@fanzhen/agent-audit 0.3.0

package/dist/parsers/zcode.js

@@ -0,0 +1,333 @@
+// Parser: ZCode (Z.ai desktop IDE) local sqlite session store -> unified
+// events. v0.2.x multi-agent plan (M4); TS-only (no Python parity). Ground
+// truth: docs/superpowers/research/2026-09-20-zcode-forensics.md + live schema
+// introspection (PRAGMA table_info over a copy of ~/.zcode/cli/db/db.sqlite,
+// 2026-09-20 — schema complete, every DATA table 0 rows on this machine, so
+// fixtures are synthetic db files built with the real schema:
+// test/zcode-fixtures.ts).
+//
+// PRIVACY RED LINE (binding M4 decision): this parser touches ONLY the store
+// given to it plus its "-wal"/"-shm" siblings (copied, see below). It must
+// NEVER open ~/.zcode/v2/credentials.json, v2/tasks-index.sqlite, or any
+// JWT/token/cookie data. Columns read are exactly: session(id, directory,
+// slug), part(data: tool parts only), tool_usage(identity/timing). Message
+// text, input_history and permission rows are never read.
+//
+// SQLite access:
+//   - Needs the node:sqlite builtin (Node >= 22.5, flag-free on current
+//     builds). Discovery (agents.ts) gates on loadNodeSqlite() and skips the
+//     agent with a single stderr hint where it is missing; calling iterEvents
+//     directly without it REJECTS.
+//   - WAL copy strategy: ZCode keeps its db in journal_mode=wal and may be
+//     running while we read; a plain mode=ro open can miss -wal content or
+//     hit locks. Each parse run therefore copies db.sqlite (+ -wal/-shm when
+//     present) into a fresh os.tmpdir() directory (TMP/TEMP respected) and
+//     opens THE COPY read-write — a private file whose WAL is replayed there;
+//     the original is never written. Copies are removed in a finally block.
+//     A torn copy (store written between the copyFileSync calls) yields a
+//     stale-but-consistent snapshot at worst; SQLite guarantees the original
+//     cannot be corrupted by this.
+//
+// Schema -> events:
+//   The driver is tool_usage — ZCode's per-execution ledger (tool_call_id,
+//   tool_name, session_id, started_at, exit/bytes telemetry). It carries NO
+//   payload columns; tool INPUT lives in part.data JSON as a tool part
+//   (shape grep-verified in the zcode.cjs CLI bundle):
+//     {"type":"tool","callID":...,"tool":...,"state":{"status":...,
+//      "input":{...},"output":...,"title":...,"time":{...}}}
+//   so the parser preloads a callID -> input map from part (rows prefiltered
+//   with LIKE '%"type":"tool"%'; last row wins for retried/streamed parts)
+//   and joins on tool_usage.tool_call_id. message.data holds only role/time
+//   scaffolding (opencode lineage) — never read.
+//
+//   sessionId   : tool_usage.session_id (the FK itself; a missing session row
+//                 degrades project resolution, not the event).
+//   project     : session.directory -> session.slug -> session_id.
+//   ShellCommand.cwd: input.workdir -> input.cwd -> session.directory.
+//   timestamp   : tool_usage.started_at (action start). INTEGER time columns
+//                 are epoch values; >= 10^12 reads as milliseconds, else as
+//                 seconds (the unit is not observable on the 0-row live db;
+//                 opencode lineage is ms and the heuristic keeps both
+//                 parseable). NULL/0/garbage -> null timestamp, as elsewhere.
+//   ordering    : ORDER BY started_at ASC, rowid ASC (deterministic; SQLite
+//                 sorts NULL first on ASC).
+//   Reads are paged (LIMIT ? OFFSET ?) to bound memory; the generator stays
+//   async for the shared parser signature although sqlite reads are sync.
+//
+// Tool mapping (tool_name lowercased; payload from the joined part):
+//   shell-class  (bash, shell, code_execution, run_command, execute_command)
+//                 -> ShellCommand(input.command; string or string[] joined)
+//   file-class   (read, view, write, edit, multiedit, notebookedit, patch,
+//                 apply_patch, str_replace_editor,
+//                 str_replace_based_edit_tool)
+//                 -> FileWrite(filePath|path|file_path|notebook_path,
+//                              content = content|file_text|new_string).
+//                 READS are audited as content-less FileWrites on purpose
+//                 (kimi M1 precedent: the event model has no FileRead and
+//                 sensitive-config reads gate the same rules via isConfigPath).
+//                 todowrite is deliberately NOT file-class: todo lists are
+//                 not files.
+//   network-class(web_fetch, webfetch, fetchurl, fetch, web_search, websearch)
+//                 -> NetworkRequest(input.url | input.query)
+//   "mcp__<server>__<tool>" / "<server>__<tool>" -> McpToolCall (same split
+//                 as the codex parser); MCP identity lives entirely in the
+//                 tool name, so its event does not need the joined part —
+//                 argsHint is empty when the payload is missing.
+//   everything else (grep, glob, list, skill, task, agent, computer, ...)
+//                 -> skipped SILENTLY, counted as nothing (codex parser's
+//                 unknown-record policy: benign/navigational tools are most
+//                 of the traffic and are not "skipped data").
+//
+// Stats semantics (sqlite is not jsonl, so the line_* fields are redefined
+// here and ONLY here):
+//   linesTotal   = tool_usage rows read (candidate actions).
+//   linesSkipped = tool_usage rows that are corrupt/unmappable: a missing
+//                  session_id or tool_name, or an AUDITABLE-CLASS row whose
+//                  joined payload cannot yield its required field (part row
+//                  missing / part.data unparseable / input field mistyped).
+//   events       = events emitted (same aggregate as every other parser).
+import { copyFileSync, existsSync, mkdtempSync, rmSync } from "node:fs";
+import { createRequire } from "node:module";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { FileWrite, McpToolCall, NetworkRequest, ShellCommand, } from "../events.js";
+import { ParseStats, pyJsonDumps } from "./claude-code.js";
+// createRequire works in ESM and require()s the builtin synchronously — the
+// agent registry's find() is sync, so import() is not an option here.
+export const defaultSqliteLoader = (id) => createRequire(import.meta.url)(id);
+let sqliteLoader = defaultSqliteLoader;
+// Tests stub this to simulate a Node without the builtin.
+export function setSqliteLoaderForTests(loader) {
+    sqliteLoader = loader;
+}
+export function loadNodeSqlite() {
+    try {
+        const mod = sqliteLoader("node:sqlite");
+        return mod && typeof mod.DatabaseSync === "function" ? mod : null;
+    }
+    catch {
+        return null; // ERR_UNKNOWN_BUILTIN_MODULE on Node < 22.5, odd embedded builds
+    }
+}
+// --- tool classification -------------------------------------------------------
+// Exact lowercase sets (kimi/codex precedent: names are matched exactly, so a
+// future unrelated tool whose name happens to contain "read" can't mis-map).
+const SHELL_TOOLS = new Set([
+    "bash", "shell", "code_execution", "run_command", "execute_command",
+]);
+const FILE_TOOLS = new Set([
+    "read", "view", "write", "edit", "multiedit", "notebookedit", "patch",
+    "apply_patch", "str_replace_editor", "str_replace_based_edit_tool",
+]);
+const NETWORK_TOOLS = new Set([
+    "web_fetch", "webfetch", "fetchurl", "fetch", "web_search", "websearch",
+]);
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function str(value) {
+    return typeof value === "string" && value ? value : null;
+}
+// ShellCommand.raw: a string passes through, an array of strings joins with
+// spaces (codex parity); anything else -> null (unmappable).
+function joinCmd(raw) {
+    if (typeof raw === "string") {
+        return raw ? raw : null;
+    }
+    if (Array.isArray(raw)) {
+        const parts = raw.filter((p) => typeof p === "string");
+        if (parts.length === 0 || parts.length !== raw.length) {
+            return null;
+        }
+        return parts.join(" ");
+    }
+    return null;
+}
+// INTEGER epoch columns: >= 10^12 -> ms, else seconds (see header). Note the
+// seconds branch must come out at the SAME wall clock for pre-2001 values;
+// audit data is contemporary, so the split point is safe in practice.
+function parseEpochMs(raw) {
+    if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) {
+        return null;
+    }
+    return new Date(raw >= 1e12 ? raw : raw * 1000);
+}
+// One mapped event or the verdict "unmappable" (counted) vs null (benign,
+// silent). `name` is the lowercased tool_name; `input` the joined part payload
+// (null when no part row parsed for this call).
+function toZcodeEvent(name, input, sessionId, project, ts, sessionDir) {
+    if (SHELL_TOOLS.has(name)) {
+        const cmd = joinCmd(input ? input["command"] : undefined);
+        if (cmd === null) {
+            return { skip: true }; // shell execution whose command never landed
+        }
+        const cwd = str(input?.["workdir"]) ?? str(input?.["cwd"]) ?? sessionDir;
+        return { event: new ShellCommand(sessionId, project, ts, cmd, cwd) };
+    }
+    if (FILE_TOOLS.has(name)) {
+        const path = str(input?.["filePath"]) ?? str(input?.["path"]) ??
+            str(input?.["file_path"]) ?? str(input?.["notebook_path"]);
+        if (path === null) {
+            return { skip: true };
+        }
+        // "" is a legitimate (empty) write; only non-strings fall back to null.
+        const raw = input?.["content"] ?? input?.["file_text"] ?? input?.["new_string"];
+        const content = typeof raw === "string" ? raw : null;
+        return { event: new FileWrite(sessionId, project, ts, path, null, content) };
+    }
+    if (NETWORK_TOOLS.has(name)) {
+        const url = str(input?.["url"]) ?? str(input?.["query"]);
+        if (url === null) {
+            return { skip: true };
+        }
+        return { event: new NetworkRequest(sessionId, project, ts, url) };
+    }
+    if (name.startsWith("mcp__") || name.includes("__")) {
+        const body = name.startsWith("mcp__") ? name.slice("mcp__".length) : name;
+        const parts = body.split("__");
+        if (parts.length < 2 || !parts[0]) {
+            return { skip: true }; // not splittable into server__tool
+        }
+        const hint = input
+            ? pyJsonDumps(input).slice(0, 200)
+            : ""; // payload never landed; the name still identifies the call
+        return { event: new McpToolCall(sessionId, project, ts, parts[0], parts.slice(1).join("__"), hint) };
+    }
+    return null; // benign/navigational tool — silent, uncounted
+}
+// --- paged reads ----------------------------------------------------------------
+const PAGE_SIZE = 500;
+function eachRow(db, sql, visit) {
+    const stmt = db.prepare(sql);
+    let offset = 0;
+    for (;;) {
+        const rows = stmt.all(PAGE_SIZE, offset);
+        if (!Array.isArray(rows) || rows.length === 0) {
+            return;
+        }
+        for (const row of rows) {
+            if (isRecord(row)) {
+                visit(row);
+            }
+        }
+        if (rows.length < PAGE_SIZE) {
+            return;
+        }
+        offset += PAGE_SIZE;
+    }
+}
+// Loads callID -> state.input from tool parts (prefiltered in SQL; the JSON
+// parse is the real check). Corrupt/untool part rows are ignored: they are not
+// tool_usage rows, and the join simply misses — an auditable usage row whose
+// payload is corrupt is counted by the caller instead.
+function loadToolInputs(db) {
+    const inputs = new Map();
+    eachRow(db, `SELECT data FROM part WHERE data LIKE '%"type":"tool"%' ORDER BY rowid ASC LIMIT ? OFFSET ?`, (row) => {
+        let parsed;
+        try {
+            parsed = JSON.parse(typeof row["data"] === "string" ? row["data"] : "");
+        }
+        catch {
+            return;
+        }
+        if (!isRecord(parsed) || parsed["type"] !== "tool") {
+            return; // prefilter false positive (text quoting a tool part)
+        }
+        const callId = str(parsed["callID"]);
+        if (!callId) {
+            return;
+        }
+        const state = isRecord(parsed["state"]) ? parsed["state"] : {};
+        // Last row wins: retried/streamed parts append newer versions.
+        inputs.set(callId, isRecord(state["input"]) ? state["input"] : {});
+    });
+    return inputs;
+}
+function loadSessions(db) {
+    const sessions = new Map();
+    eachRow(db, `SELECT id, directory, slug FROM session ORDER BY rowid ASC LIMIT ? OFFSET ?`, (row) => {
+        const id = str(row["id"]);
+        if (id) {
+            sessions.set(id, { directory: str(row["directory"]), slug: str(row["slug"]) });
+        }
+    });
+    return sessions;
+}
+function* readStore(db, stats) {
+    const inputs = loadToolInputs(db);
+    const sessions = loadSessions(db);
+    const stmt = db.prepare(`SELECT session_id AS sessionId, tool_call_id AS callId, tool_name AS toolName,
+            started_at AS startedAt
+     FROM tool_usage ORDER BY started_at ASC, rowid ASC LIMIT ? OFFSET ?`);
+    let offset = 0;
+    for (;;) {
+        const rows = stmt.all(PAGE_SIZE, offset);
+        if (!Array.isArray(rows) || rows.length === 0) {
+            return;
+        }
+        for (const row of rows) {
+            if (!isRecord(row)) {
+                stats.linesSkipped += 1;
+                continue;
+            }
+            stats.linesTotal += 1;
+            const sessionId = str(row["sessionId"]);
+            const name = str(row["toolName"]);
+            if (sessionId === null || name === null) {
+                stats.linesSkipped += 1; // identity/classification impossible
+                continue;
+            }
+            const sess = sessions.get(sessionId);
+            const project = str(sess?.directory) ?? str(sess?.slug) ?? sessionId;
+            const ts = parseEpochMs(row["startedAt"]);
+            const input = str(row["callId"]) ? inputs.get(row["callId"]) ?? null : null;
+            const mapped = toZcodeEvent(name.trim().toLowerCase(), input, sessionId, project, ts, sess?.directory ?? null);
+            if (mapped === null) {
+                continue; // benign tool: silent (see header skip policy)
+            }
+            if ("skip" in mapped) {
+                stats.linesSkipped += 1; // auditable class, unusable payload
+                continue;
+            }
+            stats.events += 1;
+            yield mapped.event;
+        }
+        if (rows.length < PAGE_SIZE) {
+            return;
+        }
+        offset += PAGE_SIZE;
+    }
+}
+// --- entry point -----------------------------------------------------------------
+export async function* iterEvents(path, stats = new ParseStats()) {
+    const mod = loadNodeSqlite();
+    if (mod === null) {
+        throw new Error("node:sqlite is required to parse the ZCode session store (Node >= 22.5)");
+    }
+    const work = mkdtempSync(join(tmpdir(), "agentaudit-zcode-"));
+    const copyPath = join(work, "db.sqlite");
+    let db = null;
+    try {
+        copyFileSync(path, copyPath);
+        for (const suffix of ["-wal", "-shm"]) {
+            if (existsSync(path + suffix)) {
+                copyFileSync(path + suffix, copyPath + suffix);
+            }
+        }
+        // Open the COPY read-write on purpose: replaying its WAL may write (and
+        // close checkpoints); the original store is never touched.
+        db = new mod.DatabaseSync(copyPath);
+        yield* readStore(db, stats);
+    }
+    finally {
+        if (db !== null) {
+            try {
+                db.close();
+            }
+            catch {
+                // already closed / failed open — the rmSync below is what matters
+            }
+        }
+        rmSync(work, { recursive: true, force: true });
+    }
+}

package/dist/report.js

@@ -0,0 +1,176 @@
+// Report rendering: terminal (picocolors + cli-table3), JSON dict, share card.
+// Faithful port of src/agentaudit/report.py (Python is the spec).
+import Table from "cli-table3";
+import pc from "picocolors";
+import { SEVERITY_ORDER } from "./events.js";
+// Python: SEV_LABEL (also consumed by the CLI's --list-rules table)
+export const SEV_LABEL = {
+    critical: "CRITICAL",
+    high: "HIGH",
+    medium: "MEDIUM",
+    low: "LOW",
+    info: "INFO",
+};
+// Python: SEV_STYLE via picocolors — "bold white on red" -> white text on red
+// background, bolded. NOTE: picocolors colors UNCONDITIONALLY on win32 (even
+// off-TTY); the CLI layer must set NO_COLOR when stdout is not a TTY to match
+// rich's isatty gating.
+function colorSev(text, sev) {
+    switch (sev) {
+        case "critical":
+            return pc.bgRed(pc.bold(pc.white(text)));
+        case "high":
+            return pc.bold(pc.red(text));
+        case "medium":
+            return pc.yellow(text);
+        case "low":
+            return pc.cyan(text);
+        case "info":
+            return pc.dim(text);
+    }
+}
+// Python: _SEV_ORDERED = list(reversed(SEVERITY_ORDER))  # critical -> info
+const SEV_ORDERED = [...SEVERITY_ORDER].reverse();
+// Python datetime.isoformat() for tz-aware UTC values: "+00:00" offset,
+// microseconds included only when nonzero (6 digits). Parsed timestamps are
+// always UTC-normalized (Z inputs), so a UTC formatter is exact.
+function pyIso(d) {
+    const p = (n, w = 2) => String(n).padStart(w, "0");
+    const base = `${d.getUTCFullYear()}-${p(d.getUTCMonth() + 1)}-${p(d.getUTCDate())}` +
+        `T${p(d.getUTCHours())}:${p(d.getUTCMinutes())}:${p(d.getUTCSeconds())}`;
+    const us = d.getUTCMilliseconds() * 1000;
+    return us ? `${base}.${p(us, 6)}+00:00` : `${base}+00:00`;
+}
+export function severityCounts(findings) {
+    // zero-fill all five severities in critical->info order so the object is
+    // directly JSON-serializable as Python's by_severity (insertion order kept)
+    const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+    for (const f of findings) {
+        counts[f.severity] += 1;
+    }
+    return counts;
+}
+export function filterBySeverity(findings, floor) {
+    const floorIdx = SEVERITY_ORDER.indexOf(floor);
+    return findings.filter((f) => SEVERITY_ORDER.indexOf(f.severity) >= floorIdx);
+}
+// Python: re.split(r"[\\/]", project.replace("\\\\", "\\"))[-1] or project
+// (collapse doubled backslashes first, then take the last /-or-\-separated
+// segment; a trailing separator leaves an empty last segment -> whole string)
+function shortProject(project) {
+    const parts = project.replace(/\\\\/g, "\\").split(/[\\/]/);
+    return parts[parts.length - 1] || project;
+}
+// Python: ts.strftime("%m-%d %H:%M") if ts else "-"
+// UTC getters on purpose: Python stores tz-aware UTC datetimes (real data is
+// always Z-suffixed) and strftime prints the stored fields, which getUTC*
+// recovers exactly. Local getters would shift them outside UTC timezones.
+function shortTs(ts) {
+    if (!ts) {
+        return "-";
+    }
+    const p2 = (n) => String(n).padStart(2, "0");
+    return (`${p2(ts.getUTCMonth() + 1)}-${p2(ts.getUTCDate())} ` +
+        `${p2(ts.getUTCHours())}:${p2(ts.getUTCMinutes())}`);
+}
+// SGR sequences wrap whole segments, so border/padding math must measure the
+// visible (code-stripped) width while emitting colored content verbatim.
+const ANSI_SGR = /\u001B\[[0-9;]*m/g;
+function padEndVisible(text, width) {
+    return text + " ".repeat(Math.max(0, width - text.replace(ANSI_SGR, "").length));
+}
+// Python render_terminal(result, floor, console=None) -> the injected `write`
+// replaces Console(file=buf) for tests; default writes to process.stdout.
+export function renderTerminal(result, floor = "low", write = (chunk) => process.stdout.write(chunk)) {
+    const out = (line) => write(`${line}\n`);
+    const findings = filterBySeverity(result.findings, floor);
+    const counts = severityCounts(findings);
+    // summary block (Python: rich Panel titled "agentaudit", expand=False)
+    const summaryLine = `files ${result.filesScanned} · sessions ${result.sessions.size} · ` +
+        `events ${result.events} · findings ${findings.length}`;
+    const sevLine = SEV_ORDERED.map((sev) => `${counts[sev]} ${colorSev(SEV_LABEL[sev], sev)}`).join("  ");
+    const width = Math.max(summaryLine.length, sevLine.replace(ANSI_SGR, "").length);
+    out(`┌─ agentaudit ${"─".repeat(Math.max(0, width - 11))}┐`);
+    out(`│ ${padEndVisible(summaryLine, width)} │`);
+    out(`│ ${padEndVisible(sevLine, width)} │`);
+    out(`└${"─".repeat(width + 2)}┘`);
+    // 7-col table. rich ratios SEV8/RULE6/FINDING30/PROJECT16/SESSION10/WHEN11/
+    // EVIDENCE40 are usable text width, but cli-table3 colWidths INCLUDE the
+    // 1+1 padding, so each is widened by 2. wordWrap + wrapOnWordBoundary:false
+    // reproduces rich's overflow="fold": hard character fold, never the
+    // ellipsis truncation cli-table3 defaults to on unbroken strings.
+    // Evidence cells stay RAW text: cli-table3 interprets nothing, so the rich
+    // markup-injection pitfall (evidence "del /s [/etc] /q") has no TS
+    // equivalent to defend against.
+    const table = new Table({
+        head: ["SEV", "RULE", "FINDING", "PROJECT", "SESSION", "WHEN", "EVIDENCE"],
+        colWidths: [10, 8, 32, 18, 12, 13, 42],
+        wordWrap: true,
+        wrapOnWordBoundary: false,
+        style: { head: [], border: [] },
+    });
+    for (const f of findings.slice(0, 200)) {
+        table.push([
+            // plain label: Python passes SEV_LABEL as a plain str too — SEV_STYLE
+            // colors only the summary panel's severity line (and a colored cell
+            // would be split mid-escape-sequence by cli-table3's hard fold)
+            SEV_LABEL[f.severity],
+            f.ruleId,
+            f.title,
+            shortProject(f.event.project),
+            f.event.sessionId.slice(0, 8),
+            shortTs(f.event.timestamp),
+            f.evidence,
+        ]);
+    }
+    out(table.toString());
+    if (result.linesSkipped) {
+        out(pc.dim(`skipped ${result.linesSkipped} malformed lines`));
+    }
+    if (result.filesFailed) {
+        out(pc.yellow(`failed to read ${result.filesFailed} file(s)`));
+    }
+    if (findings.length > 200) {
+        out(pc.dim(`showing first 200 of ${findings.length} findings`));
+    }
+}
+export function toDict(result) {
+    const counts = severityCounts(result.findings);
+    return {
+        summary: {
+            files: result.filesScanned,
+            files_failed: result.filesFailed,
+            sessions: result.sessions.size,
+            events: result.events,
+            lines_skipped: result.linesSkipped,
+            total: result.findings.length,
+            // severityCounts zero-fills in critical->info order, matching Python's
+            // {sev.value: counts[sev] for sev in _SEV_ORDERED}
+            by_severity: { ...counts },
+            by_agent: { ...result.byAgent },
+        },
+        findings: result.findings.map((f) => ({
+            rule_id: f.ruleId,
+            severity: f.severity,
+            title: f.title,
+            evidence: f.evidence,
+            project: f.event.project,
+            session_id: f.event.sessionId,
+            // Python: datetime.isoformat() emits "+00:00" offsets and omits
+            // microseconds when zero — NOT what toISOString() produces ("Z",
+            // always ".000"). pyIso mirrors it for byte-identical JSON output.
+            timestamp: f.event.timestamp ? pyIso(f.event.timestamp) : null,
+            explanation: f.explanation,
+            recommendation: f.recommendation,
+        })),
+    };
+}
+export function shareCard(result) {
+    const counts = severityCounts(result.findings);
+    const stats = SEV_ORDERED.filter((sev) => counts[sev] > 0)
+        .map((sev) => `${SEV_LABEL[sev]} ${counts[sev]}`)
+        .join(" · ") || "no findings";
+    return ("──── agent-audit · AI agent safety report ────\n" +
+        `Sessions: ${result.sessions.size}   ${stats}\n` +
+        "Audit your own agents → npx @fanzhen/agent-audit");
+}

package/dist/rules/base.js

@@ -0,0 +1,68 @@
+// Ported 1:1 from src/agentaudit/rules/base.py (Python implementation is the spec).
+import { FileWrite, McpToolCall, NetworkRequest, ShellCommand, } from "../events.js";
+export function evidenceOf(event) {
+    if (event instanceof ShellCommand) {
+        return event.raw;
+    }
+    if (event instanceof FileWrite) {
+        // path only — to match written content, write a custom Rule.check()
+        return event.path;
+    }
+    if (event instanceof NetworkRequest) {
+        return event.url;
+    }
+    if (event instanceof McpToolCall) {
+        return `${event.server}::${event.tool} ${event.argsHint}`;
+    }
+    return "";
+}
+export class Rule {
+    id = "?";
+    severity = "low";
+    title = "";
+    explanation = "";
+    recommendation = "";
+    appliesTo = [ShellCommand];
+    check(event) {
+        throw new Error("NotImplementedError");
+    }
+}
+export class RegexRule extends Rule {
+    // JS porting note: in Python, `pattern` is a class attribute that subclasses
+    // override, visible to the base __init__ via attribute lookup. JS instance
+    // fields are NOT visible to the base constructor (subclass field initializers
+    // only run after super() returns), so subclasses override the *static*
+    // `pattern` instead, and the constructor reads it via this.constructor.
+    static pattern = "";
+    re;
+    constructor() {
+        super();
+        const ctor = this.constructor;
+        if (!ctor.pattern) {
+            throw new Error(`${ctor.name}.pattern is empty`);
+        }
+        this.re = new RegExp(ctor.pattern, "i");
+    }
+    check(event) {
+        if (!this.appliesTo.some((ctor) => event instanceof ctor)) {
+            return null;
+        }
+        const text = evidenceOf(event);
+        if (!text) {
+            return null;
+        }
+        const m = this.re.exec(text);
+        if (!m) {
+            return null;
+        }
+        return {
+            ruleId: this.id,
+            severity: this.severity,
+            title: this.title,
+            event,
+            evidence: m[0].slice(0, 200),
+            explanation: this.explanation,
+            recommendation: this.recommendation,
+        };
+    }
+}