feat(cli): 本地 web 视图 --open / --serve (v0.6.8)

- scan --open: 扫完在浏览器打开 HTML 报告(写临时目录)
- scan --serve [port]: 本地 http 服务(仅 127.0.0.1)提供报告并自动打开浏览器
- 坚持数据不出本机：不做云端上传扫描，只本地查看
- 真实第三方狗粮：chalk(非AI) 0 误报、openai-quickstart-python 正确检出

Author: jnMetaCode

CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.6.8] - 2026-06-20
+
+### Added — 本地 web 视图（方便看，数据不出本机）
+- **`npx shellward scan --open`**：扫描后把 HTML 合规报告写入临时目录并在默认浏览器打开
+- **`npx shellward scan --serve [port]`**：本地零依赖 HTTP 服务（默认 7777，仅监听 127.0.0.1）提供报告，自动打开浏览器
+- 坚持"数据不出本机"原则：**不做云端上传扫描**，只在本地起服务/打开文件查看
+- 真实第三方项目狗粮验证：非 AI 库（chalk）0 误报、Python AI 项目（openai-quickstart）正确检出依赖
+
 ## [0.6.7] - 2026-06-20
 
 ### Changed

README.md

@@ -37,6 +37,8 @@ npx shellward scan
 合规得分: 63/100  [C]
 ```
 
+想在浏览器里看？`npx shellward scan --open`（扫完直接打开报告）或 `--serve`（本地 http://localhost 提供报告）——**数据全程不出本机**。
+
 `--json` 供 CI · `--ci` 发现 critical 时让构建失败 · `--html report.html` 导出可打印成 PDF 的报告（备案/审计存档）· 也可作 [GitHub Action](#github-action-pr-compliance-gate) 接入 PR 门禁。
 
 > 检测重点：**境外大模型端点与 SDK 依赖（数据出境——中国独有、英文工具没有的概念）**、硬编码密钥、文件中的中文 PII、`.env` 暴露。扫到境外模型（如 `openai` 依赖）时，**直接给出境内合规替代**（通义千问 / DeepSeek / Kimi / 智谱）及其 OpenAI 兼容 `base_url`——多数迁移只需改一个 `base_url`。

package.json

@@ -1,6 +1,6 @@
 {
   "name": "shellward",
-  "version": "0.6.7",
+  "version": "0.6.8",
   "mcpName": "io.github.jnMetaCode/shellward",
   "description": "AI agent security & MCP security middleware — prompt injection detection, AI firewall, runtime guardrails & data-loss prevention for LLM tool calls. 8-layer defense against data exfiltration & dangerous commands. Zero dependencies. SDK + OpenClaw plugin. Supports LangChain, AutoGPT, Claude Code, Cursor, OpenAI Agents, Hermes Agent.",
   "keywords": [

src/cli.ts

@@ -9,8 +9,11 @@
 //
 // 设计目标：30 秒、零配置、出一张可截图的「你的项目」合规风险报告。
 
-import { resolve } from 'path'
+import { resolve, join } from 'path'
 import { writeFileSync } from 'fs'
+import { tmpdir } from 'os'
+import { createServer } from 'http'
+import { spawn } from 'child_process'
 import { ShellWard } from './core/engine.js'
 import { runProjectComplianceAudit } from './compliance/audit.js'
 import { renderComplianceReport, renderProjectFindings } from './compliance/report.js'
@@ -48,6 +51,8 @@ function runScan(args: string[]) {
   const ci = args.includes('--ci')
   const outPath = flagValue(args, '--out')
   const htmlPath = flagValue(args, '--html')
+  const open = args.includes('--open')
+  const serve = args.includes('--serve')
   const dirArg = args.find(a => !a.startsWith('-'))
   const root = resolve(dirArg || process.cwd())
 
@@ -62,6 +67,39 @@ function runScan(args: string[]) {
 
   const { report, scan } = runProjectComplianceAudit(guard.config, root)
 
+  // ===== 本地 web 视图（方便看；数据全程不出本机）=====
+  if (serve) {
+    const html = renderHtmlReport(report, scan, locale, { root })
+    const port = Number(flagValue(args, '--serve') || flagValue(args, '--port')) || 7777
+    const server = createServer((_req, res) => {
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' })
+      res.end(html)
+    })
+    server.on('error', (e: any) => {
+      console.error(zh ? `无法启动本地服务: ${e?.message}` : `Failed to start server: ${e?.message}`)
+      process.exit(1)
+    })
+    server.listen(port, '127.0.0.1', () => {
+      const url = `http://localhost:${port}`
+      process.stdout.write(zh
+        ? `🌐 本地合规报告: ${url}  (得分 ${report.score}/100 [${report.grade}]，Ctrl+C 退出；数据不出本机)\n`
+        : `🌐 Local compliance report: ${url}  (score ${report.score}/100 [${report.grade}]; Ctrl+C to stop; nothing leaves your machine)\n`)
+      openBrowser(url)
+    })
+    return
+  }
+
+  if (open) {
+    const html = renderHtmlReport(report, scan, locale, { root })
+    const file = join(tmpdir(), `shellward-report-${report.score}-${report.grade}.html`)
+    writeFileSync(file, html, 'utf-8')
+    process.stdout.write(zh
+      ? `🌐 已在浏览器打开合规报告: ${file}  (得分 ${report.score}/100 [${report.grade}]；数据不出本机)\n`
+      : `🌐 Opened compliance report in browser: ${file}  (score ${report.score}/100 [${report.grade}])\n`)
+    openBrowser(file)
+    return
+  }
+
   if (json) {
     process.stdout.write(JSON.stringify({
       root,
@@ -117,6 +155,19 @@ function runScan(args: string[]) {
   }
 }
 
+/** 跨平台在默认浏览器打开 URL 或本地文件（失败静默，不影响主流程） */
+function openBrowser(target: string): void {
+  const cmd = process.platform === 'darwin' ? 'open'
+    : process.platform === 'win32' ? 'cmd'
+    : 'xdg-open'
+  const cmdArgs = process.platform === 'win32' ? ['/c', 'start', '', target] : [target]
+  try {
+    const child = spawn(cmd, cmdArgs, { stdio: 'ignore', detached: true })
+    child.on('error', () => {})
+    child.unref()
+  } catch { /* 打开失败不影响 */ }
+}
+
 /** 取 `--flag value` 或 `--flag=value` 的值 */
 function flagValue(args: string[], flag: string): string | undefined {
   const i = args.indexOf(flag)
@@ -136,6 +187,8 @@ Usage:
   shellward scan --ci      Exit non-zero if critical findings
   shellward scan --out f   Export the full report to a Markdown file
   shellward scan --html f  Export a self-contained HTML report (print to PDF)
+  shellward scan --open    Scan and open the report in your browser (local)
+  shellward scan --serve   Scan and serve the report at http://localhost (local)
   shellward mcp            Start MCP server (stdio)
   shellward --help
 
@@ -150,6 +203,8 @@ PII in files, .env permissions. Maps to CSL / PIPL / MLPS / cross-border / label
   shellward scan --ci       有 critical 发现时非零退出
   shellward scan --out 文件  导出完整报告为 Markdown（合规存档）
   shellward scan --html 文件 导出自包含 HTML 报告（浏览器可打印成 PDF）
+  shellward scan --open     扫描并在浏览器打开报告（本地，方便看）
+  shellward scan --serve    扫描并在 http://localhost 提供报告（本地服务）
   shellward mcp             启动 MCP 服务器（stdio）
   shellward --help