fullshield 0.2.6 → 0.3.0

package/dist/cli/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createHash } from 'crypto';
-import { writeFile, mkdir, readFile, stat, mkdtemp, unlink, readdir } from 'fs/promises';
+import { writeFile, readFile, mkdir, stat, mkdtemp, unlink, readdir } from 'fs/promises';
 import { resolve, join, dirname, relative, basename, posix } from 'path';
 import { readFileSync, existsSync, readdirSync, cpSync, mkdirSync, rmSync, statSync, writeFileSync, mkdtempSync, unlinkSync } from 'fs';
 import { homedir, tmpdir, availableParallelism } from 'os';
@@ -113,7 +113,8 @@ function walk(node, visit) {
   }
 }
 function attachParents(node, parent) {
-  node.parent = parent;
+  const current = node;
+  if (parent !== void 0 || current.parent === void 0) current.parent = parent;
   for (const key of Object.keys(node)) {
     if (SKIP_KEYS.has(String(key))) continue;
     const value = node[key];
@@ -192,8 +193,18 @@ function mcpCfgEnabled() {
 function taintV2Enabled() {
   return process.env.FULLSHIELD_EXPERIMENTAL_TAINT_V2 === "1";
 }
+function licenseEnabled() {
+  return process.env[LICENSE_FLAG] === "1";
+}
+function diffEnabled() {
+  return process.env[DIFF_FLAG] === "1";
+}
+var CI_REPORTS_FLAG, DIFF_FLAG, LICENSE_FLAG;
 var init_experimental = __esm({
   "src/modules/sast/experimental.ts"() {
+    CI_REPORTS_FLAG = "FULLSHIELD_EXPERIMENTAL_CI_REPORTS";
+    DIFF_FLAG = "FULLSHIELD_EXPERIMENTAL_DIFF";
+    LICENSE_FLAG = "FULLSHIELD_EXPERIMENTAL_LICENSE";
   }
 });
 function isSeverity(value) {
@@ -1267,6 +1278,29 @@ function shortestDependencyPath(target, starts, edges) {
   }
   return void 0;
 }
+function collectDependencyPaths(target, starts, edges, limit = 8) {
+  const out = [];
+  const queue = [];
+  let steps = 0;
+  for (const start of starts) queue.push([start]);
+  while (queue.length > 0 && out.length < limit && steps < 4e3) {
+    steps += 1;
+    const path = queue.shift();
+    if (path === void 0) continue;
+    const last = path[path.length - 1];
+    if (last === void 0) continue;
+    if (last === target) {
+      if (path.length >= 2) out.push(path);
+      continue;
+    }
+    if (path.length >= 12) continue;
+    for (const next of edges.get(last) ?? []) {
+      if (path.includes(next)) continue;
+      queue.push([...path, next]);
+    }
+  }
+  return out;
+}
 function reachableFrom(target, roots, edges) {
   if (roots.has(target)) return true;
   return shortestDependencyPath(target, roots, edges) !== void 0;
@@ -1287,9 +1321,10 @@ function classifyReachability(pkgName, productionUsage, graph) {
   }
   if (graph !== void 0 && graph.edgesKnown) {
     const roots = importedDirectNames(productionUsage, graph);
-    const path = shortestDependencyPath(pkgName, roots, graph.edges);
+    const paths = collectDependencyPaths(pkgName, roots, graph.edges);
+    const path = paths[0];
     if (path !== void 0 && path.length >= 2) {
-      return { reachability: "reachable-via-dependency", path };
+      return { reachability: "reachable-via-dependency", path, paths };
     }
     return { reachability: "not-imported" };
   }
@@ -1319,8 +1354,99 @@ function isDevOnly(pkgName, ctx) {
   if (inProd) return false;
   return directDev.has(pkgName) || reachableFrom(pkgName, directDev, edges);
 }
+function versionFromSnippet(snippet) {
+  const name = packageNameFromSnippet(snippet);
+  if (name === void 0) return snippet;
+  return snippet.slice(name.length + 1);
+}
+function pathFields(classified) {
+  const paths = classified.paths ?? (classified.path !== void 0 ? [classified.path] : []);
+  if (paths.length === 0) return {};
+  return {
+    dependencyPath: paths[0],
+    ...paths.length > 1 ? { dependencyPaths: paths } : {}
+  };
+}
+function appendOtherPaths(message, paths) {
+  if (paths === void 0 || paths.length < 2) return message;
+  const rest = paths.slice(1).map((p) => p.join(" > ")).join("; ");
+  return `${message} Other paths: ${rest}.`;
+}
+function groupPackageAdvisories(findings) {
+  const passthrough = [];
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding6 of findings) {
+    if (finding6.ruleId !== "DEPS-VULN-001" && finding6.ruleId !== "DEPS-MALICIOUS-001") {
+      passthrough.push(finding6);
+      continue;
+    }
+    const name = packageNameFromSnippet(finding6.snippet ?? "") ?? finding6.snippet ?? finding6.id;
+    const advisory = finding6.references?.[0] ?? finding6.id;
+    const key = `${finding6.ruleId}\0${name}\0${advisory}`;
+    const list = groups.get(key);
+    if (list === void 0) groups.set(key, [finding6]);
+    else list.push(finding6);
+  }
+  const merged = [];
+  for (const list of groups.values()) {
+    const only = list[0];
+    if (list.length === 1 && only !== void 0) {
+      merged.push(only);
+      continue;
+    }
+    merged.push(mergeAdvisory(list));
+  }
+  return [...passthrough, ...merged];
+}
+function mergeAdvisory(list) {
+  const ranked = [...list].sort(
+    (a, b) => severityRank(b.severity) - severityRank(a.severity) || (REACH_RANK[a.reachability ?? "not-imported"] ?? 9) - (REACH_RANK[b.reachability ?? "not-imported"] ?? 9)
+  );
+  const primary = ranked[0];
+  if (primary === void 0) {
+    throw new Error("empty advisory group");
+  }
+  const name = packageNameFromSnippet(primary.snippet ?? "") ?? "package";
+  const versions = [...new Set(list.map((f) => versionFromSnippet(f.snippet ?? "")))].filter((v) => v.length > 0).sort();
+  const paths = [];
+  const seenPath = /* @__PURE__ */ new Set();
+  for (const finding6 of list) {
+    const candidates = finding6.dependencyPaths ?? (finding6.dependencyPath !== void 0 ? [finding6.dependencyPath] : []);
+    for (const path of candidates) {
+      const key = path.join("\0");
+      if (seenPath.has(key)) continue;
+      seenPath.add(key);
+      paths.push(path);
+    }
+  }
+  paths.sort((a, b) => a.length - b.length || a.join(">").localeCompare(b.join(">")));
+  const advisory = primary.references?.[0] ?? "";
+  const onManifest = list.find((f) => f.file === "package.json");
+  const file = onManifest?.file ?? primary.file;
+  const line = onManifest?.line ?? primary.line;
+  const snippet = versions.length > 0 ? `${name}@${versions.join(",")}` : primary.snippet ?? name;
+  let message = primary.message;
+  if (versions.length > 1) {
+    message = `${message} Versions: ${versions.join(", ")}.`;
+  }
+  if (paths.length > 1) {
+    message = `${message} Dependency paths: ${paths.map((p) => p.join(" > ")).join("; ")}.`;
+  }
+  return {
+    ...primary,
+    id: makeFindingId(primary.ruleId, file, `${name}|${advisory}|${versions.join(",")}`),
+    file,
+    line,
+    snippet,
+    message,
+    severity: primary.severity,
+    reachability: primary.reachability,
+    ...paths[0] !== void 0 ? { dependencyPath: paths[0] } : {},
+    ...paths.length > 1 ? { dependencyPaths: paths } : {}
+  };
+}
 function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
-  return findings.map((finding6) => {
+  const mapped = findings.map((finding6) => {
     if (finding6.ruleId === "DEPS-MALICIOUS-001") {
       if (finding6.snippet === void 0) return finding6;
       const pkg2 = packageNameFromSnippet(finding6.snippet);
@@ -1330,7 +1456,7 @@ function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
         ...finding6,
         severity: "critical",
         reachability: classified2.reachability,
-        ...classified2.path !== void 0 ? { dependencyPath: classified2.path } : {}
+        ...pathFields(classified2)
       };
     }
     if (finding6.ruleId !== "DEPS-VULN-001" || finding6.snippet === void 0) return finding6;
@@ -1340,7 +1466,7 @@ function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
     const named = symbols.get(finding6.id) ?? [];
     if (named.length > 0 && ctx.sources !== void 0) {
       const symbolClass = classifySymbolUse(named, ctx.sources);
-      classified = { reachability: symbolClass, path: classified.path };
+      classified = { reachability: symbolClass, path: classified.path, paths: classified.paths };
     }
     const steps = reachabilitySteps(classified.reachability);
     let severity = steps === 0 ? finding6.severity : downgradeSeverity(finding6.severity, steps);
@@ -1348,6 +1474,7 @@ function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
     if (classified.path !== void 0) {
       const shown = classified.path.join(" > ");
       message = `${message} Reachable via ${shown}.`;
+      message = appendOtherPaths(message, classified.paths);
     }
     const devOnly = isDevOnly(pkg, ctx);
     if (devOnly) {
@@ -1357,16 +1484,27 @@ function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
     return {
       ...finding6,
       reachability: classified.reachability,
-      ...classified.path !== void 0 ? { dependencyPath: classified.path } : {},
+      ...pathFields(classified),
       severity,
       message
     };
   });
+  return groupPackageAdvisories(mapped);
 }
+var REACH_RANK;
 var init_reachability = __esm({
   "src/modules/deps/reachability.ts"() {
     init_finding();
     init_symbol_reachability();
+    REACH_RANK = {
+      reachable: 0,
+      "symbol-reachable": 1,
+      "reachable-via-dependency": 2,
+      "imported-not-called": 3,
+      "symbol-not-called": 4,
+      "reachability-unknown": 5,
+      "not-imported": 6
+    };
   }
 });
 
@@ -3294,6 +3432,62 @@ var init_experimental2 = __esm({
   "src/supply/experimental.ts"() {
   }
 });
+function isCopyleftLicense(license) {
+  return COPYLEFT.test(license);
+}
+function licenseText(value) {
+  if (typeof value === "string") return value;
+  if (typeof value === "object" && value !== null && "type" in value) {
+    const type = value.type;
+    if (typeof type === "string") return type;
+  }
+  return void 0;
+}
+async function readJson(path) {
+  try {
+    return JSON.parse(await readFile(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+async function scanCopyleftLicenses(cwd) {
+  const manifest = await readJson(join(cwd, "package.json"));
+  if (typeof manifest !== "object" || manifest === null) return [];
+  const names = /* @__PURE__ */ new Set();
+  for (const field of ["dependencies", "devDependencies", "optionalDependencies"]) {
+    const block = manifest[field];
+    if (typeof block === "object" && block !== null && !Array.isArray(block)) {
+      for (const name of Object.keys(block)) names.add(name);
+    }
+  }
+  const findings = [];
+  for (const name of names) {
+    const pkg = await readJson(join(cwd, "node_modules", name, "package.json"));
+    if (typeof pkg !== "object" || pkg === null) continue;
+    const license = licenseText(pkg.license);
+    if (license === void 0 || !isCopyleftLicense(license)) continue;
+    findings.push({
+      id: makeFindingId("DEPS-LICENSE-001", "package.json", `${name}|${license}`),
+      ruleId: "DEPS-LICENSE-001",
+      module: "deps",
+      title: `Copyleft dependency ${name}`,
+      severity: "medium",
+      confidence: "high",
+      file: "package.json",
+      snippet: `${name} ${license}`,
+      message: `${name} is licensed ${license}.`,
+      remediation: "Replace the dependency or get a legal review before shipping it in a commercial product."
+    });
+  }
+  return findings;
+}
+var COPYLEFT;
+var init_license = __esm({
+  "src/modules/deps/license.ts"() {
+    init_finding();
+    COPYLEFT = /(?:^|[^\w])(?:AGPL|GPL)(?:-|[^\w]|$)/i;
+  }
+});
 
 // src/fixer/eol.ts
 function detectEol(text) {
@@ -3459,7 +3653,7 @@ function walkJs(dir, out = []) {
   }
   return out;
 }
-function readJson(path) {
+function readJson2(path) {
   return JSON.parse(readFileSync(path, "utf8"));
 }
 function installScriptKeys(scripts) {
@@ -3470,7 +3664,7 @@ function analyzePackageDir(dir) {
   const findings = [];
   const manifestPath = join(dir, "package.json");
   if (!existsSync(manifestPath) || !statSync(manifestPath).isFile()) return findings;
-  const pkg = readJson(manifestPath);
+  const pkg = readJson2(manifestPath);
   const scripts = pkg.scripts ?? {};
   const keys = installScriptKeys(scripts);
   if (keys.length > 0) {
@@ -3520,8 +3714,8 @@ function analyzePackageDir(dir) {
   return findings;
 }
 function diffPackageVersions(oldDir, newDir) {
-  const oldManifest = existsSync(join(oldDir, "package.json")) ? readJson(join(oldDir, "package.json")) : {};
-  const nextManifest = existsSync(join(newDir, "package.json")) ? readJson(join(newDir, "package.json")) : {};
+  const oldManifest = existsSync(join(oldDir, "package.json")) ? readJson2(join(oldDir, "package.json")) : {};
+  const nextManifest = existsSync(join(newDir, "package.json")) ? readJson2(join(newDir, "package.json")) : {};
   const oldScripts = oldManifest.scripts ?? {};
   const nextScripts = nextManifest.scripts ?? {};
   const added = INSTALL_SCRIPT_KEYS.filter((k) => typeof nextScripts[k] === "string" && oldScripts[k] === void 0);
@@ -3562,14 +3756,24 @@ function checkLockfileIntegrity(lock) {
     if (name === "") continue;
     const resolved = entry.resolved;
     if (!resolved) continue;
+    if (entry.integrity === void 0 || entry.integrity.length === 0) {
+      findings.push(
+        finding(
+          "SUPPLY-LOCKINTEGRITY-001",
+          "Lockfile entry has no integrity hash",
+          `${name} resolved without an integrity hash`,
+          "package-lock.json"
+        )
+      );
+    }
     try {
-      const host = new URL(resolved).hostname;
-      if (host !== REGISTRY_HOST) {
+      const url = new URL(resolved);
+      if (url.protocol !== "https:" || url.hostname !== REGISTRY_HOST) {
         findings.push(
           finding(
             "SUPPLY-LOCKURL-001",
             "Lockfile entry resolves from a non-npm registry host",
-            `${name} resolved host ${host}`,
+            `${name} resolved host ${url.hostname || resolved}`,
             "package-lock.json"
           )
         );
@@ -3632,7 +3836,7 @@ function packageSources(dir) {
   let scripts = "";
   if (existsSync(manifestPath) && statSync(manifestPath).isFile()) {
     try {
-      const pkg = readJson(manifestPath);
+      const pkg = readJson2(manifestPath);
       const block = pkg.scripts ?? {};
       scripts = Object.values(block).join("\n");
     } catch {
@@ -3945,6 +4149,8 @@ var init_deps = __esm({
     init_semver();
     init_typosquat();
     init_experimental2();
+    init_experimental();
+    init_license();
     init_phase31();
     LOCKFILE_NAMES = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"];
     MANIFEST_FIELDS2 = ["dependencies", "devDependencies", "optionalDependencies"];
@@ -4026,6 +4232,7 @@ var init_deps = __esm({
           reached = attachOverrideProposals(reached, graph, lockFile, manifestRaw);
           reached.push(...scanInstalledPackages(ctx.cwd, packages));
         }
+        if (licenseEnabled()) reached.push(...await scanCopyleftLicenses(ctx.cwd));
         return reached;
       }
     };
@@ -4939,7 +5146,7 @@ function seedTaintV2(functions, facts, seeds, returners, nameToFn) {
   }
   return changed;
 }
-function analyzeFile(ast, extraReturners = NO_RETURNERS) {
+function analyzeFile(ast, extraReturners2 = NO_RETURNERS) {
   attachParents(ast);
   const facts = /* @__PURE__ */ new WeakMap();
   const functions = [];
@@ -4953,7 +5160,7 @@ function analyzeFile(ast, extraReturners = NO_RETURNERS) {
   }
   const seeds = /* @__PURE__ */ new Map();
   for (const fn of functions) seeds.set(fn, /* @__PURE__ */ new Set());
-  const returners = new Set(extraReturners);
+  const returners = new Set(extraReturners2);
   for (let hop = 0; hop < MAX_TAINT_HOPS; hop += 1) {
     let changed = false;
     facts.set(ast, analyzeScope(ast, [], returners));
@@ -6944,6 +7151,44 @@ var init_injection = __esm({
     PHRASES = [/ignore previous/i, /mark as safe/i, /ai reviewer/i];
   }
 });
+
+// src/runtime/lru.ts
+var LruMap;
+var init_lru = __esm({
+  "src/runtime/lru.ts"() {
+    LruMap = class {
+      constructor(max) {
+        this.max = max;
+        if (max < 1) throw new Error("LruMap max must be >= 1");
+      }
+      max;
+      map = /* @__PURE__ */ new Map();
+      get size() {
+        return this.map.size;
+      }
+      has(key) {
+        return this.map.has(key);
+      }
+      get(key) {
+        if (!this.map.has(key)) return void 0;
+        const value = this.map.get(key);
+        this.map.delete(key);
+        this.map.set(key, value);
+        return value;
+      }
+      set(key, value) {
+        if (this.map.has(key)) this.map.delete(key);
+        this.map.set(key, value);
+        while (this.map.size > this.max) {
+          const oldest = this.map.keys().next().value;
+          if (oldest === void 0) break;
+          this.map.delete(oldest);
+        }
+        return this;
+      }
+    };
+  }
+});
 function packageVersion() {
   let dir = dirname(fileURLToPath(import.meta.url));
   for (let depth = 0; depth < 6; depth += 1) {
@@ -6972,9 +7217,15 @@ function parsePoolSize() {
   const raw = process.env.FULLSHIELD_PARSE_WORKERS;
   if (raw !== void 0 && raw !== "") {
     const parsed = Number(raw);
-    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.min(4, Math.floor(parsed));
   }
-  return Math.max(1, availableParallelism() - 1);
+  return Math.min(2, Math.max(1, availableParallelism() - 1));
+}
+function workerMemoryMb() {
+  const raw = process.env.FULLSHIELD_PARSE_WORKER_MB;
+  const parsed = raw !== void 0 && raw !== "" ? Number(raw) : 512;
+  if (Number.isFinite(parsed) && parsed >= 64) return Math.floor(parsed);
+  return 512;
 }
 function parseCacheKey(code) {
   return createHash("sha256").update(packageVersion()).update("\0").update(code).digest("hex");
@@ -6984,12 +7235,37 @@ function parseOne(code) {
   const hit = cache.get(key);
   if (hit !== void 0) return Promise.resolve(hit);
   return new Promise((resolve8, reject) => {
-    const worker = new Worker(fileURLToPath(workerUrl), { workerData: { code } });
-    worker.once("message", (ast) => {
+    const worker = new Worker(fileURLToPath(workerUrl), {
+      workerData: { code },
+      resourceLimits: { maxOldGenerationSizeMb: workerMemoryMb() }
+    });
+    let settled = false;
+    const finish = () => {
+      void worker.terminate();
+    };
+    const succeed = (ast) => {
+      if (settled) return;
+      settled = true;
       cache.set(key, ast);
+      finish();
       resolve8(ast);
+    };
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      finish();
+      reject(error);
+    };
+    worker.once("message", (ast) => {
+      succeed(ast);
+    });
+    worker.once("error", (error) => {
+      fail(error);
+    });
+    worker.once("exit", (code2) => {
+      if (settled) return;
+      fail(new Error(`parse worker exited ${code2 ?? "null"}`));
     });
-    worker.once("error", reject);
   });
 }
 async function parseWithPool(codes) {
@@ -7013,9 +7289,10 @@ async function parseWithPool(codes) {
 var workerUrl, cache;
 var init_parse_pool = __esm({
   "src/core/parse-pool.ts"() {
+    init_lru();
     init_version();
     workerUrl = new URL("./parse-worker.mjs", import.meta.url);
-    cache = /* @__PURE__ */ new Map();
+    cache = new LruMap(64);
   }
 });
 async function parseSource(code) {
@@ -7033,8 +7310,8 @@ function snippetOf(source, node) {
   if (node.range === void 0) return "";
   return source.slice(node.range[0], node.range[1]).replace(/\s+/g, " ").trim().slice(0, 120);
 }
-function findingsFromAst(filename, source, ast, extraReturners = /* @__PURE__ */ new Set(), projectCsrfProtected = false) {
-  const facts = analyzeFile(ast, extraReturners);
+function findingsFromAst(filename, source, ast, extraReturners2 = /* @__PURE__ */ new Set(), projectCsrfProtected = false) {
+  const facts = analyzeFile(ast, extraReturners2);
   const findings = [];
   for (const rule of sastRules) {
     const ctx = {
@@ -7112,6 +7389,158 @@ function findingsFromTemplate(filename, source) {
   xssRule.create(ctx);
   return findings;
 }
+function dedupeSastSinks(findings) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const finding6 of findings) {
+    if (finding6.module !== "sast" || finding6.line === void 0) {
+      out.push(finding6);
+      continue;
+    }
+    const key = `${finding6.ruleId}\0${finding6.file ?? ""}\0${finding6.line}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(finding6);
+  }
+  return out;
+}
+function sastStreamThreshold() {
+  const raw = process.env.FULLSHIELD_SAST_STREAM_AT;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
+  }
+  return 4e3;
+}
+function sastBatchSize() {
+  const raw = process.env.FULLSHIELD_SAST_BATCH;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
+  }
+  return 150;
+}
+function skipFinding(rel, message) {
+  return {
+    id: makeFindingId("SAST-SKIP-001", rel, message),
+    ruleId: "SAST-SKIP-001",
+    module: "sast",
+    title: "File skipped by SAST",
+    severity: "info",
+    confidence: "high",
+    file: rel,
+    message,
+    remediation: "Raise sast.maxFileBytes in fullshield.config.json to parse this file, or leave it skipped."
+  };
+}
+function skipReason(source, maxBytes) {
+  if (source.includes("\0")) return "it contains NUL bytes";
+  const bytes = Buffer.byteLength(source);
+  if (bytes > maxBytes) return `${bytes} bytes exceeds the SAST parse limit of ${maxBytes} bytes`;
+  return void 0;
+}
+async function readScanSource(cwd, rel) {
+  try {
+    return await readFile(join(cwd, rel), "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function cloneAst(value) {
+  if (value === null || typeof value !== "object") return void 0;
+  try {
+    return structuredClone(value);
+  } catch {
+    return void 0;
+  }
+}
+async function parseInProcess(source) {
+  try {
+    return await parseSource(source);
+  } catch {
+    return void 0;
+  }
+}
+async function parseCode(source) {
+  if (!parsePoolEnabled()) return parseInProcess(source);
+  try {
+    const cloned = cloneAst((await parseWithPool([source]))[0]);
+    if (cloned !== void 0) return cloned;
+  } catch {
+  }
+  return parseInProcess(source);
+}
+function releaseParsed(parsed) {
+  for (const entry of parsed) {
+    entry.source = "";
+    entry.ast = void 0;
+  }
+  parsed.length = 0;
+}
+function extraReturners(rel, ast, files, returning) {
+  const ns = collectRequires(rel, ast, files);
+  const extra = new Set(returning.get(rel));
+  for (const [local, spec] of ns) {
+    const hash = spec.indexOf("#");
+    const file = hash >= 0 ? spec.slice(0, hash) : spec;
+    const exp = hash >= 0 ? spec.slice(hash + 1) : local;
+    if (returning.get(file)?.has(exp)) extra.add(local);
+  }
+  return extra;
+}
+async function runSastStreaming(ctx) {
+  const maxBytes = ctx.config.sast.maxFileBytes;
+  const findings = [];
+  const returning = /* @__PURE__ */ new Map();
+  const parseable = [];
+  const fileSet = /* @__PURE__ */ new Set();
+  let projectCsrf = false;
+  for (const rel of ctx.files) {
+    const isSource = SOURCE_EXT.test(rel);
+    const isTemplate = TEMPLATE_EXT.test(rel);
+    if (!isSource && !isTemplate) continue;
+    const source = await readScanSource(ctx.cwd, rel);
+    if (source === void 0) continue;
+    const why = skipReason(source, maxBytes);
+    if (why !== void 0) {
+      findings.push(skipFinding(rel, `Skipped ${rel}: ${why}.`));
+      continue;
+    }
+    if (sourceHasCsrfGuard(source)) projectCsrf = true;
+    if (isTemplate) {
+      findings.push(...findingsFromTemplate(rel, source));
+      continue;
+    }
+    const ast = await parseCode(source);
+    if (ast === void 0) continue;
+    returning.set(rel, functionsThatReturnTaint(ast));
+    parseable.push(rel);
+    fileSet.add(rel);
+  }
+  for (const rel of parseable) {
+    const source = await readScanSource(ctx.cwd, rel);
+    if (source === void 0) continue;
+    const ast = await parseCode(source);
+    if (ast === void 0) continue;
+    findings.push(
+      ...findingsFromAst(rel, source, ast, extraReturners(rel, ast, fileSet, returning), projectCsrf)
+    );
+  }
+  const batch = sastBatchSize();
+  for (let i = 0; i < parseable.length; i += batch) {
+    const parsed = [];
+    for (const rel of parseable.slice(i, i + batch)) {
+      const source = await readScanSource(ctx.cwd, rel);
+      if (source === void 0) continue;
+      const ast = await parseCode(source);
+      if (ast === void 0) continue;
+      parsed.push({ file: rel, source, ast });
+    }
+    findings.push(...runInterproc(parsed));
+    releaseParsed(parsed);
+  }
+  return dedupeSastSinks(findings);
+}
 var sastRules, SOURCE_EXT, sastModule;
 var init_engine = __esm({
   "src/modules/sast/engine.ts"() {
@@ -7153,49 +7582,48 @@ var init_engine = __esm({
     sastModule = {
       name: "sast",
       async run(ctx) {
+        const candidates = ctx.files.filter((rel) => SOURCE_EXT.test(rel) || TEMPLATE_EXT.test(rel));
+        if (candidates.length > sastStreamThreshold()) return runSastStreaming(ctx);
+        const maxBytes = ctx.config.sast.maxFileBytes;
         const findings = [];
         const parsed = [];
-        for (const rel of ctx.files) {
-          const isSource = SOURCE_EXT.test(rel);
-          const isTemplate = TEMPLATE_EXT.test(rel);
-          if (!isSource && !isTemplate) continue;
-          let source;
-          try {
-            source = await readFile(join(ctx.cwd, rel), "utf8");
-          } catch {
+        for (const rel of candidates) {
+          const source = await readScanSource(ctx.cwd, rel);
+          if (source === void 0) continue;
+          const why = skipReason(source, maxBytes);
+          if (why !== void 0) {
+            findings.push(skipFinding(rel, `Skipped ${rel}: ${why}.`));
             continue;
           }
-          if (source.length > 1024 * 1024 || source.includes("\0")) continue;
-          if (isTemplate) {
+          if (TEMPLATE_EXT.test(rel)) {
             findings.push(...findingsFromTemplate(rel, source));
             continue;
           }
-          try {
-            const ast = parsePoolEnabled() ? (await parseWithPool([source]))[0] : await parseSource(source);
-            if (ast === void 0) continue;
-            parsed.push({ file: rel, source, ast });
-          } catch {
-          }
+          const ast = await parseCode(source);
+          if (ast === void 0) continue;
+          parsed.push({ file: rel, source, ast });
         }
         const files = new Set(parsed.map((p) => p.file));
         const projectCsrf = parsed.some((p) => sourceHasCsrfGuard(p.source));
         const returning = /* @__PURE__ */ new Map();
-        for (const p of parsed) {
-          returning.set(p.file, functionsThatReturnTaint(p.ast));
+        for (const entry of parsed) {
+          returning.set(entry.file, functionsThatReturnTaint(entry.ast));
         }
-        for (const p of parsed) {
-          const ns = collectRequires(p.file, p.ast, files);
-          const extra = new Set(returning.get(p.file));
-          for (const [local, spec] of ns) {
-            const hash = spec.indexOf("#");
-            const file = hash >= 0 ? spec.slice(0, hash) : spec;
-            const exp = hash >= 0 ? spec.slice(hash + 1) : local;
-            if (returning.get(file)?.has(exp)) extra.add(local);
-          }
-          findings.push(...findingsFromAst(p.file, p.source, p.ast, extra, projectCsrf));
+        for (const entry of parsed) {
+          findings.push(
+            ...findingsFromAst(
+              entry.file,
+              entry.source,
+              entry.ast,
+              extraReturners(entry.file, entry.ast, files, returning),
+              projectCsrf
+            )
+          );
         }
         findings.push(...runInterproc(parsed));
-        return findings;
+        const out = dedupeSastSinks(findings);
+        releaseParsed(parsed);
+        return out;
       }
     };
   }
@@ -8121,16 +8549,37 @@ var init_provider = __esm({
     FIXTURE_COST = 0.01;
   }
 });
+function isIsoDate(value) {
+  if (!/^\d{4}-\d{2}-\d{2}(T[\d:.+\-Z]+)?$/.test(value)) return false;
+  return Number.isFinite(Date.parse(value));
+}
+function expiresAtMs(expires) {
+  if (/^\d{4}-\d{2}-\d{2}$/.test(expires)) return Date.parse(`${expires}T23:59:59.999Z`);
+  return Date.parse(expires);
+}
+function validSuppression(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const row = value;
+  if (typeof row.ruleId !== "string" || row.ruleId.length === 0) return void 0;
+  if (typeof row.owner !== "string" || row.owner.length === 0) return void 0;
+  if (typeof row.reason !== "string" || row.reason.length === 0) return void 0;
+  if (typeof row.expires !== "string" || !isIsoDate(row.expires)) return void 0;
+  const file = row.file === void 0 ? void 0 : row.file.replace(/\\/g, "/");
+  if (row.file !== void 0 && (typeof row.file !== "string" || row.file.length === 0)) return void 0;
+  return { ruleId: row.ruleId, file, owner: row.owner, reason: row.reason, expires: row.expires };
+}
 async function readBaseline(path) {
   try {
     const raw = JSON.parse(await readFile(path, "utf8"));
     if (raw.version !== 1 || !Array.isArray(raw.findings)) return void 0;
+    if (raw.suppressions !== void 0 && !Array.isArray(raw.suppressions)) return void 0;
     return raw;
   } catch {
     return void 0;
   }
 }
 async function writeBaseline(path, findings) {
+  const existing = await readBaseline(path);
   const doc = {
     version: 1,
     findings: findings.map((f) => ({
@@ -8138,7 +8587,8 @@ async function writeBaseline(path, findings) {
       ruleId: f.ruleId,
       file: f.file,
       line: f.line
-    }))
+    })),
+    ...existing?.suppressions !== void 0 ? { suppressions: existing.suppressions } : {}
   };
   await writeFile(path, `${JSON.stringify(doc, null, 2)}
 `, "utf8");
@@ -8148,6 +8598,30 @@ function applyBaseline(findings, baseline) {
   const known = new Set(baseline.findings.map((f) => f.id));
   return findings.filter((f) => !known.has(f.id));
 }
+function applySuppressions(findings, rows, now = /* @__PURE__ */ new Date()) {
+  if (rows === void 0 || rows.length === 0) return { findings: [...findings], errors: [] };
+  const errors = [];
+  const active = [];
+  rows.forEach((row, index) => {
+    const parsed = validSuppression(row);
+    if (parsed === void 0) {
+      errors.push(`suppression ${index + 1} needs ruleId, owner, reason, and an ISO expires date`);
+      return;
+    }
+    if (expiresAtMs(parsed.expires) < now.getTime()) {
+      errors.push(
+        `suppression for ${parsed.ruleId} expired on ${parsed.expires} (owner: ${parsed.owner}); renew or remove it`
+      );
+      return;
+    }
+    active.push(parsed);
+  });
+  const kept = findings.filter((finding6) => {
+    const file = (finding6.file ?? "").replace(/\\/g, "/");
+    return !active.some((row) => row.ruleId === finding6.ruleId && (row.file === void 0 || row.file === file));
+  });
+  return { findings: kept, errors };
+}
 var init_baseline = __esm({
   "src/core/baseline.ts"() {
   }
@@ -8253,6 +8727,32 @@ function validate(raw, source) {
     }
     out.ai = ai;
   }
+  if (record.defaultExcludes !== void 0) {
+    if (typeof record.defaultExcludes !== "boolean") {
+      throw new ConfigError(`${source}: "defaultExcludes" must be a boolean`);
+    }
+    out.defaultExcludes = record.defaultExcludes;
+  }
+  if (record.excludes !== void 0) {
+    if (!Array.isArray(record.excludes) || record.excludes.some((p) => typeof p !== "string")) {
+      throw new ConfigError(`${source}: "excludes" must be an array of glob strings`);
+    }
+    out.excludes = record.excludes;
+  }
+  if (record.sast !== void 0) {
+    if (typeof record.sast !== "object" || record.sast === null || Array.isArray(record.sast)) {
+      throw new ConfigError(`${source}: "sast" must be an object`);
+    }
+    const rawSast = record.sast;
+    const sast = { maxFileBytes: 1024 * 1024 };
+    if (rawSast.maxFileBytes !== void 0) {
+      if (typeof rawSast.maxFileBytes !== "number" || rawSast.maxFileBytes < 1) {
+        throw new ConfigError(`${source}: "sast.maxFileBytes" must be a positive number`);
+      }
+      sast.maxFileBytes = rawSast.maxFileBytes;
+    }
+    out.sast = sast;
+  }
   return out;
 }
 async function loadConfig(cwd, configPath) {
@@ -8287,19 +8787,35 @@ var init_config2 = __esm({
       modules: [...MODULE_NAMES],
       failOn: "high",
       ignore: ["dist/**", "**/*.test.ts"],
+      defaultExcludes: true,
       baseline: ".fullshield-baseline.json",
       notify: { slackWebhookEnv: "FULLSHIELD_SLACK_WEBHOOK" },
       deps: { offline: false },
-      ai: { enabled: false, maxCostUsd: 1, maxFindings: 50 }
+      ai: { enabled: false, maxCostUsd: 1, maxFindings: 50 },
+      sast: { maxFileBytes: 1024 * 1024 }
     };
     ConfigError = class extends Error {
     };
-    KNOWN_KEYS = /* @__PURE__ */ new Set(["modules", "failOn", "ignore", "baseline", "notify", "deps", "ai"]);
+    KNOWN_KEYS = /* @__PURE__ */ new Set([
+      "modules",
+      "failOn",
+      "ignore",
+      "defaultExcludes",
+      "excludes",
+      "baseline",
+      "notify",
+      "deps",
+      "ai",
+      "sast"
+    ]);
   }
 });
 async function walkFiles(options) {
   const ig = ignoreFactory();
-  ig.add(ALWAYS_IGNORED);
+  ig.add(HARD_IGNORED);
+  if (options.defaultExcludes !== false) {
+    ig.add(options.excludes ?? DEFAULT_EXCLUDES);
+  }
   try {
     ig.add(await readFile(join(options.cwd, ".gitignore"), "utf8"));
   } catch {
@@ -8325,11 +8841,24 @@ async function walkFiles(options) {
   await walk5("");
   return files.sort();
 }
-var ignoreFactory, ALWAYS_IGNORED;
+var ignoreFactory, HARD_IGNORED, DEFAULT_EXCLUDES;
 var init_fileWalker = __esm({
   "src/core/fileWalker.ts"() {
     ignoreFactory = ignoreModule.default;
-    ALWAYS_IGNORED = [".git/", "node_modules/", ".fullshield/"];
+    HARD_IGNORED = [".git/", ".fullshield/"];
+    DEFAULT_EXCLUDES = [
+      "node_modules/",
+      "dist/",
+      "build/",
+      ".next/",
+      "coverage/",
+      "vendor/",
+      "vendored/",
+      "third_party/",
+      "third-party/",
+      "compiled/",
+      "*.min.js"
+    ];
   }
 });
 async function listStagedFiles(cwd) {
@@ -8543,7 +9072,7 @@ function resolvePolicyBranch(cwd, env = process.env) {
     return "*";
   }
 }
-function expiresAtMs(expires) {
+function expiresAtMs2(expires) {
   if (/^\d{4}-\d{2}-\d{2}$/.test(expires)) {
     return Date.parse(`${expires}T23:59:59.999Z`);
   }
@@ -8565,7 +9094,7 @@ function applyPolicy(findings, policy, ctx = {}) {
   });
   const suppressed = /* @__PURE__ */ new Set();
   for (const exception of policy.exceptions ?? []) {
-    if (expiresAtMs(exception.expires) < now.getTime()) {
+    if (expiresAtMs2(exception.expires) < now.getTime()) {
       errors.push(
         `policy exception for ${exception.ruleId} expired on ${exception.expires} (owner: ${exception.owner}); renew or remove it`
       );
@@ -8634,6 +9163,7 @@ var init_incremental = __esm({
 // src/modules/secrets/history.ts
 var history_exports = {};
 __export(history_exports, {
+  historyCommitLimit: () => historyCommitLimit,
   scanGitHistory: () => scanGitHistory
 });
 function gitError(error) {
@@ -8676,7 +9206,13 @@ function remapHit(hit, file) {
     secret: hit.secret
   };
 }
-async function streamLogChanges(cwd) {
+function historyCommitLimit(raw = process.env.FULLSHIELD_HISTORY_MAX) {
+  if (raw === void 0 || raw.trim() === "") return 500;
+  const parsed = Number(raw);
+  if (!Number.isInteger(parsed) || parsed < 1) return 500;
+  return Math.min(parsed, 5e3);
+}
+async function streamLogChanges(cwd, maxCommits) {
   const changes = [];
   await gitOk(cwd, ["rev-parse", "--is-inside-work-tree"]);
   const child = spawn(
@@ -8693,6 +9229,8 @@ async function streamLogChanges(cwd) {
       "--format=FSCOMMIT:%H",
       "--no-textconv",
       "--no-ext-diff",
+      "-n",
+      String(maxCommits),
       "HEAD"
     ],
     { stdio: ["ignore", "pipe", "pipe"] }
@@ -8761,8 +9299,14 @@ async function headSecretKeys(cwd) {
   }
   return keys;
 }
-async function scanGitHistory(cwd) {
-  const changes = await streamLogChanges(cwd);
+async function commitCount(cwd) {
+  const raw = await gitOk(cwd, ["rev-list", "--count", "HEAD"]);
+  const total = Number(raw.trim());
+  return Number.isInteger(total) && total >= 0 ? total : 0;
+}
+async function scanGitHistory(cwd, maxCommits = historyCommitLimit()) {
+  const total = await commitCount(cwd);
+  const changes = await streamLogChanges(cwd, maxCommits);
   const blobHits = /* @__PURE__ */ new Map();
   const first = /* @__PURE__ */ new Map();
   for (const change of changes) {
@@ -8799,7 +9343,13 @@ async function scanGitHistory(cwd) {
       secret: hit.secret
     });
   }
-  return { findings: hits.map((h) => h.finding), hits };
+  const scanned = Math.min(maxCommits, total);
+  const history = total > maxCommits ? `scanned ${scanned} of ${total} commits` : void 0;
+  return {
+    findings: hits.map((h) => h.finding),
+    hits,
+    ...history !== void 0 ? { history } : {}
+  };
 }
 var execFileAsync2, ZERO_HASH, MAX_BLOB, RAW_LINE;
 var init_history = __esm({
@@ -9094,7 +9644,12 @@ async function runScan(options = {}, modules = builtinModules) {
     options.modules ?? config.modules,
     loadedPolicy?.requiredModules
   );
-  let files = await walkFiles({ cwd, ignore: config.ignore });
+  let files = await walkFiles({
+    cwd,
+    ignore: config.ignore,
+    defaultExcludes: config.defaultExcludes,
+    excludes: config.excludes
+  });
   if (options.staged === true) {
     const staged = new Set(await listStagedFiles(cwd));
     files = files.filter((file) => staged.has(file));
@@ -9128,6 +9683,7 @@ async function runScan(options = {}, modules = builtinModules) {
     );
   }
   const extraHits = [];
+  let historyNotice;
   const secretsWanted = modulesRequested.includes("secrets");
   if (secretsAdvEnabled() && secretsWanted) {
     if (options.history === true) {
@@ -9135,6 +9691,7 @@ async function runScan(options = {}, modules = builtinModules) {
       const hist = await scanGitHistory2(cwd);
       extraHits.push(...hist.hits);
       collected.push(...hist.findings);
+      historyNotice = hist.history;
     }
     if (options.bundle !== void 0 && options.bundle.length > 0) {
       const { scanBundle: scanBundle2 } = await Promise.resolve().then(() => (init_bundle(), bundle_exports));
@@ -9155,7 +9712,11 @@ async function runScan(options = {}, modules = builtinModules) {
   if (options.updateBaseline === true) {
     await writeBaseline(baselinePath, unsuppressed);
   }
-  let findings = sortFindings(applyBaseline(unsuppressed, await readBaseline(baselinePath)));
+  const baselineDoc = await readBaseline(baselinePath);
+  let findings = sortFindings(applyBaseline(unsuppressed, baselineDoc));
+  const suppressed = applySuppressions(findings, baselineDoc?.suppressions);
+  findings = sortFindings(suppressed.findings);
+  const suppressionErrors = suppressed.errors;
   if (secretsAdvEnabled() && secretsWanted && options.verifySecrets === true && options.iOwnTheseCredentials === true) {
     const { applyVerification: applyVerification2 } = await Promise.resolve().then(() => (init_verify(), verify_exports));
     const { scanTextForSecretHits: scanTextForSecretHits2 } = await Promise.resolve().then(() => (init_secrets(), secrets_exports));
@@ -9227,10 +9788,12 @@ async function runScan(options = {}, modules = builtinModules) {
       cwd,
       filesScanned: files.length,
       modulesRequested: [...modulesRequested],
-      modulesRun
+      modulesRun,
+      ...historyNotice !== void 0 ? { history: historyNotice } : {}
     },
     config,
-    policy: policyResult
+    policy: policyResult,
+    ...suppressionErrors.length > 0 ? { suppressionErrors } : {}
   };
 }
 function scan(options = {}) {
@@ -9546,6 +10109,32 @@ function finding4(ruleId, title, message, file, severity = "high") {
     remediation: "Pin actions by SHA, drop pull_request_target, tighten permissions, close 0.0.0.0/0, encrypt storage, drop privileged."
   };
 }
+function runBodies(text) {
+  const bodies = [];
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i += 1) {
+    const match = /^(\s*)(?:-\s+)?run:\s*(.*)$/.exec(lines[i] ?? "");
+    if (match === null) continue;
+    const indent = match[1]?.length ?? 0;
+    let body = match[2] ?? "";
+    if (body === "|" || body === ">") {
+      const block = [];
+      for (let j = i + 1; j < lines.length; j += 1) {
+        const line = lines[j] ?? "";
+        if (line.trim() === "") {
+          block.push(line);
+          continue;
+        }
+        const lead = line.match(/^\s*/)?.[0].length ?? 0;
+        if (lead <= indent) break;
+        block.push(line);
+      }
+      body = block.join("\n");
+    }
+    bodies.push(body);
+  }
+  return bodies;
+}
 function walk3(dir, out = []) {
   if (!existsSync(dir)) return out;
   for (const entry of readdirSync(dir, { withFileTypes: true })) {
@@ -9573,6 +10162,28 @@ function scanIac(dir, opts = {}) {
       if (/pull_request_target/.test(text)) {
         findings.push(finding4("IAC-GHA-PRTARGET-001", "pull_request_target workflow", "untrusted PR can run with base secrets", rel, "critical"));
       }
+      if (/pull_request_target/.test(text) && /actions\/checkout/.test(text) && /github\.event\.pull_request/.test(text)) {
+        findings.push(
+          finding4(
+            "IAC-GHA-PRCHECKOUT-001",
+            "pull_request_target checks out pull-request code",
+            "untrusted head can run with the base repository token",
+            rel,
+            "critical"
+          )
+        );
+      }
+      if (runBodies(text).some((body) => /\$\{\{\s*github\.event\./.test(body))) {
+        findings.push(
+          finding4(
+            "IAC-GHA-INJECT-001",
+            "Workflow run step interpolates github.event",
+            "untrusted event text is passed to the shell",
+            rel,
+            "critical"
+          )
+        );
+      }
       if (/permissions:\s*\n\s+contents:\s*write/.test(text) || /permissions:\s+write-all/.test(text)) {
         findings.push(finding4("IAC-GHA-PERMS-001", "Overly broad GitHub Actions permissions", "write-all or contents: write", rel));
       }
@@ -9723,6 +10334,7 @@ var init_compliance = __esm({
       ROW("SUPPLY-BEHAVIOR-001", "A06:2021 Vulnerable Components", "CWE-829", "V14.2.1", "PCI DSS 6.3.3"),
       ROW("SUPPLY-COOLDOWN-001", "A06:2021 Vulnerable Components", "CWE-1104", "V14.2.1", "PCI DSS 6.3.3"),
       ROW("SUPPLY-LOCKURL-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
+      ROW("SUPPLY-LOCKINTEGRITY-001", "A08:2021 Integrity Failures", "CWE-353", "V14.2.3", "PCI DSS 6.3.3"),
       ROW("SUPPLY-CONFUSION-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
       ROW("SUPPLY-PROVENANCE-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
       ROW("SUPPLY-WORM-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 6.3.3 / 12.10"),
@@ -9731,6 +10343,9 @@ var init_compliance = __esm({
       ROW("IAC-GHA-PRTARGET-001", "A01:2021 Broken Access Control", "CWE-269", "V4.1.1", "PCI DSS 7.2"),
       ROW("IAC-GHA-PERMS-001", "A01:2021 Broken Access Control", "CWE-250", "V4.1.1", "PCI DSS 7.2"),
       ROW("IAC-GHA-SECRETLOG-001", "A09:2021 Security Logging Failures", "CWE-532", "V7.1.1", "PCI DSS 3.2 / 10.2"),
+      ROW("IAC-GHA-INJECT-001", "A03:2021 Injection", "CWE-94", "V5.2.4", "PCI DSS 6.2.4"),
+      ROW("IAC-GHA-PRCHECKOUT-001", "A01:2021 Broken Access Control", "CWE-829", "V4.1.1", "PCI DSS 6.2.4"),
+      ROW("DEPS-LICENSE-001", "A06:2021 Vulnerable Components", "CWE-1104", "V14.2.1", "PCI DSS 6.3.3"),
       ROW("IAC-TF-S3PUBLIC-001", "A01:2021 Broken Access Control", "CWE-284", "V12.1.1", "PCI DSS 1.3 / 3.2"),
       ROW("IAC-TF-SGOPEN-001", "A05:2021 Security Misconfiguration", "CWE-284", "V1.4.1", "PCI DSS 1.2 / 1.3"),
       ROW("IAC-TF-UNENCRYPTED-001", "A02:2021 Cryptographic Failures", "CWE-311", "V6.2.1", "PCI DSS 3.4 / 4.2"),
@@ -9757,6 +10372,7 @@ var init_compliance = __esm({
       ROW("SAST-TIMING-001", "A07:2021 Identification Failures", "CWE-208", "V2.10.3", "PCI DSS 8.3"),
       ROW("SAST-HASH-001", "A02:2021 Cryptographic Failures", "CWE-916", "V6.2.2", "PCI DSS 8.3.1"),
       ROW("SAST-GQL-001", "A04:2021 Insecure Design", "CWE-770/200", "V13.1.1", "PCI DSS 6.2.4"),
+      ROW("SAST-SKIP-001", "A05:2021 Security Misconfiguration", "CWE-693", "V1.1.1", "PCI DSS 6.2.4"),
       ROW("CONFIG-TRUSTPROXY-001", "A07:2021 Identification Failures", "CWE-290", "V2.2.1", "PCI DSS 8.3.4"),
       ROW("SECRET-BUNDLE-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 3.2 / 8.3"),
       ROW("DLP-SECRET-001", "A02:2021 Cryptographic Failures", "CWE-200", "V8.3.4", "PCI DSS 3.2 / 8.3"),
@@ -9776,6 +10392,23 @@ var init_compliance = __esm({
     byId = new Map(RULE_MAP.map((r) => [r.ruleId, r]));
   }
 });
+function nodeSqliteAvailable() {
+  try {
+    require2("node:sqlite");
+    return true;
+  } catch {
+    return false;
+  }
+}
+function nodeSqliteUnavailableMessage(feature) {
+  return `${feature} requires Node 22.13+ (node:sqlite is not available on Node ${process.versions.node})`;
+}
+var require2;
+var init_sqlite = __esm({
+  "src/core/sqlite.ts"() {
+    require2 = createRequire(import.meta.url);
+  }
+});
 
 // src/dashboard/index.ts
 var dashboard_exports = {};
@@ -9789,7 +10422,7 @@ __export(dashboard_exports, {
   startDashboard: () => startDashboard
 });
 function sqliteDb(file) {
-  const { DatabaseSync } = require2("node:sqlite");
+  const { DatabaseSync } = require3("node:sqlite");
   let db;
   try {
     db = new DatabaseSync(file);
@@ -9840,6 +10473,9 @@ function sqliteDb(file) {
   };
 }
 function openHistory(dir) {
+  if (!nodeSqliteAvailable()) {
+    throw new Error(nodeSqliteUnavailableMessage("history"));
+  }
   const root = join(dir, ".fullshield");
   mkdirSync(root, { recursive: true });
   return sqliteDb(join(root, "history.db"));
@@ -9941,10 +10577,11 @@ function startDashboard(opts) {
     });
   });
 }
-var require2;
+var require3;
 var init_dashboard = __esm({
   "src/dashboard/index.ts"() {
-    require2 = createRequire(import.meta.url);
+    init_sqlite();
+    require3 = createRequire(import.meta.url);
   }
 });
 function finding5(ruleId, title, message, file, severity = "high") {
@@ -11169,6 +11806,153 @@ ${target.message}`
 // src/cli/program.ts
 init_version();
 
+// src/core/fingerprint.ts
+init_finding();
+function lineIndependentFingerprint(finding6) {
+  const file = (finding6.file ?? "").replace(/\\/g, "/");
+  const text = (finding6.snippet ?? finding6.message ?? "").replace(/\s+/g, " ").trim();
+  return makeFindingId(finding6.ruleId, file, `${finding6.severity}\0${text}`);
+}
+
+// src/reporters/ci.ts
+init_finding();
+
+// src/reporters/redact.ts
+init_mask();
+var SECRET = /\b(?:AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk_live_[A-Za-z0-9]{10,}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g;
+function redactSecrets2(text) {
+  return text.replace(SECRET, (match) => maskSecret(match));
+}
+function redactFinding(finding6) {
+  return {
+    ...finding6,
+    title: redactSecrets2(finding6.title),
+    message: redactSecrets2(finding6.message),
+    remediation: redactSecrets2(finding6.remediation),
+    snippet: finding6.snippet === void 0 ? void 0 : redactSecrets2(finding6.snippet)
+  };
+}
+function redactScan(result) {
+  return { ...result, findings: result.findings.map(redactFinding) };
+}
+
+// src/reporters/ci.ts
+var MESSAGE_CAP = 4e3;
+function posix2(file) {
+  return file.replace(/\\/g, "/");
+}
+function clip(text) {
+  return text.length <= MESSAGE_CAP ? text : `${text.slice(0, MESSAGE_CAP)}\u2026`;
+}
+function githubEscape(value, property) {
+  let out = value.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A").replace(/:/g, "%3A");
+  if (property) out = out.replace(/,/g, "%2C");
+  return out;
+}
+function githubLevel(severity) {
+  if (severity === "critical" || severity === "high") return "error";
+  if (severity === "medium") return "warning";
+  return "notice";
+}
+function gitlabSeverity(severity) {
+  if (severity === "info") return "info";
+  if (severity === "low") return "minor";
+  if (severity === "medium") return "major";
+  if (severity === "high") return "critical";
+  return "blocker";
+}
+function xmlEscape(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function oneLine(value) {
+  return value.replace(/\s+/g, " ").trim();
+}
+function renderGithubAnnotations(input) {
+  const result = redactScan(input);
+  if (result.findings.length === 0) {
+    return "::notice title=FullShield::No findings\n";
+  }
+  const lines = result.findings.map((finding6) => {
+    const props = [];
+    if (finding6.file !== void 0) props.push(`file=${githubEscape(posix2(finding6.file), true)}`);
+    if (finding6.line !== void 0) props.push(`line=${finding6.line}`);
+    if (finding6.column !== void 0) props.push(`col=${finding6.column + 1}`);
+    props.push(`title=${githubEscape(finding6.ruleId, true)}`);
+    const message = githubEscape(clip(finding6.message), false);
+    return `::${githubLevel(finding6.severity)} ${props.join(",")}::${message}`;
+  });
+  return `${lines.join("\n")}
+`;
+}
+function junitCase(finding6) {
+  const file = finding6.file !== void 0 ? posix2(finding6.file) : "fullshield";
+  const attrs = [
+    `name="${xmlEscape(finding6.ruleId)}"`,
+    `classname="${xmlEscape(file)}"`,
+    `file="${xmlEscape(file)}"`
+  ];
+  if (finding6.line !== void 0) attrs.push(`line="${finding6.line}"`);
+  const open = `<testcase ${attrs.join(" ")}>`;
+  if (!meetsThreshold(finding6.severity, "medium")) {
+    return `${open}<skipped message="${xmlEscape(oneLine(clip(finding6.message)))}"/></testcase>`;
+  }
+  const detail = clip(`${finding6.message}${finding6.remediation.length > 0 ? `
+Fix: ${finding6.remediation}` : ""}`);
+  return `${open}<failure type="${finding6.severity}" message="${xmlEscape(oneLine(clip(finding6.message)))}">${xmlEscape(detail)}</failure></testcase>`;
+}
+function renderJunitReport(input) {
+  const result = redactScan(input);
+  const header = '<?xml version="1.0" encoding="UTF-8"?>';
+  if (result.findings.length === 0) {
+    return `${header}
+<testsuites name="fullshield" tests="1" failures="0" skipped="0"><testsuite name="fullshield" tests="1" failures="0" skipped="0"><testcase name="scan" classname="fullshield"/></testsuite></testsuites>
+`;
+  }
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding6 of result.findings) {
+    const list = groups.get(finding6.module) ?? [];
+    list.push(finding6);
+    groups.set(finding6.module, list);
+  }
+  let failures = 0;
+  let skipped = 0;
+  const suites = [];
+  for (const [name, findings] of groups) {
+    let suiteFailures = 0;
+    let suiteSkipped = 0;
+    const cases = findings.map((finding6) => {
+      if (meetsThreshold(finding6.severity, "medium")) suiteFailures += 1;
+      else suiteSkipped += 1;
+      return junitCase(finding6);
+    });
+    failures += suiteFailures;
+    skipped += suiteSkipped;
+    suites.push(
+      `<testsuite name="${xmlEscape(name)}" tests="${findings.length}" failures="${suiteFailures}" skipped="${suiteSkipped}">${cases.join("")}</testsuite>`
+    );
+  }
+  return `${header}
+<testsuites name="fullshield" tests="${result.findings.length}" failures="${failures}" skipped="${skipped}">${suites.join("")}</testsuites>
+`;
+}
+function renderGitlabCodeQuality(input) {
+  const result = redactScan(input);
+  const report = result.findings.map((finding6) => {
+    const path = finding6.file !== void 0 ? posix2(finding6.file) : ".";
+    const location4 = { path };
+    if (finding6.line !== void 0) location4.lines = { begin: finding6.line };
+    return {
+      description: clip(finding6.message),
+      check_name: finding6.ruleId,
+      fingerprint: lineIndependentFingerprint(finding6),
+      severity: gitlabSeverity(finding6.severity),
+      location: location4
+    };
+  });
+  return `${JSON.stringify(report, null, 2)}
+`;
+}
+
 // src/reporters/console.ts
 init_finding();
 var SEVERITY_COLOR = {
@@ -11210,7 +11994,8 @@ function renderFinding(finding6) {
   }
   return lines;
 }
-function renderConsoleReport(result) {
+function renderConsoleReport(input) {
+  const result = redactScan(input);
   const { findings, summary, metadata } = result;
   const lines = [];
   lines.push(
@@ -11218,6 +12003,7 @@ function renderConsoleReport(result) {
       ` \u2014 scanned ${metadata.filesScanned} files in ${metadata.durationMs}ms (modules: ${metadata.modulesRun.length > 0 ? metadata.modulesRun.join(", ") : "none"})`
     )
   );
+  if (metadata.history !== void 0) lines.push(metadata.history);
   if (metadata.modulesRun.length < metadata.modulesRequested.length) {
     const pending = metadata.modulesRequested.filter((m) => !metadata.modulesRun.includes(m));
     lines.push(
@@ -11261,7 +12047,8 @@ function location2(finding6) {
   if (finding6.file === void 0) return "(project)";
   return finding6.line !== void 0 ? `${finding6.file}:${finding6.line}` : finding6.file;
 }
-function renderHtmlReport(result) {
+function renderHtmlReport(input) {
+  const result = redactScan(input);
   const sections = [];
   const bySeverityDesc = [...SEVERITIES].reverse();
   for (const severity of bySeverityDesc) {
@@ -11308,7 +12095,7 @@ ${items}`);
 
 // src/reporters/json.ts
 function publicFinding(finding6) {
-  const copy = { ...finding6 };
+  const copy = redactFinding(finding6);
   delete copy.aiVerdict;
   delete copy.exploitScenario;
   delete copy.aiReasoning;
@@ -11332,7 +12119,8 @@ function location3(finding6) {
   if (finding6.file === void 0) return "(project)";
   return finding6.line !== void 0 ? `${finding6.file}:${finding6.line}` : finding6.file;
 }
-function renderMarkdownReport(result) {
+function renderMarkdownReport(input) {
+  const result = redactScan(input);
   const lines = [
     "# FullShield report",
     "",
@@ -11384,7 +12172,8 @@ function sarifLevel(severity) {
 function uri(file) {
   return (file ?? "").replace(/\\/g, "/");
 }
-function renderSarifReport(result) {
+function renderSarifReport(input) {
+  const result = redactScan(input);
   const rules = /* @__PURE__ */ new Map();
   for (const finding6 of result.findings) {
     if (!rules.has(finding6.ruleId)) {
@@ -11451,7 +12240,137 @@ function renderSarifReport(result) {
   return JSON.stringify(doc, null, 2);
 }
 
+// src/diff/index.ts
+init_finding();
+init_experimental();
+function posix3(file) {
+  return (file ?? "").replace(/\\/g, "/");
+}
+function diffKey(finding6) {
+  return lineIndependentFingerprint(finding6);
+}
+function groupById(findings) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding6 of findings) {
+    if (finding6.id === void 0 || finding6.id.length === 0) continue;
+    const list = groups.get(finding6.id) ?? [];
+    list.push(finding6);
+    groups.set(finding6.id, list);
+  }
+  return groups;
+}
+function pairMoves(removed, added) {
+  const removedIds = groupById(removed);
+  const addedIds = groupById(added);
+  const moved = [];
+  for (const [id, group] of removedIds) {
+    const match = addedIds.get(id);
+    if (group.length === 1 && match?.length === 1 && group[0] !== void 0 && match[0] !== void 0) {
+      moved.push({ before: group[0], after: match[0] });
+    }
+  }
+  return moved;
+}
+function byLocation(a, b) {
+  return (a.line ?? 0) - (b.line ?? 0) || a.id.localeCompare(b.id) || a.ruleId.localeCompare(b.ruleId);
+}
+function groupFindings(findings) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding6 of findings) {
+    const key = diffKey(finding6);
+    const list = groups.get(key) ?? [];
+    list.push(finding6);
+    groups.set(key, list);
+  }
+  return groups;
+}
+function diffScans(before, after) {
+  const beforeGroups = groupFindings(before);
+  const afterGroups = groupFindings(after);
+  const unchanged = [];
+  const added = [];
+  const removed = [];
+  const moved = [];
+  const keys = [];
+  for (const key of beforeGroups.keys()) keys.push(key);
+  for (const key of afterGroups.keys()) {
+    if (!beforeGroups.has(key)) keys.push(key);
+  }
+  for (const key of keys) {
+    const left = [...beforeGroups.get(key) ?? []].sort(byLocation);
+    const right = [...afterGroups.get(key) ?? []].sort(byLocation);
+    const paired = Math.min(left.length, right.length);
+    for (let i = 0; i < paired; i += 1) {
+      const earlier = left[i];
+      const later = right[i];
+      if (earlier === void 0 || later === void 0) continue;
+      if ((earlier.line ?? 0) === (later.line ?? 0)) unchanged.push(later);
+      else moved.push({ before: earlier, after: later });
+    }
+    for (const finding6 of left.slice(paired)) removed.push(finding6);
+    for (const finding6 of right.slice(paired)) added.push(finding6);
+  }
+  const idMoves = pairMoves(removed, added);
+  const movedBefore = new Set(idMoves.map((item) => item.before));
+  const movedAfter = new Set(idMoves.map((item) => item.after));
+  return {
+    unchanged,
+    added: added.filter((finding6) => !movedAfter.has(finding6)),
+    removed: removed.filter((finding6) => !movedBefore.has(finding6)),
+    moved: [...moved, ...idMoves]
+  };
+}
+function parseScanDocument(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error("scan JSON must be an object with a findings array or a findings array");
+  }
+  const list = Array.isArray(parsed) ? parsed : typeof parsed === "object" && parsed !== null && Array.isArray(parsed.findings) ? parsed.findings : void 0;
+  if (list === void 0) {
+    throw new Error("scan JSON must be an object with a findings array or a findings array");
+  }
+  return list.map((item) => {
+    if (typeof item !== "object" || item === null) {
+      throw new Error("scan JSON finding is missing ruleId or severity");
+    }
+    const record = item;
+    const ruleId = record.ruleId;
+    const severity = record.severity;
+    if (typeof ruleId !== "string" || ruleId.length === 0 || typeof severity !== "string") {
+      throw new Error("scan JSON finding is missing ruleId or severity");
+    }
+    if (!isSeverity(severity)) {
+      throw new Error(`scan JSON finding has an unknown severity "${severity}"`);
+    }
+    if (record.line !== void 0 && (typeof record.line !== "number" || !Number.isInteger(record.line) || record.line < 0)) {
+      throw new Error("scan JSON finding line must be an integer >= 0");
+    }
+    return item;
+  });
+}
+function addedFails(diff, failOn) {
+  return diff.added.some((finding6) => finding6.source !== "ai" && meetsThreshold(finding6.severity, failOn));
+}
+var ADDED_CAP = 20;
+function addedLine(finding6) {
+  const where = finding6.file !== void 0 ? ` ${posix3(finding6.file)}:${finding6.line ?? 0}` : "";
+  return `${finding6.severity} ${finding6.ruleId}${where}`;
+}
+function renderDiffText(diff) {
+  const lines = [
+    `fullshield diff: unchanged ${diff.unchanged.length}, added ${diff.added.length}, removed ${diff.removed.length}, moved ${diff.moved.length}`
+  ];
+  if (diff.added.length === 0) return lines.join("\n");
+  lines.push("added:");
+  for (const finding6 of diff.added.slice(0, ADDED_CAP)) lines.push(addedLine(finding6));
+  if (diff.added.length > ADDED_CAP) lines.push(`${diff.added.length - ADDED_CAP} more \u2014 use --json`);
+  return lines.join("\n");
+}
+
 // src/cli/program.ts
+init_experimental();
 init_policy();
 
 // src/sbom/index.ts
@@ -12126,7 +13045,7 @@ function stateForGrace(sshd) {
 
 // src/cli/commands/doctor.ts
 init_config2();
-var MIN_NODE = [22, 13, 0];
+var MIN_NODE = [20, 11, 0];
 var LOCKFILES = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"];
 var FLAGS = [
   "FULLSHIELD_EXPERIMENTAL_SAST_GAPS",
@@ -12139,6 +13058,9 @@ var FLAGS = [
   "FULLSHIELD_EXPERIMENTAL_POLICY",
   "FULLSHIELD_EXPERIMENTAL_HOST",
   "FULLSHIELD_EXPERIMENTAL_TAINT_V2",
+  "FULLSHIELD_EXPERIMENTAL_CI_REPORTS",
+  "FULLSHIELD_EXPERIMENTAL_DIFF",
+  "FULLSHIELD_EXPERIMENTAL_LICENSE",
   "FULLSHIELD_PARSE_POOL"
 ];
 function nodeOk(version) {
@@ -12154,7 +13076,7 @@ function nodeOk(version) {
 async function runDoctor(cwd, options = {}) {
   const lines = [];
   const version = process.versions.node;
-  lines.push(`node: ${version} ${nodeOk(version) ? "ok" : "too old (need >= 22.13.0)"}`);
+  lines.push(`node: ${version} ${nodeOk(version) ? "ok" : "too old (need >= 20.11.0)"}`);
   const locks = LOCKFILES.filter((name) => existsSync(join(cwd, name)));
   lines.push(locks.length > 0 ? `lockfile: ${locks.join(", ")}` : "lockfile: none");
   const cacheDir = join(homedir(), ".cache", "fullshield", "osv");
@@ -12200,6 +13122,16 @@ var KNOWN = [
     test: /cannot read config/,
     code: "FS-E004",
     hint: "Check the path passed to --config."
+  },
+  {
+    test: /FULLSHIELD_EXPERIMENTAL_CI_REPORTS/,
+    code: "FS-E005",
+    hint: "Set FULLSHIELD_EXPERIMENTAL_CI_REPORTS=1 or pass --experimental-ci-reports."
+  },
+  {
+    test: /FULLSHIELD_EXPERIMENTAL_DIFF|scan JSON|cannot read diff/,
+    code: "FS-E006",
+    hint: "Set FULLSHIELD_EXPERIMENTAL_DIFF=1 or pass --experimental-diff. Both inputs must be scan --json files."
   }
 ];
 var DOCS = "https://github.com/kathanp/fullshield/blob/main/docs/errors.md";
@@ -12251,7 +13183,16 @@ function parseFailOn(value) {
 function createProgram(io = defaultIO) {
   const program = new Command();
   program.name("fullshield").description("Full-cycle security scanner for Node.js/TypeScript backends").version(packageVersion()).option("--debug", "print stack traces on CLI errors");
-  program.command("scan").description("Scan a project directory for security findings").argument("[path]", "directory to scan", ".").option("--json", "machine-readable JSON output").option("--fail-on <severity>", "exit 1 if any finding is at or above this severity").option("--modules <modules>", "comma-separated subset of modules to run").option("--staged", "scan only files staged in git (pre-commit mode)").option("--offline", "use the OSV cache only (no network)").option("--offline-safe", "alias of --offline").option("--config <path>", "path to fullshield.config.json").option("--sarif <file>", "write a SARIF 2.1.0 report to this path").option("--markdown <file>", "write a Markdown report to this path").option("--html <file>", "write an HTML report to this path").option("--update-baseline", "record current findings as accepted (CI fails only on new ones)").option("--ai [mode]", "experimental: explain findings (off = zero AI network calls)").option("--emit-virtual-patches [file]", "experimental: write .fullshield/vpatches.json").option("--changed", "experimental: scan git staged/changed files only").option("--since <ref>", "experimental: scan files changed since a git ref").option(
+  program.command("scan").description("Scan a project directory for security findings").argument("[path]", "directory to scan", ".").option("--json", "machine-readable JSON output").option("--fail-on <severity>", "exit 1 if any finding is at or above this severity").option("--modules <modules>", "comma-separated subset of modules to run").option("--staged", "scan only files staged in git (pre-commit mode)").option("--offline", "use the OSV cache only (no network)").option("--offline-safe", "alias of --offline").option("--config <path>", "path to fullshield.config.json").option("--sarif <file>", "write a SARIF 2.1.0 report to this path").option("--markdown <file>", "write a Markdown report to this path").option("--html <file>", "write an HTML report to this path").option(
+    "--experimental-ci-reports",
+    "experimental: GitHub annotations, JUnit, and GitLab Code Quality (FULLSHIELD_EXPERIMENTAL_CI_REPORTS=1)"
+  ).option(
+    "--github-annotations <file>",
+    "experimental: GitHub Actions workflow commands (requires FULLSHIELD_EXPERIMENTAL_CI_REPORTS=1)"
+  ).option("--junit <file>", "experimental: JUnit XML (requires FULLSHIELD_EXPERIMENTAL_CI_REPORTS=1)").option(
+    "--gitlab <file>",
+    "experimental: GitLab Code Quality JSON (requires FULLSHIELD_EXPERIMENTAL_CI_REPORTS=1)"
+  ).option("--update-baseline", "record current findings as accepted (CI fails only on new ones)").option("--ai [mode]", "experimental: explain findings (off = zero AI network calls)").option("--emit-virtual-patches [file]", "experimental: write .fullshield/vpatches.json").option("--changed", "experimental: scan git staged/changed files only").option("--since <ref>", "experimental: scan files changed since a git ref").option(
     "--experimental-sast-gaps",
     "experimental: ORM raw / sh -c / execa / zx sinks (FULLSHIELD_EXPERIMENTAL_SAST_GAPS=1)"
   ).option(
@@ -12310,6 +13251,15 @@ function createProgram(io = defaultIO) {
       if (opts.prSummary === true && process.env[POLICY_FLAG] !== "1") {
         throw new Error(`--pr-summary requires ${POLICY_FLAG}=1`);
       }
+      if (opts.experimentalCiReports === true) {
+        process.env[CI_REPORTS_FLAG] = "1";
+      }
+      const wantsCiReport = opts.githubAnnotations !== void 0 || opts.junit !== void 0 || opts.gitlab !== void 0;
+      if (wantsCiReport && process.env[CI_REPORTS_FLAG] !== "1") {
+        throw new Error(
+          `--github-annotations, --junit, and --gitlab require ${CI_REPORTS_FLAG}=1`
+        );
+      }
       const result = await scan({
         cwd: resolve(path),
         modules,
@@ -12337,6 +13287,15 @@ function createProgram(io = defaultIO) {
       if (opts.html !== void 0) {
         await writeFile(resolve(opts.html), renderHtmlReport(result), "utf8");
       }
+      if (opts.githubAnnotations !== void 0) {
+        await writeFile(resolve(opts.githubAnnotations), renderGithubAnnotations(result), "utf8");
+      }
+      if (opts.junit !== void 0) {
+        await writeFile(resolve(opts.junit), renderJunitReport(result), "utf8");
+      }
+      if (opts.gitlab !== void 0) {
+        await writeFile(resolve(opts.gitlab), renderGitlabCodeQuality(result), "utf8");
+      }
       await writeLastScan(resolve(path), result);
       if (opts.emitVirtualPatches !== void 0) {
         if (process.env.FULLSHIELD_EXPERIMENTAL_VPATCH !== "1") {
@@ -12358,6 +13317,12 @@ function createProgram(io = defaultIO) {
         }
         process.exitCode = 1;
       }
+      if (result.suppressionErrors !== void 0 && result.suppressionErrors.length > 0) {
+        for (const message of result.suppressionErrors) {
+          io.err(`fullshield: ${message}`);
+        }
+        process.exitCode = 1;
+      }
       const failOn = failOnOverride ?? result.policy?.failOn ?? result.config.failOn;
       if (result.findings.some((f) => failsCi(f, failOn))) {
         process.exitCode = 1;
@@ -12748,8 +13713,8 @@ function createProgram(io = defaultIO) {
       let name = "app";
       let version = "0.0.0";
       try {
-        const { readFile: readFile19 } = await import('fs/promises');
-        const pkg = JSON.parse(await readFile19(join(cwd, "package.json"), "utf8"));
+        const { readFile: readFile21 } = await import('fs/promises');
+        const pkg = JSON.parse(await readFile21(join(cwd, "package.json"), "utf8"));
         if (typeof pkg.name === "string") name = pkg.name;
         if (typeof pkg.version === "string") version = pkg.version;
       } catch {
@@ -12770,6 +13735,31 @@ function createProgram(io = defaultIO) {
       process.exitCode = 2;
     }
   });
+  program.command("diff").description("Experimental comparison of two scan --json files (FULLSHIELD_EXPERIMENTAL_DIFF=1)").argument("<before>", "earlier scan JSON").argument("<after>", "later scan JSON").option("--experimental-diff", "enable this command (FULLSHIELD_EXPERIMENTAL_DIFF=1)").option("--json", "print the machine diff").option("--out <file>", "write the machine diff to this file").option("--fail-on <severity>", "exit 1 when an added finding is at or above this severity", "high").action(
+    async (beforePath, afterPath, opts) => {
+      try {
+        if (opts.experimentalDiff === true) process.env[DIFF_FLAG] = "1";
+        if (!diffEnabled()) throw new Error(`diff requires ${DIFF_FLAG}=1`);
+        const failOn = parseFailOn(opts.failOn ?? "high");
+        let beforeText;
+        let afterText;
+        try {
+          beforeText = await readFile(resolve(beforePath), "utf8");
+          afterText = await readFile(resolve(afterPath), "utf8");
+        } catch {
+          throw new Error("cannot read diff input");
+        }
+        const diff = diffScans(parseScanDocument(beforeText), parseScanDocument(afterText));
+        const json = JSON.stringify(diff, null, 2);
+        if (opts.out !== void 0) await writeFile(resolve(opts.out), json, "utf8");
+        io.out(opts.json === true ? json : renderDiffText(diff));
+        if (addedFails(diff, failOn)) process.exitCode = 1;
+      } catch (error) {
+        io.err(formatCliError(error));
+        process.exitCode = 2;
+      }
+    }
+  );
   program.command("doctor").description("Report Node, lockfile, cache, flags, config, and whether OSV is offline").argument("[path]", "project directory", ".").option("--offline", "do not describe OSV as allowed to use the network").option("--config <file>", "explicit config file").action(async (path, opts) => {
     try {
       io.out(await runDoctor(resolve(path), opts));