@feiyoug/skill-lab 0.0.0

package/script/analyzer/steps/002-permissions/mod.d.ts

@@ -0,0 +1,3 @@
+import type { AnalyzerContext, AnalyzerState } from "../../types.js";
+export declare function run002Permissions(state: AnalyzerState, context: AnalyzerContext): Promise<AnalyzerState>;
+//# sourceMappingURL=mod.d.ts.map

package/script/analyzer/steps/002-permissions/mod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/steps/002-permissions/mod.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAWrE,wBAAsB,iBAAiB,CACnC,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,eAAe,GACzB,OAAO,CAAC,aAAa,CAAC,CA+FxB"}

package/script/analyzer/steps/002-permissions/mod.js

@@ -0,0 +1,188 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run002Permissions = run002Permissions;
+const mod_js_1 = require("../../rules/mod.js");
+const mod_js_2 = require("../../rules/mod.js");
+const inline_command_classifier_js_1 = require("../../rules/bash/inline-command-classifier.js");
+const code_block_path_js_1 = require("../../utils/code-block-path.js");
+const id_generator_js_1 = require("../../utils/id-generator.js");
+const scan_file_js_1 = require("./scan-file.js");
+const seed_frontmatter_js_1 = require("./seed-frontmatter.js");
+const synthesize_js_1 = require("./synthesize.js");
+async function run002Permissions(state, context) {
+    const skillMdPath = state.scanQueue.find((file) => file.role === "entrypoint")?.path ??
+        "SKILL.md";
+    let next = state;
+    next = (0, seed_frontmatter_js_1.seedPermissionsFromFrontmatter)(next, skillMdPath);
+    for (const fileRef of next.scanQueue) {
+        if (fileRef.sourceType === "external") {
+            if (fileRef.role === "host-fs") {
+                next = addHostFsPermission(next, fileRef.path, fileRef.referencedBy);
+            }
+            else if (fileRef.role === "library") {
+                next = {
+                    ...next,
+                    warnings: [
+                        ...next.warnings,
+                        `External library/import not analyzed yet: ${fileRef.path}`,
+                    ],
+                    metadata: {
+                        ...next.metadata,
+                        skippedFiles: [...next.metadata.skippedFiles, {
+                                path: fileRef.path,
+                                reason: "external_library_dependency",
+                                referenceBy: fileRef.referencedBy,
+                            }],
+                    },
+                };
+            }
+            else if (fileRef.discoveryMethod === "markdown-link" || fileRef.discoveryMethod === "url" ||
+                fileRef.discoveryMethod === undefined) {
+                next = {
+                    ...next,
+                    warnings: [
+                        ...next.warnings,
+                        `External reference not analyzed yet: ${fileRef.path}`,
+                    ],
+                    metadata: {
+                        ...next.metadata,
+                        skippedFiles: [...next.metadata.skippedFiles, {
+                                path: fileRef.path,
+                                reason: "external_reference",
+                                referenceBy: fileRef.referencedBy,
+                            }],
+                    },
+                };
+            }
+            continue;
+        }
+        const scanTargets = await resolveScanTargets(fileRef, context);
+        if (scanTargets.length === 0)
+            continue;
+        if (!mod_js_2.RULES_BY_FILETYPE[fileRef.fileType]) {
+            next = {
+                ...next,
+                warnings: [
+                    ...next.warnings,
+                    `File type '${fileRef.fileType}' is not supported yet for analysis: ${fileRef.path}`,
+                ],
+                metadata: {
+                    ...next.metadata,
+                    skippedFiles: [...next.metadata.skippedFiles, {
+                            path: fileRef.path,
+                            reason: `unsupported_type_${fileRef.fileType}`,
+                            referenceBy: fileRef.referencedBy,
+                        }],
+                },
+            };
+            continue;
+        }
+        for (const scanTarget of scanTargets) {
+            next = (0, scan_file_js_1.scanFileForPermissions)(context, {
+                state: next,
+                fileRef,
+                scanPath: scanTarget.scanPath,
+                content: scanTarget.content,
+                lineOffset: scanTarget.lineOffset,
+                referenceType: scanTarget.referenceType,
+            });
+            if (scanTarget.referenceType === "content") {
+                next = applyPromptRegexFindings(next, scanTarget.scanPath, scanTarget.content, scanTarget.lineOffset, fileRef.referencedBy);
+            }
+        }
+    }
+    return (0, synthesize_js_1.synthesizePermissions)(next);
+}
+async function resolveScanTargets(fileRef, context) {
+    if (fileRef.discoveryMethod !== "code-block") {
+        const content = await context.skillReader.readTextFile(fileRef.path);
+        if (!content)
+            return [];
+        return [{
+                scanPath: fileRef.path,
+                content,
+                lineOffset: 0,
+                referenceType: "content",
+            }];
+    }
+    const decoded = (0, code_block_path_js_1.decodeCodeBlockPath)(fileRef.path);
+    if (!decoded)
+        return [];
+    const parentContent = await context.skillReader.readTextFile(decoded.parentPath);
+    if (!parentContent)
+        return [];
+    const lines = parentContent.split("\n");
+    const referenceType = fileRef.referencedBy?.type === "inline" ? "inline" : "script";
+    if (referenceType === "inline") {
+        const line = lines[decoded.startLine - 1] ?? "";
+        const snippets = extractInlineSnippets(line);
+        const likelyCommands = snippets.filter((snippet) => (0, inline_command_classifier_js_1.isLikelyInlineBashCommand)(context, { snippet, lineContext: line }));
+        return likelyCommands.map((snippet) => ({
+            scanPath: decoded.parentPath,
+            content: snippet,
+            lineOffset: decoded.startLine - 1,
+            referenceType: "inline",
+        }));
+    }
+    const sliced = lines.slice(decoded.startLine - 1, decoded.endLine).join("\n");
+    if (!sliced.trim())
+        return [];
+    return [{
+            scanPath: decoded.parentPath,
+            content: sliced,
+            lineOffset: decoded.startLine - 1,
+            referenceType,
+        }];
+}
+function extractInlineSnippets(line) {
+    const snippets = [];
+    for (const match of line.matchAll(/`([^`\n]+)`/g)) {
+        const snippet = match[1]?.trim();
+        if (snippet)
+            snippets.push(snippet);
+    }
+    return snippets;
+}
+function applyPromptRegexFindings(state, filePath, content, lineOffset, referencedBy) {
+    const findings = [...state.findings];
+    const lines = content.split("\n");
+    for (const rule of mod_js_1.PROMPT_REGEX_RULES) {
+        for (let i = 0; i < lines.length; i += 1) {
+            if (!rule.pattern.test(lines[i]))
+                continue;
+            findings.push({
+                ruleId: rule.id,
+                reference: {
+                    file: filePath,
+                    line: i + 1 + lineOffset,
+                    type: "content",
+                    referencedBy,
+                },
+                extracted: {},
+            });
+        }
+    }
+    return { ...state, findings };
+}
+function addHostFsPermission(state, path, referencedBy) {
+    const reference = {
+        file: referencedBy?.file ?? "SKILL.md",
+        line: referencedBy?.line ?? 1,
+        type: "content",
+        referencedBy,
+    };
+    const permission = {
+        id: (0, id_generator_js_1.generatePermissionId)("read", [path]),
+        tool: "read",
+        scope: "fs",
+        permission: "read",
+        args: [path],
+        references: [reference],
+        source: "inferred",
+        comment: `Host filesystem access: ${path}`,
+        risks: [],
+    };
+    if (state.permissions.some((p) => p.id === permission.id))
+        return state;
+    return { ...state, permissions: [...state.permissions, permission] };
+}

package/script/analyzer/steps/002-permissions/scan-file.d.ts

@@ -0,0 +1,14 @@
+import type { AnalyzerContext, AnalyzerState } from "../../types.js";
+import type { FileReference } from "../../../shared/mod.js";
+/**
+ * Scans a text-like file and returns updated state with permissions and findings.
+ */
+export declare function scanFileForPermissions(context: AnalyzerContext, input: {
+    state: AnalyzerState;
+    fileRef: FileReference;
+    scanPath: string;
+    content: string;
+    lineOffset?: number;
+    referenceType?: "content" | "script" | "inline";
+}): AnalyzerState;
+//# sourceMappingURL=scan-file.d.ts.map

package/script/analyzer/steps/002-permissions/scan-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-file.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/steps/002-permissions/scan-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAA+B,MAAM,wBAAwB,CAAC;AAsCzF;;GAEG;AACH,wBAAgB,sBAAsB,CAClC,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE;IACH,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;CACnD,GACF,aAAa,CAgFf"}

package/script/analyzer/steps/002-permissions/scan-file.js

@@ -0,0 +1,192 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scanFileForPermissions = scanFileForPermissions;
+const mod_js_1 = require("../../rules/mod.js");
+const id_generator_js_1 = require("../../utils/id-generator.js");
+const GENERIC_SHELL_RULE_ID = "shell-generic-command";
+const SHELL_RESERVED_WORDS = new Set([
+    "if",
+    "then",
+    "else",
+    "elif",
+    "fi",
+    "for",
+    "while",
+    "until",
+    "do",
+    "done",
+    "case",
+    "esac",
+    "in",
+    "function",
+    "select",
+    "time",
+    "coproc",
+    "let",
+    "declare",
+    "typeset",
+    "local",
+    "readonly",
+    "export",
+    "unset",
+    "alias",
+    "unalias",
+    "source",
+    "true",
+    "false",
+]);
+/**
+ * Scans a text-like file and returns updated state with permissions and findings.
+ */
+function scanFileForPermissions(context, input) {
+    const { state, fileRef, scanPath, content, lineOffset = 0, referenceType = "content", } = input;
+    const permissions = [];
+    const findings = [...state.findings];
+    const rulesUsed = [...state.metadata.rulesUsed];
+    const rules = [...(mod_js_1.RULES_BY_FILETYPE[fileRef.fileType] ?? [])];
+    if (rules.length === 0) {
+        return {
+            ...state,
+            metadata: {
+                ...state.metadata,
+                scannedFiles: [...state.metadata.scannedFiles, scanPath],
+            },
+        };
+    }
+    const scanLanguage = rules[0].grammar;
+    const matches = context.astgrepClient.scanWithRules(content, scanLanguage, rules);
+    const lines = content.split("\n");
+    const filteredMatches = matches.filter((match) => shouldKeepMatchForBlock(match, lineOffset + 1, lines));
+    const blockFindings = context.astgrepClient.matchesToFindings(scanPath, referenceType, filteredMatches.map((match) => ({
+        ...match,
+        line: match.line + lineOffset,
+        lineEnd: (match.lineEnd ?? match.line) + lineOffset,
+    })), fileRef.referencedBy);
+    findings.push(...blockFindings);
+    for (const finding of blockFindings) {
+        const rule = rules.find((item) => item.id === finding.ruleId);
+        if (!rule)
+            continue;
+        if (!rulesUsed.includes(rule.id))
+            rulesUsed.push(rule.id);
+        const metadata = { ...finding.extracted };
+        const detectedTool = rule.permission.tool === "detected" && typeof finding.extracted.tool === "string"
+            ? String(finding.extracted.tool).toLowerCase()
+            : rule.permission.tool;
+        const args = buildPermissionArgs(metadata, detectedTool);
+        permissions.push({
+            id: (0, id_generator_js_1.generatePermissionId)(detectedTool, args.length ? args : ["*"], metadata),
+            tool: detectedTool,
+            scope: rule.permission.scope,
+            permission: rule.permission.permission,
+            args: args.length ? args : ["*"],
+            fileRole: fileRef.role,
+            metadata,
+            references: [finding.reference],
+            source: "detected",
+            risks: [],
+        });
+    }
+    return {
+        ...state,
+        permissions: [...state.permissions, ...permissions],
+        findings,
+        metadata: {
+            ...state.metadata,
+            rulesUsed,
+            scannedFiles: [...state.metadata.scannedFiles, scanPath],
+        },
+    };
+}
+function shouldKeepMatchForBlock(match, blockStartLine, blockLines) {
+    if (match.ruleId !== GENERIC_SHELL_RULE_ID)
+        return true;
+    const rawTool = match.extracted.tool;
+    if (typeof rawTool !== "string")
+        return false;
+    const normalizedTool = normalizeDetectedTool(rawTool);
+    if (!normalizedTool)
+        return false;
+    const lineIndex = Math.max(0, match.line - 1);
+    const line = blockLines[lineIndex] ?? "";
+    if (!isLikelyCommandLine(line, normalizedTool, blockStartLine + lineIndex)) {
+        return false;
+    }
+    match.extracted.tool = normalizedTool;
+    return true;
+}
+function normalizeDetectedTool(rawTool) {
+    const normalized = rawTool
+        .trim()
+        .replace(/^['"`([{]+/, "")
+        .replace(/[)\]}'"`:,;]+$/, "")
+        .toLowerCase();
+    if (!normalized)
+        return null;
+    if (normalized.length > 32)
+        return null;
+    if (!/^[a-z][a-z0-9+._-]*$/.test(normalized))
+        return null;
+    if (SHELL_RESERVED_WORDS.has(normalized))
+        return null;
+    return normalized;
+}
+function isLikelyCommandLine(line, tool, _lineNumber) {
+    const trimmed = line.trim();
+    if (!trimmed)
+        return false;
+    if (trimmed.startsWith("#"))
+        return false;
+    if (/^(?:[-*]|\d+[.)])\s+/.test(trimmed))
+        return false;
+    if (/^[A-Z]/.test(trimmed))
+        return false;
+    if (/^\w+[\w.-]*\s*=/.test(trimmed))
+        return false;
+    if (/^(?:\{|\[|"|')/.test(trimmed))
+        return false;
+    if (/^\w[^$]*[.!?]$/.test(trimmed) && trimmed.includes(" "))
+        return false;
+    const escapedTool = tool.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const commandStart = new RegExp(`(?:^|[;&|()]\\s*)${escapedTool}(?:\\s|$)`, "i");
+    return commandStart.test(trimmed);
+}
+const ARGUMENT_METADATA_KEYS = [
+    "subcommand",
+    "command",
+    "url",
+    "path",
+    "file",
+    "key",
+    "value",
+    "method",
+    "host",
+    "data",
+    "header",
+    "token",
+    "tool",
+];
+function buildPermissionArgs(metadata, detectedTool) {
+    const args = [];
+    for (const key of ARGUMENT_METADATA_KEYS) {
+        const value = metadata[key];
+        if (typeof value !== "string")
+            continue;
+        const normalized = value.trim();
+        if (!normalized || normalized.startsWith("$"))
+            continue;
+        if (key === "tool" && normalized.toLowerCase() === detectedTool)
+            continue;
+        if (!args.includes(normalized))
+            args.push(normalized);
+        if (args.length >= 4)
+            break;
+    }
+    if (args.length === 0 && typeof metadata.pattern === "string") {
+        const tokens = metadata.pattern.trim().split(/\s+/).filter(Boolean);
+        if (tokens.length >= 2 && !tokens[1].startsWith("$")) {
+            args.push(tokens[1]);
+        }
+    }
+    return args;
+}

package/script/analyzer/steps/002-permissions/seed-frontmatter.d.ts

@@ -0,0 +1,3 @@
+import type { AnalyzerState } from "../../types.js";
+export declare function seedPermissionsFromFrontmatter(state: AnalyzerState, skillMdPath: string): AnalyzerState;
+//# sourceMappingURL=seed-frontmatter.d.ts.map

package/script/analyzer/steps/002-permissions/seed-frontmatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed-frontmatter.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/steps/002-permissions/seed-frontmatter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAQpD,wBAAgB,8BAA8B,CAC1C,KAAK,EAAE,aAAa,EACpB,WAAW,EAAE,MAAM,GACpB,aAAa,CAqCf"}

package/script/analyzer/steps/002-permissions/seed-frontmatter.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.seedPermissionsFromFrontmatter = seedPermissionsFromFrontmatter;
+const config_js_1 = require("../../config.js");
+const id_generator_js_1 = require("../../utils/id-generator.js");
+function seedPermissionsFromFrontmatter(state, skillMdPath) {
+    const rawAllowed = state.frontmatter["allowed-tools"];
+    if (typeof rawAllowed !== "string" || !rawAllowed.trim()) {
+        return state;
+    }
+    const parsed = parseAllowedTools(rawAllowed);
+    const baseRef = {
+        file: skillMdPath,
+        line: 1,
+        lineEnd: state.frontmatter.endLineNumer,
+        type: "frontmatter",
+    };
+    const permissions = parsed.map((tool) => {
+        const mapping = config_js_1.ALLOWED_TOOLS_MAPPING[tool.name] ?? {
+            tool: tool.name.toLowerCase(),
+            scope: "sys",
+            permission: "shell",
+        };
+        const args = tool.args.length ? tool.args : ["*"];
+        return {
+            id: (0, id_generator_js_1.generatePermissionId)(mapping.tool, args),
+            tool: mapping.tool,
+            scope: mapping.scope,
+            permission: mapping.permission,
+            args,
+            references: [baseRef],
+            source: "frontmatter",
+            risks: [],
+        };
+    });
+    return {
+        ...state,
+        permissions: [...state.permissions, ...permissions],
+    };
+}
+function parseAllowedTools(value) {
+    return value
+        .trim()
+        .split(/\s+/)
+        .map((token) => {
+        const match = token.match(/^(\w+)(?:\(([^)]+)\))?$/);
+        if (!match)
+            return null;
+        const name = match[1];
+        const args = match[2] ? match[2].split(/[:\s,]+/).filter(Boolean) : ["*"];
+        return { name, args };
+    })
+        .filter((item) => item !== null);
+}

package/script/analyzer/steps/002-permissions/synthesize.d.ts

@@ -0,0 +1,3 @@
+import type { AnalyzerState } from "../../types.js";
+export declare function synthesizePermissions(state: AnalyzerState): AnalyzerState;
+//# sourceMappingURL=synthesize.d.ts.map

package/script/analyzer/steps/002-permissions/synthesize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"synthesize.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/steps/002-permissions/synthesize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CAwBzE"}

package/script/analyzer/steps/002-permissions/synthesize.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.synthesizePermissions = synthesizePermissions;
+function synthesizePermissions(state) {
+    const map = new Map();
+    for (const permission of state.permissions) {
+        const existing = map.get(permission.id);
+        if (!existing) {
+            map.set(permission.id, {
+                ...permission,
+                references: [...permission.references],
+                risks: [...permission.risks],
+            });
+            continue;
+        }
+        const mergedReferences = [...existing.references, ...permission.references];
+        existing.references = dedupeReferences(mergedReferences);
+        existing.risks = Array.from(new Set([...existing.risks, ...permission.risks]));
+    }
+    return {
+        ...state,
+        permissions: Array.from(map.values()),
+    };
+}
+function dedupeReferences(references) {
+    const seen = new Set();
+    const result = [];
+    for (const reference of references) {
+        const key = `${reference.file}:${reference.line}:${reference.lineEnd ?? reference.line}:${reference.type}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        result.push(reference);
+    }
+    return result;
+}

package/script/analyzer/steps/003-risks/helpers.d.ts

@@ -0,0 +1,11 @@
+import type { AnalyzerState } from "../../types.js";
+import type { RiskCode, Severity } from "../../../shared/mod.js";
+export declare function addRisk(state: AnalyzerState, input: {
+    type: RiskCode;
+    severity: Severity;
+    message: string;
+    permissionIds: string[];
+    reference: AnalyzerState["findings"][number]["reference"];
+    metadata?: Record<string, unknown>;
+}): AnalyzerState;
+//# sourceMappingURL=helpers.d.ts.map

package/script/analyzer/steps/003-risks/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/steps/003-risks/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAQ,QAAQ,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAGvE,wBAAgB,OAAO,CACnB,KAAK,EAAE,aAAa,EACpB,KAAK,EAAE;IACH,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC,GACF,aAAa,CAwBf"}

package/script/analyzer/steps/003-risks/helpers.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addRisk = addRisk;
+const id_generator_js_1 = require("../../utils/id-generator.js");
+function addRisk(state, input) {
+    const risk = {
+        id: (0, id_generator_js_1.generateRiskId)(input.type, state.risks.length),
+        type: input.type,
+        severity: input.severity,
+        message: input.message,
+        reference: input.reference,
+        permissions: input.permissionIds,
+        metadata: input.metadata,
+    };
+    const permissions = state.permissions.map((perm) => {
+        if (!input.permissionIds.includes(perm.id))
+            return perm;
+        return {
+            ...perm,
+            risks: Array.from(new Set([...perm.risks, risk.id])),
+        };
+    });
+    return {
+        ...state,
+        permissions,
+        risks: [...state.risks, risk],
+    };
+}

package/script/analyzer/steps/003-risks/mod.d.ts

@@ -0,0 +1,3 @@
+import type { AnalyzerResult, AnalyzerState } from "../../types.js";
+export declare function run003Risks(state: AnalyzerState): AnalyzerResult;
+//# sourceMappingURL=mod.d.ts.map

package/script/analyzer/steps/003-risks/mod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/steps/003-risks/mod.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAMpE,wBAAgB,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,CAKhE"}

package/script/analyzer/steps/003-risks/mod.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run003Risks = run003Risks;
+const output_js_1 = require("./output.js");
+const rule_mapped_js_1 = require("./rule-mapped.js");
+const REMOTE_SCRIPT_WARNING = "Remote script content analysis is NOT_IMPLEMENTED";
+function run003Risks(state) {
+    let next = state;
+    next = (0, rule_mapped_js_1.analyzeRuleMappedRisks)(next);
+    next = addRemoteScriptWarningIfNeeded(next);
+    return (0, output_js_1.toAnalyzerResult)(dedupeRisks(next));
+}
+function addRemoteScriptWarningIfNeeded(state) {
+    const hasRemoteCodeExecution = state.risks.some((risk) => risk.type === "NETWORK:remote_code_execution");
+    if (!hasRemoteCodeExecution)
+        return state;
+    if (state.warnings.includes(REMOTE_SCRIPT_WARNING))
+        return state;
+    return {
+        ...state,
+        warnings: [...state.warnings, REMOTE_SCRIPT_WARNING],
+    };
+}
+function dedupeRisks(state) {
+    const map = new Map();
+    for (const risk of state.risks) {
+        const key = `${risk.type}:${risk.reference.file}:${risk.reference.line}`;
+        if (!map.has(key)) {
+            map.set(key, risk);
+            continue;
+        }
+        const existing = map.get(key);
+        existing.permissions = Array.from(new Set([...existing.permissions, ...risk.permissions]));
+    }
+    return {
+        ...state,
+        risks: Array.from(map.values()),
+    };
+}

package/script/analyzer/steps/003-risks/output.d.ts

@@ -0,0 +1,3 @@
+import type { AnalyzerResult, AnalyzerState } from "../../types.js";
+export declare function toAnalyzerResult(state: AnalyzerState): AnalyzerResult;
+//# sourceMappingURL=output.d.ts.map

package/script/analyzer/steps/003-risks/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/steps/003-risks/output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,CAcrE"}

package/script/analyzer/steps/003-risks/output.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toAnalyzerResult = toAnalyzerResult;
+const scoring_js_1 = require("./scoring.js");
+function toAnalyzerResult(state) {
+    const { score, riskLevel, summary } = (0, scoring_js_1.scoreState)(state);
+    return {
+        analyzedAt: new Date().toISOString(),
+        skillId: state.skillId,
+        skillVersionId: state.skillVersionId,
+        permissions: state.permissions,
+        risks: state.risks,
+        score,
+        riskLevel,
+        summary,
+        warnings: state.warnings,
+        metadata: state.metadata,
+    };
+}

package/script/analyzer/steps/003-risks/rule-mapped.d.ts

@@ -0,0 +1,3 @@
+import type { AnalyzerState } from "../../types.js";
+export declare function analyzeRuleMappedRisks(state: AnalyzerState): AnalyzerState;
+//# sourceMappingURL=rule-mapped.d.ts.map

package/script/analyzer/steps/003-risks/rule-mapped.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-mapped.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/steps/003-risks/rule-mapped.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAUpD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CA0B1E"}