@js-recon/js-recon 1.4.1-beta.1 → 1.4.1

package/.claude-sync/capture-new.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# Intercepts newly-added real CLAUDE.md files at commit time, redirects their
+# content into the sibling js-recon-agentic-files repo on the current branch,
+# and replaces them with a symlink — so they never land in this repo's history.
+set -euo pipefail
+
+JS_RECON_ROOT="$(git rev-parse --show-toplevel)"
+AGENTIC_REPO_PATH="${JSR_AGENTIC_FILES_PATH:-$JS_RECON_ROOT/../js-recon-agentic-files}"
+CURRENT_BRANCH="$(git -C "$JS_RECON_ROOT" symbolic-ref --short HEAD)"
+
+cd "$JS_RECON_ROOT"
+
+staged_real_claude_md="$(git diff --cached --name-only --diff-filter=ACM | grep -E '(^|/)CLAUDE\.md$' || true)"
+
+if [ -z "$staged_real_claude_md" ]; then
+    exit 0
+fi
+
+captured=0
+while IFS= read -r f; do
+    [ -z "$f" ] && continue
+
+    if [ -L "$f" ]; then
+        continue
+    fi
+
+    dest="$AGENTIC_REPO_PATH/$f"
+    mkdir -p "$(dirname "$dest")"
+    cp "$JS_RECON_ROOT/$f" "$dest"
+
+    (
+        cd "$AGENTIC_REPO_PATH"
+        if ! git show-ref --verify --quiet "refs/heads/$CURRENT_BRANCH"; then
+            git fetch origin --quiet || true
+            if git show-ref --verify --quiet "refs/remotes/origin/$CURRENT_BRANCH"; then
+                git checkout -q "$CURRENT_BRANCH"
+            else
+                git checkout -q -b "$CURRENT_BRANCH"
+            fi
+        else
+            git checkout -q "$CURRENT_BRANCH"
+        fi
+        git add "$f"
+        git commit -q -m "sync: capture $f from js-recon@$CURRENT_BRANCH"
+        git push -q origin "$CURRENT_BRANCH"
+    )
+
+    git reset -q HEAD -- "$f" >/dev/null 2>&1 || true
+    rm -f "$JS_RECON_ROOT/$f"
+    ln -s "$dest" "$JS_RECON_ROOT/$f"
+    echo "[claude-sync] captured $f into js-recon-agentic-files (branch $CURRENT_BRANCH), replaced with symlink"
+    captured=1
+done <<< "$staged_real_claude_md"
+
+if [ "$captured" -eq 1 ]; then
+    echo "[claude-sync] commit aborted — CLAUDE.md file(s) were redirected to js-recon-agentic-files."
+    echo "[claude-sync] please 'git add' any remaining changes and re-run 'git commit'."
+    exit 1
+fi
+
+exit 0

package/.claude-sync/capture-scan.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Walks the working tree for real (non-symlink) CLAUDE.md / .claude/skills /
+# .claude/agents files and captures each into the sibling js-recon-agentic-files
+# repo on the current branch, replacing it with a symlink. This is the primary
+# "new file" trigger — .gitignore refuses `git add` on these paths outright, so
+# a git-staged-diff-based hook (see capture-new.sh) never sees them; a
+# filesystem scan is required.
+set -euo pipefail
+
+JS_RECON_ROOT="$(git rev-parse --show-toplevel)"
+AGENTIC_REPO_PATH="${JSR_AGENTIC_FILES_PATH:-$JS_RECON_ROOT/../js-recon-agentic-files}"
+
+# Optional $1: attribute captures to this branch instead of the current HEAD.
+# Used by the post-checkout hook, which only runs *after* HEAD has already
+# moved to the new branch — git has no pre-checkout hook, so any real file
+# left over from the branch being switched away from must be attributed to
+# that branch explicitly, or it would be mis-captured onto the new branch.
+CURRENT_BRANCH="${1:-$(git -C "$JS_RECON_ROOT" symbolic-ref --short HEAD 2>/dev/null || echo "")}"
+
+if [ -z "$CURRENT_BRANCH" ] || [ ! -d "$AGENTIC_REPO_PATH/.git" ]; then
+    exit 0
+fi
+
+captured=0
+while IFS= read -r f; do
+    [ -z "$f" ] && continue
+    rel="${f#$JS_RECON_ROOT/}"
+    dest="$AGENTIC_REPO_PATH/$rel"
+
+    mkdir -p "$(dirname "$dest")"
+    cp "$f" "$dest"
+
+    (
+        cd "$AGENTIC_REPO_PATH"
+        if git show-ref --verify --quiet "refs/heads/$CURRENT_BRANCH"; then
+            git checkout -q "$CURRENT_BRANCH"
+        elif git show-ref --verify --quiet "refs/remotes/origin/$CURRENT_BRANCH"; then
+            git checkout -q "$CURRENT_BRANCH"
+        else
+            git checkout -q -b "$CURRENT_BRANCH"
+        fi
+        git add "$rel"
+        git commit -q -m "sync: capture $rel from js-recon@$CURRENT_BRANCH"
+        git push -q origin "$CURRENT_BRANCH" 2>/dev/null || echo "[claude-sync] WARNING: push failed for $rel (branch may need 'git push -u origin $CURRENT_BRANCH' manually)"
+    )
+
+    rm -f "$f"
+    ln -s "$dest" "$f"
+    echo "[claude-sync] captured $rel into js-recon-agentic-files (branch $CURRENT_BRANCH), replaced with symlink"
+    captured=1
+done < <(find "$JS_RECON_ROOT" \( -name "CLAUDE.md" -o -path "*/.claude/skills/*" -o -path "*/.claude/agents/*" \) -not -path "*/.git/*" -not -path "*/node_modules/*" -not -path "*/build/*" -not -path "$AGENTIC_REPO_PATH/*" -type f)
+
+if [ "$captured" -eq 0 ]; then
+    exit 0
+fi

package/.claude-sync/hooks/post-checkout

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# git post-checkout hook: re-syncs CLAUDE.md symlinks whenever a branch switch happens.
+prev_head="$1"
+new_head="$2"
+branch_checkout="$3"
+
+if [ "$branch_checkout" = "1" ]; then
+    ROOT="$(git rev-parse --show-toplevel)"
+    # Resolve which branch prev_head belongs to (the branch we're leaving) so any
+    # leftover real CLAUDE.md file gets attributed correctly — HEAD has already
+    # moved to the new branch by the time this hook runs, and git has no
+    # pre-checkout hook to capture beforehand.
+    prev_branch="$(git for-each-ref --points-at="$prev_head" --format='%(refname:short)' refs/heads/ 2>/dev/null | head -1)"
+    "$ROOT/.claude-sync/capture-scan.sh" "$prev_branch"
+    "$ROOT/.claude-sync/sync.sh"
+fi

package/.claude-sync/hooks/post-merge

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+# git post-merge hook: merges the corresponding js-recon-agentic-files branch
+# whenever a merge/pull brings another branch's history in here.
+exec "$(git rev-parse --show-toplevel)/.claude-sync/merge-agentic.sh" "$@"

package/.claude-sync/hooks/pre-commit

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+# git pre-commit hook: redirects newly-staged real CLAUDE.md files to js-recon-agentic-files.
+exec "$(git rev-parse --show-toplevel)/.claude-sync/capture-new.sh"

package/.claude-sync/merge-agentic.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# Mirrors a js-recon branch merge/pull onto the corresponding branches in the
+# sibling js-recon-agentic-files repo, since CLAUDE.md files are gitignored
+# symlinks here and never participate in this repo's own merges.
+set -euo pipefail
+
+JS_RECON_ROOT="$(git rev-parse --show-toplevel)"
+AGENTIC_REPO_PATH="${JSR_AGENTIC_FILES_PATH:-$JS_RECON_ROOT/../js-recon-agentic-files}"
+
+TARGET_BRANCH="$(git -C "$JS_RECON_ROOT" symbolic-ref --short HEAD 2>/dev/null || echo "")"
+
+if [ -z "$TARGET_BRANCH" ]; then
+    echo "[claude-sync] detached HEAD, skipping agentic-files merge"
+    exit 0
+fi
+
+if [ ! -d "$AGENTIC_REPO_PATH/.git" ]; then
+    echo "[claude-sync] agentic-files repo not found at $AGENTIC_REPO_PATH — see js-recon-agentic-files/README.md for setup"
+    exit 0
+fi
+
+# git gives post-merge no argument naming the branch that was merged in, and
+# this fires for both fast-forward and real merges (plus `git pull`). The
+# reflog message git writes for the merge is the one place that reliably
+# names the source branch in both cases:
+#   "merge <branch>: Fast-forward"
+#   "merge <branch>: Merge made by the 'ort' strategy."
+#   "pull <remote> <branch>: Fast-forward" (or similar, from `git pull`)
+REFLOG_MSG="$(git -C "$JS_RECON_ROOT" reflog -1 --format=%gs HEAD 2>/dev/null || echo "")"
+
+SOURCE_BRANCH=""
+if [[ "$REFLOG_MSG" =~ ^merge\ ([^:]+): ]]; then
+    SOURCE_BRANCH="${BASH_REMATCH[1]}"
+elif [[ "$REFLOG_MSG" =~ ^pull\ [^\ ]+\ ([^:]+): ]]; then
+    SOURCE_BRANCH="${BASH_REMATCH[1]}"
+fi
+
+# Strip a remote prefix (e.g. "origin/dev" -> "dev") to match agentic-files'
+# bare branch naming.
+SOURCE_BRANCH="${SOURCE_BRANCH#origin/}"
+
+if [ -z "$SOURCE_BRANCH" ]; then
+    echo "[claude-sync] could not determine merged-in branch from reflog ('$REFLOG_MSG') — skipping agentic-files merge"
+    exit 0
+fi
+
+if [ "$SOURCE_BRANCH" = "$TARGET_BRANCH" ]; then
+    exit 0
+fi
+
+(
+    cd "$AGENTIC_REPO_PATH"
+    git fetch origin --quiet
+
+    if git show-ref --verify --quiet "refs/remotes/origin/$TARGET_BRANCH"; then
+        git checkout -B "$TARGET_BRANCH" "origin/$TARGET_BRANCH" --quiet
+    else
+        echo "[claude-sync] WARNING: no 'origin/$TARGET_BRANCH' branch in agentic-files repo — skipping merge"
+        exit 0
+    fi
+
+    if ! git show-ref --verify --quiet "refs/remotes/origin/$SOURCE_BRANCH"; then
+        echo "[claude-sync] WARNING: no 'origin/$SOURCE_BRANCH' branch in agentic-files repo — nothing to merge"
+        exit 0
+    fi
+
+    if git merge --no-edit "origin/$SOURCE_BRANCH" --quiet; then
+        git push --quiet origin "$TARGET_BRANCH"
+        echo "[claude-sync] merged agentic-files '$SOURCE_BRANCH' into '$TARGET_BRANCH' and pushed"
+    else
+        git merge --abort
+        echo "[claude-sync] WARNING: merging agentic-files '$SOURCE_BRANCH' into '$TARGET_BRANCH' conflicted — aborted automatically."
+        echo "[claude-sync] resolve manually: cd $AGENTIC_REPO_PATH && git checkout $TARGET_BRANCH && git merge origin/$SOURCE_BRANCH"
+    fi
+)
+
+"$JS_RECON_ROOT/.claude-sync/sync.sh"

package/.claude-sync/setup.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# One-time collaborator setup: installs the git hooks and runs an initial sync.
+# Requires js-recon-agentic-files to already be cloned as a sibling directory
+# (../js-recon-agentic-files) or JSR_AGENTIC_FILES_PATH to point at it.
+set -euo pipefail
+
+JS_RECON_ROOT="$(git rev-parse --show-toplevel)"
+
+chmod +x "$JS_RECON_ROOT/.claude-sync/sync.sh"
+chmod +x "$JS_RECON_ROOT/.claude-sync/capture-new.sh"
+chmod +x "$JS_RECON_ROOT/.claude-sync/hooks/post-checkout"
+chmod +x "$JS_RECON_ROOT/.claude-sync/hooks/pre-commit"
+
+git -C "$JS_RECON_ROOT" config core.hooksPath .claude-sync/hooks
+
+echo "[claude-sync] hooksPath configured, running initial sync..."
+"$JS_RECON_ROOT/.claude-sync/sync.sh"

package/.claude-sync/sync.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Syncs CLAUDE.md / .claude/skills / .claude/agents symlinks from the sibling
+# js-recon-agentic-files checkout to match the currently checked-out branch of
+# this repo.
+set -euo pipefail
+
+JS_RECON_ROOT="$(git rev-parse --show-toplevel)"
+AGENTIC_REPO_PATH="${JSR_AGENTIC_FILES_PATH:-$JS_RECON_ROOT/../js-recon-agentic-files}"
+FALLBACK_BRANCH="${JSR_AGENTIC_FALLBACK_BRANCH:-dev}"
+
+CURRENT_BRANCH="$(git -C "$JS_RECON_ROOT" symbolic-ref --short HEAD 2>/dev/null || echo "")"
+
+if [ -z "$CURRENT_BRANCH" ]; then
+    echo "[claude-sync] detached HEAD, skipping sync"
+    exit 0
+fi
+
+if [ ! -d "$AGENTIC_REPO_PATH/.git" ]; then
+    echo "[claude-sync] agentic-files repo not found at $AGENTIC_REPO_PATH — see js-recon-agentic-files/README.md for setup"
+    exit 0
+fi
+
+(
+    cd "$AGENTIC_REPO_PATH"
+    git fetch origin --quiet
+
+    if git show-ref --verify --quiet "refs/remotes/origin/$CURRENT_BRANCH"; then
+        git checkout -B "$CURRENT_BRANCH" "origin/$CURRENT_BRANCH" --quiet
+    else
+        echo "[claude-sync] WARNING: no 'origin/$CURRENT_BRANCH' branch in agentic-files repo — falling back to 'origin/$FALLBACK_BRANCH'"
+        git checkout -B "$CURRENT_BRANCH" "origin/$FALLBACK_BRANCH" --quiet
+    fi
+)
+
+# 1. Remove stale symlinks that point into the agentic checkout but whose target
+#    no longer exists on this branch (e.g. switched to a branch with fewer files).
+while IFS= read -r link; do
+    target="$(readlink "$link")"
+    case "$target" in
+        "$AGENTIC_REPO_PATH"/*)
+            if [ ! -e "$target" ]; then
+                rm "$link"
+                echo "[claude-sync] removed stale symlink: ${link#$JS_RECON_ROOT/}"
+            fi
+            ;;
+    esac
+done < <(find "$JS_RECON_ROOT" -type l \( -name "CLAUDE.md" -o -path "*/.claude/skills/*" -o -path "*/.claude/agents/*" \) -not -path "*/.git/*" -not -path "*/node_modules/*" -not -path "*/build/*")
+
+# 2. Create/update symlinks for every CLAUDE.md (and .claude/skills / .claude/agents
+#    entry) present on this branch in the agentic checkout.
+while IFS= read -r src; do
+    rel="${src#$AGENTIC_REPO_PATH/}"
+    dest="$JS_RECON_ROOT/$rel"
+
+    if [ -e "$dest" ] && [ ! -L "$dest" ]; then
+        echo "[claude-sync] WARNING: $rel exists as a real (non-symlink) file — not overwriting. Stage it to trigger capture, or remove it manually."
+        continue
+    fi
+
+    mkdir -p "$(dirname "$dest")"
+    ln -sf "$src" "$dest"
+done < <(find "$AGENTIC_REPO_PATH" \( -name "CLAUDE.md" -o -path "*/.claude/skills/*" -o -path "*/.claude/agents/*" \) -type f -not -path "*/.git/*")
+
+echo "[claude-sync] synced CLAUDE.md files for branch '$CURRENT_BRANCH'"

package/.claude-sync/watch.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Background watcher intended to be run as a VS Code task (runOn: folderOpen,
+# isBackground: true). Polls for new real CLAUDE.md files every few seconds and
+# captures them immediately via capture-scan.sh, so a file created interactively
+# (e.g. by an editor or an agent session) gets redirected without waiting for the
+# next branch switch or commit.
+set -uo pipefail
+
+ROOT="$(git rev-parse --show-toplevel)"
+INTERVAL="${JSR_WATCH_INTERVAL:-3}"
+
+echo "[claude-sync] watching for new CLAUDE.md files (interval: ${INTERVAL}s)"
+
+while true; do
+    "$ROOT/.claude-sync/capture-scan.sh"
+    sleep "$INTERVAL"
+done

package/.github/workflows/build-and-prettify.yaml

@@ -169,6 +169,9 @@ jobs:
         with:
           repository: js-recon/js-recon-rules
           path: js-recon-rules
+          # Keep the checkout token out of js-recon-rules/.git/config — this
+          # context is consumed by later build/run steps (incl. Dockerfile.w-rules).
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -225,6 +228,40 @@ jobs:
           path: output/localhost_3001/analyze.json
           if-no-files-found: ignore
 
+      - name: Build the rules-bundled (-w-rules) image
+        run: docker build -f Dockerfile.w-rules --build-arg BASE_IMAGE=js-recon/js-recon -t js-recon/js-recon-w-rules .
+
+      - name: Run js-recon-w-rules via Docker against lab app (no rules mount, no -r)
+        run: |
+          set -o pipefail
+          mkdir -p output-w-rules
+          docker run --name js-recon-w-rules-run \
+            --network host \
+            --entrypoint /bin/bash \
+            js-recon/js-recon-w-rules \
+            -c 'printf "http://localhost:3001\n" > /tmp/urls.txt && node build/index.js run -u /tmp/urls.txt --no-sandbox -y -k' \
+            | tee docker-w-rules-run.log
+          docker cp js-recon-w-rules-run:/home/pptruser/output/. ./output-w-rules/ 2>/dev/null || true
+          docker rm js-recon-w-rules-run
+
+      - name: Verify the version check was actually skipped
+        run: |
+          grep -q "Rules version check disabled" docker-w-rules-run.log || {
+            echo "Expected log line confirming JS_RECON_DISABLE_RULES_VERSION_CHECK was honored not found"
+            exit 1
+          }
+
+      - name: Verify all rules fired (w-rules image)
+        run: node scripts/smoke-test.js output-w-rules/localhost_3001/analyze.json
+
+      - name: Upload w-rules analyze.json on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: analyze-json-docker-w-rules
+          path: output-w-rules/localhost_3001/analyze.json
+          if-no-files-found: ignore
+
   integration-test-macos:
     needs: build
     runs-on: macos-latest
@@ -246,6 +283,9 @@ jobs:
         with:
           repository: js-recon/js-recon-rules
           path: js-recon-rules
+          # Keep the checkout token out of js-recon-rules/.git/config — this
+          # context is consumed by later build/run steps (incl. Dockerfile.w-rules).
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

package/.github/workflows/promote-js-recon.yml

@@ -65,8 +65,14 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git add "${FORMULA}"
-          git commit -m "chore: update ${FORMULA} to ${VERSION}"
-          git push
+          # Idempotent: re-promoting an already-promoted version leaves the formula
+          # unchanged, so skip the commit/push instead of failing on "nothing to commit".
+          if git diff --cached --quiet; then
+            echo "${FORMULA} already at ${VERSION}; nothing to commit."
+          else
+            git commit -m "chore: update ${FORMULA} to ${VERSION}"
+            git push
+          fi
         env:
           VERSION: ${{ inputs.version }}
           FORMULA: ${{ steps.formula.outputs.formula }}
@@ -78,6 +84,15 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Checkout js-recon-rules
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: js-recon/js-recon-rules
+          path: js-recon-rules
+          # Don't persist the checkout token into js-recon-rules/.git/config —
+          # Dockerfile.w-rules builds from this context and would otherwise bake
+          # the writable GHCR credential into an image layer.
+          persist-credentials: false
       - uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -103,6 +118,22 @@ jobs:
         env:
           VERSION: ${{ inputs.version }}
 
+      - name: Build and push the rules-bundled (-w-rules) variant
+        run: |
+          # layer js-recon-rules on top of the image just built/pushed above
+          docker build -f Dockerfile.w-rules --build-arg BASE_IMAGE=ghcr.io/js-recon/js-recon:$VERSION -t ghcr.io/js-recon/js-recon:$VERSION-w-rules .
+
+          TAG="latest"
+          [[ "$VERSION" == *"beta"* ]] && TAG="beta"
+          [[ "$VERSION" == *"alpha"* ]] && TAG="alpha"
+
+          docker tag ghcr.io/js-recon/js-recon:$VERSION-w-rules ghcr.io/js-recon/js-recon:$TAG-w-rules
+
+          docker push ghcr.io/js-recon/js-recon:$VERSION-w-rules
+          docker push ghcr.io/js-recon/js-recon:$TAG-w-rules
+        env:
+          VERSION: ${{ inputs.version }}
+
   verify-npm-install:
     runs-on: ubuntu-latest
     permissions:
@@ -140,7 +171,7 @@ jobs:
           npm start &
 
       - name: Wait for app to be ready
-        run: timeout 60 bash -c 'until curl -sf http://localhost:3001 > /dev/null; do sleep 2; done'
+        run: timeout 60 bash -c 'until curl -sf --max-time 2 http://localhost:3001 > /dev/null; do sleep 2; done'
 
       - name: Run installed js-recon against the lab app
         run: |
@@ -194,17 +225,23 @@ jobs:
           npm start &
 
       - name: Wait for app to be ready
-        run: timeout 60 bash -c 'until curl -sf http://localhost:3001 > /dev/null; do sleep 2; done'
+        run: timeout 60 bash -c 'until curl -sf --max-time 2 http://localhost:3001 > /dev/null; do sleep 2; done'
 
       - name: Run containerized js-recon against the lab app
         run: |
+          # The release image runs as the non-root `pptruser` (see Dockerfile.release),
+          # so a bind-mounted host directory landing inside its home dir inherits the
+          # host-side owner/perms and can be unwritable to that user. Mount outside
+          # $HOME with permissive perms and point js-recon at it explicitly via `-o`
+          # rather than relying on its default CWD-relative output path.
           mkdir -p /tmp/docker-output
+          chmod 777 /tmp/docker-output
           echo "http://localhost:3001" > /tmp/docker-smoke-urls.txt
           docker run --rm --network host \
-            -v /tmp/docker-output:/app/output \
-            -v /tmp/docker-smoke-urls.txt:/app/urls.txt \
+            -v /tmp/docker-output:/tmp/js-recon-output \
+            -v /tmp/docker-smoke-urls.txt:/tmp/urls.txt \
             ghcr.io/js-recon/js-recon:${VERSION} \
-            run -u /app/urls.txt --no-sandbox -y -k
+            run -u /tmp/urls.txt -o /tmp/js-recon-output --no-sandbox -y -k
         env:
           VERSION: ${{ inputs.version }}
 
@@ -213,6 +250,72 @@ jobs:
           test -n "$(find /tmp/docker-output -name analyze.json)" || { echo "analyze.json missing"; exit 1; }
           test -n "$(find /tmp/docker-output -name js-recon.db)" || { echo "js-recon.db missing"; exit 1; }
 
+  verify-docker-w-rules-install:
+    runs-on: ubuntu-latest
+    needs: publish-ghcr
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - name: Checkout js-recon
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Checkout js-recon-labs
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: js-recon/js-recon-labs
+          path: js-recon-labs
+          persist-credentials: false
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22"
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install and start vulnerable app
+        working-directory: js-recon-labs/next_js/vuln-all-rules
+        run: |
+          npm ci
+          npm run build
+          npm start &
+
+      - name: Wait for app to be ready
+        run: timeout 60 bash -c 'until curl -sf --max-time 2 http://localhost:3001 > /dev/null; do sleep 2; done'
+
+      - name: Run the rules-bundled image against the lab app (no rules mount, no -r)
+        run: |
+          set -o pipefail
+          # Deliberately don't mount any rules directory and don't pass -r — the
+          # -w-rules image must be able to analyze using only what's baked in.
+          mkdir -p /tmp/docker-w-rules-output
+          chmod 777 /tmp/docker-w-rules-output
+          echo "http://localhost:3001" > /tmp/docker-w-rules-smoke-urls.txt
+          docker run --network host \
+            --name js-recon-w-rules-run \
+            -v /tmp/docker-w-rules-output:/tmp/js-recon-output \
+            -v /tmp/docker-w-rules-smoke-urls.txt:/tmp/urls.txt \
+            ghcr.io/js-recon/js-recon:${VERSION}-w-rules \
+            run -u /tmp/urls.txt -o /tmp/js-recon-output --no-sandbox -y -k \
+            | tee /tmp/docker-w-rules-run.log
+          docker rm js-recon-w-rules-run
+        env:
+          VERSION: ${{ inputs.version }}
+
+      - name: Verify the version check was actually skipped
+        run: |
+          grep -q "Rules version check disabled" /tmp/docker-w-rules-run.log || {
+            echo "Expected log line confirming JS_RECON_DISABLE_RULES_VERSION_CHECK was honored not found"
+            exit 1
+          }
+
+      - name: Verify all rules fired
+        run: node scripts/smoke-test.js "$(find /tmp/docker-w-rules-output -name analyze.json | head -n1)"
+
   verify-brew-install:
     runs-on: macos-latest
     needs: update-homebrew-tap
@@ -249,9 +352,22 @@ jobs:
         env:
           VERSION: ${{ inputs.version }}
 
+      - name: Resolve js-recon binary path
+        id: bin
+        run: |
+          # js-recon-alpha/js-recon-beta are keg-only (they share the `js-recon`
+          # binary name with the stable formula), so brew never symlinks them
+          # into PATH. Resolve the keg path directly instead of relying on PATH.
+          KEG_BIN="$(brew --prefix)/opt/${{ matrix.formula }}/bin/js-recon"
+          if [[ -x "$KEG_BIN" ]]; then
+            echo "bin=$KEG_BIN" >> "$GITHUB_OUTPUT"
+          else
+            echo "bin=js-recon" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Verify installed version
         run: |
-          INSTALLED=$(js-recon -V)
+          INSTALLED=$("$BIN" -V)
           echo "Installed: ${INSTALLED}"
           if [[ "${{ matrix.formula }}" == "${{ steps.expected.outputs.formula }}" ]]; then
             [[ "$INSTALLED" == *"$VERSION"* ]] || { echo "Version mismatch: expected ${VERSION} in ${{ matrix.formula }}"; exit 1; }
@@ -260,6 +376,7 @@ jobs:
           fi
         env:
           VERSION: ${{ inputs.version }}
+          BIN: ${{ steps.bin.outputs.bin }}
 
       - name: Install and start vulnerable app
         working-directory: js-recon-labs/next_js/vuln-all-rules
@@ -269,12 +386,39 @@ jobs:
           npm start &
 
       - name: Wait for app to be ready
-        run: timeout 60 bash -c 'until curl -sf http://localhost:3001 > /dev/null; do sleep 2; done'
+        run: |
+          SECONDS=0
+          until curl -sf --max-time 2 http://localhost:3001 > /dev/null; do
+            if (( SECONDS > 60 )); then
+              echo "Timed out waiting for app to be ready"
+              exit 1
+            fi
+            sleep 2
+          done
+
+      - name: Ensure a Chrome is available for Puppeteer
+        run: |
+          # The Homebrew keg ships js-recon but not a Chromium — Puppeteer needs a
+          # browser to run lazyload. Prefer the runner's pre-installed Google Chrome
+          # (present on GitHub macOS images); fall back to a Chrome-for-Testing build.
+          CHROME="/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
+          if [[ ! -x "$CHROME" ]]; then
+            echo "Pre-installed Chrome not found; downloading a Chrome-for-Testing build..."
+            CHROME="$(npx --yes @puppeteer/browsers install chrome@stable --format "{{path}}")"
+          fi
+          if [[ ! -x "$CHROME" ]]; then
+            echo "Resolved Chrome path is not executable: $CHROME"
+            exit 1
+          fi
+          echo "Using Chrome at: $CHROME"
+          echo "PUPPETEER_EXECUTABLE_PATH=$CHROME" >> "$GITHUB_ENV"
 
       - name: Run installed js-recon against the lab app
         run: |
           echo "http://localhost:3001" > /tmp/brew-smoke-urls.txt
-          js-recon run -u /tmp/brew-smoke-urls.txt -y -k
+          "$BIN" run -u /tmp/brew-smoke-urls.txt -y -k
+        env:
+          BIN: ${{ steps.bin.outputs.bin }}
 
       - name: Verify expected output files exist
         run: |

package/.vscode/tasks.json

@@ -0,0 +1,42 @@
+{
+    "version": "2.0.0",
+    "tasks": [
+        {
+            "label": "claude-sync: sync CLAUDE.md files",
+            "type": "shell",
+            "command": "${workspaceFolder}/.claude-sync/sync.sh",
+            "runOptions": {
+                "runOn": "folderOpen"
+            },
+            "presentation": {
+                "reveal": "silent",
+                "panel": "dedicated"
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "claude-sync: watch for new CLAUDE.md files",
+            "type": "shell",
+            "command": "${workspaceFolder}/.claude-sync/watch.sh",
+            "isBackground": true,
+            "runOptions": {
+                "runOn": "folderOpen"
+            },
+            "presentation": {
+                "reveal": "silent",
+                "panel": "dedicated"
+            },
+            "problemMatcher": {
+                "pattern": {
+                    "regexp": "^(.*)$",
+                    "message": 1
+                },
+                "background": {
+                    "activeOnStart": true,
+                    "beginsPattern": "^\\[claude-sync\\] watching",
+                    "endsPattern": "^\\[claude-sync\\] watching"
+                }
+            }
+        }
+    ]
+}