docs+fix: README 中文优先 + 修 .env.example 误报 (v0.6.7)

- README 第一屏改为中文(标题/定位/30秒体检)，英文降为 ## English
- .env.example/.sample/.template/.dist 模板文件不再报权限误报(真实项目实测发现)
- test-compliance 74→75；全套 263 全绿

Author: jnMetaCode

CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.6.7] - 2026-06-20
+
+### Changed
+- **README 中文优先**：第一屏改为中文标题/定位/「30 秒合规体检」，英文降为 `## English` 章节（项目面向中国市场，理应中文打头）
+- **修复 `.env.example` 误报**：`.env.example` / `.sample` / `.template` / `.dist` 等模板文件不再报"权限过宽"（它们本就该提交、不含真实密钥）——真实第三方项目实测发现
+- `test-compliance.ts` 扩至 75 项（含 .env 模板回归）；全套 **263 测试**全绿
+
 ## [0.6.6] - 2026-06-20
 
 ### Changed — 诚信：静态扫描不再虚报"已合规"

README.md

@@ -4,41 +4,52 @@
 
 # ShellWard
 
-**AI Agent Security & Compliance Gateway** — the AI agent security middleware built for **China's regulatory regime** (网安法 / PIPL / 等保2.0 / 数据出境 / AI标识). Scan your project for compliance risks, then block prompt injection, data exfiltration, and dangerous commands at runtime. Chinese-language threat detection + Chinese PII + zero dependencies — things English tools don't do.
+**AI 应用合规网关** — 为中国监管而生的 AI Agent 安全合规工具（网安法 2026 / PIPL / 等保2.0 / 数据出境 / AI标识）。先一行命令体检项目合规风险，再在运行时拦截提示注入、数据外泄与危险命令。中文威胁检测 + 中文 PII + 零依赖——英文工具不做的事。
 
 [![npm](https://img.shields.io/npm/v/shellward?color=cb0000&label=npm)](https://www.npmjs.com/package/shellward)
 [![license](https://img.shields.io/badge/license-Apache--2.0-blue)](./LICENSE)
-[![tests](https://img.shields.io/badge/tests-262%20passing-brightgreen)](#performance)
+[![tests](https://img.shields.io/badge/tests-263%20passing-brightgreen)](#performance)
 [![deps](https://img.shields.io/badge/dependencies-0-brightgreen)](#performance)
 
-**🌐 Website: https://jnmetacode.github.io/shellward/**
+**🌐 官网: https://jnmetacode.github.io/shellward/**
 
-[English](#demo) | [中文](#中文)
+[中文](#30-秒合规体检) | [English](#english)
 
-## 30-Second Compliance Scan
+## 30 秒合规体检
 
-Zero install, read-only, nothing uploaded. Scan your AI project for compliance risks right now:
+零安装、只读、不上传任何数据。一行命令，扫出你的 AI 项目踩了哪些合规红线：
 
 ```bash
 npx shellward scan
 ```
 
-Outputs a red/yellow/green scorecard mapped to 网安法 / PIPL / 等保2.0 / 数据出境 / AI标识, plus the concrete `file:line` findings in your project:
+输出一张映射到 **网安法 / PIPL / 等保2.0 / 数据出境 / AI标识** 的红黄绿评分卡，并精确到 `文件:行`：
 
 ```
 ## 🔍 项目实测风险
 🌐 数据出境风险: 2 ｜ 🔑 硬编码密钥: 3 ｜ 🪪 个人信息暴露: 2 ｜ 📂 .env 权限: 1
 
 - .env:2          境外大模型端点: OpenAI — 向其发送个人信息即构成数据出境
+- package.json:12 境外大模型 SDK 依赖: openai — 项目内含数据出境通道
 - src/config.ts:3 硬编码 GitHub Token: ghp_12*** — 凭据不应写入源码
 - customers.csv:2 手机号 13912*** — 个人信息出现在文件中，需评估脱敏
 
-合规得分: 75/100  [B]   🟢 8 ｜ 🟡 3 ｜ 🔴 1 ｜ ⚪ 2
+合规得分: 63/100  [C]
 ```
 
-`npx shellward scan --json` for CI · `--ci` to fail the build on critical findings · `--html report.html` for a self-contained report you can print to PDF for 备案/audit · see [GitHub Action](#github-action-pr-compliance-gate).
+`--json` 供 CI · `--ci` 发现 critical 时让构建失败 · `--html report.html` 导出可打印成 PDF 的报告（备案/审计存档）· 也可作 [GitHub Action](#github-action-pr-compliance-gate) 接入 PR 门禁。
+
+> 检测重点：**境外大模型端点与 SDK 依赖（数据出境——中国独有、英文工具没有的概念）**、硬编码密钥、文件中的中文 PII、`.env` 暴露。扫到境外模型（如 `openai` 依赖）时，**直接给出境内合规替代**（通义千问 / DeepSeek / Kimi / 智谱）及其 OpenAI 兼容 `base_url`——多数迁移只需改一个 `base_url`。
+
+更多命令、运行时防护（MCP / 插件）、与英文文档见下方 [English](#english) 章节。
+
+---
+
+## English
+
+**AI Agent Security & Compliance Gateway** — the AI agent security middleware built for **China's regulatory regime** (CSL / PIPL / MLPS 2.0 / cross-border data / AI labeling). Scan your project for compliance risks, then block prompt injection, data exfiltration, and dangerous commands at runtime. Chinese-language threat detection + Chinese PII + zero dependencies — things English tools don't do.
 
-> Detects overseas-LLM endpoints (**data-export risk** — a China-only concept English tools ignore), hardcoded secrets, Chinese PII in files, and `.env` exposure. When it finds an overseas model (e.g. an `openai` dependency), it **prescribes domestic compliant alternatives** (通义千问 / DeepSeek / Kimi / 智谱) with their OpenAI-compatible `base_url` — most migrations are just a `base_url` swap.
+Quick start: `npx shellward scan` — zero install, read-only, nothing uploaded. Outputs a red/yellow/green scorecard mapped to Chinese regulations plus concrete `file:line` findings, and prescribes domestic compliant model alternatives for any overseas LLM it finds.
 
 ## Demo
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "shellward",
-  "version": "0.6.6",
+  "version": "0.6.7",
   "mcpName": "io.github.jnMetaCode/shellward",
   "description": "AI agent security & MCP security middleware — prompt injection detection, AI firewall, runtime guardrails & data-loss prevention for LLM tool calls. 8-layer defense against data exfiltration & dangerous commands. Zero dependencies. SDK + OpenClaw plugin. Supports LangChain, AutoGPT, Claude Code, Cursor, OpenAI Agents, Hermes Agent.",
   "keywords": [

src/compliance/project-scan.ts

@@ -286,7 +286,15 @@ console.log('\n--- 降误报与忽略 ---')
     writeFileSync(join(dir, 'samples', 'leak.ts'), 'const k = "sk-RZ9mKp2QwLs7Yv3Nd8Tb1Hc4Xj6Pq"\n')
     writeFileSync(join(dir, '.shellwardignore'), '# test\nsamples/\n')
 
+    // .env 模板文件不应报权限；真实 .env 应报
+    writeFileSync(join(dir, '.env.example'), 'OPENAI_API_KEY=your-key-here\n')
+    try { chmodSync(join(dir, '.env.example'), 0o644) } catch {}
+    writeFileSync(join(dir, '.env'), 'OPENAI_API_KEY=sk-RZ9mKp2QwLs7Yv3Nd8Tb1Hc4Xj6Pq\n')
+    try { chmodSync(join(dir, '.env'), 0o644) } catch {}
+
     const scan = scanProject(dir)
+    const envPerm = scan.findings.filter(f => f.kind === 'env-perm').map(f => f.file)
+    test('.env.example 模板不报权限', !envPerm.some(f => f.includes('.env.example')), envPerm.join(','))
     const secretFiles = scan.findings.filter(f => f.kind === 'secret').map(f => f.file)
     test('占位符密钥被过滤', !secretFiles.some(f => f.includes('placeholder')), secretFiles.join(','))
     test('结构真实密钥被检出', secretFiles.some(f => f.includes('real.ts')))