korext 1.0.0 → 1.0.1

package/bin/korext.js

@@ -295,6 +295,15 @@ async function fetchAndCacheRules() {
  * Run rules locally against code using cached regex definitions.
  * Mirrors korext-core/src/engine/localEngine.ts analyzeLocally().
  */
+// M1: Check if a line is a comment (skip from local engine scanning)
+function isCommentLine(line) {
+  const trimmed = line.trim();
+  return trimmed.startsWith('//')
+    || trimmed.startsWith('*')
+    || trimmed.startsWith('/*')
+    || trimmed.startsWith('#');
+}
+
 function analyzeLocally(code, packId, definitions) {
   // Normalize packId to array to support multi-pack (e.g. ["web", "pci-dss-v1"])
   const packIdList = Array.isArray(packId) ? packId : [packId];
@@ -321,6 +330,8 @@ function analyzeLocally(code, packId, definitions) {
       try {
         const re = new RegExp(pattern.regex, pattern.flags || 'gi');
         lines.forEach((line, i) => {
+          // M1: Skip comment lines to avoid false positives
+          if (isCommentLine(line)) return;
           re.lastIndex = 0;
           if (re.test(line)) {
             violations.push({
@@ -371,7 +382,12 @@ const program = new Command();
 program
   .name('korext')
   .description('Korext Command Line Interface - Enterprise Policy Enforcement')
-  .version(version);
+  .version(version)
+  .action(() => {
+    // H3: Show help and exit 0 when no subcommand is provided
+    program.outputHelp();
+    process.exit(0);
+  });
 
 program
   .command('login [token]')
@@ -859,6 +875,13 @@ program
     const format = options.format.toLowerCase();
     const isText = format === 'text';
 
+    // H1: Validate output format before proceeding
+    const SUPPORTED_FORMATS = ['text', 'json', 'sarif'];
+    if (!SUPPORTED_FORMATS.includes(format)) {
+      console.error(chalk.red(`\n\u2716 Unsupported format: "${format}". Supported formats: ${SUPPORTED_FORMATS.join(', ')}`));
+      process.exit(2);
+    }
+
     // ── Workspace config reader ──────────────────────────────────────────────
     function loadWorkspaceConfig(targetDir) {
       const configPaths = [
@@ -919,7 +942,7 @@ program
           } else {
             console.error(JSON.stringify({ error: `Unknown pack ID(s): ${unknownPacks.join(', ')}` }));
           }
-          process.exit(1);
+          process.exit(2); // C2: Error exit for invalid pack ID
         }
       }
     } else if (options.industry) {
@@ -928,14 +951,14 @@ program
       if (!taxonomy) {
         if (isText) console.error(chalk.red('\n\u2716 --industry requires cached rule definitions.'));
         if (isText) console.error(chalk.dim(`  Run ${chalk.green('korext rules sync')} first to cache pack tags.`));
-        process.exit(1);
+        process.exit(2); // C2: Error exit for missing cache
       }
       packIds = resolvePacksForIndustryRegion(options.industry, options.region || null, taxonomy);
       packSource = 'industry-flag';
       if (packIds.length === 0) {
         if (isText) console.error(chalk.red(`\n\u2716 No packs found for industry '${options.industry}'${options.region ? ` in region '${options.region}'` : ''}.`));
         if (isText) console.error(chalk.dim(`  Run ${chalk.green('korext industries')} to see valid industry names.`));
-        process.exit(1);
+        process.exit(2); // C2: Error exit for no matching packs
       }
       if (isText) console.log(`[KOREXT] Resolved ${packIds.length} packs for industry: ${options.industry}${options.region ? ` (region: ${options.region})` : ''}`);
     } else {
@@ -1005,11 +1028,30 @@ program
     let forceOffline = options.offline;
     let localDefinitions = null;
 
-    // Pre-flight: verify directory exists
+    // C1: Pre-flight: verify path exists and determine file vs directory
     const resolvedInputDir = path.resolve(dir);
     if (!fs.existsSync(resolvedInputDir)) {
-      if (isText) console.error(chalk.red(`\n✖ Directory does not exist: ${resolvedInputDir}`));
-      else console.error(JSON.stringify({ error: `Directory does not exist: ${resolvedInputDir}` }));
+      if (isText) console.error(chalk.red(`\n\u2716 Path does not exist: ${resolvedInputDir}`));
+      else console.error(JSON.stringify({ error: `Path does not exist: ${resolvedInputDir}` }));
+      process.exit(2);
+    }
+
+    // C1: Detect single file vs directory
+    let isSingleFile = false;
+    const inputStats = fs.statSync(resolvedInputDir);
+    if (inputStats.isFile()) {
+      isSingleFile = true;
+      const ext = path.extname(resolvedInputDir);
+      const SUPPORTED_EXTENSIONS = ['.ts', '.tsx', '.js', '.jsx', '.py', '.go', '.java', '.rs'];
+      if (!SUPPORTED_EXTENSIONS.includes(ext)) {
+        if (isText) console.error(chalk.red(`\n\u2716 Unsupported file type: ${ext}`));
+        else console.error(JSON.stringify({ error: `Unsupported file type: ${ext}` }));
+        if (isText) console.error(chalk.dim(`  Supported: ${SUPPORTED_EXTENSIONS.join(', ')}\n`));
+        process.exit(2);
+      }
+    } else if (!inputStats.isDirectory()) {
+      if (isText) console.error(chalk.red(`\n\u2716 Invalid path (not a file or directory): ${resolvedInputDir}`));
+      else console.error(JSON.stringify({ error: `Invalid path: ${resolvedInputDir}` }));
       process.exit(2);
     }
 
@@ -1036,7 +1078,7 @@ program
       if (!localDefinitions) {
         if (isText) console.error(chalk.red('\n✖ Offline mode requires cached rule definitions.'));
         if (isText) console.error(chalk.dim(`  Run ${chalk.green('korext rules sync')} or ${chalk.green('korext enforce --sync-rules')} first while online.`));
-        process.exit(1);
+        process.exit(2); // C2: Error exit for missing offline cache
       }
       if (isText) {
         console.log(chalk.yellow('\n⚡ Offline mode: using local rule engine (regex-based analysis)'));
@@ -1082,12 +1124,17 @@ program
       bundles: []
     };
 
+    // C1: Single file support
     let files;
-    try {
-      files = findFiles(dir);
-    } catch (e) {
-      if (isText) console.error(chalk.red(`Error reading directory: ${e.message}`));
-      process.exit(1);
+    if (isSingleFile) {
+      files = [resolvedInputDir];
+    } else {
+      try {
+        files = findFiles(dir);
+      } catch (e) {
+        if (isText) console.error(chalk.red(`Error reading directory: ${e.message}`));
+        process.exit(2); // C2: Error exit for filesystem errors
+      }
     }
 
     report.summary.totalFiles = files.length;
@@ -1153,6 +1200,18 @@ program
           });
           clearTimeout(timeoutId);
 
+          // C3 + H2: Differentiate auth errors from server/network errors
+          if (res.status === 401 || res.status === 403) {
+            if (fileSpinner) fileSpinner.stop();
+            if (isText) {
+              console.error(chalk.red('\n\u2716 Authentication failed. Your token may be expired.'));
+              console.error(chalk.dim(`  Run: ${chalk.green('korext login')} to re-authenticate.\n`));
+            } else {
+              console.error(JSON.stringify({ error: 'Authentication failed. Token may be expired. Run: korext login' }));
+            }
+            process.exit(2);
+          }
+
           if (!res.ok) {
             throw new Error(`HTTP ${res.status}`);
           }
@@ -1173,7 +1232,7 @@ program
               file: displayPath,
               bundleId: result.proofBundle.bundleId,
               decision: result.proofBundle.decision,
-              signed: !!result.proofBundle.hmacSignature,
+              signed: !!result.proofBundle.hmacSignature || !!result.proofBundle.signature,
               verifyUrl: `https://app.korext.com/verify/${result.proofBundle.bundleId}`,
             });
           }
@@ -1183,12 +1242,12 @@ program
             fetchAndCacheRules().catch(() => {});
           }
         } catch (e) {
-          // Server unreachable — fall back to local engine
+          // Network error or server 5xx: fall back to local engine
           if (localDefinitions) {
             if (!usedLocalEngine && isText && i === 0) {
               // Show fallback banner once
-              console.log(chalk.yellow(`\n⚡ Server unreachable. Falling back to local engine (regex-based analysis).`));
-              console.log(chalk.dim(`   Cached rules: v${localDefinitions.version} · ${localDefinitions.ruleCount} rules\n`));
+              console.log(chalk.yellow(`\n\u26a1 Server unreachable. Falling back to local engine (regex-based analysis).`));
+              console.log(chalk.dim(`   Cached rules: v${localDefinitions.version} \u00b7 ${localDefinitions.ruleCount} rules\n`));
             }
             fileViolations = analyzeLocally(fileContent, pack, localDefinitions);
             usedLocalEngine = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "korext",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "mcpName": "io.github.Korext/governance",
   "description": "KOREXT CLI. AI Code Governance. Enforce compliance policies on human written and AI generated code. 72 policy packs. 532 rules. 13 languages. Signed proof bundles.",
   "type": "module",