@feiyoug/skill-lab 0.0.0

package/esm/analyzer/rules/bash/inline-command-classifier.js

@@ -0,0 +1,71 @@
+import { looksLikePath } from "../shared/file-refs.js";
+import { BASH_COMMAND_RULES } from "./commands/mod.js";
+const GENERIC_COMMAND_RULE_ID = "shell-generic-command";
+const CONTEXT_VERB_PATTERN = /\b(run|execute|invoke|call|terminal|shell|command|cmd|bash|zsh|sh)\b/i;
+const CONTEXT_COMMAND_ALLOWLIST = new Set([
+    "git",
+    "gh",
+    "npm",
+    "pnpm",
+    "yarn",
+    "bun",
+    "deno",
+    "node",
+    "python",
+    "python3",
+    "pip",
+    "pip3",
+    "docker",
+    "docker-compose",
+    "kubectl",
+    "curl",
+    "wget",
+    "bd",
+    "slab",
+    "bash",
+    "sh",
+    "zsh",
+]);
+const SPECIFIC_COMMAND_RULES = BASH_COMMAND_RULES.filter((rule) => rule.id !== GENERIC_COMMAND_RULE_ID);
+const KNOWN_COMMAND_TOOLS = new Set(SPECIFIC_COMMAND_RULES
+    .map((rule) => String(rule.permission.tool ?? "").toLowerCase())
+    .filter((tool) => tool && tool !== "detected"));
+export function isLikelyInlineBashCommand(context, input) {
+    const snippet = normalizeInlineSnippet(input.snippet);
+    if (!snippet)
+        return false;
+    if (looksLikeFormattingToken(snippet))
+        return false;
+    const tokens = snippet.split(/\s+/).filter(Boolean);
+    if (tokens.length === 1 && looksLikePath(snippet))
+        return false;
+    if (matchesSpecificBashCommandRule(context, snippet))
+        return true;
+    const firstToken = tokens[0]?.toLowerCase() ?? "";
+    const hasContextVerb = CONTEXT_VERB_PATTERN.test(input.lineContext ?? "");
+    const knownTool = firstToken &&
+        (CONTEXT_COMMAND_ALLOWLIST.has(firstToken) || KNOWN_COMMAND_TOOLS.has(firstToken));
+    if (tokens.length >= 2 && knownTool) {
+        return true;
+    }
+    if (tokens.length === 1 && knownTool && hasContextVerb) {
+        return true;
+    }
+    return false;
+}
+function matchesSpecificBashCommandRule(context, snippet) {
+    const matches = context.astgrepClient.scanWithRules(snippet, "bash", SPECIFIC_COMMAND_RULES);
+    return matches.length > 0;
+}
+function normalizeInlineSnippet(raw) {
+    return raw.trim().replace(/^`+/, "").replace(/`+$/, "").trim();
+}
+function looksLikeFormattingToken(snippet) {
+    if (!snippet)
+        return true;
+    if (/^[*]{1,2}[^*]+[*]{1,2}$/.test(snippet))
+        return true;
+    if (/^[A-Z][a-z]+(?:\s+[A-Z][a-z]+)*$/.test(snippet))
+        return true;
+    return false;
+}

package/esm/analyzer/rules/bash/mod.d.ts

@@ -0,0 +1,5 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+import { FileTypeConfig } from "../../types.js";
+export declare const BASH_RULES: AstGrepRule[];
+export declare const BASH_FILETYPE_CONFIS: FileTypeConfig;
+//# sourceMappingURL=mod.d.ts.map

package/esm/analyzer/rules/bash/mod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/mod.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAShD,eAAO,MAAM,UAAU,EAAE,WAAW,EAOnC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,cAGlC,CAAC"}

package/esm/analyzer/rules/bash/mod.js

@@ -0,0 +1,19 @@
+import { BASH_COMMAND_RULES } from "./commands/mod.js";
+import { BASH_DESTRUCTIVE_RULES } from "./destructive.js";
+import { extractBashFileRefs } from "./extractFileRefs.js";
+import { BASH_FILESYSTEM_RULES } from "./filesystem.js";
+import { BASH_INJECTION_RULES } from "./injection.js";
+import { BASH_NETWORK_RULES } from "./network.js";
+import { BASH_SECRET_DETECTION_RULES } from "./secret-detection.js";
+export const BASH_RULES = [
+    ...BASH_NETWORK_RULES,
+    ...BASH_FILESYSTEM_RULES,
+    ...BASH_COMMAND_RULES,
+    ...BASH_DESTRUCTIVE_RULES,
+    ...BASH_INJECTION_RULES,
+    ...BASH_SECRET_DETECTION_RULES,
+];
+export const BASH_FILETYPE_CONFIS = {
+    defaultLanguage: "bash",
+    extractFileRefs: extractBashFileRefs,
+};

package/esm/analyzer/rules/bash/network.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+export declare const BASH_NETWORK_RULES: AstGrepRule[];
+//# sourceMappingURL=network.d.ts.map

package/esm/analyzer/rules/bash/network.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/network.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAM3D,eAAO,MAAM,kBAAkB,EAAE,WAAW,EAyD3C,CAAC"}

package/esm/analyzer/rules/bash/network.js

@@ -0,0 +1,59 @@
+import { DETECT_NETWORK_FETCH_RISKS, DETECT_REMOTE_CODE_EXECUTION_RISK, } from "../shared/network-evaluators.js";
+export const BASH_NETWORK_RULES = [
+    {
+        id: "net-curl",
+        description: "Detects curl usage",
+        grammar: "bash",
+        patterns: [
+            "curl $URL",
+            "curl -X $METHOD $URL",
+            "curl --request $METHOD $URL",
+            "curl $$$FLAGS -H $HEADER $$$REST",
+            "curl $$$FLAGS --header $HEADER $$$REST",
+            "curl $$$FLAGS $URL?token=$TOKEN",
+        ],
+        permission: {
+            tool: "curl",
+            scope: "net",
+            permission: "fetch",
+            metadata: {
+                method: "METHOD",
+                url: "URL",
+                header: "HEADER",
+                token: "TOKEN",
+            },
+            mappedRisks: [DETECT_NETWORK_FETCH_RISKS],
+        },
+    },
+    {
+        id: "net-wget",
+        description: "Detects wget usage",
+        grammar: "bash",
+        patterns: ["wget $URL", "wget --post-data=$DATA $URL"],
+        permission: {
+            tool: "wget",
+            scope: "net",
+            permission: "fetch",
+            metadata: {
+                url: "URL",
+                data: "DATA",
+            },
+            mappedRisks: [DETECT_NETWORK_FETCH_RISKS],
+        },
+    },
+    {
+        id: "net-pipe-shell",
+        description: "Detects network pipe to shell",
+        grammar: "bash",
+        patterns: ["curl $$$ARGS | bash", "curl $$$ARGS | sh", "wget $$$ARGS | bash"],
+        permission: {
+            tool: "bash",
+            scope: "sys",
+            permission: "shell",
+            metadata: {
+                command: "ARGS",
+            },
+            mappedRisks: [DETECT_REMOTE_CODE_EXECUTION_RISK],
+        },
+    },
+];

package/esm/analyzer/rules/bash/secret-detection.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+export declare const BASH_SECRET_DETECTION_RULES: AstGrepRule[];
+//# sourceMappingURL=secret-detection.d.ts.map

package/esm/analyzer/rules/bash/secret-detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-detection.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/secret-detection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAG3D,eAAO,MAAM,2BAA2B,EAAE,WAAW,EAuCpD,CAAC"}

package/esm/analyzer/rules/bash/secret-detection.js

@@ -0,0 +1,41 @@
+import { DETECT_SECRET_NAME_RISK } from "../shared/secret-evaluators.js";
+export const BASH_SECRET_DETECTION_RULES = [
+    {
+        id: "secret-bash-env-read-plain",
+        description: "Detects bash env var read with $VAR",
+        grammar: "bash",
+        patterns: ["echo \\$$VAR", "printf \\$$VAR"],
+        permission: {
+            tool: "env",
+            scope: "env",
+            permission: "read",
+            metadata: { key: "VAR" },
+            mappedRisks: [DETECT_SECRET_NAME_RISK],
+        },
+    },
+    {
+        id: "secret-bash-env-read-braced",
+        description: "Detects bash env var read with ${VAR}",
+        grammar: "bash",
+        patterns: ["echo \\${$VAR}", "printf \\${$VAR}"],
+        permission: {
+            tool: "env",
+            scope: "env",
+            permission: "read",
+            metadata: { key: "VAR" },
+            mappedRisks: [DETECT_SECRET_NAME_RISK],
+        },
+    },
+    {
+        id: "secret-bash-env-write",
+        description: "Detects export env var write",
+        grammar: "bash",
+        patterns: ["export $KEY=$VALUE"],
+        permission: {
+            tool: "env",
+            scope: "env",
+            permission: "write",
+            metadata: { key: "KEY" },
+        },
+    },
+];

package/esm/analyzer/rules/javascript/astTypes.d.ts

@@ -0,0 +1,9 @@
+/** ast-grep node types for JavaScript and TypeScript. */
+export declare const JS_NODE: {
+    readonly IMPORT_STATEMENT: "import_statement";
+    readonly EXPORT_STATEMENT: "export_statement";
+    readonly CALL_EXPRESSION: "call_expression";
+    readonly STRING: "string";
+    readonly STRING_FRAGMENT: "string_fragment";
+};
+//# sourceMappingURL=astTypes.d.ts.map

package/esm/analyzer/rules/javascript/astTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"astTypes.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/javascript/astTypes.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,eAAO,MAAM,OAAO;;;;;;CAMV,CAAC"}

package/esm/analyzer/rules/javascript/astTypes.js

@@ -0,0 +1,8 @@
+/** ast-grep node types for JavaScript and TypeScript. */
+export const JS_NODE = {
+    IMPORT_STATEMENT: "import_statement",
+    EXPORT_STATEMENT: "export_statement",
+    CALL_EXPRESSION: "call_expression",
+    STRING: "string",
+    STRING_FRAGMENT: "string_fragment",
+};

package/esm/analyzer/rules/javascript/extractFileRefs.d.ts

@@ -0,0 +1,16 @@
+/**
+ * File reference extractor for JavaScript and TypeScript files.
+ *
+ * Detects:
+ * - import/export ... from "specifier" → via: "import"
+ * - require("specifier") → via: "import"
+ * - URL string literals used in fetch/axios/XMLHttpRequest → via: "url"
+ * - Host filesystem paths in fs.readFile / fs.writeFile / open calls → via: "bare-path"
+ *
+ * Uses ast-grep AST traversal; `context` is accepted for interface consistency
+ * (AST client is synchronous for JS/TS and does not require async setup).
+ */
+import type { AnalyzerContext, FileRefDiscovery } from "../../types.js";
+export declare function extractJsFileRefs(context: AnalyzerContext, content: string): FileRefDiscovery[];
+export declare function extractTsFileRefs(context: AnalyzerContext, content: string): FileRefDiscovery[];
+//# sourceMappingURL=extractFileRefs.d.ts.map

package/esm/analyzer/rules/javascript/extractFileRefs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extractFileRefs.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/javascript/extractFileRefs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAyGxE,wBAAgB,iBAAiB,CAC7B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,gBAAgB,EAAE,CAEpB;AAED,wBAAgB,iBAAiB,CAC7B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,gBAAgB,EAAE,CAEpB"}

package/esm/analyzer/rules/javascript/extractFileRefs.js

@@ -0,0 +1,113 @@
+/**
+ * File reference extractor for JavaScript and TypeScript files.
+ *
+ * Detects:
+ * - import/export ... from "specifier" → via: "import"
+ * - require("specifier") → via: "import"
+ * - URL string literals used in fetch/axios/XMLHttpRequest → via: "url"
+ * - Host filesystem paths in fs.readFile / fs.writeFile / open calls → via: "bare-path"
+ *
+ * Uses ast-grep AST traversal; `context` is accepted for interface consistency
+ * (AST client is synchronous for JS/TS and does not require async setup).
+ */
+import { isHostFsPath, isUrl } from "../shared/file-refs.js";
+import { JS_NODE } from "./astTypes.js";
+function extractJsLikeFileRefs(lang, context, content) {
+    const refs = [];
+    const ast = context.astgrepClient.parse(lang, content);
+    const root = ast.root();
+    // ── import_statement ────────────────────────────────────────────────────
+    const importNodes = root.findAll({ rule: { kind: JS_NODE.IMPORT_STATEMENT } });
+    for (const node of importNodes) {
+        const sourceNode = node.field("source");
+        if (!sourceNode)
+            continue;
+        const fragmentNode = sourceNode.find({ rule: { kind: JS_NODE.STRING_FRAGMENT } });
+        const specifier = fragmentNode?.text() ?? "";
+        if (specifier) {
+            refs.push({ path: specifier, line: node.range().start.line + 1, via: "import" });
+        }
+    }
+    // ── export_statement (re-exports only — export ... from "…") ────────────
+    const exportNodes = root.findAll({ rule: { kind: JS_NODE.EXPORT_STATEMENT } });
+    for (const node of exportNodes) {
+        const sourceNode = node.field("source");
+        if (!sourceNode)
+            continue; // no `from` clause → local export, skip
+        const fragmentNode = sourceNode.find({ rule: { kind: JS_NODE.STRING_FRAGMENT } });
+        const specifier = fragmentNode?.text() ?? "";
+        if (specifier) {
+            refs.push({ path: specifier, line: node.range().start.line + 1, via: "import" });
+        }
+    }
+    // ── require("specifier") ────────────────────────────────────────────────
+    const requireNodes = root.findAll({
+        rule: {
+            kind: JS_NODE.CALL_EXPRESSION,
+            has: {
+                field: "function",
+                regex: "^require$",
+                stopBy: "neighbor",
+            },
+        },
+    });
+    for (const node of requireNodes) {
+        const argsNode = node.field("arguments");
+        if (!argsNode)
+            continue;
+        const fragmentNode = argsNode.find({ rule: { kind: JS_NODE.STRING_FRAGMENT } });
+        const specifier = fragmentNode?.text() ?? "";
+        if (specifier) {
+            refs.push({ path: specifier, line: node.range().start.line + 1, via: "import" });
+        }
+    }
+    // ── fetch/axios/etc. URL calls ──────────────────────────────────────────
+    const urlCallNodes = root.findAll({
+        rule: {
+            kind: JS_NODE.CALL_EXPRESSION,
+            has: {
+                field: "function",
+                regex: "^(?:fetch|axios\\.(?:get|post|put|delete|patch|head)|XMLHttpRequest|request|got|superagent)$",
+                stopBy: "neighbor",
+            },
+        },
+    });
+    for (const node of urlCallNodes) {
+        const argsNode = node.field("arguments");
+        if (!argsNode)
+            continue;
+        const fragmentNode = argsNode.find({ rule: { kind: JS_NODE.STRING_FRAGMENT } });
+        const url = fragmentNode?.text() ?? "";
+        if (url && isUrl(url)) {
+            refs.push({ path: url, line: node.range().start.line + 1, via: "url" });
+        }
+    }
+    // ── fs.* calls with host paths ──────────────────────────────────────────
+    const fsCallNodes = root.findAll({
+        rule: {
+            kind: JS_NODE.CALL_EXPRESSION,
+            has: {
+                field: "function",
+                regex: "^fs\\.(?:readFile|writeFile|appendFile|open|access|stat|unlink|mkdir|rmdir|rename|copyFile)$",
+                stopBy: "neighbor",
+            },
+        },
+    });
+    for (const node of fsCallNodes) {
+        const argsNode = node.field("arguments");
+        if (!argsNode)
+            continue;
+        const fragmentNode = argsNode.find({ rule: { kind: JS_NODE.STRING_FRAGMENT } });
+        const path = fragmentNode?.text() ?? "";
+        if (path && isHostFsPath(path)) {
+            refs.push({ path, line: node.range().start.line + 1, via: "bare-path" });
+        }
+    }
+    return refs;
+}
+export function extractJsFileRefs(context, content) {
+    return extractJsLikeFileRefs("javascript", context, content);
+}
+export function extractTsFileRefs(context, content) {
+    return extractJsLikeFileRefs("typescript", context, content);
+}

package/esm/analyzer/rules/javascript/filesystem.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+export declare const JAVASCRIPT_FILESYSTEM_RULES: AstGrepRule[];
+//# sourceMappingURL=filesystem.d.ts.map

package/esm/analyzer/rules/javascript/filesystem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/javascript/filesystem.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,eAAO,MAAM,2BAA2B,EAAE,WAAW,EAyBpD,CAAC"}

package/esm/analyzer/rules/javascript/filesystem.js

@@ -0,0 +1,26 @@
+export const JAVASCRIPT_FILESYSTEM_RULES = [
+    {
+        id: "fs-read-js",
+        description: "Detects JS file reads",
+        grammar: "javascript",
+        patterns: ["Deno.readTextFile($FILE)", "Deno.readFile($FILE)", "readFileSync($FILE)"],
+        permission: {
+            tool: "read",
+            scope: "fs",
+            permission: "read",
+            metadata: { file: "FILE" },
+        },
+    },
+    {
+        id: "fs-write-js",
+        description: "Detects JS file writes",
+        grammar: "javascript",
+        patterns: ["Deno.writeTextFile($FILE, $CONTENT)", "Deno.writeFile($FILE, $CONTENT)"],
+        permission: {
+            tool: "write",
+            scope: "fs",
+            permission: "write",
+            metadata: { file: "FILE" },
+        },
+    },
+];

package/esm/analyzer/rules/javascript/injection.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+export declare const JAVASCRIPT_INJECTION_RULES: AstGrepRule[];
+//# sourceMappingURL=injection.d.ts.map

package/esm/analyzer/rules/javascript/injection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/javascript/injection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,eAAO,MAAM,0BAA0B,EAAE,WAAW,EAkBnD,CAAC"}

package/esm/analyzer/rules/javascript/injection.js

@@ -0,0 +1,19 @@
+export const JAVASCRIPT_INJECTION_RULES = [
+    {
+        id: "inject-eval",
+        description: "Detects eval-style execution",
+        grammar: "javascript",
+        patterns: ["eval($CODE)", "new Function($CODE)", "exec($CODE)"],
+        permission: {
+            tool: "eval",
+            scope: "sys",
+            permission: "shell",
+            metadata: { code: "CODE" },
+            mappedRisks: [{
+                    code: "INJECTION:command_injection",
+                    severity: "critical",
+                    message: "Dynamic code execution detected",
+                }],
+        },
+    },
+];

package/esm/analyzer/rules/javascript/mod.d.ts

@@ -0,0 +1,6 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+import { FileTypeConfig } from "../../types.js";
+export declare const JAVASCRIPT_RULES: AstGrepRule[];
+export declare const JAVASCRIPT_FILETYPE_CONFIGS: FileTypeConfig;
+export declare const TYPESCRIPT_FILETYPE_CONFIGS: FileTypeConfig;
+//# sourceMappingURL=mod.d.ts.map

package/esm/analyzer/rules/javascript/mod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/javascript/mod.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAQhD,eAAO,MAAM,gBAAgB,EAAE,WAAW,EAMzC,CAAC;AAEF,eAAO,MAAM,2BAA2B,EAAE,cAGzC,CAAC;AAEF,eAAO,MAAM,2BAA2B,EAAE,cAGzC,CAAC"}

package/esm/analyzer/rules/javascript/mod.js

@@ -0,0 +1,21 @@
+import { extractJsFileRefs, extractTsFileRefs } from "./extractFileRefs.js";
+import { JAVASCRIPT_FILESYSTEM_RULES } from "./filesystem.js";
+import { JAVASCRIPT_INJECTION_RULES } from "./injection.js";
+import { JAVASCRIPT_NETWORK_RULES } from "./network.js";
+import { JAVASCRIPT_SECRET_DETECTION_RULES } from "./secret-detection.js";
+import { JAVASCRIPT_SUBPROCESS_RULES } from "./subprocess.js";
+export const JAVASCRIPT_RULES = [
+    ...JAVASCRIPT_NETWORK_RULES,
+    ...JAVASCRIPT_FILESYSTEM_RULES,
+    ...JAVASCRIPT_INJECTION_RULES,
+    ...JAVASCRIPT_SUBPROCESS_RULES,
+    ...JAVASCRIPT_SECRET_DETECTION_RULES,
+];
+export const JAVASCRIPT_FILETYPE_CONFIGS = {
+    defaultLanguage: "javascript",
+    extractFileRefs: extractJsFileRefs,
+};
+export const TYPESCRIPT_FILETYPE_CONFIGS = {
+    defaultLanguage: "typescript",
+    extractFileRefs: extractTsFileRefs,
+};

package/esm/analyzer/rules/javascript/network.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+export declare const JAVASCRIPT_NETWORK_RULES: AstGrepRule[];
+//# sourceMappingURL=network.d.ts.map

package/esm/analyzer/rules/javascript/network.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/javascript/network.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAG3D,eAAO,MAAM,wBAAwB,EAAE,WAAW,EAuBjD,CAAC"}

package/esm/analyzer/rules/javascript/network.js

@@ -0,0 +1,25 @@
+import { DETECT_NETWORK_FETCH_RISKS } from "../shared/network-evaluators.js";
+export const JAVASCRIPT_NETWORK_RULES = [
+    {
+        id: "net-fetch",
+        description: "Detects fetch() calls",
+        grammar: "javascript",
+        patterns: [
+            "fetch($URL)",
+            "fetch($URL, { method: $METHOD })",
+            "fetch($URL, { headers: $HEADERS })",
+            "fetch($URL, { method: $METHOD, headers: $HEADERS })",
+        ],
+        permission: {
+            tool: "fetch",
+            scope: "net",
+            permission: "fetch",
+            metadata: {
+                url: "URL",
+                method: "METHOD",
+                headers: "HEADERS",
+            },
+            mappedRisks: [DETECT_NETWORK_FETCH_RISKS],
+        },
+    },
+];

package/esm/analyzer/rules/javascript/secret-detection.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+export declare const JAVASCRIPT_SECRET_DETECTION_RULES: AstGrepRule[];
+//# sourceMappingURL=secret-detection.d.ts.map

package/esm/analyzer/rules/javascript/secret-detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-detection.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/javascript/secret-detection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAG3D,eAAO,MAAM,iCAAiC,EAAE,WAAW,EAgE1D,CAAC"}

package/esm/analyzer/rules/javascript/secret-detection.js

@@ -0,0 +1,66 @@
+import { DETECT_SECRET_NAME_RISK } from "../shared/secret-evaluators.js";
+export const JAVASCRIPT_SECRET_DETECTION_RULES = [
+    {
+        id: "secret-js-deno-env-read",
+        description: "Detects Deno.env.get access",
+        grammar: "javascript",
+        patterns: ["Deno.env.get($KEY)"],
+        permission: {
+            tool: "env",
+            scope: "env",
+            permission: "read",
+            metadata: { key: "KEY" },
+            mappedRisks: [DETECT_SECRET_NAME_RISK],
+        },
+    },
+    {
+        id: "secret-js-node-env-read-bracket",
+        description: "Detects process.env[key] access",
+        grammar: "javascript",
+        patterns: ["process.env[$KEY]"],
+        permission: {
+            tool: "env",
+            scope: "env",
+            permission: "read",
+            metadata: { key: "KEY" },
+            mappedRisks: [DETECT_SECRET_NAME_RISK],
+        },
+    },
+    {
+        id: "secret-js-node-env-read-dot",
+        description: "Detects process.env.KEY access",
+        grammar: "javascript",
+        patterns: ["process.env.$KEY"],
+        permission: {
+            tool: "env",
+            scope: "env",
+            permission: "read",
+            metadata: { key: "KEY" },
+            mappedRisks: [DETECT_SECRET_NAME_RISK],
+        },
+    },
+    {
+        id: "secret-js-deno-env-write",
+        description: "Detects Deno.env.set access",
+        grammar: "javascript",
+        patterns: ["Deno.env.set($KEY, $VALUE)"],
+        permission: {
+            tool: "env",
+            scope: "env",
+            permission: "write",
+            metadata: { key: "KEY" },
+        },
+    },
+    {
+        id: "secret-js-node-env-write",
+        description: "Detects process.env assignments",
+        grammar: "javascript",
+        patterns: ["process.env.$KEY = $VALUE", "process.env[$KEY] = $VALUE"],
+        permission: {
+            tool: "env",
+            scope: "env",
+            permission: "write",
+            metadata: { key: "KEY" },
+        },
+    },
+];

package/esm/analyzer/rules/javascript/subprocess.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+export declare const JAVASCRIPT_SUBPROCESS_RULES: AstGrepRule[];
+//# sourceMappingURL=subprocess.d.ts.map

package/esm/analyzer/rules/javascript/subprocess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subprocess.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/javascript/subprocess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,eAAO,MAAM,2BAA2B,EAAE,WAAW,EAapD,CAAC"}

package/esm/analyzer/rules/javascript/subprocess.js

@@ -0,0 +1,14 @@
+export const JAVASCRIPT_SUBPROCESS_RULES = [
+    {
+        id: "shell-subprocess-js",
+        description: "Detects JS subprocess execution",
+        grammar: "javascript",
+        patterns: ["Deno.Command($CMD)", "spawn($CMD)", "exec($CMD)"],
+        permission: {
+            tool: "subprocess",
+            scope: "sys",
+            permission: "subprocess",
+            metadata: { command: "CMD" },
+        },
+    },
+];

package/esm/analyzer/rules/markdown/astTypes.d.ts

@@ -0,0 +1,32 @@
+/** ast-grep node types for the Markdown block grammar (@ast-grep/lang-markdown). */
+export declare const MARKDOWN_NODE: {
+    readonly CODE_FENCE_BLOCK: "fenced_code_block";
+    readonly CODE_FENCE_CONTENT: "code_fence_content";
+    readonly CODE_FENCE_LANGUAGE: "language";
+    readonly INFO_STRING: "info_string";
+    readonly PARAGRAPH: "paragraph";
+    readonly INLINE: "inline";
+};
+/** tree-sitter node types for the Markdown inline grammar ("markdown-inline"). */
+export declare const MARKDOWN_INLINE_NODE: {
+    readonly INLINE_LINK: "inline_link";
+    readonly LINK_DESTINATION: "link_destination";
+    readonly CODE_SPAN: "code_span";
+    readonly TEXT: "text";
+};
+/**
+ * Pre-built tree-sitter S-expression query strings for the Markdown inline grammar.
+ * Pass these to treesitterClient.createQuery("markdown-inline", …) — results are cached
+ * by TreesitterClient so compilation happens only once per client instance.
+ */
+export declare const MARKDOWN_INLINE_QUERY: {
+    readonly INLINE_LINK_DEST: "(inline_link (link_destination) @dest)";
+    readonly CODE_SPAN: "(code_span) @code";
+    readonly TEXT: "(text) @text";
+};
+/** tree-sitter query strings for the Markdown block grammar ("markdown"). */
+export declare const MARKDOWN_QUERY: {
+    readonly FENCED_BLOCK: "(fenced_code_block) @block";
+    readonly INLINE: "(inline) @inline";
+};
+//# sourceMappingURL=astTypes.d.ts.map

package/esm/analyzer/rules/markdown/astTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"astTypes.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/markdown/astTypes.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,eAAO,MAAM,aAAa;;;;;;;CAOhB,CAAC;AAEX,kFAAkF;AAClF,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;;CAKxB,CAAC;AAEX,6EAA6E;AAC7E,eAAO,MAAM,cAAc;;;CAGjB,CAAC"}