@feiyoug/skill-lab 0.0.0

package/script/analyzer/rules/markdown/astTypes.d.ts

@@ -0,0 +1,32 @@
+/** ast-grep node types for the Markdown block grammar (@ast-grep/lang-markdown). */
+export declare const MARKDOWN_NODE: {
+    readonly CODE_FENCE_BLOCK: "fenced_code_block";
+    readonly CODE_FENCE_CONTENT: "code_fence_content";
+    readonly CODE_FENCE_LANGUAGE: "language";
+    readonly INFO_STRING: "info_string";
+    readonly PARAGRAPH: "paragraph";
+    readonly INLINE: "inline";
+};
+/** tree-sitter node types for the Markdown inline grammar ("markdown-inline"). */
+export declare const MARKDOWN_INLINE_NODE: {
+    readonly INLINE_LINK: "inline_link";
+    readonly LINK_DESTINATION: "link_destination";
+    readonly CODE_SPAN: "code_span";
+    readonly TEXT: "text";
+};
+/**
+ * Pre-built tree-sitter S-expression query strings for the Markdown inline grammar.
+ * Pass these to treesitterClient.createQuery("markdown-inline", …) — results are cached
+ * by TreesitterClient so compilation happens only once per client instance.
+ */
+export declare const MARKDOWN_INLINE_QUERY: {
+    readonly INLINE_LINK_DEST: "(inline_link (link_destination) @dest)";
+    readonly CODE_SPAN: "(code_span) @code";
+    readonly TEXT: "(text) @text";
+};
+/** tree-sitter query strings for the Markdown block grammar ("markdown"). */
+export declare const MARKDOWN_QUERY: {
+    readonly FENCED_BLOCK: "(fenced_code_block) @block";
+    readonly INLINE: "(inline) @inline";
+};
+//# sourceMappingURL=astTypes.d.ts.map

package/script/analyzer/rules/markdown/astTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"astTypes.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/markdown/astTypes.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,eAAO,MAAM,aAAa;;;;;;;CAOhB,CAAC;AAEX,kFAAkF;AAClF,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;;CAKxB,CAAC;AAEX,6EAA6E;AAC7E,eAAO,MAAM,cAAc;;;CAGjB,CAAC"}

package/script/analyzer/rules/markdown/astTypes.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MARKDOWN_QUERY = exports.MARKDOWN_INLINE_QUERY = exports.MARKDOWN_INLINE_NODE = exports.MARKDOWN_NODE = void 0;
+/** ast-grep node types for the Markdown block grammar (@ast-grep/lang-markdown). */
+exports.MARKDOWN_NODE = {
+    CODE_FENCE_BLOCK: "fenced_code_block",
+    CODE_FENCE_CONTENT: "code_fence_content",
+    CODE_FENCE_LANGUAGE: "language",
+    INFO_STRING: "info_string",
+    PARAGRAPH: "paragraph",
+    INLINE: "inline",
+};
+/** tree-sitter node types for the Markdown inline grammar ("markdown-inline"). */
+exports.MARKDOWN_INLINE_NODE = {
+    INLINE_LINK: "inline_link",
+    LINK_DESTINATION: "link_destination",
+    CODE_SPAN: "code_span",
+    TEXT: "text",
+};
+/**
+ * Pre-built tree-sitter S-expression query strings for the Markdown inline grammar.
+ * Pass these to treesitterClient.createQuery("markdown-inline", …) — results are cached
+ * by TreesitterClient so compilation happens only once per client instance.
+ */
+exports.MARKDOWN_INLINE_QUERY = {
+    INLINE_LINK_DEST: `(${exports.MARKDOWN_INLINE_NODE.INLINE_LINK} (${exports.MARKDOWN_INLINE_NODE.LINK_DESTINATION}) @dest)`,
+    CODE_SPAN: `(${exports.MARKDOWN_INLINE_NODE.CODE_SPAN}) @code`,
+    TEXT: `(${exports.MARKDOWN_INLINE_NODE.TEXT}) @text`,
+};
+/** tree-sitter query strings for the Markdown block grammar ("markdown"). */
+exports.MARKDOWN_QUERY = {
+    FENCED_BLOCK: `(${exports.MARKDOWN_NODE.CODE_FENCE_BLOCK}) @block`,
+    INLINE: `(${exports.MARKDOWN_NODE.INLINE}) @inline`,
+};

package/script/analyzer/rules/markdown/extractCodeBlocks.d.ts

@@ -0,0 +1,7 @@
+import type { AnalyzerContext, CodeBlock } from "../../types.js";
+/**
+ * For markdown we use treesitter query directly
+ * as AST-grep doesn't support inline markdown
+ */
+export declare function extractCodeBlocks(context: AnalyzerContext, content: string): Promise<CodeBlock[]>;
+//# sourceMappingURL=extractCodeBlocks.d.ts.map

package/script/analyzer/rules/markdown/extractCodeBlocks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extractCodeBlocks.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/markdown/extractCodeBlocks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAgBjE;;;GAGG;AACH,wBAAsB,iBAAiB,CACnC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqFtB"}

package/script/analyzer/rules/markdown/extractCodeBlocks.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractCodeBlocks = extractCodeBlocks;
+const mod_js_1 = require("../../../shared/mod.js");
+const astTypes_js_1 = require("./astTypes.js");
+/**
+ * For markdown we use treesitter query directly
+ * as AST-grep doesn't support inline markdown
+ */
+async function extractCodeBlocks(context, content) {
+    const blocks = [];
+    try {
+        const blockTree = await context.treesitterClient.parse("markdown", content);
+        const fencedBlockQuery = await context.treesitterClient.createQuery("markdown", astTypes_js_1.MARKDOWN_QUERY.FENCED_BLOCK);
+        for (const match of fencedBlockQuery.matches(blockTree.rootNode)) {
+            for (const capture of match.captures) {
+                if (capture.name !== "block")
+                    continue;
+                const blockNode = capture.node;
+                const startLine = blockNode.startPosition.row + 1;
+                const endLine = blockNode.endPosition.row + 1;
+                const languageNode = blockNode.children.find((child) => child.type === astTypes_js_1.MARKDOWN_NODE.CODE_FENCE_LANGUAGE ||
+                    child.type === astTypes_js_1.MARKDOWN_NODE.INFO_STRING);
+                const fenceLanguage = mod_js_1.FILETYPE_BY_LANGUAGE[(languageNode?.text ?? "").trim().toLowerCase()] ?? null;
+                const contentNode = blockNode.children.find((child) => child.type === astTypes_js_1.MARKDOWN_NODE.CODE_FENCE_CONTENT);
+                const codeContent = (contentNode?.text ?? "")
+                    .replace(/\n?[`~]{3,}[^\n]*\s*$/, "")
+                    .trimEnd();
+                if (!codeContent.trim())
+                    continue;
+                blocks.push({
+                    language: fenceLanguage ?? "text",
+                    content: codeContent,
+                    startLine,
+                    endLine,
+                    type: "script",
+                });
+            }
+        }
+        const inlineNodeQuery = await context.treesitterClient.createQuery("markdown", astTypes_js_1.MARKDOWN_QUERY.INLINE);
+        const inlineParser = await context.treesitterClient.getParser("markdown-inline");
+        const codeSpanQuery = await context.treesitterClient.createQuery("markdown-inline", astTypes_js_1.MARKDOWN_INLINE_QUERY.CODE_SPAN);
+        for (const inlineMatch of inlineNodeQuery.matches(blockTree.rootNode)) {
+            for (const inlineCapture of inlineMatch.captures) {
+                if (inlineCapture.name !== "inline")
+                    continue;
+                const inlineNode = inlineCapture.node;
+                const inlineTree = inlineParser.parse(inlineNode.text);
+                for (const codeMatch of codeSpanQuery.matches(inlineTree.rootNode)) {
+                    for (const codeCapture of codeMatch.captures) {
+                        if (codeCapture.name !== "code")
+                            continue;
+                        const spanNode = codeCapture.node;
+                        const snippet = spanNode.text.replace(/^`+/, "").replace(/`+$/, "").trim();
+                        if (!snippet || snippet.length > 200 || !/^[a-z]/i.test(snippet))
+                            continue;
+                        blocks.push({
+                            language: "bash",
+                            content: snippet,
+                            startLine: inlineNode.startPosition.row + 1,
+                            endLine: inlineNode.startPosition.row + 1,
+                            type: "inline",
+                        });
+                    }
+                }
+            }
+        }
+    }
+    catch (error) {
+        throw new Error(`Failed to extract code blocks from markdown: ${error}`);
+    }
+    return blocks;
+}

package/script/analyzer/rules/markdown/extractFileRefs.d.ts

@@ -0,0 +1,11 @@
+/**
+ * AST-based file reference extractor for Markdown content.
+ *
+ * Extracts file path references using:
+ * - tree-sitter block grammar + MARKDOWN_QUERY.INLINE to find inline nodes
+ * - tree-sitter inline grammar for inline_link, code_span, text nodes
+ * - regex fallback if AST parsing fails
+ */
+import type { AnalyzerContext, FileRefDiscovery } from "../../types.js";
+export declare function extractMarkdownFileRefs(context: AnalyzerContext, content: string): Promise<FileRefDiscovery[]>;
+//# sourceMappingURL=extractFileRefs.d.ts.map

package/script/analyzer/rules/markdown/extractFileRefs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extractFileRefs.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/markdown/extractFileRefs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAaxE,wBAAsB,uBAAuB,CACzC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAgF7B"}

package/script/analyzer/rules/markdown/extractFileRefs.js

@@ -0,0 +1,154 @@
+"use strict";
+/**
+ * AST-based file reference extractor for Markdown content.
+ *
+ * Extracts file path references using:
+ * - tree-sitter block grammar + MARKDOWN_QUERY.INLINE to find inline nodes
+ * - tree-sitter inline grammar for inline_link, code_span, text nodes
+ * - regex fallback if AST parsing fails
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractMarkdownFileRefs = extractMarkdownFileRefs;
+const file_refs_js_1 = require("../shared/file-refs.js");
+const astTypes_js_1 = require("./astTypes.js");
+async function extractMarkdownFileRefs(context, content) {
+    try {
+        const refs = [];
+        const blockTree = await context.treesitterClient.parse("markdown", content);
+        const inlineNodeQuery = await context.treesitterClient.createQuery("markdown", astTypes_js_1.MARKDOWN_QUERY.INLINE);
+        const inlineParser = await context.treesitterClient.getParser("markdown-inline");
+        const linkDestQuery = await context.treesitterClient.createQuery("markdown-inline", astTypes_js_1.MARKDOWN_INLINE_QUERY.INLINE_LINK_DEST);
+        const codeSpanQuery = await context.treesitterClient.createQuery("markdown-inline", astTypes_js_1.MARKDOWN_INLINE_QUERY.CODE_SPAN);
+        const textQuery = await context.treesitterClient.createQuery("markdown-inline", astTypes_js_1.MARKDOWN_INLINE_QUERY.TEXT);
+        for (const inlineMatch of inlineNodeQuery.matches(blockTree.rootNode)) {
+            for (const inlineCapture of inlineMatch.captures) {
+                if (inlineCapture.name !== "inline")
+                    continue;
+                const inlineNode = inlineCapture.node;
+                const blockLine = inlineNode.startPosition.row;
+                const inlineTree = inlineParser.parse(inlineNode.text);
+                const inlineRoot = inlineTree.rootNode;
+                for (const match of linkDestQuery.matches(inlineRoot)) {
+                    for (const capture of match.captures) {
+                        if (capture.name !== "dest")
+                            continue;
+                        const destNode = capture.node;
+                        const path = destNode.text.trim();
+                        if (!path || (0, file_refs_js_1.isUrl)(path) || path.startsWith("#"))
+                            continue;
+                        refs.push({ path, line: blockLine + 1, via: "markdown-link" });
+                    }
+                }
+                for (const match of codeSpanQuery.matches(inlineRoot)) {
+                    for (const capture of match.captures) {
+                        if (capture.name !== "code")
+                            continue;
+                        const codeNode = capture.node;
+                        const snippet = codeNode.text.replace(/^`+/, "").replace(/`+$/, "").trim();
+                        if (!snippet)
+                            continue;
+                        const parts = snippet.split(/\s+/);
+                        for (let pi = 0; pi < parts.length; pi++) {
+                            const part = parts[pi];
+                            if (pi === 0 && !part.includes("/") && !part.includes("."))
+                                continue;
+                            if ((0, file_refs_js_1.looksLikePath)(part) && !(0, file_refs_js_1.isUrl)(part)) {
+                                refs.push({ path: part, line: blockLine + 1, via: "inline-code" });
+                            }
+                        }
+                    }
+                }
+                for (const match of textQuery.matches(inlineRoot)) {
+                    for (const capture of match.captures) {
+                        if (capture.name !== "text")
+                            continue;
+                        const textNode = capture.node;
+                        file_refs_js_1.BARE_PATH_PATTERN.lastIndex = 0;
+                        for (const pathMatch of textNode.text.matchAll(file_refs_js_1.BARE_PATH_PATTERN)) {
+                            const path = pathMatch[0].trim();
+                            if (!path || (0, file_refs_js_1.isUrl)(path) || !(0, file_refs_js_1.looksLikePath)(path))
+                                continue;
+                            refs.push({ path, line: blockLine + 1, via: "bare-path" });
+                        }
+                    }
+                }
+            }
+        }
+        return deduplicateRefs(refs);
+    }
+    catch {
+        // Fallback to regex-based extraction if AST parsing is unavailable
+        return extractMarkdownFileRefsRegex(content);
+    }
+}
+/**
+ * Deduplicate refs, preferring higher-specificity discovery methods.
+ * Priority: markdown-link > inline-code > bare-path
+ */
+function deduplicateRefs(refs) {
+    const priority = {
+        "markdown-link": 3,
+        "inline-code": 2,
+        "bare-path": 1,
+        "import": 2,
+        "url": 3,
+        "source": 2,
+    };
+    const best = new Map();
+    for (const ref of refs) {
+        const key = `${ref.path}:${ref.line}`;
+        const existing = best.get(key);
+        if (!existing || (priority[ref.via] ?? 0) > (priority[existing.via] ?? 0)) {
+            best.set(key, ref);
+        }
+    }
+    return Array.from(best.values());
+}
+/**
+ * Regex-based fallback for when AST parsing is unavailable.
+ */
+function extractMarkdownFileRefsRegex(content) {
+    const refs = [];
+    const lines = content.split("\n");
+    let inFencedBlock = false;
+    const markdownLink = /\[[^\]]+\]\(([^)]+)\)/g;
+    const inlineCode = /`([^`\n]+)`/g;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const lineNo = i + 1;
+        if (/^[ \t]*(`{3,}|~{3,})/.test(line)) {
+            inFencedBlock = !inFencedBlock;
+            continue;
+        }
+        if (inFencedBlock)
+            continue;
+        markdownLink.lastIndex = 0;
+        for (const match of line.matchAll(markdownLink)) {
+            const path = match[1]?.trim();
+            if (path && !(0, file_refs_js_1.isUrl)(path) && !path.startsWith("#")) {
+                refs.push({ path, line: lineNo, via: "markdown-link" });
+            }
+        }
+        inlineCode.lastIndex = 0;
+        for (const match of line.matchAll(inlineCode)) {
+            const parts = match[1].trim().split(/\s+/);
+            for (let pi = 0; pi < parts.length; pi++) {
+                const part = parts[pi];
+                if (pi === 0 && !part.includes("/") && !part.includes("."))
+                    continue;
+                if ((0, file_refs_js_1.looksLikePath)(part) && !(0, file_refs_js_1.isUrl)(part)) {
+                    refs.push({ path: part, line: lineNo, via: "inline-code" });
+                }
+            }
+        }
+        const maskedLine = line.replace(/\[[^\]]*\]\([^)]*\)/g, "");
+        file_refs_js_1.BARE_PATH_PATTERN.lastIndex = 0;
+        for (const match of maskedLine.matchAll(file_refs_js_1.BARE_PATH_PATTERN)) {
+            const path = match[0].trim();
+            if (path && (0, file_refs_js_1.looksLikePath)(path) && !(0, file_refs_js_1.isUrl)(path)) {
+                refs.push({ path, line: lineNo, via: "bare-path" });
+            }
+        }
+    }
+    return deduplicateRefs(refs);
+}

package/script/analyzer/rules/markdown/mod.d.ts

@@ -0,0 +1,5 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+import { FileTypeConfig } from "../../types.js";
+export declare const MARKDOWN_RULES: AstGrepRule[];
+export declare const MARKDOWN_FILETYPE_CONFIG: FileTypeConfig;
+//# sourceMappingURL=mod.d.ts.map

package/script/analyzer/rules/markdown/mod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/markdown/mod.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhD,eAAO,MAAM,cAAc,EAAE,WAAW,EAAO,CAAC;AAEhD,eAAO,MAAM,wBAAwB,EAAE,cAItC,CAAC"}

package/script/analyzer/rules/markdown/mod.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MARKDOWN_FILETYPE_CONFIG = exports.MARKDOWN_RULES = void 0;
+const extractCodeBlocks_js_1 = require("./extractCodeBlocks.js");
+const extractFileRefs_js_1 = require("./extractFileRefs.js");
+exports.MARKDOWN_RULES = [];
+exports.MARKDOWN_FILETYPE_CONFIG = {
+    extractCodeBlocks: extractCodeBlocks_js_1.extractCodeBlocks,
+    defaultLanguage: "markdown",
+    extractFileRefs: extractFileRefs_js_1.extractMarkdownFileRefs,
+};

package/script/analyzer/rules/mod.d.ts

@@ -0,0 +1,13 @@
+import { PROMPT_REGEX_RULES } from "./shared/prompt-injection.js";
+import type { FileRefDiscovery, FileTypeConfig } from "../types.js";
+import type { FileType, RuleRiskInput, RuleRiskResult } from "../../shared/mod.js";
+import type { AstGrepRule } from "../astgrep/client.js";
+import type { PromptRegexRule } from "./shared/prompt-injection.js";
+export declare const RULES_BY_FILETYPE: Partial<Record<FileType, readonly AstGrepRule[]>>;
+export declare const FILETYPE_CONFIGS: Record<FileType, FileTypeConfig>;
+export { PROMPT_REGEX_RULES };
+export type { FileRefDiscovery };
+export type RiskRuleDefinition = AstGrepRule | PromptRegexRule;
+export declare const RULES_BY_ID: Map<string, RiskRuleDefinition>;
+export declare function evalRuleRiskMappings(rule: RiskRuleDefinition, input: RuleRiskInput): RuleRiskResult[];
+//# sourceMappingURL=mod.d.ts.map

package/script/analyzer/rules/mod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../src/analyzer/rules/mod.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGpE,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAGpE,eAAO,MAAM,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC,CAOtE,CAAC;AAEX,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,QAAQ,EAAE,cAAc,CAgBpD,CAAC;AAEX,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAC9B,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAEjC,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,eAAe,CAAC;AAE/D,eAAO,MAAM,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAKvD,CAAC;AAEF,wBAAgB,oBAAoB,CAChC,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,aAAa,GACrB,cAAc,EAAE,CAiBlB"}

package/script/analyzer/rules/mod.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RULES_BY_ID = exports.PROMPT_REGEX_RULES = exports.FILETYPE_CONFIGS = exports.RULES_BY_FILETYPE = void 0;
+exports.evalRuleRiskMappings = evalRuleRiskMappings;
+const mod_js_1 = require("./bash/mod.js");
+const mod_js_2 = require("./javascript/mod.js");
+const mod_js_3 = require("./markdown/mod.js");
+const mod_js_4 = require("./python/mod.js");
+const prompt_injection_js_1 = require("./shared/prompt-injection.js");
+Object.defineProperty(exports, "PROMPT_REGEX_RULES", { enumerable: true, get: function () { return prompt_injection_js_1.PROMPT_REGEX_RULES; } });
+const mod_js_5 = require("./text/mod.js");
+const mod_js_6 = require("./typescript/mod.js");
+// Single registry used for both file-level scanning and code-block scanning.
+exports.RULES_BY_FILETYPE = {
+    markdown: mod_js_3.MARKDOWN_RULES,
+    text: mod_js_5.TEXT_RULES,
+    bash: mod_js_1.BASH_RULES,
+    javascript: mod_js_2.JAVASCRIPT_RULES,
+    typescript: mod_js_6.TYPESCRIPT_RULES,
+    python: mod_js_4.PYTHON_RULES,
+};
+exports.FILETYPE_CONFIGS = {
+    markdown: mod_js_3.MARKDOWN_FILETYPE_CONFIG,
+    text: mod_js_5.TEXT_FILETYPE_CONFIG,
+    bash: mod_js_1.BASH_FILETYPE_CONFIS,
+    javascript: mod_js_2.JAVASCRIPT_FILETYPE_CONFIGS,
+    typescript: mod_js_2.TYPESCRIPT_FILETYPE_CONFIGS,
+    python: mod_js_4.PYTHONG_FILETYPE_CONFIGS,
+    csv: { defaultLanguage: null },
+    json: { defaultLanguage: null },
+    yaml: { defaultLanguage: null },
+    toml: { defaultLanguage: null },
+    config: { defaultLanguage: null },
+    sql: { defaultLanguage: null },
+    xml: { defaultLanguage: null },
+    binary: { defaultLanguage: null },
+    unknown: { defaultLanguage: null },
+};
+exports.RULES_BY_ID = new Map([
+    ...Object.values(exports.RULES_BY_FILETYPE).flatMap((rules) => rules ?? []),
+    ...prompt_injection_js_1.PROMPT_REGEX_RULES,
+].map((rule) => [rule.id, rule]));
+function evalRuleRiskMappings(rule, input) {
+    const entries = "permission" in rule
+        ? (rule.permission.mappedRisks ?? [])
+        : (rule.mappedRisks ?? []);
+    const results = [];
+    for (const entry of entries) {
+        if (typeof entry === "function") {
+            const value = entry(input);
+            if (!value)
+                continue;
+            results.push(...(Array.isArray(value) ? value : [value]));
+            continue;
+        }
+        results.push(entry);
+    }
+    return results;
+}

package/script/analyzer/rules/python/astTypes.d.ts

@@ -0,0 +1,10 @@
+/** ast-grep node types for Python. */
+export declare const PYTHON_NODE: {
+    readonly IMPORT_STATEMENT: "import_statement";
+    readonly IMPORT_FROM_STATEMENT: "import_from_statement";
+    readonly CALL: "call";
+    readonly STRING: "string";
+    readonly STRING_CONTENT: "string_content";
+    readonly DOTTED_NAME: "dotted_name";
+};
+//# sourceMappingURL=astTypes.d.ts.map

package/script/analyzer/rules/python/astTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"astTypes.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/python/astTypes.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,eAAO,MAAM,WAAW;;;;;;;CAOd,CAAC"}

package/script/analyzer/rules/python/astTypes.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PYTHON_NODE = void 0;
+/** ast-grep node types for Python. */
+exports.PYTHON_NODE = {
+    IMPORT_STATEMENT: "import_statement",
+    IMPORT_FROM_STATEMENT: "import_from_statement",
+    CALL: "call",
+    STRING: "string",
+    STRING_CONTENT: "string_content",
+    DOTTED_NAME: "dotted_name",
+};

package/script/analyzer/rules/python/extractFileRefs.d.ts

@@ -0,0 +1,14 @@
+/**
+ * File reference extractor for Python scripts.
+ *
+ * Detects:
+ * - import statements → via: "import"
+ * - from...import statements → via: "import"
+ * - open() calls with host FS paths → via: "bare-path"
+ * - URL string literals (requests.get, urllib, etc.) → via: "url"
+ *
+ * Uses ast-grep AST traversal.
+ */
+import type { AnalyzerContext, FileRefDiscovery } from "../../types.js";
+export declare function extractPythonFileRefs(context: AnalyzerContext, content: string): FileRefDiscovery[];
+//# sourceMappingURL=extractFileRefs.d.ts.map

package/script/analyzer/rules/python/extractFileRefs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extractFileRefs.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/python/extractFileRefs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGxE,wBAAgB,qBAAqB,CACjC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,gBAAgB,EAAE,CAwEpB"}

package/script/analyzer/rules/python/extractFileRefs.js

@@ -0,0 +1,85 @@
+"use strict";
+/**
+ * File reference extractor for Python scripts.
+ *
+ * Detects:
+ * - import statements → via: "import"
+ * - from...import statements → via: "import"
+ * - open() calls with host FS paths → via: "bare-path"
+ * - URL string literals (requests.get, urllib, etc.) → via: "url"
+ *
+ * Uses ast-grep AST traversal.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractPythonFileRefs = extractPythonFileRefs;
+const file_refs_js_1 = require("../shared/file-refs.js");
+const astTypes_js_1 = require("./astTypes.js");
+function extractPythonFileRefs(context, content) {
+    const refs = [];
+    const ast = context.astgrepClient.parse("python", content);
+    const root = ast.root();
+    // ── import_statement (e.g. `import os`, `import os.path`) ───────────────
+    const importNodes = root.findAll({ rule: { kind: astTypes_js_1.PYTHON_NODE.IMPORT_STATEMENT } });
+    for (const node of importNodes) {
+        const nameNode = node.find({ rule: { kind: astTypes_js_1.PYTHON_NODE.DOTTED_NAME } });
+        const pkg = nameNode?.text() ?? "";
+        if (pkg) {
+            refs.push({ path: pkg, line: node.range().start.line + 1, via: "import" });
+        }
+    }
+    // ── import_from_statement (e.g. `from os.path import join`) ─────────────
+    const fromImportNodes = root.findAll({ rule: { kind: astTypes_js_1.PYTHON_NODE.IMPORT_FROM_STATEMENT } });
+    for (const node of fromImportNodes) {
+        const moduleNode = node.field("module_name");
+        const pkg = moduleNode?.text() ?? "";
+        if (pkg) {
+            refs.push({ path: pkg, line: node.range().start.line + 1, via: "import" });
+        }
+    }
+    // ── open("path") ─────────────────────────────────────────────────────────
+    const openCallNodes = root.findAll({
+        rule: {
+            kind: astTypes_js_1.PYTHON_NODE.CALL,
+            has: {
+                field: "function",
+                regex: "^open$",
+                stopBy: "neighbor",
+            },
+        },
+    });
+    for (const node of openCallNodes) {
+        const argsNode = node.field("arguments");
+        if (!argsNode)
+            continue;
+        // string → string_content (Python string has no string_fragment)
+        const strNode = argsNode.find({ rule: { kind: astTypes_js_1.PYTHON_NODE.STRING } });
+        const contentNode = strNode?.find({ rule: { kind: astTypes_js_1.PYTHON_NODE.STRING_CONTENT } });
+        const path = contentNode?.text() ?? "";
+        if (path && (0, file_refs_js_1.isHostFsPath)(path)) {
+            refs.push({ path, line: node.range().start.line + 1, via: "bare-path" });
+        }
+    }
+    // ── requests.*/urllib.* URL calls ────────────────────────────────────────
+    const httpCallNodes = root.findAll({
+        rule: {
+            kind: astTypes_js_1.PYTHON_NODE.CALL,
+            has: {
+                field: "function",
+                regex: "^(?:requests|urllib)",
+                stopBy: "neighbor",
+            },
+        },
+    });
+    for (const node of httpCallNodes) {
+        const argsNode = node.field("arguments");
+        if (!argsNode)
+            continue;
+        const strNode = argsNode.find({ rule: { kind: astTypes_js_1.PYTHON_NODE.STRING } });
+        const contentNode = strNode?.find({ rule: { kind: astTypes_js_1.PYTHON_NODE.STRING_CONTENT } });
+        const url = contentNode?.text() ?? "";
+        if (url && (0, file_refs_js_1.isUrl)(url)) {
+            refs.push({ path: url, line: node.range().start.line + 1, via: "url" });
+        }
+    }
+    return refs;
+}

package/script/analyzer/rules/python/mod.d.ts

@@ -0,0 +1,5 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+import { FileTypeConfig } from "../../types.js";
+export declare const PYTHON_RULES: AstGrepRule[];
+export declare const PYTHONG_FILETYPE_CONFIGS: FileTypeConfig;
+//# sourceMappingURL=mod.d.ts.map

package/script/analyzer/rules/python/mod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/python/mod.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAKhD,eAAO,MAAM,YAAY,EAAE,WAAW,EAGrC,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,cAGtC,CAAC"}

package/script/analyzer/rules/python/mod.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PYTHONG_FILETYPE_CONFIGS = exports.PYTHON_RULES = void 0;
+const extractFileRefs_js_1 = require("./extractFileRefs.js");
+const network_js_1 = require("./network.js");
+const secret_detection_js_1 = require("./secret-detection.js");
+exports.PYTHON_RULES = [
+    ...network_js_1.PYTHON_NETWORK_RULES,
+    ...secret_detection_js_1.PYTHON_SECRET_DETECTION_RULES,
+];
+exports.PYTHONG_FILETYPE_CONFIGS = {
+    defaultLanguage: "python",
+    extractFileRefs: extractFileRefs_js_1.extractPythonFileRefs,
+};

package/script/analyzer/rules/python/network.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+export declare const PYTHON_NETWORK_RULES: AstGrepRule[];
+//# sourceMappingURL=network.d.ts.map

package/script/analyzer/rules/python/network.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/python/network.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAG3D,eAAO,MAAM,oBAAoB,EAAE,WAAW,EAsB7C,CAAC"}

package/script/analyzer/rules/python/network.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PYTHON_NETWORK_RULES = void 0;
+const network_evaluators_js_1 = require("../shared/network-evaluators.js");
+exports.PYTHON_NETWORK_RULES = [
+    {
+        id: "net-requests",
+        description: "Detects Python requests usage",
+        grammar: "python",
+        patterns: [
+            "requests.get($URL)",
+            "requests.post($URL, data=$DATA)",
+            "requests.put($URL, data=$DATA)",
+            "requests.patch($URL, data=$DATA)",
+        ],
+        permission: {
+            tool: "requests",
+            scope: "net",
+            permission: "fetch",
+            metadata: {
+                url: "URL",
+                data: "DATA",
+            },
+            mappedRisks: [network_evaluators_js_1.DETECT_NETWORK_FETCH_RISKS],
+        },
+    },
+];

package/script/analyzer/rules/python/secret-detection.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+export declare const PYTHON_SECRET_DETECTION_RULES: AstGrepRule[];
+//# sourceMappingURL=secret-detection.d.ts.map

package/script/analyzer/rules/python/secret-detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-detection.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/python/secret-detection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAG3D,eAAO,MAAM,6BAA6B,EAAE,WAAW,EA0BtD,CAAC"}