@gguf/claw 2026.2.4 → 2026.2.5

package/dist/session-key-CZkcvAtx.js

@@ -0,0 +1,177 @@
+//#region src/sessions/session-key-utils.ts
+function parseAgentSessionKey(sessionKey) {
+	const raw = (sessionKey ?? "").trim();
+	if (!raw) return null;
+	const parts = raw.split(":").filter(Boolean);
+	if (parts.length < 3) return null;
+	if (parts[0] !== "agent") return null;
+	const agentId = parts[1]?.trim();
+	const rest = parts.slice(2).join(":");
+	if (!agentId || !rest) return null;
+	return {
+		agentId,
+		rest
+	};
+}
+function isSubagentSessionKey(sessionKey) {
+	const raw = (sessionKey ?? "").trim();
+	if (!raw) return false;
+	if (raw.toLowerCase().startsWith("subagent:")) return true;
+	const parsed = parseAgentSessionKey(raw);
+	return Boolean((parsed?.rest ?? "").toLowerCase().startsWith("subagent:"));
+}
+function isAcpSessionKey(sessionKey) {
+	const raw = (sessionKey ?? "").trim();
+	if (!raw) return false;
+	if (raw.toLowerCase().startsWith("acp:")) return true;
+	const parsed = parseAgentSessionKey(raw);
+	return Boolean((parsed?.rest ?? "").toLowerCase().startsWith("acp:"));
+}
+const THREAD_SESSION_MARKERS = [":thread:", ":topic:"];
+function resolveThreadParentSessionKey(sessionKey) {
+	const raw = (sessionKey ?? "").trim();
+	if (!raw) return null;
+	const normalized = raw.toLowerCase();
+	let idx = -1;
+	for (const marker of THREAD_SESSION_MARKERS) {
+		const candidate = normalized.lastIndexOf(marker);
+		if (candidate > idx) idx = candidate;
+	}
+	if (idx <= 0) return null;
+	const parent = raw.slice(0, idx).trim();
+	return parent ? parent : null;
+}
+
+//#endregion
+//#region src/routing/session-key.ts
+const DEFAULT_AGENT_ID = "main";
+const DEFAULT_MAIN_KEY = "main";
+const DEFAULT_ACCOUNT_ID = "default";
+const VALID_ID_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
+const INVALID_CHARS_RE = /[^a-z0-9_-]+/g;
+const LEADING_DASH_RE = /^-+/;
+const TRAILING_DASH_RE = /-+$/;
+function normalizeToken(value) {
+	return (value ?? "").trim().toLowerCase();
+}
+function normalizeMainKey(value) {
+	const trimmed = (value ?? "").trim();
+	return trimmed ? trimmed.toLowerCase() : DEFAULT_MAIN_KEY;
+}
+function toAgentRequestSessionKey(storeKey) {
+	const raw = (storeKey ?? "").trim();
+	if (!raw) return;
+	return parseAgentSessionKey(raw)?.rest ?? raw;
+}
+function toAgentStoreSessionKey(params) {
+	const raw = (params.requestKey ?? "").trim();
+	if (!raw || raw === DEFAULT_MAIN_KEY) return buildAgentMainSessionKey({
+		agentId: params.agentId,
+		mainKey: params.mainKey
+	});
+	const lowered = raw.toLowerCase();
+	if (lowered.startsWith("agent:")) return lowered;
+	if (lowered.startsWith("subagent:")) return `agent:${normalizeAgentId(params.agentId)}:${lowered}`;
+	return `agent:${normalizeAgentId(params.agentId)}:${lowered}`;
+}
+function resolveAgentIdFromSessionKey(sessionKey) {
+	return normalizeAgentId(parseAgentSessionKey(sessionKey)?.agentId ?? DEFAULT_AGENT_ID);
+}
+function normalizeAgentId(value) {
+	const trimmed = (value ?? "").trim();
+	if (!trimmed) return DEFAULT_AGENT_ID;
+	if (VALID_ID_RE.test(trimmed)) return trimmed.toLowerCase();
+	return trimmed.toLowerCase().replace(INVALID_CHARS_RE, "-").replace(LEADING_DASH_RE, "").replace(TRAILING_DASH_RE, "").slice(0, 64) || DEFAULT_AGENT_ID;
+}
+function sanitizeAgentId(value) {
+	const trimmed = (value ?? "").trim();
+	if (!trimmed) return DEFAULT_AGENT_ID;
+	if (VALID_ID_RE.test(trimmed)) return trimmed.toLowerCase();
+	return trimmed.toLowerCase().replace(INVALID_CHARS_RE, "-").replace(LEADING_DASH_RE, "").replace(TRAILING_DASH_RE, "").slice(0, 64) || DEFAULT_AGENT_ID;
+}
+function normalizeAccountId(value) {
+	const trimmed = (value ?? "").trim();
+	if (!trimmed) return DEFAULT_ACCOUNT_ID;
+	if (VALID_ID_RE.test(trimmed)) return trimmed.toLowerCase();
+	return trimmed.toLowerCase().replace(INVALID_CHARS_RE, "-").replace(LEADING_DASH_RE, "").replace(TRAILING_DASH_RE, "").slice(0, 64) || DEFAULT_ACCOUNT_ID;
+}
+function buildAgentMainSessionKey(params) {
+	return `agent:${normalizeAgentId(params.agentId)}:${normalizeMainKey(params.mainKey)}`;
+}
+function buildAgentPeerSessionKey(params) {
+	const peerKind = params.peerKind ?? "dm";
+	if (peerKind === "dm") {
+		const dmScope = params.dmScope ?? "main";
+		let peerId = (params.peerId ?? "").trim();
+		const linkedPeerId = dmScope === "main" ? null : resolveLinkedPeerId({
+			identityLinks: params.identityLinks,
+			channel: params.channel,
+			peerId
+		});
+		if (linkedPeerId) peerId = linkedPeerId;
+		peerId = peerId.toLowerCase();
+		if (dmScope === "per-account-channel-peer" && peerId) {
+			const channel = (params.channel ?? "").trim().toLowerCase() || "unknown";
+			const accountId = normalizeAccountId(params.accountId);
+			return `agent:${normalizeAgentId(params.agentId)}:${channel}:${accountId}:dm:${peerId}`;
+		}
+		if (dmScope === "per-channel-peer" && peerId) {
+			const channel = (params.channel ?? "").trim().toLowerCase() || "unknown";
+			return `agent:${normalizeAgentId(params.agentId)}:${channel}:dm:${peerId}`;
+		}
+		if (dmScope === "per-peer" && peerId) return `agent:${normalizeAgentId(params.agentId)}:dm:${peerId}`;
+		return buildAgentMainSessionKey({
+			agentId: params.agentId,
+			mainKey: params.mainKey
+		});
+	}
+	const channel = (params.channel ?? "").trim().toLowerCase() || "unknown";
+	const peerId = ((params.peerId ?? "").trim() || "unknown").toLowerCase();
+	return `agent:${normalizeAgentId(params.agentId)}:${channel}:${peerKind}:${peerId}`;
+}
+function resolveLinkedPeerId(params) {
+	const identityLinks = params.identityLinks;
+	if (!identityLinks) return null;
+	const peerId = params.peerId.trim();
+	if (!peerId) return null;
+	const candidates = /* @__PURE__ */ new Set();
+	const rawCandidate = normalizeToken(peerId);
+	if (rawCandidate) candidates.add(rawCandidate);
+	const channel = normalizeToken(params.channel);
+	if (channel) {
+		const scopedCandidate = normalizeToken(`${channel}:${peerId}`);
+		if (scopedCandidate) candidates.add(scopedCandidate);
+	}
+	if (candidates.size === 0) return null;
+	for (const [canonical, ids] of Object.entries(identityLinks)) {
+		const canonicalName = canonical.trim();
+		if (!canonicalName) continue;
+		if (!Array.isArray(ids)) continue;
+		for (const id of ids) {
+			const normalized = normalizeToken(id);
+			if (normalized && candidates.has(normalized)) return canonicalName;
+		}
+	}
+	return null;
+}
+function buildGroupHistoryKey(params) {
+	const channel = normalizeToken(params.channel) || "unknown";
+	const accountId = normalizeAccountId(params.accountId);
+	const peerId = params.peerId.trim().toLowerCase() || "unknown";
+	return `${channel}:${accountId}:${params.peerKind}:${peerId}`;
+}
+function resolveThreadSessionKeys(params) {
+	const threadId = (params.threadId ?? "").trim();
+	if (!threadId) return {
+		sessionKey: params.baseSessionKey,
+		parentSessionKey: void 0
+	};
+	const normalizedThreadId = threadId.toLowerCase();
+	return {
+		sessionKey: params.useSuffix ?? true ? `${params.baseSessionKey}:thread:${normalizedThreadId}` : params.baseSessionKey,
+		parentSessionKey: params.parentSessionKey
+	};
+}
+
+//#endregion
+export { parseAgentSessionKey as _, buildAgentPeerSessionKey as a, normalizeAgentId as c, resolveThreadSessionKeys as d, sanitizeAgentId as f, isSubagentSessionKey as g, isAcpSessionKey as h, buildAgentMainSessionKey as i, normalizeMainKey as l, toAgentStoreSessionKey as m, DEFAULT_AGENT_ID as n, buildGroupHistoryKey as o, toAgentRequestSessionKey as p, DEFAULT_MAIN_KEY as r, normalizeAccountId as s, DEFAULT_ACCOUNT_ID as t, resolveAgentIdFromSessionKey as u, resolveThreadParentSessionKey as v };

package/dist/session-key-Dm2EOhrH.js

@@ -0,0 +1,177 @@
+//#region src/sessions/session-key-utils.ts
+function parseAgentSessionKey(sessionKey) {
+	const raw = (sessionKey ?? "").trim();
+	if (!raw) return null;
+	const parts = raw.split(":").filter(Boolean);
+	if (parts.length < 3) return null;
+	if (parts[0] !== "agent") return null;
+	const agentId = parts[1]?.trim();
+	const rest = parts.slice(2).join(":");
+	if (!agentId || !rest) return null;
+	return {
+		agentId,
+		rest
+	};
+}
+function isSubagentSessionKey(sessionKey) {
+	const raw = (sessionKey ?? "").trim();
+	if (!raw) return false;
+	if (raw.toLowerCase().startsWith("subagent:")) return true;
+	const parsed = parseAgentSessionKey(raw);
+	return Boolean((parsed?.rest ?? "").toLowerCase().startsWith("subagent:"));
+}
+function isAcpSessionKey(sessionKey) {
+	const raw = (sessionKey ?? "").trim();
+	if (!raw) return false;
+	if (raw.toLowerCase().startsWith("acp:")) return true;
+	const parsed = parseAgentSessionKey(raw);
+	return Boolean((parsed?.rest ?? "").toLowerCase().startsWith("acp:"));
+}
+const THREAD_SESSION_MARKERS = [":thread:", ":topic:"];
+function resolveThreadParentSessionKey(sessionKey) {
+	const raw = (sessionKey ?? "").trim();
+	if (!raw) return null;
+	const normalized = raw.toLowerCase();
+	let idx = -1;
+	for (const marker of THREAD_SESSION_MARKERS) {
+		const candidate = normalized.lastIndexOf(marker);
+		if (candidate > idx) idx = candidate;
+	}
+	if (idx <= 0) return null;
+	const parent = raw.slice(0, idx).trim();
+	return parent ? parent : null;
+}
+
+//#endregion
+//#region src/routing/session-key.ts
+const DEFAULT_AGENT_ID = "main";
+const DEFAULT_MAIN_KEY = "main";
+const DEFAULT_ACCOUNT_ID = "default";
+const VALID_ID_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
+const INVALID_CHARS_RE = /[^a-z0-9_-]+/g;
+const LEADING_DASH_RE = /^-+/;
+const TRAILING_DASH_RE = /-+$/;
+function normalizeToken(value) {
+	return (value ?? "").trim().toLowerCase();
+}
+function normalizeMainKey(value) {
+	const trimmed = (value ?? "").trim();
+	return trimmed ? trimmed.toLowerCase() : DEFAULT_MAIN_KEY;
+}
+function toAgentRequestSessionKey(storeKey) {
+	const raw = (storeKey ?? "").trim();
+	if (!raw) return;
+	return parseAgentSessionKey(raw)?.rest ?? raw;
+}
+function toAgentStoreSessionKey(params) {
+	const raw = (params.requestKey ?? "").trim();
+	if (!raw || raw === DEFAULT_MAIN_KEY) return buildAgentMainSessionKey({
+		agentId: params.agentId,
+		mainKey: params.mainKey
+	});
+	const lowered = raw.toLowerCase();
+	if (lowered.startsWith("agent:")) return lowered;
+	if (lowered.startsWith("subagent:")) return `agent:${normalizeAgentId(params.agentId)}:${lowered}`;
+	return `agent:${normalizeAgentId(params.agentId)}:${lowered}`;
+}
+function resolveAgentIdFromSessionKey(sessionKey) {
+	return normalizeAgentId(parseAgentSessionKey(sessionKey)?.agentId ?? DEFAULT_AGENT_ID);
+}
+function normalizeAgentId(value) {
+	const trimmed = (value ?? "").trim();
+	if (!trimmed) return DEFAULT_AGENT_ID;
+	if (VALID_ID_RE.test(trimmed)) return trimmed.toLowerCase();
+	return trimmed.toLowerCase().replace(INVALID_CHARS_RE, "-").replace(LEADING_DASH_RE, "").replace(TRAILING_DASH_RE, "").slice(0, 64) || DEFAULT_AGENT_ID;
+}
+function sanitizeAgentId(value) {
+	const trimmed = (value ?? "").trim();
+	if (!trimmed) return DEFAULT_AGENT_ID;
+	if (VALID_ID_RE.test(trimmed)) return trimmed.toLowerCase();
+	return trimmed.toLowerCase().replace(INVALID_CHARS_RE, "-").replace(LEADING_DASH_RE, "").replace(TRAILING_DASH_RE, "").slice(0, 64) || DEFAULT_AGENT_ID;
+}
+function normalizeAccountId(value) {
+	const trimmed = (value ?? "").trim();
+	if (!trimmed) return DEFAULT_ACCOUNT_ID;
+	if (VALID_ID_RE.test(trimmed)) return trimmed.toLowerCase();
+	return trimmed.toLowerCase().replace(INVALID_CHARS_RE, "-").replace(LEADING_DASH_RE, "").replace(TRAILING_DASH_RE, "").slice(0, 64) || DEFAULT_ACCOUNT_ID;
+}
+function buildAgentMainSessionKey(params) {
+	return `agent:${normalizeAgentId(params.agentId)}:${normalizeMainKey(params.mainKey)}`;
+}
+function buildAgentPeerSessionKey(params) {
+	const peerKind = params.peerKind ?? "dm";
+	if (peerKind === "dm") {
+		const dmScope = params.dmScope ?? "main";
+		let peerId = (params.peerId ?? "").trim();
+		const linkedPeerId = dmScope === "main" ? null : resolveLinkedPeerId({
+			identityLinks: params.identityLinks,
+			channel: params.channel,
+			peerId
+		});
+		if (linkedPeerId) peerId = linkedPeerId;
+		peerId = peerId.toLowerCase();
+		if (dmScope === "per-account-channel-peer" && peerId) {
+			const channel = (params.channel ?? "").trim().toLowerCase() || "unknown";
+			const accountId = normalizeAccountId(params.accountId);
+			return `agent:${normalizeAgentId(params.agentId)}:${channel}:${accountId}:dm:${peerId}`;
+		}
+		if (dmScope === "per-channel-peer" && peerId) {
+			const channel = (params.channel ?? "").trim().toLowerCase() || "unknown";
+			return `agent:${normalizeAgentId(params.agentId)}:${channel}:dm:${peerId}`;
+		}
+		if (dmScope === "per-peer" && peerId) return `agent:${normalizeAgentId(params.agentId)}:dm:${peerId}`;
+		return buildAgentMainSessionKey({
+			agentId: params.agentId,
+			mainKey: params.mainKey
+		});
+	}
+	const channel = (params.channel ?? "").trim().toLowerCase() || "unknown";
+	const peerId = ((params.peerId ?? "").trim() || "unknown").toLowerCase();
+	return `agent:${normalizeAgentId(params.agentId)}:${channel}:${peerKind}:${peerId}`;
+}
+function resolveLinkedPeerId(params) {
+	const identityLinks = params.identityLinks;
+	if (!identityLinks) return null;
+	const peerId = params.peerId.trim();
+	if (!peerId) return null;
+	const candidates = /* @__PURE__ */ new Set();
+	const rawCandidate = normalizeToken(peerId);
+	if (rawCandidate) candidates.add(rawCandidate);
+	const channel = normalizeToken(params.channel);
+	if (channel) {
+		const scopedCandidate = normalizeToken(`${channel}:${peerId}`);
+		if (scopedCandidate) candidates.add(scopedCandidate);
+	}
+	if (candidates.size === 0) return null;
+	for (const [canonical, ids] of Object.entries(identityLinks)) {
+		const canonicalName = canonical.trim();
+		if (!canonicalName) continue;
+		if (!Array.isArray(ids)) continue;
+		for (const id of ids) {
+			const normalized = normalizeToken(id);
+			if (normalized && candidates.has(normalized)) return canonicalName;
+		}
+	}
+	return null;
+}
+function buildGroupHistoryKey(params) {
+	const channel = normalizeToken(params.channel) || "unknown";
+	const accountId = normalizeAccountId(params.accountId);
+	const peerId = params.peerId.trim().toLowerCase() || "unknown";
+	return `${channel}:${accountId}:${params.peerKind}:${peerId}`;
+}
+function resolveThreadSessionKeys(params) {
+	const threadId = (params.threadId ?? "").trim();
+	if (!threadId) return {
+		sessionKey: params.baseSessionKey,
+		parentSessionKey: void 0
+	};
+	const normalizedThreadId = threadId.toLowerCase();
+	return {
+		sessionKey: params.useSuffix ?? true ? `${params.baseSessionKey}:thread:${normalizedThreadId}` : params.baseSessionKey,
+		parentSessionKey: params.parentSessionKey
+	};
+}
+
+//#endregion
+export { parseAgentSessionKey as _, buildAgentPeerSessionKey as a, normalizeAgentId as c, resolveThreadSessionKeys as d, sanitizeAgentId as f, isSubagentSessionKey as g, isAcpSessionKey as h, buildAgentMainSessionKey as i, normalizeMainKey as l, toAgentStoreSessionKey as m, DEFAULT_AGENT_ID as n, buildGroupHistoryKey as o, toAgentRequestSessionKey as p, DEFAULT_MAIN_KEY as r, normalizeAccountId as s, DEFAULT_ACCOUNT_ID as t, resolveAgentIdFromSessionKey as u, resolveThreadParentSessionKey as v };

package/dist/{shared-ChNOqAzp.js → shared-BmtNKsPq.js}

@@ -1,7 +1,7 @@
-import { V as getResolvedLoggerSettings, c as defaultRuntime } from "./subsystem-46MXi6Ip.js";
-import { t as formatCliCommand } from "./command-format-BQK1OIvH.js";
-import { d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel } from "./constants-3er_81qc.js";
-import { o as resolveGatewayLogPaths } from "./service-CAxAjHNB.js";
+import { V as getResolvedLoggerSettings, c as defaultRuntime } from "./subsystem-CAq3uyo7.js";
+import { t as formatCliCommand } from "./command-format-ChfKqObn.js";
+import { d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel } from "./constants-HPrOsATF.js";
+import { o as resolveGatewayLogPaths } from "./service-BZesBIaG.js";
 import { Writable } from "node:stream";
 
 //#region src/cli/daemon-cli/response.ts

package/dist/{shared-D42-KbPa.js → shared-C1XLEyB0.js}

@@ -1,7 +1,7 @@
 import { p as defaultRuntime } from "./entry.js";
-import { t as formatCliCommand } from "./command-format-3xiXujG0.js";
-import { d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel } from "./constants-CLUi6T-M.js";
-import { t as resolveGatewayService } from "./service-BoDHq_LN.js";
+import { t as formatCliCommand } from "./command-format-ayFsmwwz.js";
+import { d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel } from "./constants-D1op9uGI.js";
+import { t as resolveGatewayService } from "./service-_JwSmGSn.js";
 
 //#region src/cli/gateway-cli/shared.ts
 function parsePort(raw) {

package/dist/{shared-xZjRQa6y.js → shared-C8_5pNbb.js}

@@ -1,7 +1,7 @@
-import { c as defaultRuntime } from "./subsystem-46MXi6Ip.js";
-import { t as formatCliCommand } from "./command-format-BQK1OIvH.js";
-import { d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel } from "./constants-3er_81qc.js";
-import { t as resolveGatewayService } from "./service-CAxAjHNB.js";
+import { c as defaultRuntime } from "./subsystem-CAq3uyo7.js";
+import { t as formatCliCommand } from "./command-format-ChfKqObn.js";
+import { d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel } from "./constants-HPrOsATF.js";
+import { t as resolveGatewayService } from "./service-BZesBIaG.js";
 
 //#region src/cli/gateway-cli/shared.ts
 function parsePort(raw) {

package/dist/{shared-DBGw227P.js → shared-fnGLWyZ6.js}

@@ -1,7 +1,7 @@
 import { M as getResolvedLoggerSettings, p as defaultRuntime } from "./entry.js";
-import { t as formatCliCommand } from "./command-format-3xiXujG0.js";
-import { d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel } from "./constants-CLUi6T-M.js";
-import { o as resolveGatewayLogPaths } from "./service-BoDHq_LN.js";
+import { t as formatCliCommand } from "./command-format-ayFsmwwz.js";
+import { d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel } from "./constants-D1op9uGI.js";
+import { o as resolveGatewayLogPaths } from "./service-_JwSmGSn.js";
 import { Writable } from "node:stream";
 
 //#region src/cli/daemon-cli/response.ts

package/dist/skill-scanner-BoGjHXUZ.js

@@ -0,0 +1,255 @@
+import path from "node:path";
+import fs from "node:fs/promises";
+
+//#region src/security/skill-scanner.ts
+const SCANNABLE_EXTENSIONS = new Set([
+	".js",
+	".ts",
+	".mjs",
+	".cjs",
+	".mts",
+	".cts",
+	".jsx",
+	".tsx"
+]);
+const DEFAULT_MAX_SCAN_FILES = 500;
+const DEFAULT_MAX_FILE_BYTES = 1024 * 1024;
+function isScannable(filePath) {
+	return SCANNABLE_EXTENSIONS.has(path.extname(filePath).toLowerCase());
+}
+function isErrno(err, code) {
+	if (!err || typeof err !== "object") return false;
+	if (!("code" in err)) return false;
+	return err.code === code;
+}
+const LINE_RULES = [
+	{
+		ruleId: "dangerous-exec",
+		severity: "critical",
+		message: "Shell command execution detected (child_process)",
+		pattern: /\b(exec|execSync|spawn|spawnSync|execFile|execFileSync)\s*\(/,
+		requiresContext: /child_process/
+	},
+	{
+		ruleId: "dynamic-code-execution",
+		severity: "critical",
+		message: "Dynamic code execution detected",
+		pattern: /\beval\s*\(|new\s+Function\s*\(/
+	},
+	{
+		ruleId: "crypto-mining",
+		severity: "critical",
+		message: "Possible crypto-mining reference detected",
+		pattern: /stratum\+tcp|stratum\+ssl|coinhive|cryptonight|xmrig/i
+	},
+	{
+		ruleId: "suspicious-network",
+		severity: "warn",
+		message: "WebSocket connection to non-standard port",
+		pattern: /new\s+WebSocket\s*\(\s*["']wss?:\/\/[^"']*:(\d+)/
+	}
+];
+const STANDARD_PORTS = new Set([
+	80,
+	443,
+	8080,
+	8443,
+	3e3
+]);
+const SOURCE_RULES = [
+	{
+		ruleId: "potential-exfiltration",
+		severity: "warn",
+		message: "File read combined with network send — possible data exfiltration",
+		pattern: /readFileSync|readFile/,
+		requiresContext: /\bfetch\b|\bpost\b|http\.request/i
+	},
+	{
+		ruleId: "obfuscated-code",
+		severity: "warn",
+		message: "Hex-encoded string sequence detected (possible obfuscation)",
+		pattern: /(\\x[0-9a-fA-F]{2}){6,}/
+	},
+	{
+		ruleId: "obfuscated-code",
+		severity: "warn",
+		message: "Large base64 payload with decode call detected (possible obfuscation)",
+		pattern: /(?:atob|Buffer\.from)\s*\(\s*["'][A-Za-z0-9+/=]{200,}["']/
+	},
+	{
+		ruleId: "env-harvesting",
+		severity: "critical",
+		message: "Environment variable access combined with network send — possible credential harvesting",
+		pattern: /process\.env/,
+		requiresContext: /\bfetch\b|\bpost\b|http\.request/i
+	}
+];
+function truncateEvidence(evidence, maxLen = 120) {
+	if (evidence.length <= maxLen) return evidence;
+	return `${evidence.slice(0, maxLen)}…`;
+}
+function scanSource(source, filePath) {
+	const findings = [];
+	const lines = source.split("\n");
+	const matchedLineRules = /* @__PURE__ */ new Set();
+	for (const rule of LINE_RULES) {
+		if (matchedLineRules.has(rule.ruleId)) continue;
+		if (rule.requiresContext && !rule.requiresContext.test(source)) continue;
+		for (let i = 0; i < lines.length; i++) {
+			const line = lines[i];
+			const match = rule.pattern.exec(line);
+			if (!match) continue;
+			if (rule.ruleId === "suspicious-network") {
+				const port = parseInt(match[1], 10);
+				if (STANDARD_PORTS.has(port)) continue;
+			}
+			findings.push({
+				ruleId: rule.ruleId,
+				severity: rule.severity,
+				file: filePath,
+				line: i + 1,
+				message: rule.message,
+				evidence: truncateEvidence(line.trim())
+			});
+			matchedLineRules.add(rule.ruleId);
+			break;
+		}
+	}
+	const matchedSourceRules = /* @__PURE__ */ new Set();
+	for (const rule of SOURCE_RULES) {
+		const ruleKey = `${rule.ruleId}::${rule.message}`;
+		if (matchedSourceRules.has(ruleKey)) continue;
+		if (!rule.pattern.test(source)) continue;
+		if (rule.requiresContext && !rule.requiresContext.test(source)) continue;
+		let matchLine = 0;
+		let matchEvidence = "";
+		for (let i = 0; i < lines.length; i++) if (rule.pattern.test(lines[i])) {
+			matchLine = i + 1;
+			matchEvidence = lines[i].trim();
+			break;
+		}
+		if (matchLine === 0) {
+			matchLine = 1;
+			matchEvidence = source.slice(0, 120);
+		}
+		findings.push({
+			ruleId: rule.ruleId,
+			severity: rule.severity,
+			file: filePath,
+			line: matchLine,
+			message: rule.message,
+			evidence: truncateEvidence(matchEvidence)
+		});
+		matchedSourceRules.add(ruleKey);
+	}
+	return findings;
+}
+function normalizeScanOptions(opts) {
+	return {
+		includeFiles: opts?.includeFiles ?? [],
+		maxFiles: Math.max(1, opts?.maxFiles ?? DEFAULT_MAX_SCAN_FILES),
+		maxFileBytes: Math.max(1, opts?.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES)
+	};
+}
+function isPathInside(basePath, candidatePath) {
+	const base = path.resolve(basePath);
+	const candidate = path.resolve(candidatePath);
+	const rel = path.relative(base, candidate);
+	return rel === "" || !rel.startsWith(`..${path.sep}`) && rel !== ".." && !path.isAbsolute(rel);
+}
+async function walkDirWithLimit(dirPath, maxFiles) {
+	const files = [];
+	const stack = [dirPath];
+	while (stack.length > 0 && files.length < maxFiles) {
+		const currentDir = stack.pop();
+		if (!currentDir) break;
+		const entries = await fs.readdir(currentDir, { withFileTypes: true });
+		for (const entry of entries) {
+			if (files.length >= maxFiles) break;
+			if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
+			const fullPath = path.join(currentDir, entry.name);
+			if (entry.isDirectory()) stack.push(fullPath);
+			else if (isScannable(entry.name)) files.push(fullPath);
+		}
+	}
+	return files;
+}
+async function resolveForcedFiles(params) {
+	if (params.includeFiles.length === 0) return [];
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const rawIncludePath of params.includeFiles) {
+		const includePath = path.resolve(params.rootDir, rawIncludePath);
+		if (!isPathInside(params.rootDir, includePath)) continue;
+		if (!isScannable(includePath)) continue;
+		if (seen.has(includePath)) continue;
+		let st = null;
+		try {
+			st = await fs.stat(includePath);
+		} catch (err) {
+			if (isErrno(err, "ENOENT")) continue;
+			throw err;
+		}
+		if (!st?.isFile()) continue;
+		out.push(includePath);
+		seen.add(includePath);
+	}
+	return out;
+}
+async function collectScannableFiles(dirPath, opts) {
+	const forcedFiles = await resolveForcedFiles({
+		rootDir: dirPath,
+		includeFiles: opts.includeFiles
+	});
+	if (forcedFiles.length >= opts.maxFiles) return forcedFiles.slice(0, opts.maxFiles);
+	const walkedFiles = await walkDirWithLimit(dirPath, opts.maxFiles);
+	const seen = new Set(forcedFiles.map((f) => path.resolve(f)));
+	const out = [...forcedFiles];
+	for (const walkedFile of walkedFiles) {
+		if (out.length >= opts.maxFiles) break;
+		const resolved = path.resolve(walkedFile);
+		if (seen.has(resolved)) continue;
+		out.push(walkedFile);
+		seen.add(resolved);
+	}
+	return out;
+}
+async function readScannableSource(filePath, maxFileBytes) {
+	let st = null;
+	try {
+		st = await fs.stat(filePath);
+	} catch (err) {
+		if (isErrno(err, "ENOENT")) return null;
+		throw err;
+	}
+	if (!st?.isFile() || st.size > maxFileBytes) return null;
+	try {
+		return await fs.readFile(filePath, "utf-8");
+	} catch (err) {
+		if (isErrno(err, "ENOENT")) return null;
+		throw err;
+	}
+}
+async function scanDirectoryWithSummary(dirPath, opts) {
+	const scanOptions = normalizeScanOptions(opts);
+	const files = await collectScannableFiles(dirPath, scanOptions);
+	const allFindings = [];
+	let scannedFiles = 0;
+	for (const file of files) {
+		const source = await readScannableSource(file, scanOptions.maxFileBytes);
+		if (source == null) continue;
+		scannedFiles += 1;
+		const findings = scanSource(source, file);
+		allFindings.push(...findings);
+	}
+	return {
+		scannedFiles,
+		critical: allFindings.filter((f) => f.severity === "critical").length,
+		warn: allFindings.filter((f) => f.severity === "warn").length,
+		info: allFindings.filter((f) => f.severity === "info").length,
+		findings: allFindings
+	};
+}
+
+//#endregion
+export { scanDirectoryWithSummary as t };