@js-recon/js-recon 1.4.1-alpha.9 → 1.4.1-beta.2

package/.claude-sync/capture-new.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# Intercepts newly-added real CLAUDE.md files at commit time, redirects their
+# content into the sibling js-recon-agentic-files repo on the current branch,
+# and replaces them with a symlink — so they never land in this repo's history.
+set -euo pipefail
+
+JS_RECON_ROOT="$(git rev-parse --show-toplevel)"
+AGENTIC_REPO_PATH="${JSR_AGENTIC_FILES_PATH:-$JS_RECON_ROOT/../js-recon-agentic-files}"
+CURRENT_BRANCH="$(git -C "$JS_RECON_ROOT" symbolic-ref --short HEAD)"
+
+cd "$JS_RECON_ROOT"
+
+staged_real_claude_md="$(git diff --cached --name-only --diff-filter=ACM | grep -E '(^|/)CLAUDE\.md$' || true)"
+
+if [ -z "$staged_real_claude_md" ]; then
+    exit 0
+fi
+
+captured=0
+while IFS= read -r f; do
+    [ -z "$f" ] && continue
+
+    if [ -L "$f" ]; then
+        continue
+    fi
+
+    dest="$AGENTIC_REPO_PATH/$f"
+    mkdir -p "$(dirname "$dest")"
+    cp "$JS_RECON_ROOT/$f" "$dest"
+
+    (
+        cd "$AGENTIC_REPO_PATH"
+        if ! git show-ref --verify --quiet "refs/heads/$CURRENT_BRANCH"; then
+            git fetch origin --quiet || true
+            if git show-ref --verify --quiet "refs/remotes/origin/$CURRENT_BRANCH"; then
+                git checkout -q "$CURRENT_BRANCH"
+            else
+                git checkout -q -b "$CURRENT_BRANCH"
+            fi
+        else
+            git checkout -q "$CURRENT_BRANCH"
+        fi
+        git add "$f"
+        git commit -q -m "sync: capture $f from js-recon@$CURRENT_BRANCH"
+        git push -q origin "$CURRENT_BRANCH"
+    )
+
+    git reset -q HEAD -- "$f" >/dev/null 2>&1 || true
+    rm -f "$JS_RECON_ROOT/$f"
+    ln -s "$dest" "$JS_RECON_ROOT/$f"
+    echo "[claude-sync] captured $f into js-recon-agentic-files (branch $CURRENT_BRANCH), replaced with symlink"
+    captured=1
+done <<< "$staged_real_claude_md"
+
+if [ "$captured" -eq 1 ]; then
+    echo "[claude-sync] commit aborted — CLAUDE.md file(s) were redirected to js-recon-agentic-files."
+    echo "[claude-sync] please 'git add' any remaining changes and re-run 'git commit'."
+    exit 1
+fi
+
+exit 0

package/.claude-sync/capture-scan.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Walks the working tree for real (non-symlink) CLAUDE.md / .claude/skills /
+# .claude/agents files and captures each into the sibling js-recon-agentic-files
+# repo on the current branch, replacing it with a symlink. This is the primary
+# "new file" trigger — .gitignore refuses `git add` on these paths outright, so
+# a git-staged-diff-based hook (see capture-new.sh) never sees them; a
+# filesystem scan is required.
+set -euo pipefail
+
+JS_RECON_ROOT="$(git rev-parse --show-toplevel)"
+AGENTIC_REPO_PATH="${JSR_AGENTIC_FILES_PATH:-$JS_RECON_ROOT/../js-recon-agentic-files}"
+
+# Optional $1: attribute captures to this branch instead of the current HEAD.
+# Used by the post-checkout hook, which only runs *after* HEAD has already
+# moved to the new branch — git has no pre-checkout hook, so any real file
+# left over from the branch being switched away from must be attributed to
+# that branch explicitly, or it would be mis-captured onto the new branch.
+CURRENT_BRANCH="${1:-$(git -C "$JS_RECON_ROOT" symbolic-ref --short HEAD 2>/dev/null || echo "")}"
+
+if [ -z "$CURRENT_BRANCH" ] || [ ! -d "$AGENTIC_REPO_PATH/.git" ]; then
+    exit 0
+fi
+
+captured=0
+while IFS= read -r f; do
+    [ -z "$f" ] && continue
+    rel="${f#$JS_RECON_ROOT/}"
+    dest="$AGENTIC_REPO_PATH/$rel"
+
+    mkdir -p "$(dirname "$dest")"
+    cp "$f" "$dest"
+
+    (
+        cd "$AGENTIC_REPO_PATH"
+        if git show-ref --verify --quiet "refs/heads/$CURRENT_BRANCH"; then
+            git checkout -q "$CURRENT_BRANCH"
+        elif git show-ref --verify --quiet "refs/remotes/origin/$CURRENT_BRANCH"; then
+            git checkout -q "$CURRENT_BRANCH"
+        else
+            git checkout -q -b "$CURRENT_BRANCH"
+        fi
+        git add "$rel"
+        git commit -q -m "sync: capture $rel from js-recon@$CURRENT_BRANCH"
+        git push -q origin "$CURRENT_BRANCH" 2>/dev/null || echo "[claude-sync] WARNING: push failed for $rel (branch may need 'git push -u origin $CURRENT_BRANCH' manually)"
+    )
+
+    rm -f "$f"
+    ln -s "$dest" "$f"
+    echo "[claude-sync] captured $rel into js-recon-agentic-files (branch $CURRENT_BRANCH), replaced with symlink"
+    captured=1
+done < <(find "$JS_RECON_ROOT" \( -name "CLAUDE.md" -o -path "*/.claude/skills/*" -o -path "*/.claude/agents/*" \) -not -path "*/.git/*" -not -path "*/node_modules/*" -not -path "*/build/*" -not -path "$AGENTIC_REPO_PATH/*" -type f)
+
+if [ "$captured" -eq 0 ]; then
+    exit 0
+fi

package/.claude-sync/hooks/post-checkout

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# git post-checkout hook: re-syncs CLAUDE.md symlinks whenever a branch switch happens.
+prev_head="$1"
+new_head="$2"
+branch_checkout="$3"
+
+if [ "$branch_checkout" = "1" ]; then
+    ROOT="$(git rev-parse --show-toplevel)"
+    # Resolve which branch prev_head belongs to (the branch we're leaving) so any
+    # leftover real CLAUDE.md file gets attributed correctly — HEAD has already
+    # moved to the new branch by the time this hook runs, and git has no
+    # pre-checkout hook to capture beforehand.
+    prev_branch="$(git for-each-ref --points-at="$prev_head" --format='%(refname:short)' refs/heads/ 2>/dev/null | head -1)"
+    "$ROOT/.claude-sync/capture-scan.sh" "$prev_branch"
+    "$ROOT/.claude-sync/sync.sh"
+fi

package/.claude-sync/hooks/pre-commit

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+# git pre-commit hook: redirects newly-staged real CLAUDE.md files to js-recon-agentic-files.
+exec "$(git rev-parse --show-toplevel)/.claude-sync/capture-new.sh"

package/.claude-sync/setup.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# One-time collaborator setup: installs the git hooks and runs an initial sync.
+# Requires js-recon-agentic-files to already be cloned as a sibling directory
+# (../js-recon-agentic-files) or JSR_AGENTIC_FILES_PATH to point at it.
+set -euo pipefail
+
+JS_RECON_ROOT="$(git rev-parse --show-toplevel)"
+
+chmod +x "$JS_RECON_ROOT/.claude-sync/sync.sh"
+chmod +x "$JS_RECON_ROOT/.claude-sync/capture-new.sh"
+chmod +x "$JS_RECON_ROOT/.claude-sync/hooks/post-checkout"
+chmod +x "$JS_RECON_ROOT/.claude-sync/hooks/pre-commit"
+
+git -C "$JS_RECON_ROOT" config core.hooksPath .claude-sync/hooks
+
+echo "[claude-sync] hooksPath configured, running initial sync..."
+"$JS_RECON_ROOT/.claude-sync/sync.sh"

package/.claude-sync/sync.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Syncs CLAUDE.md / .claude/skills / .claude/agents symlinks from the sibling
+# js-recon-agentic-files checkout to match the currently checked-out branch of
+# this repo.
+set -euo pipefail
+
+JS_RECON_ROOT="$(git rev-parse --show-toplevel)"
+AGENTIC_REPO_PATH="${JSR_AGENTIC_FILES_PATH:-$JS_RECON_ROOT/../js-recon-agentic-files}"
+FALLBACK_BRANCH="${JSR_AGENTIC_FALLBACK_BRANCH:-dev}"
+
+CURRENT_BRANCH="$(git -C "$JS_RECON_ROOT" symbolic-ref --short HEAD 2>/dev/null || echo "")"
+
+if [ -z "$CURRENT_BRANCH" ]; then
+    echo "[claude-sync] detached HEAD, skipping sync"
+    exit 0
+fi
+
+if [ ! -d "$AGENTIC_REPO_PATH/.git" ]; then
+    echo "[claude-sync] agentic-files repo not found at $AGENTIC_REPO_PATH — see js-recon-agentic-files/README.md for setup"
+    exit 0
+fi
+
+(
+    cd "$AGENTIC_REPO_PATH"
+    git fetch origin --quiet
+
+    if git show-ref --verify --quiet "refs/remotes/origin/$CURRENT_BRANCH"; then
+        git checkout -B "$CURRENT_BRANCH" "origin/$CURRENT_BRANCH" --quiet
+    else
+        echo "[claude-sync] WARNING: no 'origin/$CURRENT_BRANCH' branch in agentic-files repo — falling back to 'origin/$FALLBACK_BRANCH'"
+        git checkout -B "$CURRENT_BRANCH" "origin/$FALLBACK_BRANCH" --quiet
+    fi
+)
+
+# 1. Remove stale symlinks that point into the agentic checkout but whose target
+#    no longer exists on this branch (e.g. switched to a branch with fewer files).
+while IFS= read -r link; do
+    target="$(readlink "$link")"
+    case "$target" in
+        "$AGENTIC_REPO_PATH"/*)
+            if [ ! -e "$target" ]; then
+                rm "$link"
+                echo "[claude-sync] removed stale symlink: ${link#$JS_RECON_ROOT/}"
+            fi
+            ;;
+    esac
+done < <(find "$JS_RECON_ROOT" -type l \( -name "CLAUDE.md" -o -path "*/.claude/skills/*" -o -path "*/.claude/agents/*" \) -not -path "*/.git/*" -not -path "*/node_modules/*" -not -path "*/build/*")
+
+# 2. Create/update symlinks for every CLAUDE.md (and .claude/skills / .claude/agents
+#    entry) present on this branch in the agentic checkout.
+while IFS= read -r src; do
+    rel="${src#$AGENTIC_REPO_PATH/}"
+    dest="$JS_RECON_ROOT/$rel"
+
+    if [ -e "$dest" ] && [ ! -L "$dest" ]; then
+        echo "[claude-sync] WARNING: $rel exists as a real (non-symlink) file — not overwriting. Stage it to trigger capture, or remove it manually."
+        continue
+    fi
+
+    mkdir -p "$(dirname "$dest")"
+    ln -sf "$src" "$dest"
+done < <(find "$AGENTIC_REPO_PATH" \( -name "CLAUDE.md" -o -path "*/.claude/skills/*" -o -path "*/.claude/agents/*" \) -type f -not -path "*/.git/*")
+
+echo "[claude-sync] synced CLAUDE.md files for branch '$CURRENT_BRANCH'"

package/.claude-sync/watch.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Background watcher intended to be run as a VS Code task (runOn: folderOpen,
+# isBackground: true). Polls for new real CLAUDE.md files every few seconds and
+# captures them immediately via capture-scan.sh, so a file created interactively
+# (e.g. by an editor or an agent session) gets redirected without waiting for the
+# next branch switch or commit.
+set -uo pipefail
+
+ROOT="$(git rev-parse --show-toplevel)"
+INTERVAL="${JSR_WATCH_INTERVAL:-3}"
+
+echo "[claude-sync] watching for new CLAUDE.md files (interval: ${INTERVAL}s)"
+
+while true; do
+    "$ROOT/.claude-sync/capture-scan.sh"
+    sleep "$INTERVAL"
+done

package/.github/workflows/build-and-prettify.yaml

@@ -136,6 +136,8 @@ jobs:
         run: npm run build
   build-docker:
     needs: build
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -167,6 +169,9 @@ jobs:
         with:
           repository: js-recon/js-recon-rules
           path: js-recon-rules
+          # Keep the checkout token out of js-recon-rules/.git/config — this
+          # context is consumed by later build/run steps (incl. Dockerfile.w-rules).
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -223,6 +228,40 @@ jobs:
           path: output/localhost_3001/analyze.json
           if-no-files-found: ignore
 
+      - name: Build the rules-bundled (-w-rules) image
+        run: docker build -f Dockerfile.w-rules --build-arg BASE_IMAGE=js-recon/js-recon -t js-recon/js-recon-w-rules .
+
+      - name: Run js-recon-w-rules via Docker against lab app (no rules mount, no -r)
+        run: |
+          set -o pipefail
+          mkdir -p output-w-rules
+          docker run --name js-recon-w-rules-run \
+            --network host \
+            --entrypoint /bin/bash \
+            js-recon/js-recon-w-rules \
+            -c 'printf "http://localhost:3001\n" > /tmp/urls.txt && node build/index.js run -u /tmp/urls.txt --no-sandbox -y -k' \
+            | tee docker-w-rules-run.log
+          docker cp js-recon-w-rules-run:/home/pptruser/output/. ./output-w-rules/ 2>/dev/null || true
+          docker rm js-recon-w-rules-run
+
+      - name: Verify the version check was actually skipped
+        run: |
+          grep -q "Rules version check disabled" docker-w-rules-run.log || {
+            echo "Expected log line confirming JS_RECON_DISABLE_RULES_VERSION_CHECK was honored not found"
+            exit 1
+          }
+
+      - name: Verify all rules fired (w-rules image)
+        run: node scripts/smoke-test.js output-w-rules/localhost_3001/analyze.json
+
+      - name: Upload w-rules analyze.json on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: analyze-json-docker-w-rules
+          path: output-w-rules/localhost_3001/analyze.json
+          if-no-files-found: ignore
+
   integration-test-macos:
     needs: build
     runs-on: macos-latest
@@ -244,6 +283,9 @@ jobs:
         with:
           repository: js-recon/js-recon-rules
           path: js-recon-rules
+          # Keep the checkout token out of js-recon-rules/.git/config — this
+          # context is consumed by later build/run steps (incl. Dockerfile.w-rules).
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

package/.github/workflows/promote-js-recon.yml

@@ -78,6 +78,15 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Checkout js-recon-rules
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: js-recon/js-recon-rules
+          path: js-recon-rules
+          # Don't persist the checkout token into js-recon-rules/.git/config —
+          # Dockerfile.w-rules builds from this context and would otherwise bake
+          # the writable GHCR credential into an image layer.
+          persist-credentials: false
       - uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -102,3 +111,293 @@ jobs:
 
         env:
           VERSION: ${{ inputs.version }}
+
+      - name: Build and push the rules-bundled (-w-rules) variant
+        run: |
+          # layer js-recon-rules on top of the image just built/pushed above
+          docker build -f Dockerfile.w-rules --build-arg BASE_IMAGE=ghcr.io/js-recon/js-recon:$VERSION -t ghcr.io/js-recon/js-recon:$VERSION-w-rules .
+
+          TAG="latest"
+          [[ "$VERSION" == *"beta"* ]] && TAG="beta"
+          [[ "$VERSION" == *"alpha"* ]] && TAG="alpha"
+
+          docker tag ghcr.io/js-recon/js-recon:$VERSION-w-rules ghcr.io/js-recon/js-recon:$TAG-w-rules
+
+          docker push ghcr.io/js-recon/js-recon:$VERSION-w-rules
+          docker push ghcr.io/js-recon/js-recon:$TAG-w-rules
+        env:
+          VERSION: ${{ inputs.version }}
+
+  verify-npm-install:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout js-recon-labs
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: js-recon/js-recon-labs
+          path: js-recon-labs
+          persist-credentials: false
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22"
+
+      - name: Install js-recon globally from npm
+        run: npm install -g "@js-recon/js-recon@${VERSION}"
+        env:
+          VERSION: ${{ inputs.version }}
+
+      - name: Verify installed version
+        run: |
+          INSTALLED=$(js-recon -V)
+          echo "Installed: ${INSTALLED}"
+          [[ "$INSTALLED" == *"$VERSION"* ]] || { echo "Version mismatch"; exit 1; }
+        env:
+          VERSION: ${{ inputs.version }}
+
+      - name: Install and start vulnerable app
+        working-directory: js-recon-labs/next_js/vuln-all-rules
+        run: |
+          npm ci
+          npm run build
+          npm start &
+
+      - name: Wait for app to be ready
+        run: timeout 60 bash -c 'until curl -sf --max-time 2 http://localhost:3001 > /dev/null; do sleep 2; done'
+
+      - name: Run installed js-recon against the lab app
+        run: |
+          echo "http://localhost:3001" > /tmp/npm-smoke-urls.txt
+          js-recon run -u /tmp/npm-smoke-urls.txt --no-sandbox -y -k
+        env:
+          PUPPETEER_EXECUTABLE_PATH: /usr/bin/google-chrome-stable
+
+      - name: Verify expected output files exist
+        run: |
+          test -n "$(find output -name analyze.json)" || { echo "analyze.json missing"; exit 1; }
+          test -n "$(find output -name js-recon.db)" || { echo "js-recon.db missing"; exit 1; }
+
+  verify-docker-install:
+    runs-on: ubuntu-latest
+    needs: publish-ghcr
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - name: Checkout js-recon-labs
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: js-recon/js-recon-labs
+          path: js-recon-labs
+          persist-credentials: false
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22"
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Verify installed version
+        run: |
+          INSTALLED=$(docker run --rm ghcr.io/js-recon/js-recon:${VERSION} -V)
+          echo "Installed: ${INSTALLED}"
+          [[ "$INSTALLED" == *"$VERSION"* ]] || { echo "Version mismatch"; exit 1; }
+        env:
+          VERSION: ${{ inputs.version }}
+
+      - name: Install and start vulnerable app
+        working-directory: js-recon-labs/next_js/vuln-all-rules
+        run: |
+          npm ci
+          npm run build
+          npm start &
+
+      - name: Wait for app to be ready
+        run: timeout 60 bash -c 'until curl -sf --max-time 2 http://localhost:3001 > /dev/null; do sleep 2; done'
+
+      - name: Run containerized js-recon against the lab app
+        run: |
+          # The release image runs as the non-root `pptruser` (see Dockerfile.release),
+          # so a bind-mounted host directory landing inside its home dir inherits the
+          # host-side owner/perms and can be unwritable to that user. Mount outside
+          # $HOME with permissive perms and point js-recon at it explicitly via `-o`
+          # rather than relying on its default CWD-relative output path.
+          mkdir -p /tmp/docker-output
+          chmod 777 /tmp/docker-output
+          echo "http://localhost:3001" > /tmp/docker-smoke-urls.txt
+          docker run --rm --network host \
+            -v /tmp/docker-output:/tmp/js-recon-output \
+            -v /tmp/docker-smoke-urls.txt:/tmp/urls.txt \
+            ghcr.io/js-recon/js-recon:${VERSION} \
+            run -u /tmp/urls.txt -o /tmp/js-recon-output --no-sandbox -y -k
+        env:
+          VERSION: ${{ inputs.version }}
+
+      - name: Verify expected output files exist
+        run: |
+          test -n "$(find /tmp/docker-output -name analyze.json)" || { echo "analyze.json missing"; exit 1; }
+          test -n "$(find /tmp/docker-output -name js-recon.db)" || { echo "js-recon.db missing"; exit 1; }
+
+  verify-docker-w-rules-install:
+    runs-on: ubuntu-latest
+    needs: publish-ghcr
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - name: Checkout js-recon
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Checkout js-recon-labs
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: js-recon/js-recon-labs
+          path: js-recon-labs
+          persist-credentials: false
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22"
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install and start vulnerable app
+        working-directory: js-recon-labs/next_js/vuln-all-rules
+        run: |
+          npm ci
+          npm run build
+          npm start &
+
+      - name: Wait for app to be ready
+        run: timeout 60 bash -c 'until curl -sf --max-time 2 http://localhost:3001 > /dev/null; do sleep 2; done'
+
+      - name: Run the rules-bundled image against the lab app (no rules mount, no -r)
+        run: |
+          set -o pipefail
+          # Deliberately don't mount any rules directory and don't pass -r — the
+          # -w-rules image must be able to analyze using only what's baked in.
+          mkdir -p /tmp/docker-w-rules-output
+          chmod 777 /tmp/docker-w-rules-output
+          echo "http://localhost:3001" > /tmp/docker-w-rules-smoke-urls.txt
+          docker run --network host \
+            --name js-recon-w-rules-run \
+            -v /tmp/docker-w-rules-output:/tmp/js-recon-output \
+            -v /tmp/docker-w-rules-smoke-urls.txt:/tmp/urls.txt \
+            ghcr.io/js-recon/js-recon:${VERSION}-w-rules \
+            run -u /tmp/urls.txt -o /tmp/js-recon-output --no-sandbox -y -k \
+            | tee /tmp/docker-w-rules-run.log
+          docker rm js-recon-w-rules-run
+        env:
+          VERSION: ${{ inputs.version }}
+
+      - name: Verify the version check was actually skipped
+        run: |
+          grep -q "Rules version check disabled" /tmp/docker-w-rules-run.log || {
+            echo "Expected log line confirming JS_RECON_DISABLE_RULES_VERSION_CHECK was honored not found"
+            exit 1
+          }
+
+      - name: Verify all rules fired
+        run: node scripts/smoke-test.js "$(find /tmp/docker-w-rules-output -name analyze.json | head -n1)"
+
+  verify-brew-install:
+    runs-on: macos-latest
+    needs: update-homebrew-tap
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        formula: [js-recon, js-recon-alpha, js-recon-beta]
+    steps:
+      - name: Checkout js-recon-labs
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: js-recon/js-recon-labs
+          path: js-recon-labs
+          persist-credentials: false
+
+      - name: Tap and install
+        run: |
+          brew tap js-recon/tap
+          brew update
+          brew install "js-recon/tap/${{ matrix.formula }}"
+
+      - name: Determine expected formula for this version
+        id: expected
+        run: |
+          if [[ "$VERSION" == *"alpha"* ]]; then
+            echo "formula=js-recon-alpha" >> "$GITHUB_OUTPUT"
+          elif [[ "$VERSION" == *"beta"* ]]; then
+            echo "formula=js-recon-beta" >> "$GITHUB_OUTPUT"
+          else
+            echo "formula=js-recon" >> "$GITHUB_OUTPUT"
+          fi
+        env:
+          VERSION: ${{ inputs.version }}
+
+      - name: Resolve js-recon binary path
+        id: bin
+        run: |
+          # js-recon-alpha/js-recon-beta are keg-only (they share the `js-recon`
+          # binary name with the stable formula), so brew never symlinks them
+          # into PATH. Resolve the keg path directly instead of relying on PATH.
+          KEG_BIN="$(brew --prefix)/opt/${{ matrix.formula }}/bin/js-recon"
+          if [[ -x "$KEG_BIN" ]]; then
+            echo "bin=$KEG_BIN" >> "$GITHUB_OUTPUT"
+          else
+            echo "bin=js-recon" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Verify installed version
+        run: |
+          INSTALLED=$("$BIN" -V)
+          echo "Installed: ${INSTALLED}"
+          if [[ "${{ matrix.formula }}" == "${{ steps.expected.outputs.formula }}" ]]; then
+            [[ "$INSTALLED" == *"$VERSION"* ]] || { echo "Version mismatch: expected ${VERSION} in ${{ matrix.formula }}"; exit 1; }
+          else
+            echo "Skipping version assertion — ${{ matrix.formula }} is not the channel updated by this promotion"
+          fi
+        env:
+          VERSION: ${{ inputs.version }}
+          BIN: ${{ steps.bin.outputs.bin }}
+
+      - name: Install and start vulnerable app
+        working-directory: js-recon-labs/next_js/vuln-all-rules
+        run: |
+          npm ci
+          npm run build
+          npm start &
+
+      - name: Wait for app to be ready
+        run: |
+          SECONDS=0
+          until curl -sf --max-time 2 http://localhost:3001 > /dev/null; do
+            if (( SECONDS > 60 )); then
+              echo "Timed out waiting for app to be ready"
+              exit 1
+            fi
+            sleep 2
+          done
+
+      - name: Run installed js-recon against the lab app
+        run: |
+          echo "http://localhost:3001" > /tmp/brew-smoke-urls.txt
+          "$BIN" run -u /tmp/brew-smoke-urls.txt -y -k
+        env:
+          BIN: ${{ steps.bin.outputs.bin }}
+
+      - name: Verify expected output files exist
+        run: |
+          test -n "$(find output -name analyze.json)" || { echo "analyze.json missing"; exit 1; }
+          test -n "$(find output -name js-recon.db)" || { echo "js-recon.db missing"; exit 1; }

package/.vscode/tasks.json

@@ -0,0 +1,42 @@
+{
+    "version": "2.0.0",
+    "tasks": [
+        {
+            "label": "claude-sync: sync CLAUDE.md files",
+            "type": "shell",
+            "command": "${workspaceFolder}/.claude-sync/sync.sh",
+            "runOptions": {
+                "runOn": "folderOpen"
+            },
+            "presentation": {
+                "reveal": "silent",
+                "panel": "dedicated"
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "claude-sync: watch for new CLAUDE.md files",
+            "type": "shell",
+            "command": "${workspaceFolder}/.claude-sync/watch.sh",
+            "isBackground": true,
+            "runOptions": {
+                "runOn": "folderOpen"
+            },
+            "presentation": {
+                "reveal": "silent",
+                "panel": "dedicated"
+            },
+            "problemMatcher": {
+                "pattern": {
+                    "regexp": "^(.*)$",
+                    "message": 1
+                },
+                "background": {
+                    "activeOnStart": true,
+                    "beginsPattern": "^\\[claude-sync\\] watching",
+                    "endsPattern": "^\\[claude-sync\\] watching"
+                }
+            }
+        }
+    ]
+}