@feiyoug/skill-lab 0.0.0

package/script/analyzer/steps/003-risks/rule-mapped.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeRuleMappedRisks = analyzeRuleMappedRisks;
+const mod_js_1 = require("../../rules/mod.js");
+const helpers_js_1 = require("./helpers.js");
+const PROMPT_CATEGORY = "PROMPT";
+const INJECTION_CATEGORY = "INJECTION";
+const NETWORK_CATEGORY = "NETWORK";
+const SECRETS_CATEGORY = "SECRETS";
+const DESTRUCTIVE_CATEGORIES = new Set(["DESTRUCTIVE", "PRIVILEGE", "PERSISTENCE"]);
+function analyzeRuleMappedRisks(state) {
+    let next = state;
+    for (const finding of next.findings) {
+        const rule = mod_js_1.RULES_BY_ID.get(finding.ruleId);
+        if (!rule)
+            continue;
+        const matchedPermission = resolvePermissionForFinding(next, finding);
+        const mapped = (0, mod_js_1.evalRuleRiskMappings)(rule, { permission: matchedPermission, finding });
+        for (const risk of mapped) {
+            const permissionIds = selectPermissionIds(next, finding, risk.code, matchedPermission);
+            if (permissionIds.length === 0)
+                continue;
+            next = (0, helpers_js_1.addRisk)(next, {
+                type: risk.code,
+                severity: risk.severity,
+                message: risk.message,
+                permissionIds,
+                reference: finding.reference,
+                metadata: risk.metadata ?? finding.extracted,
+            });
+        }
+    }
+    return next;
+}
+function resolvePermissionForFinding(state, finding) {
+    return state.permissions.find((permission) => overlaps(permission, finding));
+}
+function selectPermissionIds(state, finding, code, matchedPermission) {
+    const category = code.split(":", 1)[0];
+    if (category === PROMPT_CATEGORY) {
+        return state.permissions.map((perm) => perm.id);
+    }
+    if (category === INJECTION_CATEGORY) {
+        return state.permissions
+            .filter((perm) => perm.scope === "sys" || perm.scope === "net")
+            .map((perm) => perm.id);
+    }
+    if (category === NETWORK_CATEGORY) {
+        if (code === "NETWORK:remote_code_execution") {
+            return state.permissions
+                .filter((perm) => perm.scope === "sys")
+                .filter((perm) => overlaps(perm, finding))
+                .map((perm) => perm.id);
+        }
+        return matchedPermission ? [matchedPermission.id] : [];
+    }
+    if (category === SECRETS_CATEGORY) {
+        return state.permissions
+            .filter((perm) => perm.scope === "env")
+            .filter((perm) => overlaps(perm, finding))
+            .map((perm) => perm.id);
+    }
+    if (DESTRUCTIVE_CATEGORIES.has(category)) {
+        const scopedPermissions = state.permissions.filter((perm) => {
+            if (finding.ruleId.startsWith("fs-")) {
+                return perm.scope === "fs" || perm.scope === "sys";
+            }
+            return perm.scope === "sys";
+        });
+        return scopedPermissions.filter((perm) => overlaps(perm, finding)).map((perm) => perm.id);
+    }
+    return [];
+}
+function overlaps(permission, finding) {
+    return permission.references.some((reference) => reference.file === finding.reference.file &&
+        reference.line <= (finding.reference.lineEnd ?? finding.reference.line) &&
+        (reference.lineEnd ?? reference.line) >= finding.reference.line);
+}

package/script/analyzer/steps/003-risks/scoring.d.ts

@@ -0,0 +1,7 @@
+import type { AnalyzerState } from "../../types.js";
+export declare function scoreState(state: AnalyzerState): {
+    score: number;
+    riskLevel: "safe" | "caution" | "attention" | "risky" | "avoid";
+    summary: string;
+};
+//# sourceMappingURL=scoring.d.ts.map

package/script/analyzer/steps/003-risks/scoring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/steps/003-risks/scoring.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,wBAAgB,UAAU,CAAC,KAAK,EAAE,aAAa,GAAG;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,GAAG,OAAO,CAAC;IAChE,OAAO,EAAE,MAAM,CAAC;CACnB,CA0CA"}

package/script/analyzer/steps/003-risks/scoring.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scoreState = scoreState;
+const config_js_1 = require("../../config.js");
+function scoreState(state) {
+    const severityScore = Math.max(0, ...state.risks.map((risk) => config_js_1.SCORING.severity[risk.severity]));
+    const permissionScore = Math.max(0, ...state.permissions.map((perm) => {
+        const base = config_js_1.SCORING.permissions[`${perm.scope}:${perm.permission}`] ?? 0;
+        const wildcard = perm.args?.includes("*") ? config_js_1.SCORING.scopeWildcard : 0;
+        return base + wildcard;
+    }));
+    let uplift = 0;
+    const hasExternalPost = state.risks.some((risk) => risk.type === "NETWORK:data_exfiltration" &&
+        ["POST", "PUT", "PATCH"].includes(String(risk.metadata?.method ?? "GET").toUpperCase()));
+    if (hasExternalPost)
+        uplift += config_js_1.SCORING.uplift.externalPost;
+    const hasPipeToShell = state.risks.some((risk) => risk.type === "NETWORK:remote_code_execution");
+    if (hasPipeToShell)
+        uplift += config_js_1.SCORING.uplift.pipeToShell;
+    const criticalCount = state.risks.filter((risk) => risk.severity === "critical").length;
+    if (criticalCount >= 3)
+        uplift += config_js_1.SCORING.uplift.multipleCritical;
+    const hasSecretTransfer = state.risks.some((risk) => risk.type === "NETWORK:credential_leak" ||
+        risk.type === "NETWORK:localhost_secret_exposure");
+    if (hasSecretTransfer)
+        uplift += config_js_1.SCORING.uplift.secretsInRequest;
+    const score = severityScore + permissionScore + uplift;
+    const riskLevel = toRiskLevel(score);
+    const summary = buildSummary(state, riskLevel);
+    return { score, riskLevel, summary };
+}
+function toRiskLevel(score) {
+    if (score <= 0)
+        return "safe";
+    if (score <= 2)
+        return "caution";
+    if (score <= 4)
+        return "attention";
+    if (score <= 6)
+        return "risky";
+    return "avoid";
+}
+function buildSummary(state, riskLevel) {
+    const topRisk = state.risks[0]?.type ?? "no major risks";
+    const topPermission = state.permissions[0]
+        ? `${state.permissions[0].scope}:${state.permissions[0].permission}`
+        : "no permissions";
+    if (riskLevel === "avoid") {
+        return `Critical risks detected (${topRisk}) with elevated capability (${topPermission}).`;
+    }
+    if (riskLevel === "risky") {
+        return `Elevated risk profile (${topRisk}) and broad access (${topPermission}).`;
+    }
+    if (riskLevel === "attention") {
+        return `Moderate risk signal (${topRisk}) from detected capabilities.`;
+    }
+    if (riskLevel === "caution") {
+        return `Low-risk profile with limited permissions (${topPermission}).`;
+    }
+    return "No significant risk signals detected.";
+}

package/script/analyzer/steps/mod.d.ts

@@ -0,0 +1,4 @@
+export { run001Discovery } from "./001-discovery/mod.js";
+export { run002Permissions } from "./002-permissions/mod.js";
+export { run003Risks } from "./003-risks/mod.js";
+//# sourceMappingURL=mod.d.ts.map

package/script/analyzer/steps/mod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../src/analyzer/steps/mod.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC"}

package/script/analyzer/steps/mod.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run003Risks = exports.run002Permissions = exports.run001Discovery = void 0;
+var mod_js_1 = require("./001-discovery/mod.js");
+Object.defineProperty(exports, "run001Discovery", { enumerable: true, get: function () { return mod_js_1.run001Discovery; } });
+var mod_js_2 = require("./002-permissions/mod.js");
+Object.defineProperty(exports, "run002Permissions", { enumerable: true, get: function () { return mod_js_2.run002Permissions; } });
+var mod_js_3 = require("./003-risks/mod.js");
+Object.defineProperty(exports, "run003Risks", { enumerable: true, get: function () { return mod_js_3.run003Risks; } });

package/script/analyzer/treesiter/client.d.ts

@@ -0,0 +1,26 @@
+import type Parser from "tree-sitter";
+type TreesitterGrammer = "markdown" | "markdown-inline";
+export declare class TreesitterClient {
+    private PARSER_BY_GRAMMAR;
+    private LANG_BY_GRAMMAR;
+    private QUERY_CACHE;
+    private ROOT_NODE_CACHE_BY_GRAMMAR;
+    private GRAMMER_LIB_BY_LANGUAGE;
+    getParser(grammar: TreesitterGrammer): Promise<Parser>;
+    /**
+     * Creates (and caches) a tree-sitter Query for the given grammar and S-expression query string.
+     */
+    createQuery(grammar: TreesitterGrammer, queryString: string): Promise<Parser.Query>;
+    /**
+     * Parses content into a tree-sitter Tree with memoization.
+     *
+     * Cache key strategy:
+     * - first level: content length
+     * - second level: fast non-cryptographic hash of content
+     */
+    parse(grammar: TreesitterGrammer, content: string): Promise<Parser.Tree>;
+    private getTreeCache;
+    private hashContent;
+}
+export {};
+//# sourceMappingURL=client.d.ts.map

package/script/analyzer/treesiter/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/analyzer/treesiter/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC,KAAK,iBAAiB,GAChB,UAAU,GACV,iBAAiB,CAAC;AAQxB,qBAAa,gBAAgB;IACzB,OAAO,CAAC,iBAAiB,CAAkD;IAC3E,OAAO,CAAC,eAAe,CAA2D;IAClF,OAAO,CAAC,WAAW,CAAmC;IACtD,OAAO,CAAC,0BAA0B,CAG3B;IAEP,OAAO,CAAC,uBAAuB,CAS7B;IAEW,SAAS,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC;IAuCnE;;OAEG;IACU,WAAW,CACpB,OAAO,EAAE,iBAAiB,EAC1B,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;IAcxB;;;;;;OAMG;IACU,KAAK,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;IAqBrF,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,WAAW;CAStB"}

package/script/analyzer/treesiter/client.js

@@ -0,0 +1,165 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TreesitterClient = void 0;
+// export type TreesitterQuery = {
+//     matches: (
+//         node: unknown,
+//     ) => Array<{ captures: Array<{ name: string; node: unknown }> }>;
+// };
+class TreesitterClient {
+    constructor() {
+        Object.defineProperty(this, "PARSER_BY_GRAMMAR", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: {}
+        });
+        Object.defineProperty(this, "LANG_BY_GRAMMAR", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: {}
+        });
+        Object.defineProperty(this, "QUERY_CACHE", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
+        Object.defineProperty(this, "ROOT_NODE_CACHE_BY_GRAMMAR", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: {}
+        });
+        Object.defineProperty(this, "GRAMMER_LIB_BY_LANGUAGE", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: {
+                markdown: { lib: "@tree-sitter-grammars/tree-sitter-markdown" },
+                "markdown-inline": {
+                    lib: "@tree-sitter-grammars/tree-sitter-markdown",
+                    module: "inline",
+                },
+            }
+        });
+    }
+    async getParser(grammar) {
+        if (this.PARSER_BY_GRAMMAR[grammar]) {
+            return this.PARSER_BY_GRAMMAR[grammar];
+        }
+        const gramerLib = this.GRAMMER_LIB_BY_LANGUAGE[grammar];
+        if (!gramerLib) {
+            throw new Error(`Treesiter for ${grammar} is not configured`);
+        }
+        const [{ default: Parser }, libModule] = await Promise.all([
+            Promise.resolve().then(() => __importStar(require("tree-sitter"))),
+            Promise.resolve(`${gramerLib.lib}`).then(s => __importStar(require(s))),
+        ]);
+        // The markdown npm package exposes sub-grammars via "module.exports":
+        // { default: ..., "module.exports": { name, language, inline, nodeTypeInfo } }
+        let grammarModule = libModule.default;
+        if (gramerLib.module) {
+            const moduleExports = libModule["module.exports"];
+            grammarModule = moduleExports?.[gramerLib.module];
+        }
+        if (!grammarModule) {
+            throw new Error(`Invalid tree-sitter grammar: "${gramerLib.module}" not found in ${gramerLib.lib}`);
+        }
+        this.LANG_BY_GRAMMAR[grammar] = grammarModule;
+        const parser = new Parser();
+        parser.setLanguage(grammarModule);
+        this.PARSER_BY_GRAMMAR[grammar] = parser;
+        return parser;
+    }
+    /**
+     * Creates (and caches) a tree-sitter Query for the given grammar and S-expression query string.
+     */
+    async createQuery(grammar, queryString) {
+        const cacheKey = `${grammar}:${queryString}`;
+        if (this.QUERY_CACHE.has(cacheKey)) {
+            return this.QUERY_CACHE.get(cacheKey);
+        }
+        await this.getParser(grammar); // ensures LANG_BY_GRAMMAR[grammar] is populated
+        const { default: Parser } = await Promise.resolve().then(() => __importStar(require("tree-sitter")));
+        const lang = this.LANG_BY_GRAMMAR[grammar];
+        const query = new Parser.Query(lang, queryString);
+        this.QUERY_CACHE.set(cacheKey, query);
+        return query;
+    }
+    /**
+     * Parses content into a tree-sitter Tree with memoization.
+     *
+     * Cache key strategy:
+     * - first level: content length
+     * - second level: fast non-cryptographic hash of content
+     */
+    async parse(grammar, content) {
+        const treeCacheByLen = this.getTreeCache(grammar);
+        const len = content.length;
+        const treeCacheByHash = treeCacheByLen.get(len);
+        if (treeCacheByHash) {
+            const hash = this.hashContent(content);
+            const cached = treeCacheByHash.get(hash);
+            if (cached)
+                return cached;
+        }
+        const parser = await this.getParser(grammar);
+        const tree = parser.parse(content);
+        const hash = this.hashContent(content);
+        const bucket = treeCacheByLen.get(len) ?? new Map();
+        bucket.set(hash, tree);
+        treeCacheByLen.set(len, bucket);
+        return tree;
+    }
+    getTreeCache(grammar) {
+        if (!this.ROOT_NODE_CACHE_BY_GRAMMAR[grammar]) {
+            this.ROOT_NODE_CACHE_BY_GRAMMAR[grammar] = new Map();
+        }
+        return this.ROOT_NODE_CACHE_BY_GRAMMAR[grammar];
+    }
+    hashContent(content) {
+        // FNV-1a 32-bit (fast, non-cryptographic)
+        let hash = 0x811c9dc5;
+        for (let i = 0; i < content.length; i++) {
+            hash ^= content.charCodeAt(i);
+            hash = Math.imul(hash, 0x01000193);
+        }
+        return hash >>> 0;
+    }
+}
+exports.TreesitterClient = TreesitterClient;

package/script/analyzer/types.d.ts

@@ -0,0 +1,75 @@
+import type { SkillFile, SkillReader } from "../skillreader/mod.js";
+import type { FileRefDiscoveryMethod, FileReference, FileType, Finding, Frontmatter, Permission, Reference, ReferenceType, Risk } from "../shared/mod.js";
+import { AstGrepClient } from "./astgrep/client.js";
+import { TreesitterClient } from "./treesiter/client.js";
+export type AnalyzerConfig = {
+    maxFileSize: number;
+    maxFileCount: number;
+    maxScanDepth: number;
+};
+export type AnalyzerState = {
+    skillId: string;
+    skillVersionId: string;
+    files: SkillFile[];
+    frontmatter: Frontmatter;
+    scanQueue: FileReference[];
+    permissions: Permission[];
+    findings: Finding[];
+    risks: Risk[];
+    warnings: string[];
+    metadata: {
+        scannedFiles: string[];
+        skippedFiles: Array<{
+            path: string;
+            reason: string;
+            referenceBy?: Reference;
+        }>;
+        rulesUsed: string[];
+        config: AnalyzerConfig;
+    };
+};
+export type AnalyzerResult = {
+    analyzedAt: string;
+    skillId: string;
+    skillVersionId: string;
+    permissions: Permission[];
+    risks: Risk[];
+    score: number;
+    riskLevel: "safe" | "caution" | "attention" | "risky" | "avoid";
+    summary: string;
+    warnings: string[];
+    metadata: {
+        scannedFiles: string[];
+        skippedFiles: Array<{
+            path: string;
+            reason: string;
+        }>;
+        rulesUsed: string[];
+        frontmatterRangeEnd?: number;
+        config: AnalyzerConfig;
+    };
+};
+export type AnalyzerContext = {
+    skillReader: SkillReader;
+    treesitterClient: TreesitterClient;
+    astgrepClient: AstGrepClient;
+};
+/** A file path or package reference discovered in source content. */
+export type FileRefDiscovery = {
+    path: string;
+    line: number;
+    via: FileRefDiscoveryMethod;
+};
+export type CodeBlock = {
+    language: FileType;
+    content: string;
+    startLine: number;
+    endLine: number;
+    type: ReferenceType;
+};
+export type FileTypeConfig = {
+    extractCodeBlocks?: (context: AnalyzerContext, content: string) => Promise<CodeBlock[]>;
+    extractFileRefs?: (context: AnalyzerContext, content: string) => FileRefDiscovery[] | Promise<FileRefDiscovery[]>;
+    defaultLanguage: FileType | null;
+};
+//# sourceMappingURL=types.d.ts.map

package/script/analyzer/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/analyzer/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EACR,sBAAsB,EACtB,aAAa,EACb,QAAQ,EACR,OAAO,EACP,WAAW,EACX,UAAU,EACV,SAAS,EACT,aAAa,EACb,IAAI,EACP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,MAAM,MAAM,cAAc,GAAG;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE;QACN,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,YAAY,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,SAAS,CAAA;SAAE,CAAC,CAAC;QAC/E,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,MAAM,EAAE,cAAc,CAAC;KAC1B,CAAC;CACL,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,GAAG,OAAO,CAAC;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE;QACN,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,YAAY,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACtD,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,MAAM,EAAE,cAAc,CAAC;KAC1B,CAAC;CACL,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,WAAW,EAAE,WAAW,CAAC;IACzB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,aAAa,EAAE,aAAa,CAAC;CAChC,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,gBAAgB,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,sBAAsB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,aAAa,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,iBAAiB,CAAC,EAAE,CAChB,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,KACd,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1B,eAAe,CAAC,EAAE,CACd,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,KACd,gBAAgB,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACtD,eAAe,EAAE,QAAQ,GAAG,IAAI,CAAC;CACpC,CAAC"}

package/script/analyzer/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/script/analyzer/utils/code-block-path.d.ts

@@ -0,0 +1,9 @@
+export type DecodedCodeBlockPath = {
+    parentPath: string;
+    startLine: number;
+    endLine: number;
+};
+export declare function encodeCodeBlockPath(parentPath: string, startLine: number, endLine: number): string;
+export declare function decodeCodeBlockPath(path: string): DecodedCodeBlockPath | null;
+export declare function isCodeBlockPath(path: string): boolean;
+//# sourceMappingURL=code-block-path.d.ts.map

package/script/analyzer/utils/code-block-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-block-path.d.ts","sourceRoot":"","sources":["../../../src/analyzer/utils/code-block-path.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,wBAAgB,mBAAmB,CAC/B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GAChB,MAAM,CAER;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAc7E;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD"}

package/script/analyzer/utils/code-block-path.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encodeCodeBlockPath = encodeCodeBlockPath;
+exports.decodeCodeBlockPath = decodeCodeBlockPath;
+exports.isCodeBlockPath = isCodeBlockPath;
+function encodeCodeBlockPath(parentPath, startLine, endLine) {
+    return `${parentPath}:${startLine}-${endLine}`;
+}
+function decodeCodeBlockPath(path) {
+    const match = path.match(/^(.+):(\d+)-(\d+)$/);
+    if (!match)
+        return null;
+    const startLine = Number(match[2]);
+    const endLine = Number(match[3]);
+    if (!Number.isFinite(startLine) || !Number.isFinite(endLine))
+        return null;
+    if (startLine <= 0 || endLine < startLine)
+        return null;
+    return {
+        parentPath: match[1],
+        startLine,
+        endLine,
+    };
+}
+function isCodeBlockPath(path) {
+    return decodeCodeBlockPath(path) !== null;
+}

package/script/analyzer/utils/id-generator.d.ts

@@ -0,0 +1,3 @@
+export declare function generatePermissionId(tool: string, args?: string[], metadata?: Record<string, unknown>): string;
+export declare function generateRiskId(type: string, index: number): string;
+//# sourceMappingURL=id-generator.d.ts.map

package/script/analyzer/utils/id-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-generator.d.ts","sourceRoot":"","sources":["../../../src/analyzer/utils/id-generator.ts"],"names":[],"mappings":"AAAA,wBAAgB,oBAAoB,CAChC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAM,EAAU,EACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,CAUR;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAElE"}

package/script/analyzer/utils/id-generator.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generatePermissionId = generatePermissionId;
+exports.generateRiskId = generateRiskId;
+function generatePermissionId(tool, args = ["*"], metadata) {
+    const normalizedArgs = args.length > 0 ? args : ["*"];
+    const base = sanitize(`${tool}-${normalizedArgs.join("-")}`);
+    const normalizedMetadata = filterMetadataForHash(metadata ?? {});
+    const shouldHash = normalizedArgs.length > 1 || Object.keys(normalizedMetadata).length > 0;
+    if (!shouldHash)
+        return base;
+    const hashInput = stableStringify({ args: normalizedArgs, metadata: normalizedMetadata });
+    return `${base}-${shortHash(hashInput)}`;
+}
+function generateRiskId(type, index) {
+    return sanitize(`risk-${type}-${index + 1}`);
+}
+function sanitize(value) {
+    return value
+        .toLowerCase()
+        .replace(/[^a-z0-9.*-]+/g, "-")
+        .replace(/-+/g, "-")
+        .replace(/^-|-$/g, "");
+}
+function filterMetadataForHash(metadata) {
+    const result = {};
+    for (const [key, value] of Object.entries(metadata)) {
+        if (key === "pattern")
+            continue;
+        if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+function stableStringify(value) {
+    if (Array.isArray(value)) {
+        return `[${value.map((item) => stableStringify(item)).join(",")}]`;
+    }
+    if (value && typeof value === "object") {
+        const entries = Object.entries(value)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([key, item]) => `${key}:${stableStringify(item)}`);
+        return `{${entries.join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+function shortHash(input) {
+    let hash = 0;
+    for (let i = 0; i < input.length; i += 1) {
+        hash = (hash * 31 + input.charCodeAt(i)) | 0;
+    }
+    return Math.abs(hash).toString(36).padStart(6, "0").slice(0, 6);
+}

package/script/analyzer/utils/secret-validator.d.ts

@@ -0,0 +1,3 @@
+export declare function isSecretLikeName(value: unknown): boolean;
+export declare function normalizeKeyCandidate(value: unknown): string;
+//# sourceMappingURL=secret-validator.d.ts.map

package/script/analyzer/utils/secret-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-validator.d.ts","sourceRoot":"","sources":["../../../src/analyzer/utils/secret-validator.ts"],"names":[],"mappings":"AAmBA,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIxD;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAG5D"}

package/script/analyzer/utils/secret-validator.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSecretLikeName = isSecretLikeName;
+exports.normalizeKeyCandidate = normalizeKeyCandidate;
+const SECRET_KEYWORDS = [
+    "token",
+    "key",
+    "secret",
+    "password",
+    "pwd",
+    "pass",
+    "credential",
+    "cred",
+    "auth",
+    "api",
+    "apikey",
+    "bearer",
+    "oauth",
+    "jwt",
+    "session",
+    "private",
+];
+function isSecretLikeName(value) {
+    if (typeof value !== "string")
+        return false;
+    const normalized = value.toLowerCase();
+    return SECRET_KEYWORDS.some((keyword) => normalized.includes(keyword));
+}
+function normalizeKeyCandidate(value) {
+    if (typeof value !== "string")
+        return "";
+    return value.replace(/[;,)]+$/, "").trim();
+}

package/script/analyzer/utils/url-parser.d.ts

@@ -0,0 +1,7 @@
+export declare function parseUrlFromUnknown(input: string): {
+    host: string;
+    protocol: string;
+    raw: string;
+} | null;
+export declare function classifyDestination(host: string): "loopback" | "internal" | "external";
+//# sourceMappingURL=url-parser.d.ts.map

package/script/analyzer/utils/url-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-parser.d.ts","sourceRoot":"","sources":["../../../src/analyzer/utils/url-parser.ts"],"names":[],"mappings":"AAAA,wBAAgB,mBAAmB,CAC/B,KAAK,EAAE,MAAM,GACd;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAexD;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAKtF"}

package/script/analyzer/utils/url-parser.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseUrlFromUnknown = parseUrlFromUnknown;
+exports.classifyDestination = classifyDestination;
+function parseUrlFromUnknown(input) {
+    if (!input)
+        return null;
+    const cleaned = input.trim().replace(/^['"`]|['"`]$/g, "");
+    const withProtocol = /^https?:\/\//i.test(cleaned) ? cleaned : `https://${cleaned}`;
+    try {
+        const url = new URL(withProtocol);
+        return {
+            host: url.hostname,
+            protocol: url.protocol.replace(":", ""),
+            raw: cleaned,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function classifyDestination(host) {
+    if (["localhost", "127.0.0.1", "::1"].includes(host))
+        return "loopback";
+    if (host.endsWith(".local"))
+        return "internal";
+    if (/^10\.|^192\.168\.|^172\.(1[6-9]|2[0-9]|3[01])\./.test(host))
+        return "internal";
+    return "external";
+}

package/script/deps/jsr.io/@std/internal/1.0.12/_os.d.ts

@@ -0,0 +1,2 @@
+export declare function checkWindows(): boolean;
+//# sourceMappingURL=_os.d.ts.map

package/script/deps/jsr.io/@std/internal/1.0.12/_os.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_os.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/internal/1.0.12/_os.ts"],"names":[],"mappings":"AAIA,wBAAgB,YAAY,IAAI,OAAO,CAUtC"}