@feiyoug/skill-lab 0.0.0 → 0.0.2

package/esm/analyzer/rules/python/extractFileRefs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extractFileRefs.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/python/extractFileRefs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGxE,wBAAgB,qBAAqB,CACjC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,gBAAgB,EAAE,CAwEpB"}
+{"version":3,"file":"extractFileRefs.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/python/extractFileRefs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGxE,wBAAsB,qBAAqB,CACvC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAwE7B"}

package/esm/analyzer/rules/python/extractFileRefs.js

@@ -11,9 +11,9 @@
  */
 import { isHostFsPath, isUrl } from "../shared/file-refs.js";
 import { PYTHON_NODE } from "./astTypes.js";
-export function extractPythonFileRefs(context, content) {
+export async function extractPythonFileRefs(context, content) {
     const refs = [];
-    const ast = context.astgrepClient.parse("python", content);
+    const ast = await context.astgrepClient.parse("python", content);
     const root = ast.root();
     // ── import_statement (e.g. `import os`, `import os.path`) ───────────────
     const importNodes = root.findAll({ rule: { kind: PYTHON_NODE.IMPORT_STATEMENT } });

package/esm/analyzer/steps/001-discovery/discover-files.d.ts

@@ -21,6 +21,10 @@ export declare function discoverReferencedFiles(context: AnalyzerContext, input:
     allFiles: SkillFile[];
     readTextFile: (path: string) => Promise<string | null>;
     maxScanDepth: number;
+    onDiscover?: (progress: {
+        scannedCount: number;
+        discoveredCount: number;
+    }) => void;
 }): Promise<FileReference[]>;
 export type { FileRefDiscovery };
 //# sourceMappingURL=discover-files.d.ts.map

package/esm/analyzer/steps/001-discovery/discover-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discover-files.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/steps/001-discovery/discover-files.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAG7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGvE,KAAK,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,SAAS,CAAA;CAAE,CAAC;AAEhF;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CACzC,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE;IACH,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtB,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvD,YAAY,EAAE,MAAM,CAAC;CACxB,GACF,OAAO,CAAC,aAAa,EAAE,CAAC,CA6J1B;AAMD,YAAY,EAAE,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"discover-files.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/steps/001-discovery/discover-files.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAG7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGvE,KAAK,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,SAAS,CAAA;CAAE,CAAC;AAEhF;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CACzC,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE;IACH,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtB,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACtF,GACF,OAAO,CAAC,aAAa,EAAE,CAAC,CA8K1B;AAMD,YAAY,EAAE,gBAAgB,EAAE,CAAC"}

package/esm/analyzer/steps/001-discovery/discover-files.js

@@ -14,6 +14,8 @@ import { encodeCodeBlockPath } from "../../utils/code-block-path.js";
 export async function discoverReferencedFiles(context, input) {
     const discovered = new Map();
     const queue = [...input.startQueue];
+    let scannedCount = 0;
+    let discoveredCount = 0;
     // A set of file paths which have been processed
     const processed = new Set();
     const startPaths = new Set(input.startQueue.map((item) => normalizePath(item.path)));
@@ -24,6 +26,7 @@ export async function discoverReferencedFiles(context, input) {
         if (processed.has(current.path) || current.depth > input.maxScanDepth)
             continue;
         processed.add(current.path);
+        input.onDiscover?.({ scannedCount: scannedCount++, discoveredCount });
         const content = await input.readTextFile(current.path);
         if (!content)
             continue;
@@ -77,6 +80,7 @@ export async function discoverReferencedFiles(context, input) {
                             depth: current.depth + 1,
                             referencedBy: localEntry.referencedBy,
                         });
+                        input.onDiscover?.({ scannedCount, discoveredCount: discoveredCount++ });
                     }
                     continue;
                 }
@@ -104,11 +108,23 @@ export async function discoverReferencedFiles(context, input) {
                     });
                     continue;
                 }
-                if (absoluteRef.via === "import" || absoluteRef.via === "source") {
+                if (absoluteRef.via === "import") {
                     discovered.set(normalizedPath, {
                         path: normalizedPath,
                         sourceType: "external",
-                        fileType: "unknown",
+                        fileType: block.language,
+                        role: "library",
+                        depth: current.depth + 1,
+                        discoveryMethod: absoluteRef.via,
+                        referencedBy: referenceFromCurrent,
+                    });
+                    continue;
+                }
+                if (absoluteRef.via === "source") {
+                    discovered.set(normalizedPath, {
+                        path: normalizedPath,
+                        sourceType: "external",
+                        fileType: block.language,
                         role: "library",
                         depth: current.depth + 1,
                         discoveryMethod: absoluteRef.via,

package/esm/analyzer/steps/001-discovery/mod.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/steps/001-discovery/mod.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIrE,wBAAsB,eAAe,CACjC,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,eAAe,GACzB,OAAO,CAAC,aAAa,CAAC,CA4DxB"}
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/steps/001-discovery/mod.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIrE,wBAAsB,eAAe,CACjC,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,eAAe,GACzB,OAAO,CAAC,aAAa,CAAC,CAwFxB"}

package/esm/analyzer/steps/001-discovery/mod.js

@@ -1,4 +1,6 @@
-import { DEFAULT_SKILL_VERSION, FRONTMATTER_SUPPORTED_FIELDS } from "../../config.js";
+import * as dntShim from "../../../_dnt.shims.js";
+import ProgressBar from "../../../deps/jsr.io/@deno-library/progress/1.5.1/mod.js";
+import { DEFAULT_ANALYZER_CONFIG, DEFAULT_SKILL_VERSION, FRONTMATTER_SUPPORTED_FIELDS, } from "../../config/mod.js";
 import { discoverReferencedFiles } from "./discover-files.js";
 import { filterScanQueue } from "./filter-files.js";
 export async function run001Discovery(state, context) {
@@ -20,12 +22,40 @@ export async function run001Discovery(state, context) {
             nextState.warnings.push(`Unknown frontmatter field '${field}' - analysis not supported yet`);
         }
     }
-    const discovered = await discoverReferencedFiles(context, {
-        startQueue: [{ path: skillMdPath, depth: 0 }],
-        allFiles: files,
-        readTextFile: (path) => context.skillReader.readTextFile(path),
-        maxScanDepth: state.metadata.config.maxScanDepth,
-    });
+    const shouldLogProgress = (context.showProgressBar ?? false) && dntShim.Deno.stderr.isTerminal();
+    const maxScanDepth = state.metadata.config.maxScanDepth ??
+        DEFAULT_ANALYZER_CONFIG.scan?.maxScanDepth ?? 5;
+    const maxFileCount = state.metadata.config.maxFileCount ??
+        DEFAULT_ANALYZER_CONFIG.scan?.maxFileCount ?? 100;
+    const maxFileSize = state.metadata.config.maxFileSize ??
+        DEFAULT_ANALYZER_CONFIG.scan?.maxFileSize ?? 1_000_000;
+    const discoveryBar = shouldLogProgress
+        ? new ProgressBar({
+            total: files.length,
+            clear: true,
+            output: dntShim.Deno.stderr,
+            complete: "=",
+            incomplete: "-",
+            display: "Readings skills [:bar] :percent ETA :eta",
+        })
+        : null;
+    let discovered = [];
+    try {
+        discovered = await discoverReferencedFiles(context, {
+            startQueue: [{ path: skillMdPath, depth: 0 }],
+            allFiles: files,
+            readTextFile: (path) => context.skillReader.readTextFile(path),
+            maxScanDepth,
+            onDiscover: (progress) => {
+                discoveryBar?.render(progress.scannedCount, {
+                    total: progress.discoveredCount + 1,
+                });
+            },
+        });
+    }
+    finally {
+        discoveryBar?.end();
+    }
     discovered.push({
         path: skillMdPath,
         sourceType: "local",
@@ -36,8 +66,8 @@ export async function run001Discovery(state, context) {
     const filtered = filterScanQueue({
         queue: discovered,
         allFiles: files,
-        maxFileCount: state.metadata.config.maxFileCount,
-        maxFileSize: state.metadata.config.maxFileSize,
+        maxFileCount,
+        maxFileSize,
     });
     return {
         ...nextState,

package/esm/analyzer/steps/002-permissions/mod.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/steps/002-permissions/mod.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAWrE,wBAAsB,iBAAiB,CACnC,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,eAAe,GACzB,OAAO,CAAC,aAAa,CAAC,CA+FxB"}
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/steps/002-permissions/mod.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAcrE,wBAAsB,iBAAiB,CACnC,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,eAAe,GACzB,OAAO,CAAC,aAAa,CAAC,CAsGxB"}

package/esm/analyzer/steps/002-permissions/mod.js

@@ -1,3 +1,5 @@
+import * as dntShim from "../../../_dnt.shims.js";
+import ProgressBar from "../../../deps/jsr.io/@deno-library/progress/1.5.1/mod.js";
 import { PROMPT_REGEX_RULES } from "../../rules/mod.js";
 import { RULES_BY_FILETYPE } from "../../rules/mod.js";
 import { isLikelyInlineBashCommand } from "../../rules/bash/inline-command-classifier.js";
@@ -6,86 +8,98 @@ import { generatePermissionId } from "../../utils/id-generator.js";
 import { scanFileForPermissions } from "./scan-file.js";
 import { seedPermissionsFromFrontmatter } from "./seed-frontmatter.js";
 import { synthesizePermissions } from "./synthesize.js";
+const ANSI_SHOW_CURSOR = "\x1b[?25h";
+const ENCODER = new TextEncoder();
 export async function run002Permissions(state, context) {
     const skillMdPath = state.scanQueue.find((file) => file.role === "entrypoint")?.path ??
         "SKILL.md";
     let next = state;
     next = seedPermissionsFromFrontmatter(next, skillMdPath);
-    for (const fileRef of next.scanQueue) {
-        if (fileRef.sourceType === "external") {
-            if (fileRef.role === "host-fs") {
-                next = addHostFsPermission(next, fileRef.path, fileRef.referencedBy);
-            }
-            else if (fileRef.role === "library") {
-                next = {
-                    ...next,
-                    warnings: [
-                        ...next.warnings,
-                        `External library/import not analyzed yet: ${fileRef.path}`,
-                    ],
-                    metadata: {
-                        ...next.metadata,
-                        skippedFiles: [...next.metadata.skippedFiles, {
-                                path: fileRef.path,
-                                reason: "external_library_dependency",
-                                referenceBy: fileRef.referencedBy,
-                            }],
-                    },
-                };
-            }
-            else if (fileRef.discoveryMethod === "markdown-link" || fileRef.discoveryMethod === "url" ||
-                fileRef.discoveryMethod === undefined) {
-                next = {
-                    ...next,
-                    warnings: [
-                        ...next.warnings,
-                        `External reference not analyzed yet: ${fileRef.path}`,
-                    ],
-                    metadata: {
-                        ...next.metadata,
-                        skippedFiles: [...next.metadata.skippedFiles, {
-                                path: fileRef.path,
-                                reason: "external_reference",
-                                referenceBy: fileRef.referencedBy,
-                            }],
-                    },
-                };
-            }
-            continue;
-        }
-        const scanTargets = await resolveScanTargets(fileRef, context);
-        if (scanTargets.length === 0)
-            continue;
-        if (!RULES_BY_FILETYPE[fileRef.fileType]) {
-            next = {
-                ...next,
-                warnings: [
-                    ...next.warnings,
-                    `File type '${fileRef.fileType}' is not supported yet for analysis: ${fileRef.path}`,
-                ],
-                metadata: {
-                    ...next.metadata,
-                    skippedFiles: [...next.metadata.skippedFiles, {
+    const shouldRenderProgress = (context.showProgressBar ?? false) && dntShim.Deno.stderr.isTerminal();
+    const scanBar = shouldRenderProgress
+        ? new ProgressBar({
+            total: Math.max(1, next.scanQueue.length),
+            clear: true,
+            output: dntShim.Deno.stderr,
+            complete: "=",
+            incomplete: "-",
+            display: "Scanning skills [:bar] :percent ETA :eta",
+        })
+        : null;
+    let processed = 0;
+    try {
+        await scanBar?.render(processed);
+        for (const fileRef of next.scanQueue) {
+            try {
+                if (fileRef.sourceType === "external") {
+                    if (fileRef.role === "host-fs") {
+                        next = addHostFsPermission(next, fileRef.path, fileRef.referencedBy);
+                    }
+                    else if (fileRef.discoveryMethod === "import") {
+                        next = addImportDependencyPermission(next, fileRef);
+                        next = appendSkippedFile(next, {
                             path: fileRef.path,
-                            reason: `unsupported_type_${fileRef.fileType}`,
+                            reason: "external_library_dependency",
                             referenceBy: fileRef.referencedBy,
-                        }],
-                },
-            };
-            continue;
-        }
-        for (const scanTarget of scanTargets) {
-            next = scanFileForPermissions(context, {
-                state: next,
-                fileRef,
-                scanPath: scanTarget.scanPath,
-                content: scanTarget.content,
-                lineOffset: scanTarget.lineOffset,
-                referenceType: scanTarget.referenceType,
-            });
-            if (scanTarget.referenceType === "content") {
-                next = applyPromptRegexFindings(next, scanTarget.scanPath, scanTarget.content, scanTarget.lineOffset, fileRef.referencedBy);
+                        });
+                    }
+                    else {
+                        next = addExternalReferencePermission(next, fileRef);
+                        const reason = fileRef.role === "library"
+                            ? "external_library_dependency"
+                            : "external_reference";
+                        next = appendSkippedFile(next, {
+                            path: fileRef.path,
+                            reason,
+                            referenceBy: fileRef.referencedBy,
+                        });
+                    }
+                    continue;
+                }
+                const scanTargets = await resolveScanTargets(fileRef, context);
+                if (scanTargets.length === 0)
+                    continue;
+                if (!RULES_BY_FILETYPE[fileRef.fileType]) {
+                    next = {
+                        ...next,
+                        warnings: [
+                            ...next.warnings,
+                            `File type '${fileRef.fileType}' is not supported yet for analysis: ${fileRef.path}`,
+                        ],
+                        metadata: {
+                            ...next.metadata,
+                            skippedFiles: [...next.metadata.skippedFiles, {
+                                    path: fileRef.path,
+                                    reason: `unsupported_type_${fileRef.fileType}`,
+                                    referenceBy: fileRef.referencedBy,
+                                }],
+                        },
+                    };
+                    continue;
+                }
+                for (const scanTarget of scanTargets) {
+                    next = await scanFileForPermissions(context, {
+                        state: next,
+                        fileRef,
+                        scanPath: scanTarget.scanPath,
+                        content: scanTarget.content,
+                        lineOffset: scanTarget.lineOffset,
+                        referenceType: scanTarget.referenceType,
+                    });
+                    if (scanTarget.referenceType === "content") {
+                        next = applyPromptRegexFindings(next, scanTarget.scanPath, scanTarget.content, scanTarget.lineOffset, fileRef.referencedBy);
+                    }
+                }
             }
+            finally {
+                await scanBar?.render(++processed);
+            }
+        }
+    }
+    finally {
+        await scanBar?.end();
+        if (shouldRenderProgress && dntShim.Deno.stderr.isTerminal()) {
+            dntShim.Deno.stderr.writeSync(ENCODER.encode(ANSI_SHOW_CURSOR));
         }
     }
     return synthesizePermissions(next);
@@ -113,7 +127,8 @@ async function resolveScanTargets(fileRef, context) {
     if (referenceType === "inline") {
         const line = lines[decoded.startLine - 1] ?? "";
         const snippets = extractInlineSnippets(line);
-        const likelyCommands = snippets.filter((snippet) => isLikelyInlineBashCommand(context, { snippet, lineContext: line }));
+        const likelyCommandFlags = await Promise.all(snippets.map((snippet) => isLikelyInlineBashCommand(context, { snippet, lineContext: line })));
+        const likelyCommands = snippets.filter((_, i) => likelyCommandFlags[i]);
         return likelyCommands.map((snippet) => ({
             scanPath: decoded.parentPath,
             content: snippet,
@@ -161,6 +176,74 @@ function applyPromptRegexFindings(state, filePath, content, lineOffset, referenc
     }
     return { ...state, findings };
 }
+function appendSkippedFile(state, skipped) {
+    return {
+        ...state,
+        metadata: {
+            ...state.metadata,
+            skippedFiles: [...state.metadata.skippedFiles, skipped],
+        },
+    };
+}
+function addImportDependencyPermission(state, fileRef) {
+    const language = fileRef.fileType;
+    const importName = fileRef.path;
+    const metadata = {
+        language,
+        discoveryMethod: fileRef.discoveryMethod,
+    };
+    const permission = {
+        id: generatePermissionId("dep-import", [language, importName]),
+        tool: language,
+        scope: "dep",
+        permission: "import",
+        args: [importName],
+        metadata,
+        references: [toPermissionReference(fileRef)],
+        source: "inferred",
+        risks: [],
+    };
+    if (state.permissions.some((p) => p.id === permission.id))
+        return state;
+    return {
+        ...state,
+        permissions: [...state.permissions, permission],
+    };
+}
+function addExternalReferencePermission(state, fileRef) {
+    const path = fileRef.path;
+    const language = fileRef.fileType ?? "unknown";
+    const metadata = {
+        language,
+        discoveryMethod: fileRef.discoveryMethod,
+    };
+    const permission = {
+        id: generatePermissionId("dep-externalreference", [language, path]),
+        tool: language,
+        scope: "dep",
+        permission: "externalreference",
+        args: [path],
+        metadata,
+        references: [toPermissionReference(fileRef)],
+        source: "inferred",
+        risks: [],
+    };
+    if (state.permissions.some((p) => p.id === permission.id))
+        return state;
+    return {
+        ...state,
+        permissions: [...state.permissions, permission],
+    };
+}
+function toPermissionReference(fileRef) {
+    return {
+        file: fileRef.referencedBy?.file ?? fileRef.path,
+        line: fileRef.referencedBy?.line ?? 1,
+        lineEnd: fileRef.referencedBy?.lineEnd,
+        type: fileRef.referencedBy?.type ?? "content",
+        referencedBy: fileRef.referencedBy?.referencedBy,
+    };
+}
 function addHostFsPermission(state, path, referencedBy) {
     const reference = {
         file: referencedBy?.file ?? "SKILL.md",

package/esm/analyzer/steps/002-permissions/scan-file.d.ts

@@ -10,5 +10,5 @@ export declare function scanFileForPermissions(context: AnalyzerContext, input:
     content: string;
     lineOffset?: number;
     referenceType?: "content" | "script" | "inline";
-}): AnalyzerState;
+}): Promise<AnalyzerState>;
 //# sourceMappingURL=scan-file.d.ts.map

package/esm/analyzer/steps/002-permissions/scan-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan-file.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/steps/002-permissions/scan-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAA+B,MAAM,wBAAwB,CAAC;AAsCzF;;GAEG;AACH,wBAAgB,sBAAsB,CAClC,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE;IACH,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;CACnD,GACF,aAAa,CAgFf"}
+{"version":3,"file":"scan-file.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/steps/002-permissions/scan-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAA+B,MAAM,wBAAwB,CAAC;AAsCzF;;GAEG;AACH,wBAAsB,sBAAsB,CACxC,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE;IACH,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;CACnD,GACF,OAAO,CAAC,aAAa,CAAC,CAiFxB"}

package/esm/analyzer/steps/002-permissions/scan-file.js

@@ -35,7 +35,7 @@ const SHELL_RESERVED_WORDS = new Set([
 /**
  * Scans a text-like file and returns updated state with permissions and findings.
  */
-export function scanFileForPermissions(context, input) {
+export async function scanFileForPermissions(context, input) {
     const { state, fileRef, scanPath, content, lineOffset = 0, referenceType = "content", } = input;
     const permissions = [];
     const findings = [...state.findings];
@@ -46,15 +46,16 @@ export function scanFileForPermissions(context, input) {
             ...state,
             metadata: {
                 ...state.metadata,
-                scannedFiles: [...state.metadata.scannedFiles, scanPath],
+                scannedFiles: new Set([...state.metadata.scannedFiles, scanPath]),
             },
         };
     }
     const scanLanguage = rules[0].grammar;
-    const matches = context.astgrepClient.scanWithRules(content, scanLanguage, rules);
+    const matches = await context.astgrepClient.scanWithRules(content, scanLanguage, rules);
     const lines = content.split("\n");
     const filteredMatches = matches.filter((match) => shouldKeepMatchForBlock(match, lineOffset + 1, lines));
-    const blockFindings = context.astgrepClient.matchesToFindings(scanPath, referenceType, filteredMatches.map((match) => ({
+    const deconflictedMatches = dropGenericShellDuplicates(filteredMatches, rules);
+    const blockFindings = context.astgrepClient.matchesToFindings(scanPath, referenceType, deconflictedMatches.map((match) => ({
         ...match,
         line: match.line + lineOffset,
         lineEnd: (match.lineEnd ?? match.line) + lineOffset,
@@ -91,7 +92,7 @@ export function scanFileForPermissions(context, input) {
         metadata: {
             ...state.metadata,
             rulesUsed,
-            scannedFiles: [...state.metadata.scannedFiles, scanPath],
+            scannedFiles: new Set([...state.metadata.scannedFiles, scanPath]),
         },
     };
 }
@@ -187,3 +188,37 @@ function buildPermissionArgs(metadata, detectedTool) {
     }
     return args;
 }
+function dropGenericShellDuplicates(matches, rules) {
+    const ruleById = new Map(rules.map((rule) => [rule.id, rule]));
+    const specificToolAtLine = new Set();
+    for (const match of matches) {
+        if (match.ruleId === GENERIC_SHELL_RULE_ID)
+            continue;
+        const rule = ruleById.get(match.ruleId);
+        if (!rule)
+            continue;
+        const tool = resolveToolForMatch(rule.permission.tool, match.extracted);
+        if (!tool)
+            continue;
+        specificToolAtLine.add(`${match.line}:${tool}`);
+    }
+    return matches.filter((match) => {
+        if (match.ruleId !== GENERIC_SHELL_RULE_ID)
+            return true;
+        const rule = ruleById.get(match.ruleId);
+        if (!rule)
+            return true;
+        const tool = resolveToolForMatch(rule.permission.tool, match.extracted);
+        if (!tool)
+            return true;
+        return !specificToolAtLine.has(`${match.line}:${tool}`);
+    });
+}
+function resolveToolForMatch(ruleTool, extracted) {
+    if (ruleTool !== "detected")
+        return ruleTool.toLowerCase();
+    const tool = extracted.tool;
+    if (typeof tool !== "string" || !tool.trim())
+        return null;
+    return tool.trim().toLowerCase();
+}

package/esm/analyzer/steps/002-permissions/seed-frontmatter.js

@@ -1,4 +1,4 @@
-import { ALLOWED_TOOLS_MAPPING } from "../../config.js";
+import { ALLOWED_TOOLS_MAPPING } from "../../config/mod.js";
 import { generatePermissionId } from "../../utils/id-generator.js";
 export function seedPermissionsFromFrontmatter(state, skillMdPath) {
     const rawAllowed = state.frontmatter["allowed-tools"];
@@ -9,7 +9,7 @@ export function seedPermissionsFromFrontmatter(state, skillMdPath) {
     const baseRef = {
         file: skillMdPath,
         line: 1,
-        lineEnd: state.frontmatter.endLineNumer,
+        lineEnd: state.frontmatter.endLineNumber,
         type: "frontmatter",
     };
     const permissions = parsed.map((tool) => {

package/esm/analyzer/steps/003-risks/dep-risks.d.ts

@@ -0,0 +1,3 @@
+import type { AnalyzerContext, AnalyzerState } from "../../types.js";
+export declare function analyzeDependencyRisks(state: AnalyzerState, context: Pick<AnalyzerContext, "config">): AnalyzerState;
+//# sourceMappingURL=dep-risks.d.ts.map

package/esm/analyzer/steps/003-risks/dep-risks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dep-risks.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/steps/003-risks/dep-risks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAOrE,wBAAgB,sBAAsB,CAClC,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,GACzC,aAAa,CAgEf"}

package/esm/analyzer/steps/003-risks/dep-risks.js

@@ -0,0 +1,74 @@
+import { addRisk } from "./helpers.js";
+import { isAllowed, isDenied } from "./policy.js";
+import { GRAMMAR_SPECS } from "../../treesitter/registry.js";
+export function analyzeDependencyRisks(state, context) {
+    let next = state;
+    for (const permission of next.permissions) {
+        if (permission.scope !== "dep")
+            continue;
+        if (permission.permission === "import") {
+            const grammar = resolveGrammar(permission.tool);
+            const importName = permission.args?.[0]?.trim();
+            if (!importName)
+                continue;
+            const groupKey = `DEPENDENCY:external_import:${grammar ?? "unknown"}`;
+            if (grammar && isDenied(context.config, grammar, importName)) {
+                next = addRisk(next, {
+                    type: "DEPENDENCY:external_import",
+                    groupKey,
+                    severity: "critical",
+                    message: `Import '${importName}' is denied by config for ${grammar} and may execute untrusted dependency code.`,
+                    permissionIds: [permission.id],
+                    reference: resolvePrimaryReference(permission),
+                    metadata: { policy: { language: { grammar, importName, source: "denylist" } } },
+                });
+                continue;
+            }
+            if (grammar && isAllowed(context.config, grammar, importName)) {
+                continue;
+            }
+            next = addRisk(next, {
+                type: "DEPENDENCY:external_import",
+                groupKey,
+                severity: "warning",
+                message: `External import not explicitly configured: ${importName}`,
+                permissionIds: [permission.id],
+                reference: resolvePrimaryReference(permission),
+                metadata: grammar
+                    ? { policy: { language: { grammar, importName, source: "default" } } }
+                    : undefined,
+            });
+            continue;
+        }
+        if (permission.permission === "externalreference") {
+            const discoveryMethod = permission.metadata?.discoveryMethod;
+            const path = permission.args?.[0] ?? permission.tool;
+            const isSourceInclude = discoveryMethod === "source";
+            next = addRisk(next, {
+                type: "REFERENCE:external_file",
+                groupKey: `REFERENCE:external_file:${permission.tool}`,
+                severity: "warning",
+                message: isSourceInclude
+                    ? `Sourced external file not analyzed yet: ${path}`
+                    : `External reference not analyzed yet: ${path}`,
+                permissionIds: [permission.id],
+                reference: resolvePrimaryReference(permission),
+                metadata: isSourceInclude ? { discoveryMethod: "source" } : undefined,
+            });
+        }
+    }
+    return next;
+}
+function resolveGrammar(tool) {
+    return tool in GRAMMAR_SPECS ? tool : null;
+}
+function resolvePrimaryReference(permission) {
+    const reference = permission.references[0];
+    if (reference)
+        return reference;
+    return {
+        file: "SKILL.md",
+        line: 1,
+        type: "content",
+    };
+}

package/esm/analyzer/steps/003-risks/helpers.d.ts

@@ -2,6 +2,7 @@ import type { AnalyzerState } from "../../types.js";
 import type { RiskCode, Severity } from "../../../shared/mod.js";
 export declare function addRisk(state: AnalyzerState, input: {
     type: RiskCode;
+    groupKey?: string;
     severity: Severity;
     message: string;
     permissionIds: string[];

package/esm/analyzer/steps/003-risks/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/steps/003-risks/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAQ,QAAQ,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAGvE,wBAAgB,OAAO,CACnB,KAAK,EAAE,aAAa,EACpB,KAAK,EAAE;IACH,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC,GACF,aAAa,CAwBf"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/steps/003-risks/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAQ,QAAQ,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAGvE,wBAAgB,OAAO,CACnB,KAAK,EAAE,aAAa,EACpB,KAAK,EAAE;IACH,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC,GACF,aAAa,CAyBf"}

package/esm/analyzer/steps/003-risks/helpers.js

@@ -3,6 +3,7 @@ export function addRisk(state, input) {
     const risk = {
         id: generateRiskId(input.type, state.risks.length),
         type: input.type,
+        groupKey: input.groupKey,
         severity: input.severity,
         message: input.message,
         reference: input.reference,

package/esm/analyzer/steps/003-risks/mod.d.ts

@@ -1,3 +1,4 @@
-import type { AnalyzerResult, AnalyzerState } from "../../types.js";
-export declare function run003Risks(state: AnalyzerState): AnalyzerResult;
+import { SkillAnalyzerResult } from "../../result.js";
+import type { AnalyzerContext, AnalyzerState } from "../../types.js";
+export declare function run003Risks(state: AnalyzerState, context?: Pick<AnalyzerContext, "showProgressBar" | "config">): Promise<SkillAnalyzerResult>;
 //# sourceMappingURL=mod.d.ts.map