@feiyoug/skill-lab 0.0.0 → 0.0.2

package/src/analyzer/rules/javascript/extractFileRefs.ts

@@ -0,0 +1,131 @@
+/**
+ * File reference extractor for JavaScript and TypeScript files.
+ *
+ * Detects:
+ * - import/export ... from "specifier" → via: "import"
+ * - require("specifier") → via: "import"
+ * - URL string literals used in fetch/axios/XMLHttpRequest → via: "url"
+ * - Host filesystem paths in fs.readFile / fs.writeFile / open calls → via: "bare-path"
+ *
+ * Uses ast-grep AST traversal.
+ */
+
+import { isHostFsPath, isUrl } from "../shared/file-refs.js";
+import type { AnalyzerContext, FileRefDiscovery } from "../../types.js";
+import { JS_NODE } from "./astTypes.js";
+
+async function extractJsLikeFileRefs(
+    lang: "javascript" | "typescript",
+    context: AnalyzerContext,
+    content: string,
+): Promise<FileRefDiscovery[]> {
+    const refs: FileRefDiscovery[] = [];
+
+    const ast = await context.astgrepClient.parse(lang, content);
+    const root = ast.root();
+
+    // ── import_statement ────────────────────────────────────────────────────
+    const importNodes = root.findAll({ rule: { kind: JS_NODE.IMPORT_STATEMENT } });
+    for (const node of importNodes) {
+        const sourceNode = node.field("source");
+        if (!sourceNode) continue;
+        const fragmentNode = sourceNode.find({ rule: { kind: JS_NODE.STRING_FRAGMENT } });
+        const specifier = fragmentNode?.text() ?? "";
+        if (specifier) {
+            refs.push({ path: specifier, line: node.range().start.line + 1, via: "import" });
+        }
+    }
+
+    // ── export_statement (re-exports only — export ... from "…") ────────────
+    const exportNodes = root.findAll({ rule: { kind: JS_NODE.EXPORT_STATEMENT } });
+    for (const node of exportNodes) {
+        const sourceNode = node.field("source");
+        if (!sourceNode) continue; // no `from` clause → local export, skip
+        const fragmentNode = sourceNode.find({ rule: { kind: JS_NODE.STRING_FRAGMENT } });
+        const specifier = fragmentNode?.text() ?? "";
+        if (specifier) {
+            refs.push({ path: specifier, line: node.range().start.line + 1, via: "import" });
+        }
+    }
+
+    // ── require("specifier") ────────────────────────────────────────────────
+    const requireNodes = root.findAll({
+        rule: {
+            kind: JS_NODE.CALL_EXPRESSION,
+            has: {
+                field: "function",
+                regex: "^require$",
+                stopBy: "neighbor",
+            },
+        },
+    });
+    for (const node of requireNodes) {
+        const argsNode = node.field("arguments");
+        if (!argsNode) continue;
+        const fragmentNode = argsNode.find({ rule: { kind: JS_NODE.STRING_FRAGMENT } });
+        const specifier = fragmentNode?.text() ?? "";
+        if (specifier) {
+            refs.push({ path: specifier, line: node.range().start.line + 1, via: "import" });
+        }
+    }
+
+    // ── fetch/axios/etc. URL calls ──────────────────────────────────────────
+    const urlCallNodes = root.findAll({
+        rule: {
+            kind: JS_NODE.CALL_EXPRESSION,
+            has: {
+                field: "function",
+                regex:
+                    "^(?:fetch|axios\\.(?:get|post|put|delete|patch|head)|XMLHttpRequest|request|got|superagent)$",
+                stopBy: "neighbor",
+            },
+        },
+    });
+    for (const node of urlCallNodes) {
+        const argsNode = node.field("arguments");
+        if (!argsNode) continue;
+        const fragmentNode = argsNode.find({ rule: { kind: JS_NODE.STRING_FRAGMENT } });
+        const url = fragmentNode?.text() ?? "";
+        if (url && isUrl(url)) {
+            refs.push({ path: url, line: node.range().start.line + 1, via: "url" });
+        }
+    }
+
+    // ── fs.* calls with host paths ──────────────────────────────────────────
+    const fsCallNodes = root.findAll({
+        rule: {
+            kind: JS_NODE.CALL_EXPRESSION,
+            has: {
+                field: "function",
+                regex:
+                    "^fs\\.(?:readFile|writeFile|appendFile|open|access|stat|unlink|mkdir|rmdir|rename|copyFile)$",
+                stopBy: "neighbor",
+            },
+        },
+    });
+    for (const node of fsCallNodes) {
+        const argsNode = node.field("arguments");
+        if (!argsNode) continue;
+        const fragmentNode = argsNode.find({ rule: { kind: JS_NODE.STRING_FRAGMENT } });
+        const path = fragmentNode?.text() ?? "";
+        if (path && isHostFsPath(path)) {
+            refs.push({ path, line: node.range().start.line + 1, via: "bare-path" });
+        }
+    }
+
+    return refs;
+}
+
+export function extractJsFileRefs(
+    context: AnalyzerContext,
+    content: string,
+): Promise<FileRefDiscovery[]> {
+    return extractJsLikeFileRefs("javascript", context, content);
+}
+
+export function extractTsFileRefs(
+    context: AnalyzerContext,
+    content: string,
+): Promise<FileRefDiscovery[]> {
+    return extractJsLikeFileRefs("typescript", context, content);
+}

package/src/analyzer/rules/javascript/filesystem.ts

@@ -0,0 +1,28 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+
+export const JAVASCRIPT_FILESYSTEM_RULES: AstGrepRule[] = [
+    {
+        id: "fs-read-js",
+        description: "Detects JS file reads",
+        grammar: "javascript",
+        patterns: ["Deno.readTextFile($FILE)", "Deno.readFile($FILE)", "readFileSync($FILE)"],
+        permission: {
+            tool: "read",
+            scope: "fs",
+            permission: "read",
+            metadata: { file: "FILE" },
+        },
+    },
+    {
+        id: "fs-write-js",
+        description: "Detects JS file writes",
+        grammar: "javascript",
+        patterns: ["Deno.writeTextFile($FILE, $CONTENT)", "Deno.writeFile($FILE, $CONTENT)"],
+        permission: {
+            tool: "write",
+            scope: "fs",
+            permission: "write",
+            metadata: { file: "FILE" },
+        },
+    },
+];

package/src/analyzer/rules/javascript/injection.ts

@@ -0,0 +1,21 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+
+export const JAVASCRIPT_INJECTION_RULES: AstGrepRule[] = [
+    {
+        id: "inject-eval",
+        description: "Detects eval-style execution",
+        grammar: "javascript",
+        patterns: ["eval($CODE)", "new Function($CODE)", "exec($CODE)"],
+        permission: {
+            tool: "eval",
+            scope: "sys",
+            permission: "shell",
+            metadata: { code: "CODE" },
+            mappedRisks: [{
+                code: "INJECTION:command_injection",
+                severity: "critical",
+                message: "Dynamic code execution detected",
+            }],
+        },
+    },
+];

package/src/analyzer/rules/javascript/mod.ts

@@ -0,0 +1,26 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+import { FileTypeConfig } from "../../types.js";
+import { extractJsFileRefs, extractTsFileRefs } from "./extractFileRefs.js";
+import { JAVASCRIPT_FILESYSTEM_RULES } from "./filesystem.js";
+import { JAVASCRIPT_INJECTION_RULES } from "./injection.js";
+import { JAVASCRIPT_NETWORK_RULES } from "./network.js";
+import { JAVASCRIPT_SECRET_DETECTION_RULES } from "./secret-detection.js";
+import { JAVASCRIPT_SUBPROCESS_RULES } from "./subprocess.js";
+
+export const JAVASCRIPT_RULES: AstGrepRule[] = [
+    ...JAVASCRIPT_NETWORK_RULES,
+    ...JAVASCRIPT_FILESYSTEM_RULES,
+    ...JAVASCRIPT_INJECTION_RULES,
+    ...JAVASCRIPT_SUBPROCESS_RULES,
+    ...JAVASCRIPT_SECRET_DETECTION_RULES,
+];
+
+export const JAVASCRIPT_FILETYPE_CONFIGS: FileTypeConfig = {
+    defaultLanguage: "javascript",
+    extractFileRefs: extractJsFileRefs,
+};
+
+export const TYPESCRIPT_FILETYPE_CONFIGS: FileTypeConfig = {
+    defaultLanguage: "typescript",
+    extractFileRefs: extractTsFileRefs,
+};

package/src/analyzer/rules/javascript/network.ts

@@ -0,0 +1,27 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+import { DETECT_NETWORK_FETCH_RISKS } from "../shared/network-evaluators.js";
+
+export const JAVASCRIPT_NETWORK_RULES: AstGrepRule[] = [
+    {
+        id: "net-fetch",
+        description: "Detects fetch() calls",
+        grammar: "javascript",
+        patterns: [
+            "fetch($URL)",
+            "fetch($URL, { method: $METHOD })",
+            "fetch($URL, { headers: $HEADERS })",
+            "fetch($URL, { method: $METHOD, headers: $HEADERS })",
+        ],
+        permission: {
+            tool: "fetch",
+            scope: "net",
+            permission: "fetch",
+            metadata: {
+                url: "URL",
+                method: "METHOD",
+                headers: "HEADERS",
+            },
+            mappedRisks: [DETECT_NETWORK_FETCH_RISKS],
+        },
+    },
+];

package/src/analyzer/rules/javascript/secret-detection.ts

@@ -0,0 +1,68 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+import { DETECT_SECRET_NAME_RISK } from "../shared/secret-evaluators.js";
+
+export const JAVASCRIPT_SECRET_DETECTION_RULES: AstGrepRule[] = [
+    {
+        id: "secret-js-deno-env-read",
+        description: "Detects Deno.env.get access",
+        grammar: "javascript",
+        patterns: ["Deno.env.get($KEY)"],
+        permission: {
+            tool: "env",
+            scope: "env",
+            permission: "read",
+            metadata: { key: "KEY" },
+            mappedRisks: [DETECT_SECRET_NAME_RISK],
+        },
+    },
+    {
+        id: "secret-js-node-env-read-bracket",
+        description: "Detects process.env[key] access",
+        grammar: "javascript",
+        patterns: ["process.env[$KEY]"],
+        permission: {
+            tool: "env",
+            scope: "env",
+            permission: "read",
+            metadata: { key: "KEY" },
+            mappedRisks: [DETECT_SECRET_NAME_RISK],
+        },
+    },
+    {
+        id: "secret-js-node-env-read-dot",
+        description: "Detects process.env.KEY access",
+        grammar: "javascript",
+        patterns: ["process.env.$KEY"],
+        permission: {
+            tool: "env",
+            scope: "env",
+            permission: "read",
+            metadata: { key: "KEY" },
+            mappedRisks: [DETECT_SECRET_NAME_RISK],
+        },
+    },
+    {
+        id: "secret-js-deno-env-write",
+        description: "Detects Deno.env.set access",
+        grammar: "javascript",
+        patterns: ["Deno.env.set($KEY, $VALUE)"],
+        permission: {
+            tool: "env",
+            scope: "env",
+            permission: "write",
+            metadata: { key: "KEY" },
+        },
+    },
+    {
+        id: "secret-js-node-env-write",
+        description: "Detects process.env assignments",
+        grammar: "javascript",
+        patterns: ["process.env.$KEY = $VALUE", "process.env[$KEY] = $VALUE"],
+        permission: {
+            tool: "env",
+            scope: "env",
+            permission: "write",
+            metadata: { key: "KEY" },
+        },
+    },
+];

package/src/analyzer/rules/javascript/subprocess.ts

@@ -0,0 +1,16 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+
+export const JAVASCRIPT_SUBPROCESS_RULES: AstGrepRule[] = [
+    {
+        id: "shell-subprocess-js",
+        description: "Detects JS subprocess execution",
+        grammar: "javascript",
+        patterns: ["Deno.Command($CMD)", "spawn($CMD)", "exec($CMD)"],
+        permission: {
+            tool: "subprocess",
+            scope: "sys",
+            permission: "subprocess",
+            metadata: { command: "CMD" },
+        },
+    },
+];

package/src/analyzer/rules/markdown/astTypes.ts

@@ -0,0 +1,35 @@
+/** ast-grep node types for the Markdown block grammar (@ast-grep/lang-markdown). */
+export const MARKDOWN_NODE = {
+    CODE_FENCE_BLOCK: "fenced_code_block",
+    CODE_FENCE_CONTENT: "code_fence_content",
+    CODE_FENCE_LANGUAGE: "language",
+    INFO_STRING: "info_string",
+    PARAGRAPH: "paragraph",
+    INLINE: "inline",
+} as const;
+
+/** tree-sitter node types for the Markdown inline grammar ("markdown-inline"). */
+export const MARKDOWN_INLINE_NODE = {
+    INLINE_LINK: "inline_link",
+    LINK_DESTINATION: "link_destination",
+    CODE_SPAN: "code_span",
+    TEXT: "text",
+} as const;
+
+/**
+ * Pre-built tree-sitter S-expression query strings for the Markdown inline grammar.
+ * Pass these to treesitterClient.createQuery("markdown-inline", …) — results are cached
+ * by TreesitterClient so compilation happens only once per client instance.
+ */
+export const MARKDOWN_INLINE_QUERY = {
+    INLINE_LINK_DEST:
+        `(${MARKDOWN_INLINE_NODE.INLINE_LINK} (${MARKDOWN_INLINE_NODE.LINK_DESTINATION}) @dest)`,
+    CODE_SPAN: `(${MARKDOWN_INLINE_NODE.CODE_SPAN}) @code`,
+    TEXT: `(${MARKDOWN_INLINE_NODE.TEXT}) @text`,
+} as const;
+
+/** tree-sitter query strings for the Markdown block grammar ("markdown"). */
+export const MARKDOWN_QUERY = {
+    FENCED_BLOCK: `(${MARKDOWN_NODE.CODE_FENCE_BLOCK}) @block`,
+    INLINE: `(${MARKDOWN_NODE.INLINE}) @inline`,
+} as const;

package/src/analyzer/rules/markdown/extractCodeBlocks.ts

@@ -0,0 +1,101 @@
+import { FILETYPE_BY_LANGUAGE } from "../../../shared/mod.js";
+import type { AnalyzerContext, CodeBlock } from "../../types.js";
+import { MARKDOWN_INLINE_QUERY, MARKDOWN_NODE, MARKDOWN_QUERY } from "./astTypes.js";
+import type { Node as TsNode } from "web-tree-sitter";
+
+/**
+ * For markdown we use treesitter query directly
+ * as AST-grep doesn't support inline markdown
+ */
+export async function extractCodeBlocks(
+    context: AnalyzerContext,
+    content: string,
+): Promise<CodeBlock[]> {
+    const blocks: CodeBlock[] = [];
+
+    try {
+        const blockTree = await context.treesitterClient.parse("markdown", content);
+
+        const fencedBlockQuery = await context.treesitterClient.createQuery(
+            "markdown",
+            MARKDOWN_QUERY.FENCED_BLOCK,
+        );
+
+        for (const match of fencedBlockQuery.matches(blockTree.rootNode)) {
+            for (const capture of match.captures) {
+                if (capture.name !== "block") continue;
+                const blockNode = capture.node as TsNode;
+
+                const startLine = blockNode.startPosition.row + 1;
+                const endLine = blockNode.endPosition.row + 1;
+
+                const languageNode = blockNode.children.find((child: TsNode | null) =>
+                    child !== null &&
+                    (child.type === MARKDOWN_NODE.CODE_FENCE_LANGUAGE ||
+                        child.type === MARKDOWN_NODE.INFO_STRING)
+                );
+                const fenceLanguage = FILETYPE_BY_LANGUAGE[
+                    (languageNode?.text ?? "").trim().toLowerCase()
+                ] ?? null;
+
+                const contentNode = blockNode.children.find((child: TsNode | null) =>
+                    child !== null && child.type === MARKDOWN_NODE.CODE_FENCE_CONTENT
+                );
+                const codeContent = (contentNode?.text ?? "")
+                    .replace(/\n?[`~]{3,}[^\n]*\s*$/, "")
+                    .trimEnd();
+                if (!codeContent.trim()) continue;
+
+                blocks.push({
+                    language: fenceLanguage ?? "text",
+                    content: codeContent,
+                    startLine,
+                    endLine,
+                    type: "script",
+                });
+            }
+        }
+
+        const inlineNodeQuery = await context.treesitterClient.createQuery(
+            "markdown",
+            MARKDOWN_QUERY.INLINE,
+        );
+        const inlineParser = await context.treesitterClient.getParser("markdown-inline");
+        const codeSpanQuery = await context.treesitterClient.createQuery(
+            "markdown-inline",
+            MARKDOWN_INLINE_QUERY.CODE_SPAN,
+        );
+
+        for (const inlineMatch of inlineNodeQuery.matches(blockTree.rootNode)) {
+            for (const inlineCapture of inlineMatch.captures) {
+                if (inlineCapture.name !== "inline") continue;
+                const inlineNode = inlineCapture.node as TsNode;
+
+                const inlineTree = inlineParser.parse(inlineNode.text);
+                if (!inlineTree) continue;
+
+                for (const codeMatch of codeSpanQuery.matches(inlineTree.rootNode)) {
+                    for (const codeCapture of codeMatch.captures) {
+                        if (codeCapture.name !== "code") continue;
+                        const spanNode = codeCapture.node as TsNode;
+
+                        const snippet = spanNode.text.replace(/^`+/, "").replace(/`+$/, "").trim();
+                        if (!snippet || snippet.length > 200 || !/^[a-z]/i.test(snippet)) continue;
+
+                        blocks.push({
+                            language: "bash",
+                            content: snippet,
+                            startLine: inlineNode.startPosition.row + 1,
+                            endLine: inlineNode.startPosition.row + 1,
+                            type: "inline",
+                        });
+                    }
+                }
+            }
+        }
+    } catch (error) {
+        throw new Error(`Failed to extract code blocks from markdown: ${error}`);
+    }
+
+    return blocks;
+}

package/src/analyzer/rules/markdown/extractFileRefs.ts

@@ -0,0 +1,179 @@
+/**
+ * AST-based file reference extractor for Markdown content.
+ *
+ * Extracts file path references using:
+ * - tree-sitter block grammar + MARKDOWN_QUERY.INLINE to find inline nodes
+ * - tree-sitter inline grammar for inline_link, code_span, text nodes
+ * - regex fallback if AST parsing fails
+ */
+
+import { BARE_PATH_PATTERN, isUrl, looksLikePath } from "../shared/file-refs.js";
+import type { AnalyzerContext, FileRefDiscovery } from "../../types.js";
+import { MARKDOWN_INLINE_QUERY, MARKDOWN_QUERY } from "./astTypes.js";
+import type { Node as TsNode } from "web-tree-sitter";
+
+export async function extractMarkdownFileRefs(
+    context: AnalyzerContext,
+    content: string,
+): Promise<FileRefDiscovery[]> {
+    try {
+        const refs: FileRefDiscovery[] = [];
+        const blockTree = await context.treesitterClient.parse("markdown", content);
+
+        const inlineNodeQuery = await context.treesitterClient.createQuery(
+            "markdown",
+            MARKDOWN_QUERY.INLINE,
+        );
+        const inlineParser = await context.treesitterClient.getParser("markdown-inline");
+
+        const linkDestQuery = await context.treesitterClient.createQuery(
+            "markdown-inline",
+            MARKDOWN_INLINE_QUERY.INLINE_LINK_DEST,
+        );
+        const codeSpanQuery = await context.treesitterClient.createQuery(
+            "markdown-inline",
+            MARKDOWN_INLINE_QUERY.CODE_SPAN,
+        );
+        const textQuery = await context.treesitterClient.createQuery(
+            "markdown-inline",
+            MARKDOWN_INLINE_QUERY.TEXT,
+        );
+
+        for (const inlineMatch of inlineNodeQuery.matches(blockTree.rootNode)) {
+            for (const inlineCapture of inlineMatch.captures) {
+                if (inlineCapture.name !== "inline") continue;
+                const inlineNode = inlineCapture.node as TsNode;
+                const blockLine = inlineNode.startPosition.row;
+
+                const inlineTree = inlineParser.parse(inlineNode.text);
+                if (!inlineTree) continue;
+                const inlineRoot = inlineTree.rootNode;
+
+                for (const match of linkDestQuery.matches(inlineRoot)) {
+                    for (const capture of match.captures) {
+                        if (capture.name !== "dest") continue;
+                        const destNode = capture.node as TsNode;
+                        const path = destNode.text.trim();
+                        if (!path || isUrl(path) || path.startsWith("#")) continue;
+                        refs.push({ path, line: blockLine + 1, via: "markdown-link" });
+                    }
+                }
+
+                for (const match of codeSpanQuery.matches(inlineRoot)) {
+                    for (const capture of match.captures) {
+                        if (capture.name !== "code") continue;
+                        const codeNode = capture.node as TsNode;
+                        const snippet = codeNode.text.replace(/^`+/, "").replace(/`+$/, "").trim();
+                        if (!snippet) continue;
+                        const parts = snippet.split(/\s+/);
+                        for (let pi = 0; pi < parts.length; pi++) {
+                            const part = parts[pi];
+                            if (pi === 0 && !part.includes("/") && !part.includes(".")) continue;
+                            if (looksLikePath(part) && !isUrl(part)) {
+                                refs.push({ path: part, line: blockLine + 1, via: "inline-code" });
+                            }
+                        }
+                    }
+                }
+
+                for (const match of textQuery.matches(inlineRoot)) {
+                    for (const capture of match.captures) {
+                        if (capture.name !== "text") continue;
+                        const textNode = capture.node as TsNode;
+                        BARE_PATH_PATTERN.lastIndex = 0;
+                        for (const pathMatch of textNode.text.matchAll(BARE_PATH_PATTERN)) {
+                            const path = pathMatch[0].trim();
+                            if (!path || isUrl(path) || !looksLikePath(path)) continue;
+                            refs.push({ path, line: blockLine + 1, via: "bare-path" });
+                        }
+                    }
+                }
+            }
+        }
+
+        return deduplicateRefs(refs);
+    } catch {
+        // Fallback to regex-based extraction if AST parsing is unavailable
+        return extractMarkdownFileRefsRegex(content);
+    }
+}
+
+/**
+ * Deduplicate refs, preferring higher-specificity discovery methods.
+ * Priority: markdown-link > inline-code > bare-path
+ */
+function deduplicateRefs(refs: FileRefDiscovery[]): FileRefDiscovery[] {
+    const priority: Record<string, number> = {
+        "markdown-link": 3,
+        "inline-code": 2,
+        "bare-path": 1,
+        "import": 2,
+        "url": 3,
+        "source": 2,
+    };
+
+    const best = new Map<string, FileRefDiscovery>();
+    for (const ref of refs) {
+        const key = `${ref.path}:${ref.line}`;
+        const existing = best.get(key);
+        if (!existing || (priority[ref.via] ?? 0) > (priority[existing.via] ?? 0)) {
+            best.set(key, ref);
+        }
+    }
+
+    return Array.from(best.values());
+}
+
+/**
+ * Regex-based fallback for when AST parsing is unavailable.
+ */
+function extractMarkdownFileRefsRegex(content: string): FileRefDiscovery[] {
+    const refs: FileRefDiscovery[] = [];
+    const lines = content.split("\n");
+    let inFencedBlock = false;
+
+    const markdownLink = /\[[^\]]+\]\(([^)]+)\)/g;
+    const inlineCode = /`([^`\n]+)`/g;
+
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const lineNo = i + 1;
+
+        if (/^[ \t]*(`{3,}|~{3,})/.test(line)) {
+            inFencedBlock = !inFencedBlock;
+            continue;
+        }
+        if (inFencedBlock) continue;
+
+        markdownLink.lastIndex = 0;
+        for (const match of line.matchAll(markdownLink)) {
+            const path = match[1]?.trim();
+            if (path && !isUrl(path) && !path.startsWith("#")) {
+                refs.push({ path, line: lineNo, via: "markdown-link" });
+            }
+        }
+
+        inlineCode.lastIndex = 0;
+        for (const match of line.matchAll(inlineCode)) {
+            const parts = match[1].trim().split(/\s+/);
+            for (let pi = 0; pi < parts.length; pi++) {
+                const part = parts[pi];
+                if (pi === 0 && !part.includes("/") && !part.includes(".")) continue;
+                if (looksLikePath(part) && !isUrl(part)) {
+                    refs.push({ path: part, line: lineNo, via: "inline-code" });
+                }
+            }
+        }
+
+        const maskedLine = line.replace(/\[[^\]]*\]\([^)]*\)/g, "");
+        BARE_PATH_PATTERN.lastIndex = 0;
+        for (const match of maskedLine.matchAll(BARE_PATH_PATTERN)) {
+            const path = match[0].trim();
+            if (path && looksLikePath(path) && !isUrl(path)) {
+                refs.push({ path, line: lineNo, via: "bare-path" });
+            }
+        }
+    }
+
+    return deduplicateRefs(refs);
+}

package/src/analyzer/rules/markdown/mod.ts

@@ -0,0 +1,12 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+import { extractCodeBlocks } from "./extractCodeBlocks.js";
+import { FileTypeConfig } from "../../types.js";
+import { extractMarkdownFileRefs } from "./extractFileRefs.js";
+
+export const MARKDOWN_RULES: AstGrepRule[] = [];
+
+export const MARKDOWN_FILETYPE_CONFIG: FileTypeConfig = {
+    extractCodeBlocks,
+    defaultLanguage: "markdown",
+    extractFileRefs: extractMarkdownFileRefs,
+};