@js-recon/js-recon 1.4.4 → 2.0.1-alpha.2

package/build/utility/progressLog.js

@@ -7,6 +7,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+import { printMsg, MSG } from "./printMsg.js";
 /**
  * Computes a progress bar width that fits within the current terminal.
  * @param formatOverhead Total visible characters in the format string excluding the bar itself
@@ -86,7 +87,7 @@ export const progressLog = (message) => {
         activeBarLogger.log(message + "\n");
     }
     else {
-        console.log(message);
+        printMsg(MSG.Plain, message);
     }
 };
 export const progressError = (message) => {
@@ -95,7 +96,7 @@ export const progressError = (message) => {
         activeBarLogger.log(message + "\n");
     }
     else {
-        console.error(message);
+        printMsg(MSG.Err, message);
     }
 };
 export const progressWarn = (message) => {
@@ -104,7 +105,7 @@ export const progressWarn = (message) => {
         activeBarLogger.log(message + "\n");
     }
     else {
-        console.warn(message);
+        printMsg(MSG.Warn, message);
     }
 };
 //# sourceMappingURL=progressLog.js.map

package/build/utility/progressLog.js.map

@@ -1 +1 @@
-{"version":3,"file":"progressLog.js","sourceRoot":"","sources":["../../src/utility/progressLog.ts"],"names":[],"mappings":";;;;;;;;;AAmBA;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,cAAsB,EAAU,EAAE;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,GAAG,cAAc,CAAC,CAAC;AAC/C,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAqC,EAAE,QAAgB,EAAgB,EAAE;IACpG,wEAAwE;IACxE,0EAA0E;IAC1E,+CAA+C;IAC/C,MAAM,OAAO,GAAI,GAA4B,CAAC,OAAO,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG,EAAE;QACjB,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACzC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;QAE1B,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,CAAC,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO,CAAC,mBAAmB,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAChF,CAAC;IACL,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC,CAAC;AAEF,IAAI,gBAAgB,GAAmC,EAAE,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAiB,EAAE,UAAmB,IAAI,EAAgB,EAAE;IAC1F,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IAErC,MAAM,KAAK,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACxC,gBAAgB,GAAG,CAAC,GAAG,gBAAgB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAE5D,OAAO,GAAG,EAAE;QACR,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACjF,CAAC,CAAC;AACN,CAAC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,YAAuC,EAAQ,EAAE;IACzF,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACjC,IAAI,CAAC;YACD,OAAO,EAAE,CAAC;QACd,CAAC;QAAC,WAAM,CAAC;YACL,6DAA6D;YAC7D,+CAA+C;QACnD,CAAC;IACL,CAAC;AACL,CAAC,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACjC,IAAsB,EACtB,GAAG,YAAuC,EAChC,EAAE;IACZ,IAAI,CAAC;QACD,OAAO,MAAM,IAAI,EAAE,CAAC;IACxB,CAAC;YAAS,CAAC;QACP,wBAAwB,CAAC,GAAG,YAAY,CAAC,CAAC;IAC9C,CAAC;AACL,CAAC,CAAA,CAAC;AAEF,MAAM,kBAAkB,GAAG,GAA0B,EAAE,WAAC,OAAA,MAAA,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,0CAAE,MAAM,CAAA,EAAA,CAAC;AAE9G,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAQ,EAAE;IACjD,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,IAAI,eAAe,EAAE,CAAC;QAClB,eAAe,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAQ,EAAE;IACnD,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,IAAI,eAAe,EAAE,CAAC;QAClB,eAAe,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAQ,EAAE;IAClD,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,IAAI,eAAe,EAAE,CAAC;QAClB,eAAe,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;AACL,CAAC,CAAC"}
+{"version":3,"file":"progressLog.js","sourceRoot":"","sources":["../../src/utility/progressLog.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAmB9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,cAAsB,EAAU,EAAE;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,GAAG,cAAc,CAAC,CAAC;AAC/C,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAqC,EAAE,QAAgB,EAAgB,EAAE;IACpG,wEAAwE;IACxE,0EAA0E;IAC1E,+CAA+C;IAC/C,MAAM,OAAO,GAAI,GAA4B,CAAC,OAAO,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG,EAAE;QACjB,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACzC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;QAE1B,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,CAAC,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO,CAAC,mBAAmB,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAChF,CAAC;IACL,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC,CAAC;AAEF,IAAI,gBAAgB,GAAmC,EAAE,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAiB,EAAE,UAAmB,IAAI,EAAgB,EAAE;IAC1F,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IAErC,MAAM,KAAK,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACxC,gBAAgB,GAAG,CAAC,GAAG,gBAAgB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAE5D,OAAO,GAAG,EAAE;QACR,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACjF,CAAC,CAAC;AACN,CAAC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,YAAuC,EAAQ,EAAE;IACzF,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACjC,IAAI,CAAC;YACD,OAAO,EAAE,CAAC;QACd,CAAC;QAAC,WAAM,CAAC;YACL,6DAA6D;YAC7D,+CAA+C;QACnD,CAAC;IACL,CAAC;AACL,CAAC,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACjC,IAAsB,EACtB,GAAG,YAAuC,EAChC,EAAE;IACZ,IAAI,CAAC;QACD,OAAO,MAAM,IAAI,EAAE,CAAC;IACxB,CAAC;YAAS,CAAC;QACP,wBAAwB,CAAC,GAAG,YAAY,CAAC,CAAC;IAC9C,CAAC;AACL,CAAC,CAAA,CAAC;AAEF,MAAM,kBAAkB,GAAG,GAA0B,EAAE,WAAC,OAAA,MAAA,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,0CAAE,MAAM,CAAA,EAAA,CAAC;AAE9G,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAQ,EAAE;IACjD,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,IAAI,eAAe,EAAE,CAAC;QAClB,eAAe,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACJ,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAQ,EAAE;IACnD,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,IAAI,eAAe,EAAE,CAAC;QAClB,eAAe,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACJ,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAQ,EAAE;IAClD,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,IAAI,eAAe,EAAE,CAAC;QAClB,eAAe,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACJ,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;AACL,CAAC,CAAC"}

package/build/utility/resolvePath.js

@@ -1,3 +1,4 @@
+import { printMsg, MSG } from "./printMsg.js";
 /**
  * Resolves a relative path with a given base URL.
  *
@@ -34,7 +35,7 @@ const resolvePath = (url, path) => {
         return resolvedUrl.href;
     }
     catch (e) {
-        console.error(`Error resolving path "${path}" with base URL "${url}": ${e.message}`);
+        printMsg(MSG.Err, `Error resolving path "${path}" with base URL "${url}": ${e.message}`);
         // Rethrowing the error to signal failure to the caller.
         // Alternative error handling (e.g., returning null) can be implemented if required.
         throw e;

package/build/utility/resolvePath.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolvePath.js","sourceRoot":"","sources":["../../src/utility/resolvePath.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,IAAY,EAAE,EAAE;IAC9C,IAAI,CAAC;QACD,gEAAgE;QAChE,yEAAyE;QACzE,oEAAoE;QACpE,+CAA+C;QAC/C,mDAAmD;QACnD,qFAAqF;QACrF,sDAAsD;QACtD,gGAAgG;QAChG,2DAA2D;QAC3D,4FAA4F;QAC5F,yFAAyF;QACzF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvC,OAAO,WAAW,CAAC,IAAI,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,yBAAyB,IAAI,oBAAoB,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,wDAAwD;QACxD,oFAAoF;QACpF,MAAM,CAAC,CAAC;IACZ,CAAC;AACL,CAAC,CAAC;AAEF,eAAe,WAAW,CAAC"}
+{"version":3,"file":"resolvePath.js","sourceRoot":"","sources":["../../src/utility/resolvePath.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAE9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,IAAY,EAAE,EAAE;IAC9C,IAAI,CAAC;QACD,gEAAgE;QAChE,yEAAyE;QACzE,oEAAoE;QACpE,+CAA+C;QAC/C,mDAAmD;QACnD,qFAAqF;QACrF,sDAAsD;QACtD,gGAAgG;QAChG,2DAA2D;QAC3D,4FAA4F;QAC5F,yFAAyF;QACzF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvC,OAAO,WAAW,CAAC,IAAI,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,yBAAyB,IAAI,oBAAoB,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACzF,wDAAwD;QACxD,oFAAoF;QACpF,MAAM,CAAC,CAAC;IACZ,CAAC;AACL,CAAC,CAAC;AAEF,eAAe,WAAW,CAAC"}

package/build/utility/ruleVersionMap.js

@@ -0,0 +1,73 @@
+/**
+ * Maps a rule attribute (tech value, rule type, or step sub-feature) to the js-recon
+ * version that introduced it, and, if it has since been retired, the version it was
+ * removed in. Only attributes added after `js_recon_version` itself became mandatory
+ * (1.3.1-alpha.3) need an entry here — anything from the original schema is implicitly
+ * satisfied by any declared version.
+ *
+ * When `schemas.ts` or an engine gains/retires a capability, add/update the matching
+ * entry here (see `src/analyze/CLAUDE.md`).
+ */
+export const RULE_VERSION_MAP = {
+    "tech.vue": { min: "1.3.1-alpha.3" },
+    "tech.all": { min: "1.3.1-alpha.3" },
+    "tech.react": { min: "1.3.1-alpha.4" },
+    "tech.svelte": { min: "1.3.1-alpha.4" },
+    "tech.angular": { min: "1.4.1-alpha.4" },
+    "type.cs-mast-s": { min: "1.4.1-alpha.5" },
+    "step.esquery.inScopeOf": { min: "1.3.1-alpha.1" },
+    "step.esquery.taintFrom": { min: "1.3.1-alpha.2" },
+    "step.regexMatch": { min: "1.3.1-alpha.4" },
+    "step.csMastS": { min: "1.4.1-alpha.5" },
+};
+const parseVersion = (version) => {
+    const clean = version.split("-")[0];
+    const parts = clean.split(".").map(Number);
+    return [parts[0] || 0, parts[1] || 0, parts[2] || 0];
+};
+const compareVersions = (a, b) => {
+    for (let i = 0; i < 3; i++) {
+        if (a[i] !== b[i])
+            return a[i] - b[i];
+    }
+    return 0;
+};
+const isHigherMin = (a, b) => compareVersions(parseVersion(a), parseVersion(b)) > 0;
+const isLowerMax = (a, b) => compareVersions(parseVersion(a), parseVersion(b)) < 0;
+/**
+ * Walks a parsed rule's tech list, type, and steps, looks up every attribute present
+ * in RULE_VERSION_MAP, and folds the results into the strictest overall requirement:
+ * the highest min version and (if any apply) the lowest max version.
+ */
+export const computeRequiredVersion = (rule) => {
+    var _a, _b;
+    const keys = [];
+    for (const tech of rule.tech || []) {
+        keys.push(`tech.${tech}`);
+    }
+    keys.push(`type.${rule.type}`);
+    for (const step of rule.steps || []) {
+        if (((_a = step.esquery) === null || _a === void 0 ? void 0 : _a.inScopeOf) !== undefined)
+            keys.push("step.esquery.inScopeOf");
+        if (((_b = step.esquery) === null || _b === void 0 ? void 0 : _b.taintFrom) !== undefined)
+            keys.push("step.esquery.taintFrom");
+        if (step.regexMatch)
+            keys.push("step.regexMatch");
+        if (step.csMastS)
+            keys.push("step.csMastS");
+    }
+    let result = { min: "0.0.0" };
+    for (const key of keys) {
+        const requirement = RULE_VERSION_MAP[key];
+        if (!requirement)
+            continue;
+        if (isHigherMin(requirement.min, result.min)) {
+            result = Object.assign(Object.assign({}, result), { min: requirement.min });
+        }
+        if (requirement.max && (!result.max || isLowerMax(requirement.max, result.max))) {
+            result = Object.assign(Object.assign({}, result), { max: requirement.max });
+        }
+    }
+    return result;
+};
+//# sourceMappingURL=ruleVersionMap.js.map

package/build/utility/ruleVersionMap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleVersionMap.js","sourceRoot":"","sources":["../../src/utility/ruleVersionMap.ts"],"names":[],"mappings":"AAOA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAuC;IAChE,UAAU,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;IACpC,UAAU,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;IACpC,YAAY,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;IACtC,aAAa,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;IACvC,cAAc,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;IACxC,gBAAgB,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;IAC1C,wBAAwB,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;IAClD,wBAAwB,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;IAClD,iBAAiB,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;IAC3C,cAAc,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;CAC3C,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,OAAe,EAA4B,EAAE;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,CAA2B,EAAE,CAA2B,EAAU,EAAE;IACzF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAC7G,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAE5G;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,IAAU,EAAsB,EAAE;;IACrE,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QAClC,IAAI,CAAA,MAAA,IAAI,CAAC,OAAO,0CAAE,SAAS,MAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAC/E,IAAI,CAAA,MAAA,IAAI,CAAC,OAAO,0CAAE,SAAS,MAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAC/E,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,MAAM,GAAuB,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAElD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW;YAAE,SAAS;QAE3B,IAAI,WAAW,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,mCAAQ,MAAM,KAAE,GAAG,EAAE,WAAW,CAAC,GAAG,GAAE,CAAC;QACjD,CAAC;QACD,IAAI,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC9E,MAAM,mCAAQ,MAAM,KAAE,GAAG,EAAE,WAAW,CAAC,GAAG,GAAE,CAAC;QACjD,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}

package/config.dist.yaml

@@ -36,7 +36,7 @@ commands:
         oxylabsFallbackMaxRequests: "10"
         oxylabsFallbackMaxTotal: "100"
         oxylabsFallbackMaxOrigins: "25"
-        cacheFile: .resp_cache.json
+        cacheFile: .resp_cache.db
         disableCache: false
         cacheOnly: false
         yes: false
@@ -173,7 +173,7 @@ commands:
         oxylabsFallbackMaxRequests: "10"
         oxylabsFallbackMaxTotal: "100"
         oxylabsFallbackMaxOrigins: "25"
-        cacheFile: .resp_cache.json
+        cacheFile: .resp_cache.db
         disableCache: false
         cacheOnly: false
         yes: false
@@ -209,7 +209,7 @@ commands:
     load:
         caido: null
         url: null
-        cacheFile: .resp_cache.json
+        cacheFile: .resp_cache.db
 
     fingerprint:
         # May also be a YAML list of HTTP(S) URLs.

package/contributing/testing.md

@@ -0,0 +1,106 @@
+# Writing tests for js-recon
+
+New functionality must ship with tests. Which kind depends on what you're adding — see below.
+
+## Unit tests (Vitest)
+
+Test framework is [Vitest](https://vitest.dev/) — ESM-native, TypeScript-native, no build step.
+
+```bash
+npm test          # run all unit tests once
+npm run test:watch  # watch mode
+npm run test:coverage  # run with coverage report
+```
+
+**What to test.** Pure functions: anything that takes plain inputs and returns a value without I/O.
+Puppeteer, network calls (`makeRequest`), and file writes are intentionally left untested at the
+unit level — they're validated end-to-end via the `run` subcommand instead (see below). When a
+function mixes I/O with logic, extract the parse/transform step into an exported pure function and
+test that:
+
+```typescript
+// Exported pure function — testable
+export const parseThings = (content: string, baseUrl: string): string[] => {
+    /* ... */
+};
+
+// Orchestrator — not unit-tested
+const myModule = async (url: string): Promise<string[]> => {
+    const resp = await makeRequest(url);
+    const content = await resp.text();
+    return parseThings(content, url);
+};
+```
+
+**File layout.** Tests live in `src/__tests__/<component>/<name>.test.ts`, mirroring the source
+path. Use `describe`/`it` blocks grouped by function name; cover the happy path, edge cases (empty
+input, malformed input), and threshold boundaries.
+
+**Local imports use the `.js` extension** (this is an ESM project with `"module": "node16"`):
+
+```typescript
+import { fn } from "../../lazyLoad/next_js/myModule.js";
+```
+
+**Constructing Babel AST nodes for tests.** If a function under test requires a real Babel AST node
+(with `scope`, `path`, correct `start`/`end` offsets), parse a snippet and capture the node via a
+`traverse` visitor rather than building it by hand:
+
+```typescript
+import parser from "@babel/parser";
+import _traverse from "@babel/traverse";
+const traverse = (_traverse.default ?? _traverse) as typeof _traverse.default;
+
+function parseExpr(code: string) {
+    const src = `const _x = ${code};`;
+    const ast = parser.parse(src, { sourceType: "unambiguous", plugins: ["jsx", "typescript"] });
+    let node: any;
+    traverse(ast, {
+        VariableDeclarator(p) {
+            node = p.node.init;
+            p.stop();
+        },
+    });
+    return { node, src };
+}
+```
+
+**Avoid GitHub's secret scanner false-positives.** Strings that look like real secrets (webhook
+URLs, API keys) get blocked by push protection even inside test files. Assemble them at runtime:
+
+```typescript
+// BAD — blocked by secret scanner
+const url = "https://hooks.slack.com/services/TABCDEF/BABCDEF/xxxxxxxxxxxx";
+
+// GOOD — assembled at runtime
+const parts = ["https://hooks.slack.com/services/T", "ABCDEF/B", "ABCDEF/xxxx"];
+const url = parts.join("");
+```
+
+## Fuzz tests (fast-check)
+
+js-recon's job is parsing and analyzing JS bundles pulled from third-party targets — that input is
+fully untrusted. Functions on that boundary (parsing raw bundle text, resolving URLs/strings out of
+it) should get a property-based fuzz test in addition to example-based unit tests, using
+[fast-check](https://fast-check.dev/).
+
+```bash
+npm run test:fuzz   # runs src/**/*.fuzz.test.ts via vitest.fuzz.config.ts
+```
+
+Fuzz tests live alongside the function's regular unit test, named `<name>.fuzz.test.ts`, and are
+excluded from the default `npm test` run (they're slower — property-based, hundreds of generated
+cases per run). See `src/__tests__/strings/extractStrings.fuzz.test.ts` for the reference shape:
+generate arbitrary/adversarial strings, feed them through the same parse config the real call site
+uses, and assert the function under test never throws uncaught or hangs. If a parse step can
+legitimately throw on malformed input (Babel's `errorRecovery: true` does not guarantee it won't),
+wrap it in try/catch inside the test exactly as the real call site does — a caught, expected error
+is not a fuzz failure; an uncaught throw or a hang is.
+
+## Smoke tests (CI)
+
+The `rules-smoke-test` GitHub Actions workflow runs js-recon end-to-end against a seeded lab app and
+asserts every expected rule fires. If you're adding a new AST/request rule to `js-recon-rules`, seed
+the corresponding vulnerability in `js-recon-labs`'s `next_js/vuln-all-rules` app and add the rule ID
+to `EXPECTED_RULES` in `scripts/smoke-test.js`. See the root `CLAUDE.md`'s "Rules smoke test (CI)"
+section for details.

package/eslint.config.js

@@ -0,0 +1,24 @@
+import tseslint from "typescript-eslint";
+import security from "eslint-plugin-security";
+
+export default tseslint.config(
+    {
+        ignores: ["build/**", "output/**", "output_refactored/**", "node_modules/**"],
+    },
+    {
+        files: ["src/**/*.ts"],
+        extends: [...tseslint.configs.recommended],
+        plugins: {
+            security,
+        },
+        rules: {
+            ...security.configs.recommended.rules,
+            // These fire on legitimate dynamic-code patterns intrinsic to a bundle-analysis tool
+            // (parsing/instrumenting untrusted third-party JS is the entire point of js-recon).
+            "security/detect-non-literal-fs-filename": "off",
+            "security/detect-object-injection": "off",
+            "@typescript-eslint/no-explicit-any": "off",
+            "@typescript-eslint/no-unused-vars": ["warn", { argsIgnorePattern: "^_" }],
+        },
+    }
+);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@js-recon/js-recon",
-    "version": "1.4.4",
+    "version": "2.0.1-alpha.2",
     "description": "JS Recon Tool",
     "main": "build/index.js",
     "type": "module",
@@ -13,9 +13,12 @@
         "start": "node --max-old-space-size=8192 build/index.js",
         "test": "vitest run",
         "test:watch": "vitest",
+        "test:coverage": "vitest run --coverage",
+        "test:fuzz": "vitest run --config vitest.fuzz.config.ts",
         "test:build": "node build/index.js -h",
-        "postinstall": "patch-package",
-        "cleanup": "rm -rf build output output_refactored .resp_cache.json .resp_cache.json.entries endpoints.json extracted_urls{.txt,.json,-openapi.json} strings.json mapped{-openapi.json,.json,-openapi.postman_collection.json} analyze.json test{.yaml,.js} js-recon-js-recon-*.tgz js-recon.db report.{html,md} js_recon_run_output *_test.js extracted/ research.json results* out.* && tsc"
+        "lint": "eslint src",
+        "postinstall": "patch-package || true; node scripts/postinstall-completion.mjs",
+        "cleanup": "rm -rf build output output_refactored .resp_cache.json .resp_cache.json.entries .resp_cache.db endpoints.json extracted_urls{.txt,.json,-openapi.json} strings.json mapped{-openapi.json,.json,-openapi.postman_collection.json} analyze.json test{.yaml,.js} js-recon-js-recon-*.tgz js-recon.db report.{html,md} js_recon_run_output *_test.js extracted/ research.json results* out.* swagger-jacker-results.json && tsc"
     },
     "keywords": [],
     "author": "Shriyans Sudhi",
@@ -27,7 +30,7 @@
         "@babel/traverse": "^7.28.5",
         "@babel/types": "^7.27.6",
         "@modelcontextprotocol/sdk": "^1.29.0",
-        "@shriyanss/cli-print-img": "^1.1.0",
+        "@shriyanss/cli-print-img": "^1.1.1",
         "@shriyanss/cs-mast": "0.1.8",
         "@types/chalk": "^0.4.31",
         "@types/cli-progress": "^3.11.6",
@@ -41,13 +44,14 @@
         "datatables.net": "^2.3.6",
         "datatables.net-dt": "^2.3.6",
         "esquery": "^1.6.0",
+        "express": "^5.2.1",
         "extract-zip": "^2.0.1",
-        "fs": "^0.0.2",
         "graphql": "^16.14.1",
         "highlight.js": "^11.11.1",
         "inquirer": "^12.6.3",
         "marked": "^16.1.2",
         "md5": "^2.3.0",
+        "ohash": "^2.0.11",
         "ollama": "^0.6.3",
         "openai": "^5.8.2",
         "patch-package": "^8.0.1",
@@ -58,7 +62,10 @@
         "puppeteer-extra-plugin-stealth": "^2.11.2",
         "readline": "^1.3.0",
         "ses": "^1.13.0",
-        "undici": "^7.28.0",
+        "shell-quote": "^1.10.0",
+        "tar": "^7.5.22",
+        "undici": "^7.29.0",
+        "ws": "^8.21.2",
         "yaml": "^2.8.0",
         "zod": "^3.23.8"
     },
@@ -78,11 +85,20 @@
         "@types/babel__traverse": "^7.28.0",
         "@types/better-sqlite3": "^7.6.13",
         "@types/blessed": "^0.1.25",
+        "@types/express": "^5.0.6",
         "@types/graphql": "^14.2.3",
         "@types/node": "^24.12.4",
+        "@types/shell-quote": "^1.7.5",
+        "@types/ws": "^8.18.1",
+        "@vitest/coverage-v8": "^4.1.10",
+        "eslint": "^10.8.0",
+        "eslint-plugin-security": "^4.0.1",
+        "fast-check": "^4.9.0",
+        "patch-package": "^8.0.1",
         "ts-node": "^10.9.2",
         "tsconfig-paths": "^4.2.0",
         "typescript": "^5.9.2",
+        "typescript-eslint": "^8.66.0",
         "vitest": "^4.1.10"
     }
 }

package/scripts/exploit-smoke-test.js

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+/**
+ * Smoke test: verifies that the `exploit` module reported `vulnerable: true` for every CVE
+ * fixture in js-recon-labs.
+ *
+ * Usage:
+ *   node scripts/exploit-smoke-test.js [results-dir]
+ *
+ * Expects one `<CVE-ID>.json` (rich exploit.json output shape) per CVE in results-dir, as
+ * produced by the `exploit-smoke-test.yaml` workflow's `-o` flag.
+ */
+
+import { readFileSync, existsSync } from "fs";
+import { resolve } from "path";
+
+const resultsDir = process.argv[2] || "/tmp/exploit-results";
+
+const EXPECTED_CVES = [
+    "CVE-2025-29927",
+    "CVE-2026-64645",
+    "CVE-2025-30208",
+    "CVE-2026-39363",
+    "CVE-2026-71320",
+    "CVE-2026-71315",
+    "CVE-2026-68945",
+    "CVE-2025-55182",
+];
+
+// RCE-class CVEs must additionally prove their `id` proof output looks like real `id` command
+// output, not just any non-empty string — otherwise a broken payload that returns garbage would
+// still satisfy a loose `vulnerable: true` check.
+const RCE_OUTPUT_PATTERN = /uid=\d+.*gid=\d+/;
+const RCE_CVES = new Set(["CVE-2026-71320", "CVE-2025-55182"]);
+
+let failures = [];
+
+for (const cveId of EXPECTED_CVES) {
+    const filePath = resolve(resultsDir, `${cveId}.json`);
+    if (!existsSync(filePath)) {
+        failures.push(`${cveId}: no result file at ${filePath}`);
+        continue;
+    }
+
+    let findings;
+    try {
+        findings = JSON.parse(readFileSync(filePath, "utf-8"));
+    } catch (err) {
+        failures.push(`${cveId}: could not parse ${filePath}: ${err.message}`);
+        continue;
+    }
+
+    const finding = findings[0];
+    if (!finding || finding.vulnerable !== true) {
+        failures.push(`${cveId}: not reported vulnerable (evidence: ${finding?.evidence ?? "none"})`);
+        continue;
+    }
+
+    if (RCE_CVES.has(cveId)) {
+        const execOutput = finding.execOutput ?? "";
+        if (!RCE_OUTPUT_PATTERN.test(execOutput)) {
+            failures.push(
+                `${cveId}: vulnerable=true but execOutput doesn't look like real 'id' output: "${execOutput}"`
+            );
+        }
+    }
+
+    console.log(`[✓] ${cveId}: vulnerable (${finding.evidence.slice(0, 120)})`);
+}
+
+console.log();
+console.log(`[i] ${EXPECTED_CVES.length - failures.length} / ${EXPECTED_CVES.length} CVEs confirmed vulnerable.`);
+
+if (failures.length > 0) {
+    console.error();
+    console.error("[!] Exploit smoke test FAILED:");
+    for (const f of failures) {
+        console.error(`      - ${f}`);
+    }
+    process.exit(1);
+}
+
+console.log("[✓] Exploit smoke test PASSED.");

package/scripts/framework-detect-smoke-test.js

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+/**
+ * Smoke test: verifies that js-recon's `fingerprint` command detects the
+ * correct front-end framework for every lab app in the framework-detection
+ * matrix (js-recon-labs/detection/*).
+ *
+ * Usage:
+ *   node scripts/framework-detect-smoke-test.js [path-to-fingerprint-result.json]
+ *
+ * Default path: /tmp/fingerprint-result.json
+ */
+
+import { readFileSync } from "fs";
+import { resolve } from "path";
+
+const resultPath = process.argv[2] || "/tmp/fingerprint-result.json";
+const absolutePath = resolve(resultPath);
+
+let results;
+try {
+    results = JSON.parse(readFileSync(absolutePath, "utf-8"));
+} catch (err) {
+    console.error(`[!] Could not read ${absolutePath}: ${err.message}`);
+    console.error("    Make sure `js-recon fingerprint -f json` completed successfully before running this script.");
+    process.exit(1);
+}
+
+// URL -> expected framework name, matching js-recon-labs/detection/* app ports.
+const EXPECTED = {
+    "http://localhost:3010": "next",
+    "http://localhost:3011": "vue",
+    "http://localhost:3012": "nuxt",
+    "http://localhost:3013": "svelte",
+    "http://localhost:3014": "angular",
+    "http://localhost:3015": "react",
+    "http://localhost:3016": "react",
+};
+
+const detected = new Map(results.map((r) => [r.url, r.framework]));
+const rows = [];
+let failed = false;
+
+for (const [url, expected] of Object.entries(EXPECTED)) {
+    const actual = detected.get(url) ?? "unknown";
+    const ok = actual === expected;
+    if (!ok) failed = true;
+    rows.push({ url, expected, actual, ok });
+}
+
+console.log(`[i] Checked ${rows.length} lab apps.`);
+console.log();
+console.log("URL".padEnd(28), "Expected".padEnd(10), "Detected".padEnd(10), "Result");
+for (const { url, expected, actual, ok } of rows) {
+    console.log(url.padEnd(28), expected.padEnd(10), actual.padEnd(10), ok ? "OK" : "MISMATCH");
+}
+console.log();
+
+if (failed) {
+    const mismatches = rows.filter((r) => !r.ok).length;
+    console.error(`[!] ${mismatches} / ${rows.length} apps failed framework detection. Smoke test FAILED.`);
+    process.exit(1);
+}
+
+console.log(`[✓] All ${rows.length} apps detected correctly. Smoke test PASSED.`);

package/scripts/postinstall-completion.mjs

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+// Auto-installs shell completion on real global installs/upgrades (npm install -g,
+// Homebrew, the Docker release image). Never runs for contributor `npm install`/`npm ci`
+// inside this repo (npm_config_global is unset/false there). Must never fail the parent
+// `npm install` regardless of outcome — all errors are caught and logged, not thrown.
+
+import path from "path";
+import { fileURLToPath, pathToFileURL } from "url";
+
+const SUPPORTED_SHELLS = new Set(["bash", "zsh", "fish"]);
+
+async function main() {
+    if (process.env.npm_config_global !== "true") {
+        return;
+    }
+
+    const shellPath = process.env.SHELL;
+    if (!shellPath) {
+        console.log("[i] js-recon: SHELL environment variable not set; skipping automatic completion install.");
+        console.log("[i] Run `js-recon completion <bash|zsh|fish>` manually to enable it.");
+        return;
+    }
+
+    const shell = path.basename(shellPath);
+    if (!SUPPORTED_SHELLS.has(shell)) {
+        console.log(`[i] js-recon: unsupported shell "${shell}"; skipping automatic completion install.`);
+        console.log("[i] Supported shells: bash, zsh, fish. Run `js-recon completion <shell>` manually if applicable.");
+        return;
+    }
+
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    const completionModuleUrl = pathToFileURL(path.join(here, "..", "build", "completion", "index.js"));
+    const { default: completion } = await import(completionModuleUrl);
+    completion(shell);
+}
+
+main().catch((err) => {
+    console.error(`[!] js-recon: automatic completion install failed: ${err?.message ?? err}`);
+    console.error("[!] Run `js-recon completion <bash|zsh|fish>` manually to enable it.");
+});

package/scripts/smoke-test.js

@@ -40,13 +40,25 @@ const EXPECTED_RULES = [
     "detect_js_injection_eval",
     "detect_redos_url_param",
     "detect_cspt_fetch_url_param",
+    "detect_cspt_xhr_url_param",
     "detect_ajax_header_manipulation",
     "detect_postMessage",
     "detect_postMessage_innerHtml_sink",
     "detect_postMessage_function_href",
     "detect_postMessage_wildcard_origin",
     "detect_postmessage_eval",
+    "detect_postmessage_weak_origin_check",
     "detect_hardcoded_secrets",
+    "detect_css_injection_style_sink",
+    "detect_react_createelement_dynamic_type",
+    "detect_jquery_html_injection_url_param",
+    "detect_dompurify_forcekeepattr_hook",
+    "detect_client_side_authz_gate",
+    "detect_insecure_random_token_storage",
+    "detect_cloud_credentials_in_bundle",
+    "detect_hardcoded_hmac_signing_key",
+    "detect_non_global_regex_sanitizer",
+    "detect_prototype_pollution_merge_gadget",
     // Request rules
     "api_path",
     "admin_api",