@clear-capabilities/agentic-security-scanner 0.172.0 → 0.173.0

package/dist/1336.index.js

@@ -9069,107 +9069,107 @@ function dbg(...args) {
 // === Body ===
 
 var ASM_CONSTS = {
-  21603448: () => { return current_async_call_id; },  
- 21603482: ($0) => { reject_async($0, new Error("Memory allocation failed")); },  
- 21603543: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
- 21603598: () => { return current_async_call_id; },  
- 21603632: ($0) => { reject_async($0, new Error("Memory allocation failed")); },  
- 21603693: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
- 21603748: () => { return current_async_call_id; },  
- 21603782: ($0) => { reject_async($0, new Error("Memory allocation failed")); },  
- 21603843: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
- 21603898: () => { return current_async_call_id; },  
- 21603932: ($0) => { reject_async($0, new Error("Memory allocation failed")); },  
- 21603993: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
- 21604048: () => { return current_async_call_id; },  
- 21604082: ($0) => { reject_async($0, new Error("Memory allocation failed")); },  
- 21604143: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
- 21604198: ($0, $1) => { resolve_async($1, $0); },  
- 21604225: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
- 21604291: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
- 21604342: () => { clearTimeout(threadTimeouts.shift()); },  
- 21604384: ($0, $1) => { resolve_async($1, $0); },  
- 21604411: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
- 21604477: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
- 21604528: () => { clearTimeout(threadTimeouts.shift()); },  
- 21604570: ($0, $1) => { resolve_async($1, $0); },  
- 21604597: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
- 21604663: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
- 21604714: () => { clearTimeout(threadTimeouts.shift()); },  
- 21604756: ($0, $1) => { resolve_async($1, $0); },  
- 21604783: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
- 21604849: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
- 21604900: () => { clearTimeout(threadTimeouts.shift()); },  
- 21604942: ($0, $1) => { resolve_async($1, $0); },  
- 21604969: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
- 21605035: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
- 21605086: () => { clearTimeout(threadTimeouts.shift()); },  
- 21605128: () => { return current_async_call_id; },  
- 21605162: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
- 21605217: ($0, $1) => { resolve_async($1, UTF8ToString($0)); },  
- 21605258: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
- 21605324: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
- 21605375: () => { clearTimeout(threadTimeouts.shift()); },  
- 21605417: () => { return current_async_call_id; },  
- 21605451: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
- 21605506: ($0, $1) => { resolve_async($1, $0); },  
- 21605533: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
- 21605599: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
- 21605650: () => { clearTimeout(threadTimeouts.shift()); },  
- 21605692: () => { return current_async_call_id; },  
- 21605726: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
- 21605781: ($0, $1) => { resolve_async($1, $0); },  
- 21605808: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
- 21605874: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
- 21605925: () => { clearTimeout(threadTimeouts.shift()); },  
- 21605967: () => { return current_async_call_id; },  
- 21606001: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
- 21606056: ($0, $1) => { resolve_async($1, $0); },  
- 21606083: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
- 21606149: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
- 21606200: () => { clearTimeout(threadTimeouts.shift()); },  
- 21606242: () => { return current_async_call_id; },  
- 21606276: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
- 21606331: ($0, $1) => { resolve_async($1, $0); },  
- 21606358: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
- 21606424: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
- 21606475: () => { clearTimeout(threadTimeouts.shift()); },  
- 21606517: () => { return current_async_call_id; },  
- 21606551: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
- 21606606: ($0, $1) => { resolve_async($1, $0); },  
- 21606633: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
- 21606699: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
- 21606750: () => { clearTimeout(threadTimeouts.shift()); },  
- 21606792: () => { return current_async_call_id; },  
- 21606826: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
- 21606881: ($0, $1) => { resolve_async($1, $0); },  
- 21606908: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
- 21606974: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
- 21607025: () => { clearTimeout(threadTimeouts.shift()); },  
- 21607067: () => { return current_async_call_id; },  
- 21607101: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
- 21607156: ($0, $1) => { resolve_async($1, $0); },  
- 21607183: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
- 21607249: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
- 21607300: () => { clearTimeout(threadTimeouts.shift()); },  
- 21607342: () => { return current_async_call_id; },  
- 21607376: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
- 21607431: ($0, $1) => { resolve_async($1, $0); },  
- 21607458: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
- 21607524: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
- 21607575: () => { clearTimeout(threadTimeouts.shift()); },  
- 21607617: () => { return current_async_call_id; },  
- 21607651: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
- 21607706: ($0, $1) => { resolve_async($1, $0); },  
- 21607733: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
- 21607799: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
- 21607850: () => { clearTimeout(threadTimeouts.shift()); },  
- 21607892: () => { return current_async_call_id; },  
- 21607926: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
- 21607981: ($0, $1) => { resolve_async($1, $0); },  
- 21608008: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
- 21608074: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
- 21608125: () => { clearTimeout(threadTimeouts.shift()); }
+  21603560: () => { return current_async_call_id; },  
+ 21603594: ($0) => { reject_async($0, new Error("Memory allocation failed")); },  
+ 21603655: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
+ 21603710: () => { return current_async_call_id; },  
+ 21603744: ($0) => { reject_async($0, new Error("Memory allocation failed")); },  
+ 21603805: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
+ 21603860: () => { return current_async_call_id; },  
+ 21603894: ($0) => { reject_async($0, new Error("Memory allocation failed")); },  
+ 21603955: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
+ 21604010: () => { return current_async_call_id; },  
+ 21604044: ($0) => { reject_async($0, new Error("Memory allocation failed")); },  
+ 21604105: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
+ 21604160: () => { return current_async_call_id; },  
+ 21604194: ($0) => { reject_async($0, new Error("Memory allocation failed")); },  
+ 21604255: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
+ 21604310: ($0, $1) => { resolve_async($1, $0); },  
+ 21604337: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
+ 21604403: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
+ 21604454: () => { clearTimeout(threadTimeouts.shift()); },  
+ 21604496: ($0, $1) => { resolve_async($1, $0); },  
+ 21604523: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
+ 21604589: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
+ 21604640: () => { clearTimeout(threadTimeouts.shift()); },  
+ 21604682: ($0, $1) => { resolve_async($1, $0); },  
+ 21604709: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
+ 21604775: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
+ 21604826: () => { clearTimeout(threadTimeouts.shift()); },  
+ 21604868: ($0, $1) => { resolve_async($1, $0); },  
+ 21604895: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
+ 21604961: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
+ 21605012: () => { clearTimeout(threadTimeouts.shift()); },  
+ 21605054: ($0, $1) => { resolve_async($1, $0); },  
+ 21605081: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
+ 21605147: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
+ 21605198: () => { clearTimeout(threadTimeouts.shift()); },  
+ 21605240: () => { return current_async_call_id; },  
+ 21605274: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
+ 21605329: ($0, $1) => { resolve_async($1, UTF8ToString($0)); },  
+ 21605370: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
+ 21605436: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
+ 21605487: () => { clearTimeout(threadTimeouts.shift()); },  
+ 21605529: () => { return current_async_call_id; },  
+ 21605563: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
+ 21605618: ($0, $1) => { resolve_async($1, $0); },  
+ 21605645: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
+ 21605711: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
+ 21605762: () => { clearTimeout(threadTimeouts.shift()); },  
+ 21605804: () => { return current_async_call_id; },  
+ 21605838: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
+ 21605893: ($0, $1) => { resolve_async($1, $0); },  
+ 21605920: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
+ 21605986: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
+ 21606037: () => { clearTimeout(threadTimeouts.shift()); },  
+ 21606079: () => { return current_async_call_id; },  
+ 21606113: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
+ 21606168: ($0, $1) => { resolve_async($1, $0); },  
+ 21606195: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
+ 21606261: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
+ 21606312: () => { clearTimeout(threadTimeouts.shift()); },  
+ 21606354: () => { return current_async_call_id; },  
+ 21606388: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
+ 21606443: ($0, $1) => { resolve_async($1, $0); },  
+ 21606470: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
+ 21606536: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
+ 21606587: () => { clearTimeout(threadTimeouts.shift()); },  
+ 21606629: () => { return current_async_call_id; },  
+ 21606663: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
+ 21606718: ($0, $1) => { resolve_async($1, $0); },  
+ 21606745: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
+ 21606811: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
+ 21606862: () => { clearTimeout(threadTimeouts.shift()); },  
+ 21606904: () => { return current_async_call_id; },  
+ 21606938: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
+ 21606993: ($0, $1) => { resolve_async($1, $0); },  
+ 21607020: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
+ 21607086: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
+ 21607137: () => { clearTimeout(threadTimeouts.shift()); },  
+ 21607179: () => { return current_async_call_id; },  
+ 21607213: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
+ 21607268: ($0, $1) => { resolve_async($1, $0); },  
+ 21607295: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
+ 21607361: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
+ 21607412: () => { clearTimeout(threadTimeouts.shift()); },  
+ 21607454: () => { return current_async_call_id; },  
+ 21607488: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
+ 21607543: ($0, $1) => { resolve_async($1, $0); },  
+ 21607570: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
+ 21607636: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
+ 21607687: () => { clearTimeout(threadTimeouts.shift()); },  
+ 21607729: () => { return current_async_call_id; },  
+ 21607763: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
+ 21607818: ($0, $1) => { resolve_async($1, $0); },  
+ 21607845: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
+ 21607911: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
+ 21607962: () => { clearTimeout(threadTimeouts.shift()); },  
+ 21608004: () => { return current_async_call_id; },  
+ 21608038: () => { threadTimeouts.push(setTimeout(() => {}, 600000)); },  
+ 21608093: ($0, $1) => { resolve_async($1, $0); },  
+ 21608120: ($0) => { reject_async($0, new Error('failed with unknown exception')); },  
+ 21608186: ($0, $1) => { reject_async($1, new Error(UTF8ToString($0))); },  
+ 21608237: () => { clearTimeout(threadTimeouts.shift()); }
 };
 
 // end include: preamble.js

package/dist/1351.index.js

@@ -0,0 +1,133 @@
+export const id = 1351;
+export const ids = [1351];
+export const modules = {
+
+/***/ 41351:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   discoverHarnessConfigs: () => (/* binding */ discoverHarnessConfigs),
+/* harmony export */   summarizeHarnessPresence: () => (/* binding */ summarizeHarnessPresence)
+/* harmony export */ });
+/* unused harmony export HARNESS_DIRS */
+/* harmony import */ var node_fs_promises__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(51455);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
+/* harmony import */ var node_os__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(48161);
+// Multi-harness configuration discovery.
+//
+// Finds every agent-harness configuration directory the user has, both at
+// the project root AND under ~/. The discovered files feed the
+// claude-settings / claude-md-prompt-injection / claude-hook-injection
+// detectors so we audit Claude / Cursor / Codex / Gemini / Kiro / OpenCode /
+// Trae / Qwen / Zed / Continue / Aider with one sweep.
+//
+// Used by the `/scan --harness` mode.
+
+
+
+
+
+const HARNESS_DIRS = [
+  '.claude', '.cursor', '.codex', '.gemini', '.kiro',
+  '.opencode', '.trae', '.qwen', '.zed', '.continue', '.aider',
+  '.codebuddy', '.copilot',
+];
+
+const HARNESS_FILES = [
+  // settings + permissions
+  'settings.json', 'settings.local.json', 'config.json',
+  // instruction files (lifted into context every session)
+  'CLAUDE.md', 'AGENTS.md', 'GEMINI.md', 'CURSOR.md', 'CODEX.md',
+  'KIRO.md', 'QWEN.md', 'TRAE.md', 'OPENCODE.md', 'SYSTEM_PROMPT.md',
+  // mcp
+  'mcp.json', '.mcp.json', 'mcp_servers.json', 'claude_desktop_config.json',
+  // hooks
+  'hooks.json', 'hooks.yml', 'hooks.yaml',
+];
+
+const HARNESS_SUBDIRS = ['agents', 'skills', 'commands', 'hooks', 'rules'];
+
+const MAX_FILE_SIZE = 1_000_000;
+
+async function _readSafe(fp) {
+  try {
+    const stat = await node_fs_promises__WEBPACK_IMPORTED_MODULE_0__.stat(fp);
+    if (stat.size > MAX_FILE_SIZE) return null;
+    return await node_fs_promises__WEBPACK_IMPORTED_MODULE_0__.readFile(fp, 'utf8');
+  } catch { return null; }
+}
+
+async function _walkHarnessDir(harnessRoot, harnessName, out) {
+  // Top-level config files.
+  for (const fn of HARNESS_FILES) {
+    const fp = node_path__WEBPACK_IMPORTED_MODULE_1__.join(harnessRoot, fn);
+    const content = await _readSafe(fp);
+    if (content !== null) out[fp] = content;
+  }
+  // Subdirs holding instruction-style files.
+  for (const sub of HARNESS_SUBDIRS) {
+    const dp = node_path__WEBPACK_IMPORTED_MODULE_1__.join(harnessRoot, sub);
+    try {
+      const entries = await node_fs_promises__WEBPACK_IMPORTED_MODULE_0__.readdir(dp, { withFileTypes: true });
+      for (const e of entries) {
+        if (!e.isFile()) continue;
+        if (!/\.(?:md|json|yaml|yml)$/i.test(e.name)) continue;
+        const fp = node_path__WEBPACK_IMPORTED_MODULE_1__.join(dp, e.name);
+        const content = await _readSafe(fp);
+        if (content !== null) out[fp] = content;
+      }
+    } catch { /* dir does not exist — fine */ }
+  }
+  // Project-root CLAUDE.md / AGENTS.md (some users put them outside .claude/).
+  // Only walked when the harness is .claude.
+  void harnessName;
+}
+
+// Discover harness configs at one of:
+//   1. The project root (e.g. /path/to/repo/.claude, /path/to/repo/.cursor)
+//   2. Home directory (e.g. ~/.claude, ~/.cursor) — opt-in via includeHome=true
+async function discoverHarnessConfigs(projectRoot, opts = {}) {
+  const includeHome = !!opts.includeHome;
+  const out = {};
+
+  // Project-rooted instruction files commonly placed at repo root.
+  for (const fn of ['CLAUDE.md', 'AGENTS.md', 'GEMINI.md', 'CURSOR.md', 'CODEX.md', 'KIRO.md', 'QWEN.md', 'TRAE.md', 'OPENCODE.md']) {
+    const fp = node_path__WEBPACK_IMPORTED_MODULE_1__.join(projectRoot, fn);
+    const content = await _readSafe(fp);
+    if (content !== null) out[fp] = content;
+  }
+
+  for (const dir of HARNESS_DIRS) {
+    const harnessRoot = node_path__WEBPACK_IMPORTED_MODULE_1__.join(projectRoot, dir);
+    try { await node_fs_promises__WEBPACK_IMPORTED_MODULE_0__.access(harnessRoot); } catch { continue; }
+    await _walkHarnessDir(harnessRoot, dir, out);
+  }
+
+  if (includeHome) {
+    const home = node_os__WEBPACK_IMPORTED_MODULE_2__.homedir();
+    if (home) {
+      for (const dir of HARNESS_DIRS) {
+        const harnessRoot = node_path__WEBPACK_IMPORTED_MODULE_1__.join(home, dir);
+        try { await node_fs_promises__WEBPACK_IMPORTED_MODULE_0__.access(harnessRoot); } catch { continue; }
+        await _walkHarnessDir(harnessRoot, dir, out);
+      }
+    }
+  }
+
+  return out;
+}
+
+// Inventory of which harnesses are present (for grade / summary).
+function summarizeHarnessPresence(fileContents) {
+  const present = new Set();
+  for (const fp of Object.keys(fileContents || {})) {
+    const m = /\.(claude|cursor|codex|gemini|kiro|opencode|trae|qwen|zed|continue|aider|codebuddy|copilot)[\\/]/.exec(fp);
+    if (m) present.add(m[1]);
+  }
+  return [...present].sort();
+}
+
+
+/***/ })
+
+};