@feiyoug/skill-lab 0.0.0 → 0.0.2

package/script/analyzer/mod.js

@@ -1,16 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Analyzer = exports.DEFAULT_SKILL_VERSION = exports.DEFAULT_CONFIG = void 0;
+exports.Analyzer = exports.resolveConfig = exports.DEFAULT_SKILL_VERSION = exports.DEFAULT_ANALYZER_CONFIG = exports.SkillAnalyzerResult = void 0;
 exports.runAnalysis = runAnalysis;
 exports.createInitialState = createInitialState;
-const config_js_1 = require("./config.js");
-const mod_js_1 = require("./steps/mod.js");
+const mod_js_1 = require("./config/mod.js");
+const logging_js_1 = require("./logging.js");
+const mod_js_2 = require("./steps/mod.js");
 const factory_js_1 = require("../skillreader/factory.js");
-const client_js_1 = require("./treesiter/client.js");
-const mod_js_2 = require("./astgrep/mod.js");
-var config_js_2 = require("./config.js");
-Object.defineProperty(exports, "DEFAULT_CONFIG", { enumerable: true, get: function () { return config_js_2.DEFAULT_CONFIG; } });
-Object.defineProperty(exports, "DEFAULT_SKILL_VERSION", { enumerable: true, get: function () { return config_js_2.DEFAULT_SKILL_VERSION; } });
+const client_js_1 = require("./treesitter/client.js");
+const mod_js_3 = require("./astgrep/mod.js");
+var result_js_1 = require("./result.js");
+Object.defineProperty(exports, "SkillAnalyzerResult", { enumerable: true, get: function () { return result_js_1.SkillAnalyzerResult; } });
+var mod_js_4 = require("./config/mod.js");
+Object.defineProperty(exports, "DEFAULT_ANALYZER_CONFIG", { enumerable: true, get: function () { return mod_js_4.DEFAULT_ANALYZER_CONFIG; } });
+Object.defineProperty(exports, "DEFAULT_SKILL_VERSION", { enumerable: true, get: function () { return mod_js_4.DEFAULT_SKILL_VERSION; } });
+Object.defineProperty(exports, "resolveConfig", { enumerable: true, get: function () { return mod_js_4.resolveConfig; } });
 class Analyzer {
     analyze(input) {
         return runAnalysis({
@@ -23,34 +27,48 @@ class Analyzer {
             skillId: input.skillId,
             skillVersionId: input.skillVersionId,
             config: input.config,
+            logger: input.logger,
+            showProgressBar: input.showProgressBar,
         });
     }
 }
 exports.Analyzer = Analyzer;
 async function runAnalysis(input) {
+    const config = (0, mod_js_1.resolveConfig)(input.config);
     let state = createInitialState({
         skillId: input.skillId,
         skillVersionId: input.skillVersionId,
-        config: input.config,
+        config,
     });
     const skillReader = await factory_js_1.SkillReaderFactory.create(input.options);
     const validation = await skillReader.validate();
     if (!validation.ok) {
         throw new Error(validation.reason ?? "Invalid skill repository");
     }
+    const logger = input.logger ?? logging_js_1.NO_OP_LOGGER;
+    const showProgressBar = input.showProgressBar ?? false;
     const context = {
         skillReader,
-        treesitterClient: new client_js_1.TreesitterClient(),
-        astgrepClient: new mod_js_2.AstGrepClient(),
+        treesitterClient: new client_js_1.TreesitterClient(logger, showProgressBar),
+        astgrepClient: new mod_js_3.AstGrepClient(logger, showProgressBar),
+        logger,
+        showProgressBar,
+        config,
     };
-    state = await (0, mod_js_1.run001Discovery)(state, context);
-    state = await (0, mod_js_1.run002Permissions)(state, context);
-    return (0, mod_js_1.run003Risks)(state);
+    state = await (0, mod_js_2.run001Discovery)(state, context);
+    state = await (0, mod_js_2.run002Permissions)(state, context);
+    return await (0, mod_js_2.run003Risks)(state, context);
 }
 function createInitialState(input) {
+    const resolvedConfig = (0, mod_js_1.resolveConfig)(input?.config);
+    const scan = resolvedConfig.scan ?? mod_js_1.DEFAULT_ANALYZER_CONFIG.scan ?? {
+        maxFileSize: 1_000_000,
+        maxFileCount: 100,
+        maxScanDepth: 5,
+    };
     return {
         skillId: input?.skillId ?? "unknown",
-        skillVersionId: input?.skillVersionId ?? config_js_1.DEFAULT_SKILL_VERSION,
+        skillVersionId: input?.skillVersionId ?? mod_js_1.DEFAULT_SKILL_VERSION,
         files: [],
         frontmatter: {},
         scanQueue: [],
@@ -59,13 +77,10 @@ function createInitialState(input) {
         risks: [],
         warnings: [],
         metadata: {
-            scannedFiles: [],
+            scannedFiles: new Set(),
             skippedFiles: [],
             rulesUsed: [],
-            config: {
-                ...config_js_1.DEFAULT_CONFIG,
-                ...(input?.config ?? {}),
-            },
+            config: scan,
         },
     };
 }

package/script/analyzer/result.d.ts

@@ -0,0 +1,35 @@
+import type { Permission, Risk } from "../shared/mod.js";
+import type { AnalyzerConfig } from "./config/mod.js";
+import type { AnalyzerState, ScanConfig } from "./types.js";
+export declare class SkillAnalyzerResult {
+    private readonly state;
+    private readonly config;
+    readonly analyzedAt: string;
+    private _score;
+    private _riskLevel;
+    private _summary;
+    constructor(state: AnalyzerState, config?: AnalyzerConfig);
+    get skillId(): string;
+    get skillVersionId(): string;
+    get permissions(): Permission[];
+    get risks(): Risk[];
+    get warnings(): string[];
+    get metadata(): {
+        scannedFiles: Set<string>;
+        skippedFiles: Array<{
+            path: string;
+            reason: string;
+        }>;
+        rulesUsed: string[];
+        frontmatterRangeEnd?: number;
+        config: ScanConfig;
+    };
+    get score(): number;
+    get riskLevel(): "safe" | "caution" | "attention" | "risky" | "avoid";
+    get summary(): string;
+    private _ensureScored;
+    toString(): string;
+    toJson(): string;
+    toSarif(toolVersion: string): Promise<string>;
+}
+//# sourceMappingURL=result.d.ts.map

package/script/analyzer/result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../../src/analyzer/result.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAGzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA8D5D,qBAAa,mBAAmB;IAQxB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAR3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,UAAU,CAAmE;IACrF,OAAO,CAAC,QAAQ,CAAqB;gBAGhB,KAAK,EAAE,aAAa,EACpB,MAAM,GAAE,cAAwC;IAKrE,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED,IAAI,WAAW,IAAI,UAAU,EAAE,CAE9B;IAED,IAAI,KAAK,IAAI,IAAI,EAAE,CAElB;IAED,IAAI,QAAQ,IAAI,MAAM,EAAE,CAEvB;IAED,IAAI,QAAQ,IAAI;QACZ,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,YAAY,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACtD,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,MAAM,EAAE,UAAU,CAAC;KACtB,CAEA;IAED,IAAI,KAAK,IAAI,MAAM,CAElB;IAED,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,GAAG,OAAO,CAEpE;IAED,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,OAAO,CAAC,aAAa;IAkBrB,QAAQ,IAAI,MAAM;IAoGlB,MAAM,IAAI,MAAM;IA0BV,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAyFtD"}

package/script/analyzer/result.js

@@ -0,0 +1,315 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SkillAnalyzerResult = void 0;
+const scoring_js_1 = require("./steps/003-risks/scoring.js");
+const mod_js_1 = require("./config/mod.js");
+const INDENT = "  ";
+const SUB_INDENT = "    ";
+// ---------------------------------------------------------------------------
+// SkillAnalyzerResult class
+// ---------------------------------------------------------------------------
+class SkillAnalyzerResult {
+    constructor(state, config = mod_js_1.DEFAULT_ANALYZER_CONFIG) {
+        Object.defineProperty(this, "state", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: state
+        });
+        Object.defineProperty(this, "config", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: config
+        });
+        Object.defineProperty(this, "analyzedAt", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "_score", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "_riskLevel", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "_summary", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.analyzedAt = new Date().toISOString();
+    }
+    get skillId() {
+        return this.state.skillId;
+    }
+    get skillVersionId() {
+        return this.state.skillVersionId;
+    }
+    get permissions() {
+        return this.state.permissions;
+    }
+    get risks() {
+        return this.state.risks;
+    }
+    get warnings() {
+        return this.state.warnings;
+    }
+    get metadata() {
+        return this.state.metadata;
+    }
+    get score() {
+        return this._ensureScored().score;
+    }
+    get riskLevel() {
+        return this._ensureScored().riskLevel;
+    }
+    get summary() {
+        return this._ensureScored().summary;
+    }
+    _ensureScored() {
+        if (this._score === undefined) {
+            const scored = (0, scoring_js_1.scoreState)(this.state, this.config);
+            this._score = scored.score;
+            this._riskLevel = scored.riskLevel;
+            this._summary = scored.summary;
+        }
+        return {
+            score: this._score,
+            riskLevel: this._riskLevel,
+            summary: this._summary,
+        };
+    }
+    // -----------------------------------------------------------------------
+    // toString() — human-readable terminal output
+    // -----------------------------------------------------------------------
+    toString() {
+        const lines = [];
+        const hr = "=".repeat(60);
+        lines.push(hr);
+        lines.push("Analysis Results");
+        lines.push(hr);
+        lines.push(`${INDENT}Skill: ${this.skillId}@${this.skillVersionId}`);
+        // lines.push("");
+        // lines.push(`${INDENT}Permissions (${this.permissions.length})`);
+        // if (this.permissions.length === 0) {
+        //     lines.push(`${SUB_INDENT}- none`);
+        // } else {
+        //     for (const p of this.permissions) {
+        //         lines.push(`${SUB_INDENT}- ${p.tool}.${p.permission} [${p.scope}]`);
+        //         if (p.args && p.args.length > 0) {
+        //             lines.push(`${SUB_INDENT}${INDENT}args: ${p.args.join(", ")}`);
+        //         }
+        //         lines.push(`${SUB_INDENT}${INDENT}source: ${p.source}`);
+        //         if (p.references.length > 0) {
+        //             lines.push(
+        //                 `${SUB_INDENT}${INDENT}ref: ${_formatRef(p.references[0])}`,
+        //             );
+        //         }
+        //     }
+        // }
+        lines.push("");
+        lines.push(`${INDENT}Risks (${this.risks.length})`);
+        if (this.risks.length === 0) {
+            lines.push(`${SUB_INDENT}- none`);
+        }
+        else {
+            const SEVERITY_ORDER = { critical: 0, warning: 1, info: 2 };
+            const groups = new Map();
+            for (const r of this.risks) {
+                const key = r.groupKey ?? `${r.type}:${r.reference.file}:${r.reference.line}`;
+                const bucket = groups.get(key) ?? [];
+                bucket.push(r);
+                groups.set(key, bucket);
+            }
+            const sortedGroups = Array.from(groups.entries())
+                .map(([groupKey, risks]) => ({
+                groupKey,
+                risks,
+                sortKey: Math.min(...risks.map((r) => SEVERITY_ORDER[r.severity] ?? 99)),
+            }))
+                .sort((a, b) => a.sortKey - b.sortKey);
+            for (const group of sortedGroups) {
+                if (group.risks.length === 1) {
+                    const r = group.risks[0];
+                    lines.push(`${SUB_INDENT}- ${r.severity} ${r.type}`);
+                    lines.push(`${SUB_INDENT}${INDENT}message: ${r.message}`);
+                    lines.push(`${SUB_INDENT}${INDENT}ref: ${_formatRef(r.reference)}`);
+                    if (r.permissions.length > 0) {
+                        lines.push(`${SUB_INDENT}${INDENT}permissions: ${r.permissions.join(", ")}`);
+                    }
+                    continue;
+                }
+                const topRisk = group.risks.reduce((best, r) => (SEVERITY_ORDER[r.severity] ?? 99) < (SEVERITY_ORDER[best.severity] ?? 99)
+                    ? r
+                    : best);
+                lines.push(`${SUB_INDENT}[${group.groupKey}] (${topRisk.severity})`);
+                for (const r of group.risks) {
+                    lines.push(`${SUB_INDENT}${INDENT}- ${r.message}`);
+                    lines.push(`${SUB_INDENT}${INDENT}  ref: ${_formatRef(r.reference)}`);
+                }
+            }
+        }
+        lines.push("");
+        lines.push(`${INDENT}Warnings (${this.warnings.length})`);
+        if (this.warnings.length === 0) {
+            lines.push(`${SUB_INDENT}- none`);
+        }
+        else {
+            for (const w of this.warnings) {
+                lines.push(`${SUB_INDENT}- ${w}`);
+            }
+        }
+        lines.push("");
+        lines.push(`${INDENT}Risk Level: ${this.riskLevel}`);
+        lines.push(`${INDENT}Score: ${this.score}`);
+        lines.push(`${INDENT}Summary: ${this.summary}`);
+        return lines.join("\n");
+    }
+    // -----------------------------------------------------------------------
+    // toJson() — plain JSON matching legacy AnalyzerResult shape
+    // -----------------------------------------------------------------------
+    toJson() {
+        return JSON.stringify({
+            analyzedAt: this.analyzedAt,
+            skillId: this.skillId,
+            skillVersionId: this.skillVersionId,
+            permissions: this.permissions,
+            risks: this.risks,
+            score: this.score,
+            riskLevel: this.riskLevel,
+            summary: this.summary,
+            warnings: this.warnings,
+            metadata: {
+                ...this.metadata,
+                scannedFiles: [...this.metadata.scannedFiles],
+            },
+        }, null, 2);
+    }
+    // -----------------------------------------------------------------------
+    // toSarif() — SARIF 2.1.0 for GitHub Code Scanning
+    // -----------------------------------------------------------------------
+    async toSarif(toolVersion) {
+        // --- rules ---
+        const rules = [];
+        const seenRiskTypes = new Set();
+        for (const r of this.risks) {
+            if (!seenRiskTypes.has(r.type)) {
+                seenRiskTypes.add(r.type);
+                rules.push({
+                    id: r.type,
+                    shortDescription: { text: r.type },
+                    help: { text: r.message },
+                    properties: { tags: ["security"] },
+                });
+            }
+        }
+        if (this.warnings.length > 0) {
+            rules.push({
+                id: "slab/warning",
+                shortDescription: { text: "Analysis warning" },
+                help: { text: "Warnings produced during skill analysis." },
+                properties: { tags: ["maintainability"] },
+            });
+        }
+        for (const p of this.permissions) {
+            rules.push({
+                id: p.id,
+                shortDescription: { text: `${p.tool}.${p.permission} [${p.scope}]` },
+                help: {
+                    text: p.comment ??
+                        `Permission detected: ${p.tool} ${p.permission} (${p.scope})`,
+                },
+                properties: { tags: ["permissions"] },
+            });
+        }
+        // --- results ---
+        const results = [];
+        for (const r of this.risks) {
+            const fp = await _fingerprint(`${r.type}:${r.reference.file}:${r.reference.line}`);
+            results.push({
+                ruleId: r.type,
+                level: _sarifLevel(r.severity),
+                message: { text: r.message },
+                locations: [
+                    _sarifLocation(r.reference.file, r.reference.line, r.reference.lineEnd),
+                ],
+                fingerprints: { "slab/v1": fp },
+            });
+        }
+        for (const w of this.warnings) {
+            results.push({
+                ruleId: "slab/warning",
+                level: "note",
+                message: { text: w },
+                locations: [_sarifLocation("SKILL.md", 1)],
+            });
+        }
+        // --- artifacts ---
+        const artifacts = [...this.metadata.scannedFiles].map((f) => ({
+            location: { uri: f, uriBaseId: "%SRCROOT%" },
+        }));
+        const log = {
+            $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+            version: "2.1.0",
+            runs: [
+                {
+                    tool: {
+                        driver: {
+                            name: "slab",
+                            version: toolVersion,
+                            informationUri: "https://github.com/FeiyouG/skill-lab",
+                            rules,
+                        },
+                    },
+                    results,
+                    artifacts,
+                },
+            ],
+        };
+        return JSON.stringify(log, null, 2);
+    }
+}
+exports.SkillAnalyzerResult = SkillAnalyzerResult;
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function _formatRef(ref) {
+    if (ref.lineEnd !== undefined && ref.lineEnd !== ref.line) {
+        return `${ref.file}:${ref.line}-${ref.lineEnd} (${ref.type})`;
+    }
+    return `${ref.file}:${ref.line} (${ref.type})`;
+}
+function _sarifLevel(severity) {
+    if (severity === "critical")
+        return "error";
+    if (severity === "warning")
+        return "warning";
+    return "note";
+}
+function _sarifLocation(file, startLine, endLine) {
+    const region = { startLine };
+    if (endLine !== undefined && endLine !== startLine) {
+        region.endLine = endLine;
+    }
+    return {
+        physicalLocation: {
+            artifactLocation: { uri: file, uriBaseId: "%SRCROOT%" },
+            region,
+        },
+    };
+}
+async function _fingerprint(input) {
+    const encoded = new TextEncoder().encode(input);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", encoded);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
+}

package/script/analyzer/rules/bash/commands/mod.d.ts

@@ -8,6 +8,7 @@ export * from "./gh.js";
 export * from "./git.js";
 export * from "./node.js";
 export * from "./openspec.js";
+export * from "./pip.js";
 export * from "./sudo.js";
 export declare const BASH_COMMAND_RULES: AstGrepRule[];
 //# sourceMappingURL=mod.d.ts.map

package/script/analyzer/rules/bash/commands/mod.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/mod.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAY9D,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAE1B,eAAO,MAAM,kBAAkB,EAAE,WAAW,EAW3C,CAAC"}
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/mod.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAa9D,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAE1B,eAAO,MAAM,kBAAkB,EAAE,WAAW,EAY3C,CAAC"}

package/script/analyzer/rules/bash/commands/mod.js

@@ -24,6 +24,7 @@ const gh_js_1 = require("./gh.js");
 const git_js_1 = require("./git.js");
 const node_js_1 = require("./node.js");
 const openspec_js_1 = require("./openspec.js");
+const pip_js_1 = require("./pip.js");
 const sudo_js_1 = require("./sudo.js");
 __exportStar(require("./bd.js"), exports);
 __exportStar(require("./cron.js"), exports);
@@ -34,11 +35,13 @@ __exportStar(require("./gh.js"), exports);
 __exportStar(require("./git.js"), exports);
 __exportStar(require("./node.js"), exports);
 __exportStar(require("./openspec.js"), exports);
+__exportStar(require("./pip.js"), exports);
 __exportStar(require("./sudo.js"), exports);
 exports.BASH_COMMAND_RULES = [
     ...git_js_1.GIT_RULES,
     ...gh_js_1.GH_RULES,
     ...node_js_1.NODE_ECOSYSTEM_RULES,
+    ...pip_js_1.PIP_RULES,
     ...docker_js_1.DOCKER_RULES,
     ...bd_js_1.BD_RULES,
     ...sudo_js_1.SUDO_RULES,

package/script/analyzer/rules/bash/commands/pip.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../../astgrep/client.js";
+export declare const PIP_RULES: AstGrepRule[];
+//# sourceMappingURL=pip.d.ts.map

package/script/analyzer/rules/bash/commands/pip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pip.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/pip.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,eAAO,MAAM,SAAS,EAAE,WAAW,EAalC,CAAC"}

package/script/analyzer/rules/bash/commands/pip.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PIP_RULES = void 0;
+exports.PIP_RULES = [
+    {
+        id: "shell-pip",
+        description: "Detects pip commands",
+        grammar: "bash",
+        patterns: ["pip $SUB $$$ARGS", "pip3 $SUB $$$ARGS"],
+        permission: {
+            tool: "pip",
+            scope: "sys",
+            permission: "shell",
+            metadata: { subcommand: "SUB" },
+        },
+    },
+];

package/script/analyzer/rules/bash/extractFileRefs.d.ts

@@ -9,5 +9,5 @@
  * Uses ast-grep AST traversal on `command` nodes.
  */
 import type { AnalyzerContext, FileRefDiscovery } from "../../types.js";
-export declare function extractBashFileRefs(context: AnalyzerContext, content: string): FileRefDiscovery[];
+export declare function extractBashFileRefs(context: AnalyzerContext, content: string): Promise<FileRefDiscovery[]>;
 //# sourceMappingURL=extractFileRefs.d.ts.map

package/script/analyzer/rules/bash/extractFileRefs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extractFileRefs.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/extractFileRefs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGxE,wBAAgB,mBAAmB,CAC/B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,gBAAgB,EAAE,CAkFpB"}
+{"version":3,"file":"extractFileRefs.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/extractFileRefs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGxE,wBAAsB,mBAAmB,CACrC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAkF7B"}

package/script/analyzer/rules/bash/extractFileRefs.js

@@ -13,9 +13,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractBashFileRefs = extractBashFileRefs;
 const file_refs_js_1 = require("../shared/file-refs.js");
 const astTypes_js_1 = require("./astTypes.js");
-function extractBashFileRefs(context, content) {
+async function extractBashFileRefs(context, content) {
     const refs = [];
-    const ast = context.astgrepClient.parse("bash", content);
+    const ast = await context.astgrepClient.parse("bash", content);
     const root = ast.root();
     const commandNodes = root.findAll({ rule: { kind: astTypes_js_1.BASH_NODE.COMMAND } });
     for (const node of commandNodes) {

package/script/analyzer/rules/bash/inline-command-classifier.d.ts

@@ -2,5 +2,5 @@ import type { AnalyzerContext } from "../../types.js";
 export declare function isLikelyInlineBashCommand(context: AnalyzerContext, input: {
     snippet: string;
     lineContext?: string;
-}): boolean;
+}): Promise<boolean>;
 //# sourceMappingURL=inline-command-classifier.d.ts.map

package/script/analyzer/rules/bash/inline-command-classifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inline-command-classifier.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/inline-command-classifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AA4CtD,wBAAgB,yBAAyB,CACrC,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD,OAAO,CAuBT"}
+{"version":3,"file":"inline-command-classifier.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/inline-command-classifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AA4CtD,wBAAsB,yBAAyB,CAC3C,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD,OAAO,CAAC,OAAO,CAAC,CAuBlB"}

package/script/analyzer/rules/bash/inline-command-classifier.js

@@ -33,7 +33,7 @@ const SPECIFIC_COMMAND_RULES = mod_js_1.BASH_COMMAND_RULES.filter((rule) => rule
 const KNOWN_COMMAND_TOOLS = new Set(SPECIFIC_COMMAND_RULES
     .map((rule) => String(rule.permission.tool ?? "").toLowerCase())
     .filter((tool) => tool && tool !== "detected"));
-function isLikelyInlineBashCommand(context, input) {
+async function isLikelyInlineBashCommand(context, input) {
     const snippet = normalizeInlineSnippet(input.snippet);
     if (!snippet)
         return false;
@@ -42,7 +42,7 @@ function isLikelyInlineBashCommand(context, input) {
     const tokens = snippet.split(/\s+/).filter(Boolean);
     if (tokens.length === 1 && (0, file_refs_js_1.looksLikePath)(snippet))
         return false;
-    if (matchesSpecificBashCommandRule(context, snippet))
+    if (await matchesSpecificBashCommandRule(context, snippet))
         return true;
     const firstToken = tokens[0]?.toLowerCase() ?? "";
     const hasContextVerb = CONTEXT_VERB_PATTERN.test(input.lineContext ?? "");
@@ -56,8 +56,8 @@ function isLikelyInlineBashCommand(context, input) {
     }
     return false;
 }
-function matchesSpecificBashCommandRule(context, snippet) {
-    const matches = context.astgrepClient.scanWithRules(snippet, "bash", SPECIFIC_COMMAND_RULES);
+async function matchesSpecificBashCommandRule(context, snippet) {
+    const matches = await context.astgrepClient.scanWithRules(snippet, "bash", SPECIFIC_COMMAND_RULES);
     return matches.length > 0;
 }
 function normalizeInlineSnippet(raw) {

package/script/analyzer/rules/javascript/extractFileRefs.d.ts

@@ -7,10 +7,9 @@
  * - URL string literals used in fetch/axios/XMLHttpRequest → via: "url"
  * - Host filesystem paths in fs.readFile / fs.writeFile / open calls → via: "bare-path"
  *
- * Uses ast-grep AST traversal; `context` is accepted for interface consistency
- * (AST client is synchronous for JS/TS and does not require async setup).
+ * Uses ast-grep AST traversal.
  */
 import type { AnalyzerContext, FileRefDiscovery } from "../../types.js";
-export declare function extractJsFileRefs(context: AnalyzerContext, content: string): FileRefDiscovery[];
-export declare function extractTsFileRefs(context: AnalyzerContext, content: string): FileRefDiscovery[];
+export declare function extractJsFileRefs(context: AnalyzerContext, content: string): Promise<FileRefDiscovery[]>;
+export declare function extractTsFileRefs(context: AnalyzerContext, content: string): Promise<FileRefDiscovery[]>;
 //# sourceMappingURL=extractFileRefs.d.ts.map

package/script/analyzer/rules/javascript/extractFileRefs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extractFileRefs.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/javascript/extractFileRefs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAyGxE,wBAAgB,iBAAiB,CAC7B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,gBAAgB,EAAE,CAEpB;AAED,wBAAgB,iBAAiB,CAC7B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,gBAAgB,EAAE,CAEpB"}
+{"version":3,"file":"extractFileRefs.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/javascript/extractFileRefs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAyGxE,wBAAgB,iBAAiB,CAC7B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE7B;AAED,wBAAgB,iBAAiB,CAC7B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE7B"}

package/script/analyzer/rules/javascript/extractFileRefs.js

@@ -8,17 +8,16 @@
  * - URL string literals used in fetch/axios/XMLHttpRequest → via: "url"
  * - Host filesystem paths in fs.readFile / fs.writeFile / open calls → via: "bare-path"
  *
- * Uses ast-grep AST traversal; `context` is accepted for interface consistency
- * (AST client is synchronous for JS/TS and does not require async setup).
+ * Uses ast-grep AST traversal.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractJsFileRefs = extractJsFileRefs;
 exports.extractTsFileRefs = extractTsFileRefs;
 const file_refs_js_1 = require("../shared/file-refs.js");
 const astTypes_js_1 = require("./astTypes.js");
-function extractJsLikeFileRefs(lang, context, content) {
+async function extractJsLikeFileRefs(lang, context, content) {
     const refs = [];
-    const ast = context.astgrepClient.parse(lang, content);
+    const ast = await context.astgrepClient.parse(lang, content);
     const root = ast.root();
     // ── import_statement ────────────────────────────────────────────────────
     const importNodes = root.findAll({ rule: { kind: astTypes_js_1.JS_NODE.IMPORT_STATEMENT } });

package/script/analyzer/rules/markdown/extractCodeBlocks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extractCodeBlocks.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/markdown/extractCodeBlocks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAgBjE;;;GAGG;AACH,wBAAsB,iBAAiB,CACnC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqFtB"}
+{"version":3,"file":"extractCodeBlocks.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/markdown/extractCodeBlocks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAIjE;;;GAGG;AACH,wBAAsB,iBAAiB,CACnC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,SAAS,EAAE,CAAC,CAwFtB"}