram(io = defaultIO) {
       if (opts.html !== void 0) {
         await writeFile(resolve(opts.html), renderHtmlReport(result), "utf8");
       }
+      if (opts.githubAnnotations !== void 0) {
+        await writeFile(resolve(opts.githubAnnotations), renderGithubAnnotations(result), "utf8");
+      }
+      if (opts.junit !== void 0) {
+        await writeFile(resolve(opts.junit), renderJunitReport(result), "utf8");
+      }
+      if (opts.gitlab !== void 0) {
+        await writeFile(resolve(opts.gitlab), renderGitlabCodeQuality(result), "utf8");
+      }
       await writeLastScan(resolve(path), result);
       if (opts.emitVirtualPatches !== void 0) {
         if (process.env.FULLSHIELD_EXPERIMENTAL_VPATCH !== "1") {
@@ -11945,12 +13317,18 @@ function createProgram(io = defaultIO) {
         }
         process.exitCode = 1;
       }
+      if (result.suppressionErrors !== void 0 && result.suppressionErrors.length > 0) {
+        for (const message of result.suppressionErrors) {
+          io.err(`fullshield: ${message}`);
+        }
+        process.exitCode = 1;
+      }
       const failOn = failOnOverride ?? result.policy?.failOn ?? result.config.failOn;
       if (result.findings.some((f) => failsCi(f, failOn))) {
         process.exitCode = 1;
       }
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -11995,7 +13373,7 @@ function createProgram(io = defaultIO) {
         io.out("Dry run. Re-run with --apply to write safe fixes.");
       }
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12008,7 +13386,7 @@ function createProgram(io = defaultIO) {
         io.out(`Wrote ${result.written.join(", ")}`);
       }
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12037,7 +13415,7 @@ function createProgram(io = defaultIO) {
       }
       io.out(formatSummary(summary));
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12057,7 +13435,7 @@ function createProgram(io = defaultIO) {
         io.out(json);
       }
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12076,7 +13454,7 @@ function createProgram(io = defaultIO) {
       }
       if (findings.some((f) => meetsThreshold(f.severity, "high"))) process.exitCode = 1;
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12111,7 +13489,7 @@ function createProgram(io = defaultIO) {
       const gate = failOn ?? result.config.failOn;
       if (fresh.some((f) => meetsThreshold(f.severity, gate))) process.exitCode = 1;
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12124,7 +13502,7 @@ function createProgram(io = defaultIO) {
       const model = buildThreatModel2(resolve(path), { experimental: true });
       io.out(JSON.stringify({ routes: model.routes.length, stride: model.stride, mermaid: model.mermaid }));
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12154,7 +13532,7 @@ function createProgram(io = defaultIO) {
       const started = await startDashboard2({ dir: resolve(path), experimental: true });
       io.out(`dashboard listening on http://127.0.0.1:${started.port} (Host must be localhost or 127.0.0.1)`);
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12167,7 +13545,7 @@ function createProgram(io = defaultIO) {
       const findings = scanIac2(resolve(path), { experimental: true });
       io.out(JSON.stringify({ findings }));
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12196,7 +13574,7 @@ function createProgram(io = defaultIO) {
       const req = JSON.parse(text);
       io.out(JSON.stringify(await handleMcpRequest2(session, req)));
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12210,7 +13588,7 @@ function createProgram(io = defaultIO) {
       const result = await confirmTarget2(url, { experimental: true, routes: [] });
       io.out(JSON.stringify({ ok: true, confirmations: result.confirmations }));
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12233,7 +13611,7 @@ function createProgram(io = defaultIO) {
       }
       io.out(`static checks passed for ${pkg}; next step would be npm install --ignore-scripts`);
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12253,7 +13631,7 @@ function createProgram(io = defaultIO) {
       });
       io.out(JSON.stringify({ prs: result.prs, stoppedOnTestFailure: result.stoppedOnTestFailure, merged: result.merged }));
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12303,7 +13681,7 @@ function createProgram(io = defaultIO) {
       }
       if (result.findings.some((f) => meetsThreshold(f.severity, "high"))) process.exitCode = 1;
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12317,7 +13695,7 @@ function createProgram(io = defaultIO) {
       io.out(`wrote honeytokens (.env.backup). decoys: /admin.php /.git/config /wp-login.php`);
       io.out(`canary prefix ${canaries.awsKey.slice(0, 4)}****`);
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });
@@ -12335,8 +13713,8 @@ function createProgram(io = defaultIO) {
       let name = "app";
       let version = "0.0.0";
       try {
-        const { readFile: readFile19 } = await import('fs/promises');
-        const pkg = JSON.parse(await readFile19(join(cwd, "package.json"), "utf8"));
+        const { readFile: readFile21 } = await import('fs/promises');
+        const pkg = JSON.parse(await readFile21(join(cwd, "package.json"), "utf8"));
         if (typeof pkg.name === "string") name = pkg.name;
         if (typeof pkg.version === "string") version = pkg.version;
       } catch {
@@ -12353,7 +13731,40 @@ function createProgram(io = defaultIO) {
         io.out(json);
       }
     } catch (error) {
-      io.err(`fullshield: ${error instanceof Error ? error.message : String(error)}`);
+      io.err(formatCliError(error));
+      process.exitCode = 2;
+    }
+  });
+  program.command("diff").description("Experimental comparison of two scan --json files (FULLSHIELD_EXPERIMENTAL_DIFF=1)").argument("<before>", "earlier scan JSON").argument("<after>", "later scan JSON").option("--experimental-diff", "enable this command (FULLSHIELD_EXPERIMENTAL_DIFF=1)").option("--json", "print the machine diff").option("--out <file>", "write the machine diff to this file").option("--fail-on <severity>", "exit 1 when an added finding is at or above this severity", "high").action(
+    async (beforePath, afterPath, opts) => {
+      try {
+        if (opts.experimentalDiff === true) process.env[DIFF_FLAG] = "1";
+        if (!diffEnabled()) throw new Error(`diff requires ${DIFF_FLAG}=1`);
+        const failOn = parseFailOn(opts.failOn ?? "high");
+        let beforeText;
+        let afterText;
+        try {
+          beforeText = await readFile(resolve(beforePath), "utf8");
+          afterText = await readFile(resolve(afterPath), "utf8");
+        } catch {
+          throw new Error("cannot read diff input");
+        }
+        const diff = diffScans(parseScanDocument(beforeText), parseScanDocument(afterText));
+        const json = JSON.stringify(diff, null, 2);
+        if (opts.out !== void 0) await writeFile(resolve(opts.out), json, "utf8");
+        io.out(opts.json === true ? json : renderDiffText(diff));
+        if (addedFails(diff, failOn)) process.exitCode = 1;
+      } catch (error) {
+        io.err(formatCliError(error));
+        process.exitCode = 2;
+      }
+    }
+  );
+  program.command("doctor").description("Report Node, lockfile, cache, flags, config, and whether OSV is offline").argument("[path]", "project directory", ".").option("--offline", "do not describe OSV as allowed to use the network").option("--config <file>", "explicit config file").action(async (path, opts) => {
+    try {
+      io.out(await runDoctor(resolve(path), opts));
+    } catch (error) {
+      io.err(formatCliError(error));
       process.exitCode = 2;
     }
   });