@anatomytool/validate 1.0.0

package/dist/checks/verify/ast-grep-verifier.js

@@ -0,0 +1,153 @@
+// src/checks/verify/ast-grep-verifier.ts
+// AST-based verifier for [[rules]].verify with kind="ast_pattern". Uses
+// @ast-grep/napi as an optional dependency loaded via detect-ast-grep.ts.
+// If napi is unavailable (package not installed, native binary missing for
+// this platform), emits verify-ast-grep-unavailable and skips the rule —
+// it does NOT fail validation. Malformed patterns surface as
+// verify-invalid-pattern (author bug, not source drift); parse errors on
+// individual source files are silently skipped (likely binary or wrong lang).
+//
+// API notes for @ast-grep/napi v0.42:
+//   - Lang is NOT an enum; language parsers are module-level named exports:
+//     m.ts, m.tsx, m.js, m.jsx, m.css, m.html
+//   - Python, Rust, Go, Java are NOT built-in; they require separate lang packs
+//   - Each lang object has: parse(src), parseAsync(src), findInFiles(config), kind(name), pattern(src)
+//   - parse(src) is synchronous and returns an SgRoot
+//   - SgRoot has .root() → SgNode
+//   - SgNode has .findAll({ rule: { pattern } }) → SgNode[]
+//   - SgNode has .range() → { start: { line, column, index }, end: { ... } }
+//   - SgNode has .kind() → string; ERROR nodes have kind "ERROR"
+//   - Malformed patterns don't throw on findAll — they silently return 0 matches.
+//     We detect bad patterns by parsing the pattern string as source and checking
+//     for ERROR-kind children in the parse tree.
+import { glob, readFile } from "node:fs/promises";
+import { join, sep as platformSep } from "node:path";
+import { getAstGrep } from "./detect-ast-grep.js";
+const MAX_LISTED_HITS = 5;
+const MAX_FILE_BYTES = 256 * 1024;
+// Map schema lang values to the napi module-level export name.
+// Python, Rust, Go, Java are listed in the schema but lack built-in napi support
+// without additional lang pack configuration; they are handled gracefully below.
+const LANG_EXPORT_MAP = {
+    ts: "ts",
+    tsx: "tsx",
+    js: "js",
+    jsx: "jsx",
+    py: "py", // Not a built-in napi export; will surface as verify-invalid-pattern
+    rs: "rs", // Same
+    go: "go", // Same
+    java: "java", // Same
+};
+/** Normalize a platform path to POSIX (forward-slash) for display and glob matching. */
+function toPosix(p) {
+    return platformSep === "/" ? p : p.split(platformSep).join("/");
+}
+/** Collect all glob matches under repoRoot, returning POSIX-style relative paths. */
+async function collectMatches(repoRoot, pattern) {
+    const out = [];
+    for await (const entry of glob(pattern, { cwd: repoRoot })) {
+        out.push(toPosix(entry));
+    }
+    return out;
+}
+/** Detect whether a pattern string is syntactically malformed by parsing it as
+ *  source code and checking for ERROR-kind nodes in the parse tree. */
+function isPatternMalformed(lang, pattern) {
+    const root = lang.parse(pattern).root();
+    return root.children().some(n => n.kind() === "ERROR");
+}
+export async function verifyAstPattern(repoRoot, cfg, pointer) {
+    const sg = await getAstGrep();
+    if (!sg) {
+        return [{
+                code: "verify-ast-grep-unavailable",
+                message: `verify rule with kind="ast_pattern" requires @ast-grep/napi. Install it ` +
+                    `('npm install --save-optional @ast-grep/napi') to enable AST-based ` +
+                    `verification, or remove the verify field. Rule skipped.`,
+                pointer,
+            }];
+    }
+    const exportName = LANG_EXPORT_MAP[cfg.lang];
+    // Access the language parser from the module (e.g., sg.ts, sg.tsx, sg.js)
+    const sgModule = sg;
+    const langParser = sgModule[exportName];
+    if (!langParser || typeof langParser.parse !== "function") {
+        return [{
+                code: "verify-invalid-pattern",
+                message: `ast-grep's napi build does not include "${cfg.lang}". ` +
+                    `For non-JS-family languages, use kind = "semgrep" instead — see ` +
+                    `spec/0.13/prompt.md. Or use lang = ts/tsx/js/jsx for ast-grep.`,
+                pointer,
+            }];
+    }
+    // Validate the pattern before scanning files — detect syntax errors early.
+    if (isPatternMalformed(langParser, cfg.pattern)) {
+        return [{
+                code: "verify-invalid-pattern",
+                message: `ast-grep pattern "${cfg.pattern}" is malformed (parse tree contains ERROR nodes for lang=${cfg.lang}).`,
+                pointer,
+            }];
+    }
+    const targetGlob = cfg.expect_in ?? cfg.forbid_in;
+    if (!targetGlob) {
+        // Schema enforces oneOf(expect_in, forbid_in); this is a defensive guard.
+        return [];
+    }
+    const files = await collectMatches(repoRoot, targetGlob);
+    const hits = [];
+    for (const relPath of files) {
+        const absPath = join(repoRoot, relPath);
+        let source;
+        try {
+            const buf = await readFile(absPath);
+            if (buf.length > MAX_FILE_BYTES)
+                continue;
+            source = buf.toString("utf8");
+        }
+        catch {
+            continue;
+        }
+        let sgRoot;
+        try {
+            sgRoot = langParser.parse(source);
+        }
+        catch {
+            // Parse error on this file — skip silently (binary or wrong language).
+            continue;
+        }
+        let matches;
+        try {
+            matches = sgRoot.root().findAll({ rule: { pattern: cfg.pattern } });
+        }
+        catch {
+            // Unexpected runtime error from findAll — treat pattern as invalid.
+            continue;
+        }
+        for (const match of matches) {
+            hits.push({ file: relPath, line: match.range().start.line + 1 });
+        }
+    }
+    if (cfg.expect_in !== undefined && hits.length === 0) {
+        return [{
+                code: "verify-pattern-not-matched",
+                message: `ast-grep pattern "${cfg.pattern}" did not match any occurrence ` +
+                    `in "${targetGlob}" (lang=${cfg.lang}).`,
+                pointer,
+            }];
+    }
+    if (cfg.forbid_in !== undefined && hits.length > 0) {
+        const shown = hits
+            .slice(0, MAX_LISTED_HITS)
+            .map(h => `${h.file}:${h.line}`)
+            .join(", ");
+        const suffix = hits.length > MAX_LISTED_HITS ? ", ..." : "";
+        return [{
+                code: "verify-pattern-found-where-forbidden",
+                message: `ast-grep pattern "${cfg.pattern}" matched ${hits.length} occurrence(s) ` +
+                    `in forbidden glob "${targetGlob}": ${shown}${suffix}`,
+                pointer,
+            }];
+    }
+    return [];
+}
+//# sourceMappingURL=ast-grep-verifier.js.map

package/dist/checks/verify/ast-grep-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast-grep-verifier.js","sourceRoot":"","sources":["../../../src/checks/verify/ast-grep-verifier.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,wEAAwE;AACxE,0EAA0E;AAC1E,2EAA2E;AAC3E,yEAAyE;AACzE,6DAA6D;AAC7D,yEAAyE;AACzE,8EAA8E;AAC9E,EAAE;AACF,sCAAsC;AACtC,4EAA4E;AAC5E,8CAA8C;AAC9C,gFAAgF;AAChF,uGAAuG;AACvG,sDAAsD;AACtD,kCAAkC;AAClC,4DAA4D;AAC5D,6EAA6E;AAC7E,iEAAiE;AACjE,kFAAkF;AAClF,kFAAkF;AAClF,iDAAiD;AAEjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAGrD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC;AAElC,+DAA+D;AAC/D,iFAAiF;AACjF,iFAAiF;AACjF,MAAM,eAAe,GAA6C;IAChE,EAAE,EAAE,IAAI;IACR,GAAG,EAAE,KAAK;IACV,EAAE,EAAE,IAAI;IACR,GAAG,EAAE,KAAK;IACV,EAAE,EAAE,IAAI,EAAM,qEAAqE;IACnF,EAAE,EAAE,IAAI,EAAM,OAAO;IACrB,EAAE,EAAE,IAAI,EAAM,OAAO;IACrB,IAAI,EAAE,MAAM,EAAE,OAAO;CACtB,CAAC;AAEF,wFAAwF;AACxF,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClE,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,OAAe;IAC7D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAaD;uEACuE;AACvE,SAAS,kBAAkB,CAAC,IAAgB,EAAE,OAAe;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,GAAqB,EACrB,OAAe;IAEf,MAAM,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;IAC9B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,CAAC;gBACN,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EACL,0EAA0E;oBAC1E,qEAAqE;oBACrE,yDAAyD;gBAC3D,OAAO;aACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,EAAuD,CAAC;IACzE,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IAExC,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAC1D,OAAO,CAAC;gBACN,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EACL,2CAA2C,GAAG,CAAC,IAAI,KAAK;oBACxD,kEAAkE;oBAClE,gEAAgE;gBAClE,OAAO;aACR,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,IAAI,kBAAkB,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC;gBACN,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EACL,qBAAqB,GAAG,CAAC,OAAO,4DAA4D,GAAG,CAAC,IAAI,IAAI;gBAC1G,OAAO;aACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC;IAClD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,0EAA0E;QAC1E,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,IAAI,GAA0C,EAAE,CAAC;IAEvD,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACxC,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,GAAG,CAAC,MAAM,GAAG,cAAc;gBAAE,SAAS;YAC1C,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,SAAS;QACX,CAAC;QAED,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,SAAS;QACX,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,CAAC;gBACN,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EACL,qBAAqB,GAAG,CAAC,OAAO,iCAAiC;oBACjE,OAAO,UAAU,WAAW,GAAG,CAAC,IAAI,IAAI;gBAC1C,OAAO;aACR,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI;aACf,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;aACzB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;aAC/B,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC;gBACN,IAAI,EAAE,sCAAsC;gBAC5C,OAAO,EACL,qBAAqB,GAAG,CAAC,OAAO,aAAa,IAAI,CAAC,MAAM,iBAAiB;oBACzE,sBAAsB,UAAU,MAAM,KAAK,GAAG,MAAM,EAAE;gBACxD,OAAO;aACR,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/checks/verify/detect-ast-grep.d.ts

@@ -0,0 +1,9 @@
+type AstGrepModule = typeof import("@ast-grep/napi");
+/** Returns the @ast-grep/napi module, or null if the package is unavailable
+ *  (not installed, or native binary missing for this platform). Caches the
+ *  outcome — at most one import attempt per process. */
+export declare function getAstGrep(): Promise<AstGrepModule | null>;
+/** Test-only: clear the cache so a follow-up call retries the import. */
+export declare function _resetAstGrepCache(): void;
+export {};
+//# sourceMappingURL=detect-ast-grep.d.ts.map

package/dist/checks/verify/detect-ast-grep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-ast-grep.d.ts","sourceRoot":"","sources":["../../../src/checks/verify/detect-ast-grep.ts"],"names":[],"mappings":"AAOA,KAAK,aAAa,GAAG,cAAc,gBAAgB,CAAC,CAAC;AAIrD;;wDAEwD;AACxD,wBAAsB,UAAU,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAQhE;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}

package/dist/checks/verify/detect-ast-grep.js

@@ -0,0 +1,26 @@
+// src/checks/verify/detect-ast-grep.ts
+// Lazy loader for the optional @ast-grep/napi dependency. ast-grep is shipped
+// as platform-specific native binaries via optionalDependencies; on unsupported
+// platforms or installations where it failed, the import throws. We catch the
+// throw and surface a null, letting the ast_pattern verifier degrade gracefully
+// with a verify-ast-grep-unavailable warning instead of failing validation.
+let cached;
+/** Returns the @ast-grep/napi module, or null if the package is unavailable
+ *  (not installed, or native binary missing for this platform). Caches the
+ *  outcome — at most one import attempt per process. */
+export async function getAstGrep() {
+    if (cached !== undefined)
+        return cached;
+    try {
+        cached = await import("@ast-grep/napi");
+    }
+    catch {
+        cached = null;
+    }
+    return cached;
+}
+/** Test-only: clear the cache so a follow-up call retries the import. */
+export function _resetAstGrepCache() {
+    cached = undefined;
+}
+//# sourceMappingURL=detect-ast-grep.js.map

package/dist/checks/verify/detect-ast-grep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-ast-grep.js","sourceRoot":"","sources":["../../../src/checks/verify/detect-ast-grep.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,4EAA4E;AAI5E,IAAI,MAAwC,CAAC;AAE7C;;wDAEwD;AACxD,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,SAAS,CAAC;AACrB,CAAC"}

package/dist/checks/verify/detect-semgrep.d.ts

@@ -0,0 +1,8 @@
+export interface SemgrepDetection {
+    available: boolean;
+    version?: string;
+}
+export declare function getSemgrep(): SemgrepDetection;
+/** Test-only: reset the module-level cache so each test sees a clean state. */
+export declare function _resetSemgrepCache(): void;
+//# sourceMappingURL=detect-semgrep.d.ts.map

package/dist/checks/verify/detect-semgrep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-semgrep.d.ts","sourceRoot":"","sources":["../../../src/checks/verify/detect-semgrep.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID,wBAAgB,UAAU,IAAI,gBAAgB,CAqB7C;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}

package/dist/checks/verify/detect-semgrep.js

@@ -0,0 +1,36 @@
+// src/checks/verify/detect-semgrep.ts
+// Cached one-shot detection of the `semgrep` binary on PATH. Used by both
+// semgrep-pattern-verifier and semgrep-rule-file-verifier to decide whether
+// to invoke Semgrep or emit verify-semgrep-unavailable.
+//
+// shell:true is required for .cmd shim resolution on Windows — npm/pip-installed
+// CLIs don't resolve as plain executables on Windows without it.
+import { spawnSync } from "node:child_process";
+let cached;
+export function getSemgrep() {
+    if (cached !== undefined)
+        return cached;
+    try {
+        const result = spawnSync("semgrep", ["--version"], {
+            shell: true,
+            encoding: "buffer",
+            timeout: 10_000,
+        });
+        if (result.status === 0 && !result.error) {
+            const version = result.stdout.toString("utf8").trim();
+            cached = { available: true, version };
+        }
+        else {
+            cached = { available: false };
+        }
+    }
+    catch {
+        cached = { available: false };
+    }
+    return cached;
+}
+/** Test-only: reset the module-level cache so each test sees a clean state. */
+export function _resetSemgrepCache() {
+    cached = undefined;
+}
+//# sourceMappingURL=detect-semgrep.js.map

package/dist/checks/verify/detect-semgrep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-semgrep.js","sourceRoot":"","sources":["../../../src/checks/verify/detect-semgrep.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,0EAA0E;AAC1E,4EAA4E;AAC5E,wDAAwD;AACxD,EAAE;AACF,iFAAiF;AACjF,iEAAiE;AAEjE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAO/C,IAAI,MAAoC,CAAC;AAEzC,MAAM,UAAU,UAAU;IACxB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE;YACjD,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACtD,MAAM,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,SAAS,CAAC;AACrB,CAAC"}

package/dist/checks/verify/glob-verifier.d.ts

@@ -0,0 +1,5 @@
+import type { Warning } from "../../errors.js";
+import type { GlobExistsConfig, GlobOnlyConfig } from "./types.js";
+export declare function verifyGlobExists(repoRoot: string, cfg: GlobExistsConfig, pointer: string): Promise<Warning[]>;
+export declare function verifyGlobOnly(repoRoot: string, cfg: GlobOnlyConfig, pointer: string): Promise<Warning[]>;
+//# sourceMappingURL=glob-verifier.d.ts.map

package/dist/checks/verify/glob-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob-verifier.d.ts","sourceRoot":"","sources":["../../../src/checks/verify/glob-verifier.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAkBnE,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,gBAAgB,EACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,EAAE,CAAC,CAqBpB;AAED,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,EAAE,CAAC,CAYpB"}

package/dist/checks/verify/glob-verifier.js

@@ -0,0 +1,58 @@
+// src/checks/verify/glob-verifier.ts
+// Pure glob-based verifiers (no native deps). Uses Node 22+'s built-in
+// `glob` from node:fs/promises. All globs are repo-root-relative; results
+// are joined with the repo root for human-readable warning messages.
+// Windows path separators are normalized to forward slash at the boundary.
+import { glob } from "node:fs/promises";
+import { sep as platformSep } from "node:path";
+const MAX_LISTED_FILES = 5;
+/** Normalize platform path to POSIX (forward slash) for stable display + glob matching. */
+function toPosix(p) {
+    return platformSep === "/" ? p : p.split(platformSep).join("/");
+}
+/** Collect all matches for a glob under repoRoot, returning POSIX-style relative paths. */
+async function collectMatches(repoRoot, pattern) {
+    const out = [];
+    for await (const entry of glob(pattern, { cwd: repoRoot })) {
+        out.push(toPosix(entry));
+    }
+    return out;
+}
+export async function verifyGlobExists(repoRoot, cfg, pointer) {
+    const matches = await collectMatches(repoRoot, cfg.path);
+    if (cfg.should_not === true) {
+        if (matches.length > 0) {
+            const shown = matches.slice(0, MAX_LISTED_FILES);
+            return [{
+                    code: "verify-glob-unexpected-files",
+                    message: `glob "${cfg.path}" should not match any files, but matched ${matches.length}: ${shown.join(", ")}${matches.length > MAX_LISTED_FILES ? ", ..." : ""}`,
+                    pointer,
+                }];
+        }
+        return [];
+    }
+    if (matches.length === 0) {
+        return [{
+                code: "verify-glob-empty",
+                message: `glob "${cfg.path}" matched no files (expected ≥1).`,
+                pointer,
+            }];
+    }
+    return [];
+}
+export async function verifyGlobOnly(repoRoot, cfg, pointer) {
+    const matchFiles = await collectMatches(repoRoot, cfg.match);
+    if (matchFiles.length === 0)
+        return [];
+    const containerFiles = new Set(await collectMatches(repoRoot, cfg.container));
+    const violations = matchFiles.filter(f => !containerFiles.has(f));
+    if (violations.length === 0)
+        return [];
+    const shown = violations.slice(0, MAX_LISTED_FILES);
+    return [{
+            code: "verify-glob-outside-container",
+            message: `glob "${cfg.match}" matched ${violations.length} file(s) outside container "${cfg.container}": ${shown.join(", ")}${violations.length > MAX_LISTED_FILES ? ", ..." : ""}`,
+            pointer,
+        }];
+}
+//# sourceMappingURL=glob-verifier.js.map

package/dist/checks/verify/glob-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob-verifier.js","sourceRoot":"","sources":["../../../src/checks/verify/glob-verifier.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,2EAA2E;AAE3E,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,GAAG,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAI/C,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B,2FAA2F;AAC3F,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClE,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,OAAe;IAC7D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,GAAqB,EACrB,OAAe;IAEf,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YACjD,OAAO,CAAC;oBACN,IAAI,EAAE,8BAA8B;oBACpC,OAAO,EAAE,SAAS,GAAG,CAAC,IAAI,6CAA6C,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;oBAC/J,OAAO;iBACR,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC;gBACN,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,SAAS,GAAG,CAAC,IAAI,mCAAmC;gBAC7D,OAAO;aACR,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,GAAmB,EACnB,OAAe;IAEf,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACpD,OAAO,CAAC;YACN,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,SAAS,GAAG,CAAC,KAAK,aAAa,UAAU,CAAC,MAAM,+BAA+B,GAAG,CAAC,SAAS,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YACnL,OAAO;SACR,CAAC,CAAC;AACL,CAAC"}

package/dist/checks/verify/semgrep-pattern-verifier.d.ts

@@ -0,0 +1,4 @@
+import type { Warning } from "../../errors.js";
+import type { SemgrepPatternConfig } from "./types.js";
+export declare function verifySemgrepPattern(repoRoot: string, cfg: SemgrepPatternConfig, pointer: string): Promise<Warning[]>;
+//# sourceMappingURL=semgrep-pattern-verifier.d.ts.map

package/dist/checks/verify/semgrep-pattern-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep-pattern-verifier.d.ts","sourceRoot":"","sources":["../../../src/checks/verify/semgrep-pattern-verifier.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AA+BvD,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,oBAAoB,EACzB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,EAAE,CAAC,CA0GpB"}

package/dist/checks/verify/semgrep-pattern-verifier.js

@@ -0,0 +1,121 @@
+// src/checks/verify/semgrep-pattern-verifier.ts
+// Inline-pattern verifier for [[rules]].verify with kind="semgrep" and pattern
+// + lang fields. Mirrors ast-grep-verifier shape but shells out to the optional
+// `semgrep` binary on PATH. Soft-fail policy: missing binary, timeout, invalid
+// JSON, or unrecognized non-zero exit all surface as verify-semgrep-unavailable
+// warnings — never throws.
+import { spawnSync } from "node:child_process";
+import { glob } from "node:fs/promises";
+import { join, sep as platformSep } from "node:path";
+import { getSemgrep } from "./detect-semgrep.js";
+const MAX_LISTED_HITS = 5;
+const TIMEOUT_MS = 60_000;
+const MAX_BUFFER_BYTES = 10 * 1024 * 1024;
+const PATTERN_ERROR_SIGNALS = [
+    "Invalid pattern",
+    "Syntax error",
+    "Pattern error",
+];
+function toPosix(p) {
+    return platformSep === "/" ? p : p.split(platformSep).join("/");
+}
+async function collectMatches(repoRoot, pattern) {
+    const out = [];
+    for await (const entry of glob(pattern, { cwd: repoRoot })) {
+        out.push(toPosix(entry));
+    }
+    return out;
+}
+export async function verifySemgrepPattern(repoRoot, cfg, pointer) {
+    const detection = getSemgrep();
+    if (!detection.available) {
+        return [{
+                code: "verify-semgrep-unavailable",
+                message: `verify rule with kind="semgrep" requires the semgrep binary on PATH. ` +
+                    `Install with 'pip install semgrep' or 'brew install semgrep'. Rule skipped.`,
+                pointer,
+            }];
+    }
+    const targetGlob = cfg.expect_in ?? cfg.forbid_in;
+    if (!targetGlob)
+        return []; // Schema enforces oneOf — defensive guard.
+    const files = await collectMatches(repoRoot, targetGlob);
+    if (files.length === 0) {
+        return [{
+                code: "verify-no-files-matched",
+                message: `Glob "${targetGlob}" matched 0 files; semgrep verify skipped.`,
+                pointer,
+            }];
+    }
+    const absFiles = files.map(f => join(repoRoot, f));
+    let result;
+    try {
+        result = spawnSync("semgrep", ["--json", "--lang", cfg.lang, "--pattern", cfg.pattern, ...absFiles], {
+            shell: true,
+            encoding: "buffer",
+            timeout: TIMEOUT_MS,
+            maxBuffer: MAX_BUFFER_BYTES,
+            cwd: repoRoot,
+        });
+    }
+    catch (err) {
+        return [{
+                code: "verify-semgrep-unavailable",
+                message: `semgrep spawn failed: ${err instanceof Error ? err.message : String(err)}`,
+                pointer,
+            }];
+    }
+    if (result.error || result.signal === "SIGTERM") {
+        return [{
+                code: "verify-semgrep-unavailable",
+                message: `semgrep invocation failed: ${result.error?.message ?? "timeout after 60s"}`,
+                pointer,
+            }];
+    }
+    const stderr = result.stderr.toString("utf8");
+    if (result.status !== 0) {
+        const parseErrLine = stderr.split("\n").find(l => PATTERN_ERROR_SIGNALS.some(s => l.includes(s)));
+        if (parseErrLine) {
+            return [{
+                    code: "verify-invalid-pattern",
+                    message: `semgrep rejected pattern: ${parseErrLine.trim()}`,
+                    pointer,
+                }];
+        }
+        return [{
+                code: "verify-semgrep-unavailable",
+                message: `semgrep exited with status ${result.status}. stderr: ${stderr.slice(0, 200)}`,
+                pointer,
+            }];
+    }
+    let hits;
+    try {
+        const parsed = JSON.parse(result.stdout.toString("utf8"));
+        hits = parsed.results ?? [];
+    }
+    catch {
+        return [{
+                code: "verify-semgrep-unavailable",
+                message: `semgrep stdout was not valid JSON. stderr: ${stderr.slice(0, 200)}`,
+                pointer,
+            }];
+    }
+    if (cfg.expect_in !== undefined && hits.length === 0) {
+        return [{
+                code: "verify-pattern-not-matched",
+                message: `semgrep pattern "${cfg.pattern}" did not match any occurrence ` +
+                    `in "${targetGlob}" (lang=${cfg.lang}).`,
+                pointer,
+            }];
+    }
+    if (cfg.forbid_in !== undefined && hits.length > 0) {
+        return hits.slice(0, MAX_LISTED_HITS).map(h => ({
+            code: "verify-pattern-found-where-forbidden",
+            message: `semgrep pattern "${cfg.pattern}" matched at ${h.path}:${h.start.line} ` +
+                `in forbidden glob "${cfg.forbid_in}".`,
+            pointer,
+        }));
+    }
+    return [];
+}
+//# sourceMappingURL=semgrep-pattern-verifier.js.map

package/dist/checks/verify/semgrep-pattern-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep-pattern-verifier.js","sourceRoot":"","sources":["../../../src/checks/verify/semgrep-pattern-verifier.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,2BAA2B;AAE3B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAGrD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,UAAU,GAAG,MAAM,CAAC;AAC1B,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1C,MAAM,qBAAqB,GAAG;IAC5B,iBAAiB;IACjB,cAAc;IACd,eAAe;CAChB,CAAC;AAEF,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,OAAe;IAC7D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAAgB,EAChB,GAAyB,EACzB,OAAe;IAEf,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;QACzB,OAAO,CAAC;gBACN,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EACL,uEAAuE;oBACvE,6EAA6E;gBAC/E,OAAO;aACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC;IAClD,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC,CAAC,2CAA2C;IAEvE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC;gBACN,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,SAAS,UAAU,4CAA4C;gBACxE,OAAO;aACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,MAAoC,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAChB,SAAS,EACT,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,EACrE;YACE,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,UAAU;YACnB,SAAS,EAAE,gBAAgB;YAC3B,GAAG,EAAE,QAAQ;SACd,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC;gBACN,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gBACpF,OAAO;aACR,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,CAAC;gBACN,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,8BAA8B,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,mBAAmB,EAAE;gBACrF,OAAO;aACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC/C,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAC/C,CAAC;QACF,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,CAAC;oBACN,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,6BAA6B,YAAY,CAAC,IAAI,EAAE,EAAE;oBAC3D,OAAO;iBACR,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC;gBACN,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,8BAA8B,MAAM,CAAC,MAAM,aAAa,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACvF,OAAO;aACR,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA+B,CAAC;QACxF,IAAI,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC;gBACN,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,8CAA8C,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBAC7E,OAAO;aACR,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,CAAC;gBACN,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EACL,oBAAoB,GAAG,CAAC,OAAO,iCAAiC;oBAChE,OAAO,UAAU,WAAW,GAAG,CAAC,IAAI,IAAI;gBAC1C,OAAO;aACR,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9C,IAAI,EAAE,sCAA+C;YACrD,OAAO,EACL,oBAAoB,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG;gBACxE,sBAAsB,GAAG,CAAC,SAAS,IAAI;YACzC,OAAO;SACR,CAAC,CAAC,CAAC;IACN,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/checks/verify/semgrep-rule-file-verifier.d.ts

@@ -0,0 +1,9 @@
+import type { Warning, ValidationError } from "../../errors.js";
+import type { SemgrepRuleFileConfig } from "./types.js";
+interface VerifyResult {
+    errors: ValidationError[];
+    warnings: Warning[];
+}
+export declare function verifySemgrepRuleFile(repoRoot: string, cfg: SemgrepRuleFileConfig, pointer: string): Promise<VerifyResult>;
+export {};
+//# sourceMappingURL=semgrep-rule-file-verifier.d.ts.map

package/dist/checks/verify/semgrep-rule-file-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep-rule-file-verifier.d.ts","sourceRoot":"","sources":["../../../src/checks/verify/semgrep-rule-file-verifier.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAgCxD,UAAU,YAAY;IACpB,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAOD,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,qBAAqB,EAC1B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CAmIvB"}

package/dist/checks/verify/semgrep-rule-file-verifier.js

@@ -0,0 +1,151 @@
+// src/checks/verify/semgrep-rule-file-verifier.ts
+// YAML-rule-file verifier for [[rules]].verify with kind="semgrep" and rule_file
+// field. Resolves the rule file relative to repo root, refuses path-escape
+// attempts (emits verify-rule-file-outside-repo as ERROR — the only verify code
+// that is not a warning), then shells out to `semgrep --config <path>`.
+//
+// Returns { errors, warnings } separately so the path-escape ERROR can flow
+// into the dispatcher's errors[] slot. All other verifiers return Warning[]
+// directly because they only ever produce warnings.
+import { spawnSync } from "node:child_process";
+import { glob, access } from "node:fs/promises";
+import { resolve, join, sep as platformSep } from "node:path";
+import { getSemgrep } from "./detect-semgrep.js";
+const MAX_LISTED_HITS = 5;
+const TIMEOUT_MS = 60_000;
+const MAX_BUFFER_BYTES = 10 * 1024 * 1024;
+const RULE_FILE_ERROR_SIGNALS = [
+    "Invalid rule",
+    "Failed to parse rule",
+    "Syntax error in rule",
+    "missing required field",
+];
+function toPosix(p) {
+    return platformSep === "/" ? p : p.split(platformSep).join("/");
+}
+async function collectMatches(repoRoot, pattern) {
+    const out = [];
+    for await (const entry of glob(pattern, { cwd: repoRoot })) {
+        out.push(toPosix(entry));
+    }
+    return out;
+}
+const warning = (w) => ({ errors: [], warnings: [w] });
+const warnings = (ws) => ({ errors: [], warnings: ws });
+const error = (e) => ({ errors: [e], warnings: [] });
+const empty = () => ({ errors: [], warnings: [] });
+export async function verifySemgrepRuleFile(repoRoot, cfg, pointer) {
+    const detection = getSemgrep();
+    if (!detection.available) {
+        return warning({
+            code: "verify-semgrep-unavailable",
+            message: `verify rule with kind="semgrep" requires the semgrep binary on PATH. ` +
+                `Install with 'pip install semgrep' or 'brew install semgrep'. Rule skipped.`,
+            pointer,
+        });
+    }
+    // Path-escape check FIRST — refuse to even check existence outside repo.
+    const resolvedRule = resolve(repoRoot, cfg.rule_file);
+    const repoRootWithSep = repoRoot.endsWith(platformSep) ? repoRoot : repoRoot + platformSep;
+    if (!resolvedRule.startsWith(repoRootWithSep) && resolvedRule !== repoRoot) {
+        return error({
+            code: "verify-rule-file-outside-repo",
+            message: `verify rule_file "${cfg.rule_file}" resolves outside the repo root ` +
+                `(${resolvedRule}). Refusing to invoke semgrep with a non-repo rule file.`,
+            pointer,
+        });
+    }
+    // Existence check.
+    try {
+        await access(resolvedRule);
+    }
+    catch {
+        return warning({
+            code: "verify-rule-file-missing",
+            message: `verify rule_file "${cfg.rule_file}" does not exist or is not readable at ${resolvedRule}.`,
+            pointer,
+        });
+    }
+    const targetGlob = cfg.expect_in ?? cfg.forbid_in;
+    if (!targetGlob)
+        return empty();
+    const files = await collectMatches(repoRoot, targetGlob);
+    if (files.length === 0) {
+        return warning({
+            code: "verify-no-files-matched",
+            message: `Glob "${targetGlob}" matched 0 files; semgrep verify skipped.`,
+            pointer,
+        });
+    }
+    const absFiles = files.map(f => join(repoRoot, f));
+    let result;
+    try {
+        result = spawnSync("semgrep", ["--json", "--config", resolvedRule, ...absFiles], {
+            shell: true,
+            encoding: "buffer",
+            timeout: TIMEOUT_MS,
+            maxBuffer: MAX_BUFFER_BYTES,
+            cwd: repoRoot,
+        });
+    }
+    catch (err) {
+        return warning({
+            code: "verify-semgrep-unavailable",
+            message: `semgrep spawn failed: ${err instanceof Error ? err.message : String(err)}`,
+            pointer,
+        });
+    }
+    if (result.error || result.signal === "SIGTERM") {
+        return warning({
+            code: "verify-semgrep-unavailable",
+            message: `semgrep invocation failed: ${result.error?.message ?? "timeout after 60s"}`,
+            pointer,
+        });
+    }
+    const stderr = result.stderr.toString("utf8");
+    if (result.status !== 0) {
+        const ruleErrLine = stderr.split("\n").find(l => RULE_FILE_ERROR_SIGNALS.some(s => l.includes(s)));
+        if (ruleErrLine) {
+            return warning({
+                code: "verify-invalid-rule-file",
+                message: `semgrep rejected rule_file "${cfg.rule_file}": ${ruleErrLine.trim()}`,
+                pointer,
+            });
+        }
+        return warning({
+            code: "verify-semgrep-unavailable",
+            message: `semgrep exited with status ${result.status}. stderr: ${stderr.slice(0, 200)}`,
+            pointer,
+        });
+    }
+    let hits;
+    try {
+        const parsed = JSON.parse(result.stdout.toString("utf8"));
+        hits = parsed.results ?? [];
+    }
+    catch {
+        return warning({
+            code: "verify-semgrep-unavailable",
+            message: `semgrep stdout was not valid JSON. stderr: ${stderr.slice(0, 200)}`,
+            pointer,
+        });
+    }
+    if (cfg.expect_in !== undefined && hits.length === 0) {
+        return warning({
+            code: "verify-pattern-not-matched",
+            message: `semgrep rule_file "${cfg.rule_file}" did not match any occurrence ` +
+                `in "${targetGlob}".`,
+            pointer,
+        });
+    }
+    if (cfg.forbid_in !== undefined && hits.length > 0) {
+        return warnings(hits.slice(0, MAX_LISTED_HITS).map(h => ({
+            code: "verify-pattern-found-where-forbidden",
+            message: `semgrep rule_file "${cfg.rule_file}" matched at ${h.path}:${h.start.line} ` +
+                `in forbidden glob "${cfg.forbid_in}".`,
+            pointer,
+        })));
+    }
+    return empty();
+}
+//# sourceMappingURL=semgrep-rule-file-verifier.js.map