@js-recon/js-recon 1.4.1-beta.1 → 1.4.1-beta.2

package/.claude-sync/capture-new.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# Intercepts newly-added real CLAUDE.md files at commit time, redirects their
+# content into the sibling js-recon-agentic-files repo on the current branch,
+# and replaces them with a symlink — so they never land in this repo's history.
+set -euo pipefail
+
+JS_RECON_ROOT="$(git rev-parse --show-toplevel)"
+AGENTIC_REPO_PATH="${JSR_AGENTIC_FILES_PATH:-$JS_RECON_ROOT/../js-recon-agentic-files}"
+CURRENT_BRANCH="$(git -C "$JS_RECON_ROOT" symbolic-ref --short HEAD)"
+
+cd "$JS_RECON_ROOT"
+
+staged_real_claude_md="$(git diff --cached --name-only --diff-filter=ACM | grep -E '(^|/)CLAUDE\.md$' || true)"
+
+if [ -z "$staged_real_claude_md" ]; then
+    exit 0
+fi
+
+captured=0
+while IFS= read -r f; do
+    [ -z "$f" ] && continue
+
+    if [ -L "$f" ]; then
+        continue
+    fi
+
+    dest="$AGENTIC_REPO_PATH/$f"
+    mkdir -p "$(dirname "$dest")"
+    cp "$JS_RECON_ROOT/$f" "$dest"
+
+    (
+        cd "$AGENTIC_REPO_PATH"
+        if ! git show-ref --verify --quiet "refs/heads/$CURRENT_BRANCH"; then
+            git fetch origin --quiet || true
+            if git show-ref --verify --quiet "refs/remotes/origin/$CURRENT_BRANCH"; then
+                git checkout -q "$CURRENT_BRANCH"
+            else
+                git checkout -q -b "$CURRENT_BRANCH"
+            fi
+        else
+            git checkout -q "$CURRENT_BRANCH"
+        fi
+        git add "$f"
+        git commit -q -m "sync: capture $f from js-recon@$CURRENT_BRANCH"
+        git push -q origin "$CURRENT_BRANCH"
+    )
+
+    git reset -q HEAD -- "$f" >/dev/null 2>&1 || true
+    rm -f "$JS_RECON_ROOT/$f"
+    ln -s "$dest" "$JS_RECON_ROOT/$f"
+    echo "[claude-sync] captured $f into js-recon-agentic-files (branch $CURRENT_BRANCH), replaced with symlink"
+    captured=1
+done <<< "$staged_real_claude_md"
+
+if [ "$captured" -eq 1 ]; then
+    echo "[claude-sync] commit aborted — CLAUDE.md file(s) were redirected to js-recon-agentic-files."
+    echo "[claude-sync] please 'git add' any remaining changes and re-run 'git commit'."
+    exit 1
+fi
+
+exit 0

package/.claude-sync/capture-scan.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Walks the working tree for real (non-symlink) CLAUDE.md / .claude/skills /
+# .claude/agents files and captures each into the sibling js-recon-agentic-files
+# repo on the current branch, replacing it with a symlink. This is the primary
+# "new file" trigger — .gitignore refuses `git add` on these paths outright, so
+# a git-staged-diff-based hook (see capture-new.sh) never sees them; a
+# filesystem scan is required.
+set -euo pipefail
+
+JS_RECON_ROOT="$(git rev-parse --show-toplevel)"
+AGENTIC_REPO_PATH="${JSR_AGENTIC_FILES_PATH:-$JS_RECON_ROOT/../js-recon-agentic-files}"
+
+# Optional $1: attribute captures to this branch instead of the current HEAD.
+# Used by the post-checkout hook, which only runs *after* HEAD has already
+# moved to the new branch — git has no pre-checkout hook, so any real file
+# left over from the branch being switched away from must be attributed to
+# that branch explicitly, or it would be mis-captured onto the new branch.
+CURRENT_BRANCH="${1:-$(git -C "$JS_RECON_ROOT" symbolic-ref --short HEAD 2>/dev/null || echo "")}"
+
+if [ -z "$CURRENT_BRANCH" ] || [ ! -d "$AGENTIC_REPO_PATH/.git" ]; then
+    exit 0
+fi
+
+captured=0
+while IFS= read -r f; do
+    [ -z "$f" ] && continue
+    rel="${f#$JS_RECON_ROOT/}"
+    dest="$AGENTIC_REPO_PATH/$rel"
+
+    mkdir -p "$(dirname "$dest")"
+    cp "$f" "$dest"
+
+    (
+        cd "$AGENTIC_REPO_PATH"
+        if git show-ref --verify --quiet "refs/heads/$CURRENT_BRANCH"; then
+            git checkout -q "$CURRENT_BRANCH"
+        elif git show-ref --verify --quiet "refs/remotes/origin/$CURRENT_BRANCH"; then
+            git checkout -q "$CURRENT_BRANCH"
+        else
+            git checkout -q -b "$CURRENT_BRANCH"
+        fi
+        git add "$rel"
+        git commit -q -m "sync: capture $rel from js-recon@$CURRENT_BRANCH"
+        git push -q origin "$CURRENT_BRANCH" 2>/dev/null || echo "[claude-sync] WARNING: push failed for $rel (branch may need 'git push -u origin $CURRENT_BRANCH' manually)"
+    )
+
+    rm -f "$f"
+    ln -s "$dest" "$f"
+    echo "[claude-sync] captured $rel into js-recon-agentic-files (branch $CURRENT_BRANCH), replaced with symlink"
+    captured=1
+done < <(find "$JS_RECON_ROOT" \( -name "CLAUDE.md" -o -path "*/.claude/skills/*" -o -path "*/.claude/agents/*" \) -not -path "*/.git/*" -not -path "*/node_modules/*" -not -path "*/build/*" -not -path "$AGENTIC_REPO_PATH/*" -type f)
+
+if [ "$captured" -eq 0 ]; then
+    exit 0
+fi

package/.claude-sync/hooks/post-checkout

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# git post-checkout hook: re-syncs CLAUDE.md symlinks whenever a branch switch happens.
+prev_head="$1"
+new_head="$2"
+branch_checkout="$3"
+
+if [ "$branch_checkout" = "1" ]; then
+    ROOT="$(git rev-parse --show-toplevel)"
+    # Resolve which branch prev_head belongs to (the branch we're leaving) so any
+    # leftover real CLAUDE.md file gets attributed correctly — HEAD has already
+    # moved to the new branch by the time this hook runs, and git has no
+    # pre-checkout hook to capture beforehand.
+    prev_branch="$(git for-each-ref --points-at="$prev_head" --format='%(refname:short)' refs/heads/ 2>/dev/null | head -1)"
+    "$ROOT/.claude-sync/capture-scan.sh" "$prev_branch"
+    "$ROOT/.claude-sync/sync.sh"
+fi

package/.claude-sync/hooks/pre-commit

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+# git pre-commit hook: redirects newly-staged real CLAUDE.md files to js-recon-agentic-files.
+exec "$(git rev-parse --show-toplevel)/.claude-sync/capture-new.sh"

package/.claude-sync/setup.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# One-time collaborator setup: installs the git hooks and runs an initial sync.
+# Requires js-recon-agentic-files to already be cloned as a sibling directory
+# (../js-recon-agentic-files) or JSR_AGENTIC_FILES_PATH to point at it.
+set -euo pipefail
+
+JS_RECON_ROOT="$(git rev-parse --show-toplevel)"
+
+chmod +x "$JS_RECON_ROOT/.claude-sync/sync.sh"
+chmod +x "$JS_RECON_ROOT/.claude-sync/capture-new.sh"
+chmod +x "$JS_RECON_ROOT/.claude-sync/hooks/post-checkout"
+chmod +x "$JS_RECON_ROOT/.claude-sync/hooks/pre-commit"
+
+git -C "$JS_RECON_ROOT" config core.hooksPath .claude-sync/hooks
+
+echo "[claude-sync] hooksPath configured, running initial sync..."
+"$JS_RECON_ROOT/.claude-sync/sync.sh"

package/.claude-sync/sync.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Syncs CLAUDE.md / .claude/skills / .claude/agents symlinks from the sibling
+# js-recon-agentic-files checkout to match the currently checked-out branch of
+# this repo.
+set -euo pipefail
+
+JS_RECON_ROOT="$(git rev-parse --show-toplevel)"
+AGENTIC_REPO_PATH="${JSR_AGENTIC_FILES_PATH:-$JS_RECON_ROOT/../js-recon-agentic-files}"
+FALLBACK_BRANCH="${JSR_AGENTIC_FALLBACK_BRANCH:-dev}"
+
+CURRENT_BRANCH="$(git -C "$JS_RECON_ROOT" symbolic-ref --short HEAD 2>/dev/null || echo "")"
+
+if [ -z "$CURRENT_BRANCH" ]; then
+    echo "[claude-sync] detached HEAD, skipping sync"
+    exit 0
+fi
+
+if [ ! -d "$AGENTIC_REPO_PATH/.git" ]; then
+    echo "[claude-sync] agentic-files repo not found at $AGENTIC_REPO_PATH — see js-recon-agentic-files/README.md for setup"
+    exit 0
+fi
+
+(
+    cd "$AGENTIC_REPO_PATH"
+    git fetch origin --quiet
+
+    if git show-ref --verify --quiet "refs/remotes/origin/$CURRENT_BRANCH"; then
+        git checkout -B "$CURRENT_BRANCH" "origin/$CURRENT_BRANCH" --quiet
+    else
+        echo "[claude-sync] WARNING: no 'origin/$CURRENT_BRANCH' branch in agentic-files repo — falling back to 'origin/$FALLBACK_BRANCH'"
+        git checkout -B "$CURRENT_BRANCH" "origin/$FALLBACK_BRANCH" --quiet
+    fi
+)
+
+# 1. Remove stale symlinks that point into the agentic checkout but whose target
+#    no longer exists on this branch (e.g. switched to a branch with fewer files).
+while IFS= read -r link; do
+    target="$(readlink "$link")"
+    case "$target" in
+        "$AGENTIC_REPO_PATH"/*)
+            if [ ! -e "$target" ]; then
+                rm "$link"
+                echo "[claude-sync] removed stale symlink: ${link#$JS_RECON_ROOT/}"
+            fi
+            ;;
+    esac
+done < <(find "$JS_RECON_ROOT" -type l \( -name "CLAUDE.md" -o -path "*/.claude/skills/*" -o -path "*/.claude/agents/*" \) -not -path "*/.git/*" -not -path "*/node_modules/*" -not -path "*/build/*")
+
+# 2. Create/update symlinks for every CLAUDE.md (and .claude/skills / .claude/agents
+#    entry) present on this branch in the agentic checkout.
+while IFS= read -r src; do
+    rel="${src#$AGENTIC_REPO_PATH/}"
+    dest="$JS_RECON_ROOT/$rel"
+
+    if [ -e "$dest" ] && [ ! -L "$dest" ]; then
+        echo "[claude-sync] WARNING: $rel exists as a real (non-symlink) file — not overwriting. Stage it to trigger capture, or remove it manually."
+        continue
+    fi
+
+    mkdir -p "$(dirname "$dest")"
+    ln -sf "$src" "$dest"
+done < <(find "$AGENTIC_REPO_PATH" \( -name "CLAUDE.md" -o -path "*/.claude/skills/*" -o -path "*/.claude/agents/*" \) -type f -not -path "*/.git/*")
+
+echo "[claude-sync] synced CLAUDE.md files for branch '$CURRENT_BRANCH'"

package/.claude-sync/watch.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Background watcher intended to be run as a VS Code task (runOn: folderOpen,
+# isBackground: true). Polls for new real CLAUDE.md files every few seconds and
+# captures them immediately via capture-scan.sh, so a file created interactively
+# (e.g. by an editor or an agent session) gets redirected without waiting for the
+# next branch switch or commit.
+set -uo pipefail
+
+ROOT="$(git rev-parse --show-toplevel)"
+INTERVAL="${JSR_WATCH_INTERVAL:-3}"
+
+echo "[claude-sync] watching for new CLAUDE.md files (interval: ${INTERVAL}s)"
+
+while true; do
+    "$ROOT/.claude-sync/capture-scan.sh"
+    sleep "$INTERVAL"
+done

package/.github/workflows/build-and-prettify.yaml

@@ -169,6 +169,9 @@ jobs:
         with:
           repository: js-recon/js-recon-rules
           path: js-recon-rules
+          # Keep the checkout token out of js-recon-rules/.git/config — this
+          # context is consumed by later build/run steps (incl. Dockerfile.w-rules).
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -225,6 +228,40 @@ jobs:
           path: output/localhost_3001/analyze.json
           if-no-files-found: ignore
 
+      - name: Build the rules-bundled (-w-rules) image
+        run: docker build -f Dockerfile.w-rules --build-arg BASE_IMAGE=js-recon/js-recon -t js-recon/js-recon-w-rules .
+
+      - name: Run js-recon-w-rules via Docker against lab app (no rules mount, no -r)
+        run: |
+          set -o pipefail
+          mkdir -p output-w-rules
+          docker run --name js-recon-w-rules-run \
+            --network host \
+            --entrypoint /bin/bash \
+            js-recon/js-recon-w-rules \
+            -c 'printf "http://localhost:3001\n" > /tmp/urls.txt && node build/index.js run -u /tmp/urls.txt --no-sandbox -y -k' \
+            | tee docker-w-rules-run.log
+          docker cp js-recon-w-rules-run:/home/pptruser/output/. ./output-w-rules/ 2>/dev/null || true
+          docker rm js-recon-w-rules-run
+
+      - name: Verify the version check was actually skipped
+        run: |
+          grep -q "Rules version check disabled" docker-w-rules-run.log || {
+            echo "Expected log line confirming JS_RECON_DISABLE_RULES_VERSION_CHECK was honored not found"
+            exit 1
+          }
+
+      - name: Verify all rules fired (w-rules image)
+        run: node scripts/smoke-test.js output-w-rules/localhost_3001/analyze.json
+
+      - name: Upload w-rules analyze.json on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: analyze-json-docker-w-rules
+          path: output-w-rules/localhost_3001/analyze.json
+          if-no-files-found: ignore
+
   integration-test-macos:
     needs: build
     runs-on: macos-latest
@@ -246,6 +283,9 @@ jobs:
         with:
           repository: js-recon/js-recon-rules
           path: js-recon-rules
+          # Keep the checkout token out of js-recon-rules/.git/config — this
+          # context is consumed by later build/run steps (incl. Dockerfile.w-rules).
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

package/.github/workflows/promote-js-recon.yml

@@ -78,6 +78,15 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Checkout js-recon-rules
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: js-recon/js-recon-rules
+          path: js-recon-rules
+          # Don't persist the checkout token into js-recon-rules/.git/config —
+          # Dockerfile.w-rules builds from this context and would otherwise bake
+          # the writable GHCR credential into an image layer.
+          persist-credentials: false
       - uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -103,6 +112,22 @@ jobs:
         env:
           VERSION: ${{ inputs.version }}
 
+      - name: Build and push the rules-bundled (-w-rules) variant
+        run: |
+          # layer js-recon-rules on top of the image just built/pushed above
+          docker build -f Dockerfile.w-rules --build-arg BASE_IMAGE=ghcr.io/js-recon/js-recon:$VERSION -t ghcr.io/js-recon/js-recon:$VERSION-w-rules .
+
+          TAG="latest"
+          [[ "$VERSION" == *"beta"* ]] && TAG="beta"
+          [[ "$VERSION" == *"alpha"* ]] && TAG="alpha"
+
+          docker tag ghcr.io/js-recon/js-recon:$VERSION-w-rules ghcr.io/js-recon/js-recon:$TAG-w-rules
+
+          docker push ghcr.io/js-recon/js-recon:$VERSION-w-rules
+          docker push ghcr.io/js-recon/js-recon:$TAG-w-rules
+        env:
+          VERSION: ${{ inputs.version }}
+
   verify-npm-install:
     runs-on: ubuntu-latest
     permissions:
@@ -140,7 +165,7 @@ jobs:
           npm start &
 
       - name: Wait for app to be ready
-        run: timeout 60 bash -c 'until curl -sf http://localhost:3001 > /dev/null; do sleep 2; done'
+        run: timeout 60 bash -c 'until curl -sf --max-time 2 http://localhost:3001 > /dev/null; do sleep 2; done'
 
       - name: Run installed js-recon against the lab app
         run: |
@@ -194,17 +219,23 @@ jobs:
           npm start &
 
       - name: Wait for app to be ready
-        run: timeout 60 bash -c 'until curl -sf http://localhost:3001 > /dev/null; do sleep 2; done'
+        run: timeout 60 bash -c 'until curl -sf --max-time 2 http://localhost:3001 > /dev/null; do sleep 2; done'
 
       - name: Run containerized js-recon against the lab app
         run: |
+          # The release image runs as the non-root `pptruser` (see Dockerfile.release),
+          # so a bind-mounted host directory landing inside its home dir inherits the
+          # host-side owner/perms and can be unwritable to that user. Mount outside
+          # $HOME with permissive perms and point js-recon at it explicitly via `-o`
+          # rather than relying on its default CWD-relative output path.
           mkdir -p /tmp/docker-output
+          chmod 777 /tmp/docker-output
           echo "http://localhost:3001" > /tmp/docker-smoke-urls.txt
           docker run --rm --network host \
-            -v /tmp/docker-output:/app/output \
-            -v /tmp/docker-smoke-urls.txt:/app/urls.txt \
+            -v /tmp/docker-output:/tmp/js-recon-output \
+            -v /tmp/docker-smoke-urls.txt:/tmp/urls.txt \
             ghcr.io/js-recon/js-recon:${VERSION} \
-            run -u /app/urls.txt --no-sandbox -y -k
+            run -u /tmp/urls.txt -o /tmp/js-recon-output --no-sandbox -y -k
         env:
           VERSION: ${{ inputs.version }}
 
@@ -213,6 +244,72 @@ jobs:
           test -n "$(find /tmp/docker-output -name analyze.json)" || { echo "analyze.json missing"; exit 1; }
           test -n "$(find /tmp/docker-output -name js-recon.db)" || { echo "js-recon.db missing"; exit 1; }
 
+  verify-docker-w-rules-install:
+    runs-on: ubuntu-latest
+    needs: publish-ghcr
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - name: Checkout js-recon
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Checkout js-recon-labs
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: js-recon/js-recon-labs
+          path: js-recon-labs
+          persist-credentials: false
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22"
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install and start vulnerable app
+        working-directory: js-recon-labs/next_js/vuln-all-rules
+        run: |
+          npm ci
+          npm run build
+          npm start &
+
+      - name: Wait for app to be ready
+        run: timeout 60 bash -c 'until curl -sf --max-time 2 http://localhost:3001 > /dev/null; do sleep 2; done'
+
+      - name: Run the rules-bundled image against the lab app (no rules mount, no -r)
+        run: |
+          set -o pipefail
+          # Deliberately don't mount any rules directory and don't pass -r — the
+          # -w-rules image must be able to analyze using only what's baked in.
+          mkdir -p /tmp/docker-w-rules-output
+          chmod 777 /tmp/docker-w-rules-output
+          echo "http://localhost:3001" > /tmp/docker-w-rules-smoke-urls.txt
+          docker run --network host \
+            --name js-recon-w-rules-run \
+            -v /tmp/docker-w-rules-output:/tmp/js-recon-output \
+            -v /tmp/docker-w-rules-smoke-urls.txt:/tmp/urls.txt \
+            ghcr.io/js-recon/js-recon:${VERSION}-w-rules \
+            run -u /tmp/urls.txt -o /tmp/js-recon-output --no-sandbox -y -k \
+            | tee /tmp/docker-w-rules-run.log
+          docker rm js-recon-w-rules-run
+        env:
+          VERSION: ${{ inputs.version }}
+
+      - name: Verify the version check was actually skipped
+        run: |
+          grep -q "Rules version check disabled" /tmp/docker-w-rules-run.log || {
+            echo "Expected log line confirming JS_RECON_DISABLE_RULES_VERSION_CHECK was honored not found"
+            exit 1
+          }
+
+      - name: Verify all rules fired
+        run: node scripts/smoke-test.js "$(find /tmp/docker-w-rules-output -name analyze.json | head -n1)"
+
   verify-brew-install:
     runs-on: macos-latest
     needs: update-homebrew-tap
@@ -249,9 +346,22 @@ jobs:
         env:
           VERSION: ${{ inputs.version }}
 
+      - name: Resolve js-recon binary path
+        id: bin
+        run: |
+          # js-recon-alpha/js-recon-beta are keg-only (they share the `js-recon`
+          # binary name with the stable formula), so brew never symlinks them
+          # into PATH. Resolve the keg path directly instead of relying on PATH.
+          KEG_BIN="$(brew --prefix)/opt/${{ matrix.formula }}/bin/js-recon"
+          if [[ -x "$KEG_BIN" ]]; then
+            echo "bin=$KEG_BIN" >> "$GITHUB_OUTPUT"
+          else
+            echo "bin=js-recon" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Verify installed version
         run: |
-          INSTALLED=$(js-recon -V)
+          INSTALLED=$("$BIN" -V)
           echo "Installed: ${INSTALLED}"
           if [[ "${{ matrix.formula }}" == "${{ steps.expected.outputs.formula }}" ]]; then
             [[ "$INSTALLED" == *"$VERSION"* ]] || { echo "Version mismatch: expected ${VERSION} in ${{ matrix.formula }}"; exit 1; }
@@ -260,6 +370,7 @@ jobs:
           fi
         env:
           VERSION: ${{ inputs.version }}
+          BIN: ${{ steps.bin.outputs.bin }}
 
       - name: Install and start vulnerable app
         working-directory: js-recon-labs/next_js/vuln-all-rules
@@ -269,12 +380,22 @@ jobs:
           npm start &
 
       - name: Wait for app to be ready
-        run: timeout 60 bash -c 'until curl -sf http://localhost:3001 > /dev/null; do sleep 2; done'
+        run: |
+          SECONDS=0
+          until curl -sf --max-time 2 http://localhost:3001 > /dev/null; do
+            if (( SECONDS > 60 )); then
+              echo "Timed out waiting for app to be ready"
+              exit 1
+            fi
+            sleep 2
+          done
 
       - name: Run installed js-recon against the lab app
         run: |
           echo "http://localhost:3001" > /tmp/brew-smoke-urls.txt
-          js-recon run -u /tmp/brew-smoke-urls.txt -y -k
+          "$BIN" run -u /tmp/brew-smoke-urls.txt -y -k
+        env:
+          BIN: ${{ steps.bin.outputs.bin }}
 
       - name: Verify expected output files exist
         run: |

package/.vscode/tasks.json

@@ -0,0 +1,42 @@
+{
+    "version": "2.0.0",
+    "tasks": [
+        {
+            "label": "claude-sync: sync CLAUDE.md files",
+            "type": "shell",
+            "command": "${workspaceFolder}/.claude-sync/sync.sh",
+            "runOptions": {
+                "runOn": "folderOpen"
+            },
+            "presentation": {
+                "reveal": "silent",
+                "panel": "dedicated"
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "claude-sync: watch for new CLAUDE.md files",
+            "type": "shell",
+            "command": "${workspaceFolder}/.claude-sync/watch.sh",
+            "isBackground": true,
+            "runOptions": {
+                "runOn": "folderOpen"
+            },
+            "presentation": {
+                "reveal": "silent",
+                "panel": "dedicated"
+            },
+            "problemMatcher": {
+                "pattern": {
+                    "regexp": "^(.*)$",
+                    "message": 1
+                },
+                "background": {
+                    "activeOnStart": true,
+                    "beginsPattern": "^\\[claude-sync\\] watching",
+                    "endsPattern": "^\\[claude-sync\\] watching"
+                }
+            }
+        }
+    ]
+}

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Change Log
 
+## 1.4.1-beta.2 - 2026-07-22
+
+### Added
+
+- The `api-gateway` module has been renamed to **`proxy`** and now supports three outbound-proxy methods: AWS API Gateway IP rotation (as before), generic SOCKS5/HTTP proxies, and Oxylabs. Proxy setup is driven by an interactive configuration wizard, and `lazyload`/`run` now consume proxy settings exclusively from the generated config file (`proxy_config.json`). Proxy request logic is centralized in `makeReq.ts`. (`proxy`, `lazyload`, `run`)
+- `analyze`: added a `--disable-rules-version-check` flag (and a corresponding `JS_RECON_DISABLE_RULES_VERSION_CHECK` environment variable) so the rules version-compatibility check can be skipped. A new rules-bundled Docker image variant (`ghcr.io/js-recon/js-recon:<version>-w-rules`) ships with `js-recon-rules` baked in, allowing `analyze` to run without a rules mount or `-r` flag. (`analyze`, `docker`)
+- `run`: added `--disable-refactor` flag to skip the automatic bundler-detection and refactor step that otherwise runs after `report`. (`run`)
+- `run` (batch mode, `-u <file>`): each domain still gets its own `<output>/<host>/js-recon.db`, but a combined `<output>/js-recon.db` is now also maintained across the whole batch, so findings/endpoints/mapped chunks can be queried across every target without opening each per-domain database individually. Every table in the combined database gains a `domain` column (the sanitized host, doubling as a foreign key back to the corresponding output directory), and primary keys that were only unique within a single domain (`mapped`'s chunk `id`, `mapped_openapi`'s `(path, method)`, `endpoints`' `url`) are widened or replaced with an autoincrement `globalId` so rows from different domains never collide. (`run`, `report`)
+
+### Fixed
+
+- Tech detection's intercepted-URL fallback (`techDetect/index.ts`) accepted a framework-shaped URL path (e.g. `/_nuxt/`, `/_next/`) as detection evidence without checking its actual response. A framework-shaped path resolving to a non-JS response (e.g. an error/maintenance page) could mis-fingerprint the whole target and send it down the wrong per-framework pipeline. The fallback now also confirms the captured response is a genuine 2xx JS response (status + `Content-Type` + body shape) before accepting the match. (`lazyload`)
+- `proxy`: corrected the Oxylabs method to use the datacenter proxy scheme (verified against a live account); the module now fails cleanly on a malformed proxy config or URL, warns on a malformed config parse, and exits with an error when AWS credentials are missing for `-l`/`-d`. (`proxy`)
+- `run`: replaced a fragile `@ts-ignore` on the final `analyze()` call with an explicit cast, and the Ctrl-C interrupt menu now waits for user input instead of exiting immediately. (`run`)
+- Suppressed the misleading suggestion to pass `-k` when SSL verification is already disabled. (`run`, `lazyload`)
+- Resolved npm-audit advisories: a path-traversal advisory in `@hono/node-server`, plus `fast-uri`/`hono` and `body-parser`/`brace-expansion` advisories. (`deps`)
+
 ## 1.4.1-beta.1 - 2026-07-16
 
 ### Fixed

package/Dockerfile.w-rules

@@ -0,0 +1,13 @@
+ARG BASE_IMAGE=js-recon/js-recon
+FROM ${BASE_IMAGE}
+
+USER root
+COPY js-recon-rules/ /home/pptruser/.js-recon/rules/
+RUN rm -rf /home/pptruser/.js-recon/rules/.github && \
+    if [ -d /home/pptruser/.js-recon/rules/skills ]; then \
+        mv /home/pptruser/.js-recon/rules/skills /home/pptruser/.js-recon/skills; \
+    fi && \
+    chown -R pptruser:pptruser /home/pptruser/.js-recon
+USER pptruser
+
+ENV JS_RECON_DISABLE_RULES_VERSION_CHECK=true

package/README.md

@@ -84,7 +84,7 @@ js-recon run -u https://app.example.com
 | `endpoints`   | Extracts API endpoints and client-side paths from JS files.                      | [Read Docs](https://js-recon.io/docs/docs/modules/endpoints)   |
 | `strings`     | Extracts strings, URLs, and potential secrets from JS files.                     | [Read Docs](https://js-recon.io/docs/docs/modules/strings)     |
 | `map`         | Maps function calls and analyzes code, with optional AI-powered descriptions.    | [Read Docs](https://js-recon.io/docs/docs/modules/map)         |
-| `api-gateway` | Manages AWS API Gateway for IP rotation to bypass rate limits.                   | [Read Docs](https://js-recon.io/docs/docs/modules/api-gateway) |
+| `proxy`       | Routes requests through AWS API Gateway, SOCKS5/HTTP, or Oxylabs proxies.        | [Read Docs](https://js-recon.io/docs/docs/modules/proxy)       |
 | `run`         | Runs all analysis modules automatically on a target.                             | [Read Docs](https://js-recon.io/docs/docs/modules/run)         |
 | `analyze`     | Analyzes the code.                                                               | [Read Docs](https://js-recon.io/docs/docs/modules/analyze)     |
 | `report`      | Generates a report from the analysis modules.                                    | [Read Docs](https://js-recon.io/docs/docs/modules/report)      |