@feiyoug/skill-lab 0.0.1 → 0.0.2

package/esm/analyzer/mod.js

@@ -1,9 +1,11 @@
-import { DEFAULT_CONFIG, DEFAULT_SKILL_VERSION } from "./config.js";
+import { DEFAULT_ANALYZER_CONFIG, DEFAULT_SKILL_VERSION, resolveConfig } from "./config/mod.js";
+import { NO_OP_LOGGER } from "./logging.js";
 import { run001Discovery, run002Permissions, run003Risks } from "./steps/mod.js";
 import { SkillReaderFactory } from "../skillreader/factory.js";
-import { TreesitterClient } from "./treesiter/client.js";
+import { TreesitterClient } from "./treesitter/client.js";
 import { AstGrepClient } from "./astgrep/mod.js";
-export { DEFAULT_CONFIG, DEFAULT_SKILL_VERSION } from "./config.js";
+export { SkillAnalyzerResult } from "./result.js";
+export { DEFAULT_ANALYZER_CONFIG, DEFAULT_SKILL_VERSION, resolveConfig } from "./config/mod.js";
 export class Analyzer {
     analyze(input) {
         return runAnalysis({
@@ -16,30 +18,44 @@ export class Analyzer {
             skillId: input.skillId,
             skillVersionId: input.skillVersionId,
             config: input.config,
+            logger: input.logger,
+            showProgressBar: input.showProgressBar,
         });
     }
 }
 export async function runAnalysis(input) {
+    const config = resolveConfig(input.config);
     let state = createInitialState({
         skillId: input.skillId,
         skillVersionId: input.skillVersionId,
-        config: input.config,
+        config,
     });
     const skillReader = await SkillReaderFactory.create(input.options);
     const validation = await skillReader.validate();
     if (!validation.ok) {
         throw new Error(validation.reason ?? "Invalid skill repository");
     }
+    const logger = input.logger ?? NO_OP_LOGGER;
+    const showProgressBar = input.showProgressBar ?? false;
     const context = {
         skillReader,
-        treesitterClient: new TreesitterClient(),
-        astgrepClient: new AstGrepClient(),
+        treesitterClient: new TreesitterClient(logger, showProgressBar),
+        astgrepClient: new AstGrepClient(logger, showProgressBar),
+        logger,
+        showProgressBar,
+        config,
     };
     state = await run001Discovery(state, context);
     state = await run002Permissions(state, context);
-    return run003Risks(state);
+    return await run003Risks(state, context);
 }
 export function createInitialState(input) {
+    const resolvedConfig = resolveConfig(input?.config);
+    const scan = resolvedConfig.scan ?? DEFAULT_ANALYZER_CONFIG.scan ?? {
+        maxFileSize: 1_000_000,
+        maxFileCount: 100,
+        maxScanDepth: 5,
+    };
     return {
         skillId: input?.skillId ?? "unknown",
         skillVersionId: input?.skillVersionId ?? DEFAULT_SKILL_VERSION,
@@ -51,13 +67,10 @@ export function createInitialState(input) {
         risks: [],
         warnings: [],
         metadata: {
-            scannedFiles: [],
+            scannedFiles: new Set(),
             skippedFiles: [],
             rulesUsed: [],
-            config: {
-                ...DEFAULT_CONFIG,
-                ...(input?.config ?? {}),
-            },
+            config: scan,
         },
     };
 }

package/esm/analyzer/result.d.ts

@@ -0,0 +1,35 @@
+import type { Permission, Risk } from "../shared/mod.js";
+import type { AnalyzerConfig } from "./config/mod.js";
+import type { AnalyzerState, ScanConfig } from "./types.js";
+export declare class SkillAnalyzerResult {
+    private readonly state;
+    private readonly config;
+    readonly analyzedAt: string;
+    private _score;
+    private _riskLevel;
+    private _summary;
+    constructor(state: AnalyzerState, config?: AnalyzerConfig);
+    get skillId(): string;
+    get skillVersionId(): string;
+    get permissions(): Permission[];
+    get risks(): Risk[];
+    get warnings(): string[];
+    get metadata(): {
+        scannedFiles: Set<string>;
+        skippedFiles: Array<{
+            path: string;
+            reason: string;
+        }>;
+        rulesUsed: string[];
+        frontmatterRangeEnd?: number;
+        config: ScanConfig;
+    };
+    get score(): number;
+    get riskLevel(): "safe" | "caution" | "attention" | "risky" | "avoid";
+    get summary(): string;
+    private _ensureScored;
+    toString(): string;
+    toJson(): string;
+    toSarif(toolVersion: string): Promise<string>;
+}
+//# sourceMappingURL=result.d.ts.map

package/esm/analyzer/result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../../src/analyzer/result.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAGzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA8D5D,qBAAa,mBAAmB;IAQxB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAR3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,UAAU,CAAmE;IACrF,OAAO,CAAC,QAAQ,CAAqB;gBAGhB,KAAK,EAAE,aAAa,EACpB,MAAM,GAAE,cAAwC;IAKrE,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED,IAAI,WAAW,IAAI,UAAU,EAAE,CAE9B;IAED,IAAI,KAAK,IAAI,IAAI,EAAE,CAElB;IAED,IAAI,QAAQ,IAAI,MAAM,EAAE,CAEvB;IAED,IAAI,QAAQ,IAAI;QACZ,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,YAAY,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACtD,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,MAAM,EAAE,UAAU,CAAC;KACtB,CAEA;IAED,IAAI,KAAK,IAAI,MAAM,CAElB;IAED,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,GAAG,OAAO,CAEpE;IAED,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,OAAO,CAAC,aAAa;IAkBrB,QAAQ,IAAI,MAAM;IAoGlB,MAAM,IAAI,MAAM;IA0BV,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAyFtD"}

package/esm/analyzer/result.js

@@ -0,0 +1,311 @@
+import { scoreState } from "./steps/003-risks/scoring.js";
+import { DEFAULT_ANALYZER_CONFIG } from "./config/mod.js";
+const INDENT = "  ";
+const SUB_INDENT = "    ";
+// ---------------------------------------------------------------------------
+// SkillAnalyzerResult class
+// ---------------------------------------------------------------------------
+export class SkillAnalyzerResult {
+    constructor(state, config = DEFAULT_ANALYZER_CONFIG) {
+        Object.defineProperty(this, "state", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: state
+        });
+        Object.defineProperty(this, "config", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: config
+        });
+        Object.defineProperty(this, "analyzedAt", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "_score", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "_riskLevel", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "_summary", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.analyzedAt = new Date().toISOString();
+    }
+    get skillId() {
+        return this.state.skillId;
+    }
+    get skillVersionId() {
+        return this.state.skillVersionId;
+    }
+    get permissions() {
+        return this.state.permissions;
+    }
+    get risks() {
+        return this.state.risks;
+    }
+    get warnings() {
+        return this.state.warnings;
+    }
+    get metadata() {
+        return this.state.metadata;
+    }
+    get score() {
+        return this._ensureScored().score;
+    }
+    get riskLevel() {
+        return this._ensureScored().riskLevel;
+    }
+    get summary() {
+        return this._ensureScored().summary;
+    }
+    _ensureScored() {
+        if (this._score === undefined) {
+            const scored = scoreState(this.state, this.config);
+            this._score = scored.score;
+            this._riskLevel = scored.riskLevel;
+            this._summary = scored.summary;
+        }
+        return {
+            score: this._score,
+            riskLevel: this._riskLevel,
+            summary: this._summary,
+        };
+    }
+    // -----------------------------------------------------------------------
+    // toString() — human-readable terminal output
+    // -----------------------------------------------------------------------
+    toString() {
+        const lines = [];
+        const hr = "=".repeat(60);
+        lines.push(hr);
+        lines.push("Analysis Results");
+        lines.push(hr);
+        lines.push(`${INDENT}Skill: ${this.skillId}@${this.skillVersionId}`);
+        // lines.push("");
+        // lines.push(`${INDENT}Permissions (${this.permissions.length})`);
+        // if (this.permissions.length === 0) {
+        //     lines.push(`${SUB_INDENT}- none`);
+        // } else {
+        //     for (const p of this.permissions) {
+        //         lines.push(`${SUB_INDENT}- ${p.tool}.${p.permission} [${p.scope}]`);
+        //         if (p.args && p.args.length > 0) {
+        //             lines.push(`${SUB_INDENT}${INDENT}args: ${p.args.join(", ")}`);
+        //         }
+        //         lines.push(`${SUB_INDENT}${INDENT}source: ${p.source}`);
+        //         if (p.references.length > 0) {
+        //             lines.push(
+        //                 `${SUB_INDENT}${INDENT}ref: ${_formatRef(p.references[0])}`,
+        //             );
+        //         }
+        //     }
+        // }
+        lines.push("");
+        lines.push(`${INDENT}Risks (${this.risks.length})`);
+        if (this.risks.length === 0) {
+            lines.push(`${SUB_INDENT}- none`);
+        }
+        else {
+            const SEVERITY_ORDER = { critical: 0, warning: 1, info: 2 };
+            const groups = new Map();
+            for (const r of this.risks) {
+                const key = r.groupKey ?? `${r.type}:${r.reference.file}:${r.reference.line}`;
+                const bucket = groups.get(key) ?? [];
+                bucket.push(r);
+                groups.set(key, bucket);
+            }
+            const sortedGroups = Array.from(groups.entries())
+                .map(([groupKey, risks]) => ({
+                groupKey,
+                risks,
+                sortKey: Math.min(...risks.map((r) => SEVERITY_ORDER[r.severity] ?? 99)),
+            }))
+                .sort((a, b) => a.sortKey - b.sortKey);
+            for (const group of sortedGroups) {
+                if (group.risks.length === 1) {
+                    const r = group.risks[0];
+                    lines.push(`${SUB_INDENT}- ${r.severity} ${r.type}`);
+                    lines.push(`${SUB_INDENT}${INDENT}message: ${r.message}`);
+                    lines.push(`${SUB_INDENT}${INDENT}ref: ${_formatRef(r.reference)}`);
+                    if (r.permissions.length > 0) {
+                        lines.push(`${SUB_INDENT}${INDENT}permissions: ${r.permissions.join(", ")}`);
+                    }
+                    continue;
+                }
+                const topRisk = group.risks.reduce((best, r) => (SEVERITY_ORDER[r.severity] ?? 99) < (SEVERITY_ORDER[best.severity] ?? 99)
+                    ? r
+                    : best);
+                lines.push(`${SUB_INDENT}[${group.groupKey}] (${topRisk.severity})`);
+                for (const r of group.risks) {
+                    lines.push(`${SUB_INDENT}${INDENT}- ${r.message}`);
+                    lines.push(`${SUB_INDENT}${INDENT}  ref: ${_formatRef(r.reference)}`);
+                }
+            }
+        }
+        lines.push("");
+        lines.push(`${INDENT}Warnings (${this.warnings.length})`);
+        if (this.warnings.length === 0) {
+            lines.push(`${SUB_INDENT}- none`);
+        }
+        else {
+            for (const w of this.warnings) {
+                lines.push(`${SUB_INDENT}- ${w}`);
+            }
+        }
+        lines.push("");
+        lines.push(`${INDENT}Risk Level: ${this.riskLevel}`);
+        lines.push(`${INDENT}Score: ${this.score}`);
+        lines.push(`${INDENT}Summary: ${this.summary}`);
+        return lines.join("\n");
+    }
+    // -----------------------------------------------------------------------
+    // toJson() — plain JSON matching legacy AnalyzerResult shape
+    // -----------------------------------------------------------------------
+    toJson() {
+        return JSON.stringify({
+            analyzedAt: this.analyzedAt,
+            skillId: this.skillId,
+            skillVersionId: this.skillVersionId,
+            permissions: this.permissions,
+            risks: this.risks,
+            score: this.score,
+            riskLevel: this.riskLevel,
+            summary: this.summary,
+            warnings: this.warnings,
+            metadata: {
+                ...this.metadata,
+                scannedFiles: [...this.metadata.scannedFiles],
+            },
+        }, null, 2);
+    }
+    // -----------------------------------------------------------------------
+    // toSarif() — SARIF 2.1.0 for GitHub Code Scanning
+    // -----------------------------------------------------------------------
+    async toSarif(toolVersion) {
+        // --- rules ---
+        const rules = [];
+        const seenRiskTypes = new Set();
+        for (const r of this.risks) {
+            if (!seenRiskTypes.has(r.type)) {
+                seenRiskTypes.add(r.type);
+                rules.push({
+                    id: r.type,
+                    shortDescription: { text: r.type },
+                    help: { text: r.message },
+                    properties: { tags: ["security"] },
+                });
+            }
+        }
+        if (this.warnings.length > 0) {
+            rules.push({
+                id: "slab/warning",
+                shortDescription: { text: "Analysis warning" },
+                help: { text: "Warnings produced during skill analysis." },
+                properties: { tags: ["maintainability"] },
+            });
+        }
+        for (const p of this.permissions) {
+            rules.push({
+                id: p.id,
+                shortDescription: { text: `${p.tool}.${p.permission} [${p.scope}]` },
+                help: {
+                    text: p.comment ??
+                        `Permission detected: ${p.tool} ${p.permission} (${p.scope})`,
+                },
+                properties: { tags: ["permissions"] },
+            });
+        }
+        // --- results ---
+        const results = [];
+        for (const r of this.risks) {
+            const fp = await _fingerprint(`${r.type}:${r.reference.file}:${r.reference.line}`);
+            results.push({
+                ruleId: r.type,
+                level: _sarifLevel(r.severity),
+                message: { text: r.message },
+                locations: [
+                    _sarifLocation(r.reference.file, r.reference.line, r.reference.lineEnd),
+                ],
+                fingerprints: { "slab/v1": fp },
+            });
+        }
+        for (const w of this.warnings) {
+            results.push({
+                ruleId: "slab/warning",
+                level: "note",
+                message: { text: w },
+                locations: [_sarifLocation("SKILL.md", 1)],
+            });
+        }
+        // --- artifacts ---
+        const artifacts = [...this.metadata.scannedFiles].map((f) => ({
+            location: { uri: f, uriBaseId: "%SRCROOT%" },
+        }));
+        const log = {
+            $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+            version: "2.1.0",
+            runs: [
+                {
+                    tool: {
+                        driver: {
+                            name: "slab",
+                            version: toolVersion,
+                            informationUri: "https://github.com/FeiyouG/skill-lab",
+                            rules,
+                        },
+                    },
+                    results,
+                    artifacts,
+                },
+            ],
+        };
+        return JSON.stringify(log, null, 2);
+    }
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function _formatRef(ref) {
+    if (ref.lineEnd !== undefined && ref.lineEnd !== ref.line) {
+        return `${ref.file}:${ref.line}-${ref.lineEnd} (${ref.type})`;
+    }
+    return `${ref.file}:${ref.line} (${ref.type})`;
+}
+function _sarifLevel(severity) {
+    if (severity === "critical")
+        return "error";
+    if (severity === "warning")
+        return "warning";
+    return "note";
+}
+function _sarifLocation(file, startLine, endLine) {
+    const region = { startLine };
+    if (endLine !== undefined && endLine !== startLine) {
+        region.endLine = endLine;
+    }
+    return {
+        physicalLocation: {
+            artifactLocation: { uri: file, uriBaseId: "%SRCROOT%" },
+            region,
+        },
+    };
+}
+async function _fingerprint(input) {
+    const encoded = new TextEncoder().encode(input);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", encoded);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
+}

package/esm/analyzer/rules/bash/commands/mod.d.ts

@@ -8,6 +8,7 @@ export * from "./gh.js";
 export * from "./git.js";
 export * from "./node.js";
 export * from "./openspec.js";
+export * from "./pip.js";
 export * from "./sudo.js";
 export declare const BASH_COMMAND_RULES: AstGrepRule[];
 //# sourceMappingURL=mod.d.ts.map

package/esm/analyzer/rules/bash/commands/mod.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/mod.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAY9D,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAE1B,eAAO,MAAM,kBAAkB,EAAE,WAAW,EAW3C,CAAC"}
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/mod.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAa9D,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAE1B,eAAO,MAAM,kBAAkB,EAAE,WAAW,EAY3C,CAAC"}

package/esm/analyzer/rules/bash/commands/mod.js

@@ -7,6 +7,7 @@ import { GH_RULES } from "./gh.js";
 import { GIT_RULES } from "./git.js";
 import { NODE_ECOSYSTEM_RULES } from "./node.js";
 import { OPENSPEC_RULES } from "./openspec.js";
+import { PIP_RULES } from "./pip.js";
 import { SUDO_RULES } from "./sudo.js";
 export * from "./bd.js";
 export * from "./cron.js";
@@ -17,11 +18,13 @@ export * from "./gh.js";
 export * from "./git.js";
 export * from "./node.js";
 export * from "./openspec.js";
+export * from "./pip.js";
 export * from "./sudo.js";
 export const BASH_COMMAND_RULES = [
     ...GIT_RULES,
     ...GH_RULES,
     ...NODE_ECOSYSTEM_RULES,
+    ...PIP_RULES,
     ...DOCKER_RULES,
     ...BD_RULES,
     ...SUDO_RULES,

package/esm/analyzer/rules/bash/commands/pip.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../../astgrep/client.js";
+export declare const PIP_RULES: AstGrepRule[];
+//# sourceMappingURL=pip.d.ts.map

package/esm/analyzer/rules/bash/commands/pip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pip.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/pip.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,eAAO,MAAM,SAAS,EAAE,WAAW,EAalC,CAAC"}

package/esm/analyzer/rules/bash/commands/pip.js

@@ -0,0 +1,14 @@
+export const PIP_RULES = [
+    {
+        id: "shell-pip",
+        description: "Detects pip commands",
+        grammar: "bash",
+        patterns: ["pip $SUB $$$ARGS", "pip3 $SUB $$$ARGS"],
+        permission: {
+            tool: "pip",
+            scope: "sys",
+            permission: "shell",
+            metadata: { subcommand: "SUB" },
+        },
+    },
+];

package/esm/analyzer/rules/bash/extractFileRefs.d.ts

@@ -9,5 +9,5 @@
  * Uses ast-grep AST traversal on `command` nodes.
  */
 import type { AnalyzerContext, FileRefDiscovery } from "../../types.js";
-export declare function extractBashFileRefs(context: AnalyzerContext, content: string): FileRefDiscovery[];
+export declare function extractBashFileRefs(context: AnalyzerContext, content: string): Promise<FileRefDiscovery[]>;
 //# sourceMappingURL=extractFileRefs.d.ts.map

package/esm/analyzer/rules/bash/extractFileRefs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extractFileRefs.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/extractFileRefs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGxE,wBAAgB,mBAAmB,CAC/B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,gBAAgB,EAAE,CAkFpB"}
+{"version":3,"file":"extractFileRefs.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/extractFileRefs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGxE,wBAAsB,mBAAmB,CACrC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAkF7B"}

package/esm/analyzer/rules/bash/extractFileRefs.js

@@ -10,9 +10,9 @@
  */
 import { isHostFsPath, isUrl, looksLikePath } from "../shared/file-refs.js";
 import { BASH_NODE } from "./astTypes.js";
-export function extractBashFileRefs(context, content) {
+export async function extractBashFileRefs(context, content) {
     const refs = [];
-    const ast = context.astgrepClient.parse("bash", content);
+    const ast = await context.astgrepClient.parse("bash", content);
     const root = ast.root();
     const commandNodes = root.findAll({ rule: { kind: BASH_NODE.COMMAND } });
     for (const node of commandNodes) {

package/esm/analyzer/rules/bash/inline-command-classifier.d.ts

@@ -2,5 +2,5 @@ import type { AnalyzerContext } from "../../types.js";
 export declare function isLikelyInlineBashCommand(context: AnalyzerContext, input: {
     snippet: string;
     lineContext?: string;
-}): boolean;
+}): Promise<boolean>;
 //# sourceMappingURL=inline-command-classifier.d.ts.map

package/esm/analyzer/rules/bash/inline-command-classifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inline-command-classifier.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/inline-command-classifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AA4CtD,wBAAgB,yBAAyB,CACrC,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD,OAAO,CAuBT"}
+{"version":3,"file":"inline-command-classifier.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/inline-command-classifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AA4CtD,wBAAsB,yBAAyB,CAC3C,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD,OAAO,CAAC,OAAO,CAAC,CAuBlB"}

package/esm/analyzer/rules/bash/inline-command-classifier.js

@@ -30,7 +30,7 @@ const SPECIFIC_COMMAND_RULES = BASH_COMMAND_RULES.filter((rule) => rule.id !== G
 const KNOWN_COMMAND_TOOLS = new Set(SPECIFIC_COMMAND_RULES
     .map((rule) => String(rule.permission.tool ?? "").toLowerCase())
     .filter((tool) => tool && tool !== "detected"));
-export function isLikelyInlineBashCommand(context, input) {
+export async function isLikelyInlineBashCommand(context, input) {
     const snippet = normalizeInlineSnippet(input.snippet);
     if (!snippet)
         return false;
@@ -39,7 +39,7 @@ export function isLikelyInlineBashCommand(context, input) {
     const tokens = snippet.split(/\s+/).filter(Boolean);
     if (tokens.length === 1 && looksLikePath(snippet))
         return false;
-    if (matchesSpecificBashCommandRule(context, snippet))
+    if (await matchesSpecificBashCommandRule(context, snippet))
         return true;
     const firstToken = tokens[0]?.toLowerCase() ?? "";
     const hasContextVerb = CONTEXT_VERB_PATTERN.test(input.lineContext ?? "");
@@ -53,8 +53,8 @@ export function isLikelyInlineBashCommand(context, input) {
     }
     return false;
 }
-function matchesSpecificBashCommandRule(context, snippet) {
-    const matches = context.astgrepClient.scanWithRules(snippet, "bash", SPECIFIC_COMMAND_RULES);
+async function matchesSpecificBashCommandRule(context, snippet) {
+    const matches = await context.astgrepClient.scanWithRules(snippet, "bash", SPECIFIC_COMMAND_RULES);
     return matches.length > 0;
 }
 function normalizeInlineSnippet(raw) {

package/esm/analyzer/rules/javascript/extractFileRefs.d.ts

@@ -7,10 +7,9 @@
  * - URL string literals used in fetch/axios/XMLHttpRequest → via: "url"
  * - Host filesystem paths in fs.readFile / fs.writeFile / open calls → via: "bare-path"
  *
- * Uses ast-grep AST traversal; `context` is accepted for interface consistency
- * (AST client is synchronous for JS/TS and does not require async setup).
+ * Uses ast-grep AST traversal.
  */
 import type { AnalyzerContext, FileRefDiscovery } from "../../types.js";
-export declare function extractJsFileRefs(context: AnalyzerContext, content: string): FileRefDiscovery[];
-export declare function extractTsFileRefs(context: AnalyzerContext, content: string): FileRefDiscovery[];
+export declare function extractJsFileRefs(context: AnalyzerContext, content: string): Promise<FileRefDiscovery[]>;
+export declare function extractTsFileRefs(context: AnalyzerContext, content: string): Promise<FileRefDiscovery[]>;
 //# sourceMappingURL=extractFileRefs.d.ts.map

package/esm/analyzer/rules/javascript/extractFileRefs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extractFileRefs.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/javascript/extractFileRefs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAyGxE,wBAAgB,iBAAiB,CAC7B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,gBAAgB,EAAE,CAEpB;AAED,wBAAgB,iBAAiB,CAC7B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,gBAAgB,EAAE,CAEpB"}
+{"version":3,"file":"extractFileRefs.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/javascript/extractFileRefs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAyGxE,wBAAgB,iBAAiB,CAC7B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE7B;AAED,wBAAgB,iBAAiB,CAC7B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE7B"}

package/esm/analyzer/rules/javascript/extractFileRefs.js

@@ -7,14 +7,13 @@
  * - URL string literals used in fetch/axios/XMLHttpRequest → via: "url"
  * - Host filesystem paths in fs.readFile / fs.writeFile / open calls → via: "bare-path"
  *
- * Uses ast-grep AST traversal; `context` is accepted for interface consistency
- * (AST client is synchronous for JS/TS and does not require async setup).
+ * Uses ast-grep AST traversal.
  */
 import { isHostFsPath, isUrl } from "../shared/file-refs.js";
 import { JS_NODE } from "./astTypes.js";
-function extractJsLikeFileRefs(lang, context, content) {
+async function extractJsLikeFileRefs(lang, context, content) {
     const refs = [];
-    const ast = context.astgrepClient.parse(lang, content);
+    const ast = await context.astgrepClient.parse(lang, content);
     const root = ast.root();
     // ── import_statement ────────────────────────────────────────────────────
     const importNodes = root.findAll({ rule: { kind: JS_NODE.IMPORT_STATEMENT } });

package/esm/analyzer/rules/markdown/extractCodeBlocks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extractCodeBlocks.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/markdown/extractCodeBlocks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAgBjE;;;GAGG;AACH,wBAAsB,iBAAiB,CACnC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqFtB"}
+{"version":3,"file":"extractCodeBlocks.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/markdown/extractCodeBlocks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAIjE;;;GAGG;AACH,wBAAsB,iBAAiB,CACnC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,SAAS,EAAE,CAAC,CAwFtB"}

package/esm/analyzer/rules/markdown/extractCodeBlocks.js

@@ -16,10 +16,11 @@ export async function extractCodeBlocks(context, content) {
                 const blockNode = capture.node;
                 const startLine = blockNode.startPosition.row + 1;
                 const endLine = blockNode.endPosition.row + 1;
-                const languageNode = blockNode.children.find((child) => child.type === MARKDOWN_NODE.CODE_FENCE_LANGUAGE ||
-                    child.type === MARKDOWN_NODE.INFO_STRING);
+                const languageNode = blockNode.children.find((child) => child !== null &&
+                    (child.type === MARKDOWN_NODE.CODE_FENCE_LANGUAGE ||
+                        child.type === MARKDOWN_NODE.INFO_STRING));
                 const fenceLanguage = FILETYPE_BY_LANGUAGE[(languageNode?.text ?? "").trim().toLowerCase()] ?? null;
-                const contentNode = blockNode.children.find((child) => child.type === MARKDOWN_NODE.CODE_FENCE_CONTENT);
+                const contentNode = blockNode.children.find((child) => child !== null && child.type === MARKDOWN_NODE.CODE_FENCE_CONTENT);
                 const codeContent = (contentNode?.text ?? "")
                     .replace(/\n?[`~]{3,}[^\n]*\s*$/, "")
                     .trimEnd();
@@ -43,6 +44,8 @@ export async function extractCodeBlocks(context, content) {
                     continue;
                 const inlineNode = inlineCapture.node;
                 const inlineTree = inlineParser.parse(inlineNode.text);
+                if (!inlineTree)
+                    continue;
                 for (const codeMatch of codeSpanQuery.matches(inlineTree.rootNode)) {
                     for (const codeCapture of codeMatch.captures) {
                         if (codeCapture.name !== "code")

package/esm/analyzer/rules/markdown/extractFileRefs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extractFileRefs.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/markdown/extractFileRefs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAaxE,wBAAsB,uBAAuB,CACzC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAgF7B"}
+{"version":3,"file":"extractFileRefs.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/markdown/extractFileRefs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAIxE,wBAAsB,uBAAuB,CACzC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAiF7B"}

package/esm/analyzer/rules/markdown/extractFileRefs.js

@@ -24,6 +24,8 @@ export async function extractMarkdownFileRefs(context, content) {
                 const inlineNode = inlineCapture.node;
                 const blockLine = inlineNode.startPosition.row;
                 const inlineTree = inlineParser.parse(inlineNode.text);
+                if (!inlineTree)
+                    continue;
                 const inlineRoot = inlineTree.rootNode;
                 for (const match of linkDestQuery.matches(inlineRoot)) {
                     for (const capture of match.captures) {

package/esm/analyzer/rules/python/extractFileRefs.d.ts

@@ -10,5 +10,5 @@
  * Uses ast-grep AST traversal.
  */
 import type { AnalyzerContext, FileRefDiscovery } from "../../types.js";
-export declare function extractPythonFileRefs(context: AnalyzerContext, content: string): FileRefDiscovery[];
+export declare function extractPythonFileRefs(context: AnalyzerContext, content: string): Promise<FileRefDiscovery[]>;
 //# sourceMappingURL=extractFileRefs.d.ts.map