@lintsure/core 0.1.0 → 0.1.1

package/dist/src/assessment.js

@@ -7,7 +7,7 @@ const esc = (s) => s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">
 const NAME = { "eu-ai-act": "EU AI Act", gdpr: "GDPR", soc2: "SOC 2", "iso-27001": "ISO/IEC 27001" };
 const STATUS = { gap: "Gap", partial: "Partial", met: "Met", outside: "Outside code" };
 const SEV = ["high", "medium", "low"];
-const SKIPPED = "node_modules, .git, dist, build, .next, venv, .venv, __pycache__, coverage";
+const SKIPPED = "node_modules, .git, dist, build, out, .output, .next, .nuxt, .svelte-kit, .astro, .vercel, .netlify, .wrangler, .turbo, .cache, venv, .venv, __pycache__, coverage";
 function page(title, body, n, total, project) {
     return `<section class="page"><header><span>Lintsure readiness assessment · ${esc(project)}</span><span>Draft until reviewed by a person</span></header>
 <h2>${esc(title)}</h2>${body}<footer><span>Not an audit, a certification or legal advice.</span><span>Section ${n} of ${total}</span></footer></section>`;
@@ -51,7 +51,7 @@ export function toAssessmentHtml(r, opts) {
 ${fws.map((f) => `<tr><td>${NAME[f]}</td><td>${r.findings.filter((x) => x.status === "gap" && x.controls.some((c) => c.framework === f)).length}</td><td>${r.findings.filter((x) => x.status === "partial" && x.controls.some((c) => c.framework === f)).length}</td><td>${r.met.filter((m) => m.controls.some((c) => c.framework === f)).length}</td><td>${r.outside.filter((o) => o.framework === f).length}</td></tr>`).join("")}</table>
 <div class="callout"><b>What this summary does not mean.</b> ${esc(NOT_A_VERDICT)}</div>`;
     const method = `<h3>What was checked</h3>
-<p>Lintsure read ${r.filesChecked} files in the project folder on the computer or CI runner where it ran. Nothing was uploaded. It skipped these folders: ${SKIPPED}, and any file over 1 MB or binary.</p>
+<p>Lintsure read ${r.filesChecked} files in the project folder on the computer or CI runner where it ran. Nothing was uploaded. It skipped these folders: ${SKIPPED}, any paths listed under ignore in lintsure.config.yaml, minified files, and any file over 1 MB or binary.</p>
 <h3>How results are produced</h3>
 <ul><li>A fixed set of rules (version ${esc(r.rulesVersion)}) looks for known patterns, line by line or file by file. It does not use a language model to decide results, so the same code gives the same findings.</li>
 <li><b>Gap</b>: a rule found code that may break a control. <b>Partial</b>: a likely problem that depends on context only you can confirm. <b>Met</b>: the rule ran and found nothing in the files it read. <b>Outside code</b>: work that code cannot show.</li>

package/dist/src/index.d.ts

@@ -5,7 +5,7 @@ export { rules };
 export * from "./guidance.js";
 export { toAssessmentHtml } from "./assessment.js";
 export * from "./knowledge/index.js";
-export declare const RULES_VERSION = "0.1.0";
+export declare const RULES_VERSION = "0.1.1";
 /** Shown with every result, in every interface. Lintsure prepares; people decide. */
 export declare const DISCLAIMER: string;
 /** What a report must never be read as. Used in the report and by the MCP server. */
@@ -17,12 +17,15 @@ export declare const ALL_FRAMEWORKS: FrameworkId[];
  *  Only the simple list form is supported:
  *    frameworks:
  *      - gdpr
- *  Ids Lintsure doesn't check yet (for example "hipaa") are returned in `skipped`. */
+ *  Ids Lintsure doesn't check yet (for example "hipaa") are returned in `skipped`.
+ *  An `ignore:` list of paths (relative to the root, for example tests/ or fixtures/) is skipped by scan(). */
 export declare function readConfig(root: string): Promise<{
     frameworks: FrameworkId[] | null;
     skipped: string[];
+    ignore: string[];
 }>;
+export declare const SKIP_DIRS: string[];
 /** Scout: list files to check, sorted so output order never depends on the file system. */
-export declare function listFiles(root: string): Promise<string[]>;
+export declare function listFiles(root: string, ignore?: string[]): Promise<string[]>;
 export declare function scan(root: string, frameworks?: FrameworkId[]): Promise<Report>;
 export declare function toMarkdown(r: Report): string;

package/dist/src/index.js

@@ -9,7 +9,7 @@ export { rules };
 export * from "./guidance.js";
 export { toAssessmentHtml } from "./assessment.js";
 export * from "./knowledge/index.js";
-export const RULES_VERSION = "0.1.0";
+export const RULES_VERSION = "0.1.1";
 /** Shown with every result, in every interface. Lintsure prepares; people decide. */
 export const DISCLAIMER = "Lintsure is a readiness tool, not an audit, a certification or legal advice. " +
     "Its rules reflect our reading of the publicly available text of each framework, and they check code only. " +
@@ -34,46 +34,64 @@ export const ALL_FRAMEWORKS = ["gdpr", "soc2", "iso-27001", "eu-ai-act"];
  *  Only the simple list form is supported:
  *    frameworks:
  *      - gdpr
- *  Ids Lintsure doesn't check yet (for example "hipaa") are returned in `skipped`. */
+ *  Ids Lintsure doesn't check yet (for example "hipaa") are returned in `skipped`.
+ *  An `ignore:` list of paths (relative to the root, for example tests/ or fixtures/) is skipped by scan(). */
 export async function readConfig(root) {
     let text;
     try {
         text = await readFile(join(root, "lintsure.config.yaml"), "utf8");
     }
     catch {
-        return { frameworks: null, skipped: [] };
+        return { frameworks: null, skipped: [], ignore: [] };
     }
-    const ids = [];
-    let inList = false;
+    const lists = { frameworks: [], ignore: [] };
+    let key = "";
+    let emptyFw = false;
     for (const raw of text.split(/\r?\n/)) {
         const line = raw.replace(/#.*$/, "").trimEnd();
-        if (/^frameworks\s*:\s*\[\s*\]\s*$/.test(line))
-            return { frameworks: [], skipped: [] };
-        if (/^frameworks\s*:\s*$/.test(line)) {
-            inList = true;
+        if (/^frameworks\s*:\s*\[\s*\]\s*$/.test(line)) {
+            emptyFw = true;
+            key = "";
             continue;
         }
-        if (inList) {
-            const m = line.match(/^\s+-\s*([\w-]+)\s*$/);
+        const head = line.match(/^(frameworks|ignore)\s*:\s*$/);
+        if (head) {
+            key = head[1];
+            continue;
+        }
+        if (key) {
+            const m = line.match(/^\s+-\s*["']?([^"'\s]+)["']?\s*$/);
             if (m)
-                ids.push(m[1]);
+                lists[key].push(m[1]);
             else if (line.trim())
-                inList = false;
+                key = "";
         }
     }
+    const ignore = lists.ignore.map((p) => p.replace(/\\/g, "/").replace(/^\.?\//, "").replace(/\/+$/, ""));
+    if (emptyFw)
+        return { frameworks: [], skipped: [], ignore };
+    const ids = lists.frameworks;
+    if (!ids.length)
+        return { frameworks: null, skipped: [], ignore };
     const known = ids.filter((i) => ALL_FRAMEWORKS.includes(i));
-    return { frameworks: known, skipped: ids.filter((i) => !known.includes(i)) };
+    return { frameworks: known, skipped: ids.filter((i) => !known.includes(i)), ignore };
 }
-const SKIP = new Set(["node_modules", ".git", "dist", "build", ".next", "venv", ".venv", "__pycache__", "coverage"]);
+// Dependencies, build output and caches: generated code, not code you wrote.
+export const SKIP_DIRS = ["node_modules", ".git", "dist", "build", "out", ".output", ".next", ".nuxt", ".svelte-kit", ".astro", ".vercel", ".netlify", ".wrangler", ".turbo", ".cache", "venv", ".venv", "__pycache__", "coverage"];
+const SKIP = new Set(SKIP_DIRS);
+const MAX_LINE = 1000; // a line this long means minified or generated code
 const MAX_BYTES = 1_000_000;
 /** Scout: list files to check, sorted so output order never depends on the file system. */
-export async function listFiles(root) {
+export async function listFiles(root, ignore = []) {
     const out = [];
+    const ignored = (p) => { const r = relative(root, p).split(sep).join("/"); return ignore.some((i) => r === i || r.startsWith(i + "/")); };
     async function walk(dir) {
         for (const e of await readdir(dir, { withFileTypes: true })) {
-            if (SKIP.has(e.name))
+            if (SKIP.has(e.name) || /\.min\.(js|css)$/.test(e.name))
                 continue;
             const p = join(dir, e.name);
+            if (ignored(p))
+                continue;
             if (e.isDirectory())
                 await walk(p);
             else if (e.isFile())
@@ -87,7 +105,7 @@ export async function scan(root, frameworks = ALL_FRAMEWORKS) {
     const active = rules.filter((r) => r.controls.some((c) => frameworks.includes(c.framework)));
     const findings = [];
     let filesChecked = 0;
-    for (const abs of await listFiles(root)) {
+    for (const abs of await listFiles(root, (await readConfig(root)).ignore)) {
         const ext = extname(abs) || (abs.endsWith(".env") ? ".env" : "");
         const relevant = active.filter((r) => r.extensions.includes(ext));
         if (!relevant.length)
@@ -95,9 +113,11 @@ export async function scan(root, frameworks = ALL_FRAMEWORKS) {
         const buf = await readFile(abs);
         if (buf.length > MAX_BYTES || buf.includes(0))
             continue; // skip big or binary files
-        filesChecked++;
         const file = relative(root, abs).split(sep).join("/");
         const lines = buf.toString("utf8").split(/\r?\n/);
+        if (lines.some((l) => l.length > MAX_LINE))
+            continue; // minified or generated
+        filesChecked++;
         const add = (r, line) => findings.push({
             ruleId: r.id, file, line, status: r.status, severity: r.severity, title: r.title,
             controls: r.controls.filter((c) => frameworks.includes(c.framework)), fix: r.fix, note: r.note,

package/dist/src/rules/index.js

@@ -2,6 +2,8 @@ const CODE = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".py"];
 // Beta: mapped by us, awaiting review by a qualified compliance professional.
 const DRAFT = { mappedBy: "beta", reviewedAt: "pending" };
 const LOG_CALL = /\b(console\.(log|info|warn|error|debug)|logger\.\w+|log\.(info|warn|error|debug)|logging\.\w+|print)\s*\(/;
+// Drops the text of string literals but keeps interpolations, so "email error" is ignored and `${user.email}` or f"{user.email}" is not.
+const codeOnly = (l) => l.replace(/(["'`])(?:\\.|(?!\1).)*\1/g, (s) => (s.match(/\{[^}]*\}/g) ?? []).join(" "));
 const PII = /\b(e-?mail|phone|ssn|social_?security|passport|date_?of_?birth|dob|password|passwd|credit_?card|card_?number|iban)\b/i;
 export const rules = [
     {
@@ -16,7 +18,7 @@ export const rules = [
         fix: "Mask or remove the personal field before logging, for example mask(user.email).",
         note: "Logs are copied to many places and kept for a long time. Personal data in them is hard to find and delete.",
         extensions: CODE,
-        test: (l) => LOG_CALL.test(l) && PII.test(l),
+        test: (l) => LOG_CALL.test(l) && PII.test(codeOnly(l)),
         ...DRAFT,
     },
     {
@@ -107,7 +109,7 @@ export const rules = [
         fix: "Remove the override and trust a proper certificate. For self-signed certs in tests, scope it to the test only.",
         note: "With checks off, anyone on the network path can read or change the traffic.",
         extensions: [...CODE, ".env"],
-        test: (l) => /rejectUnauthorized\s*:\s*false|NODE_TLS_REJECT_UNAUTHORIZED\s*[=:]\s*["']?0|verify\s*=\s*False|InsecureSkipVerify\s*:\s*true|CERT_NONE/.test(l),
+        test: (l) => /rejectUnauthorized\s*:\s*false|NODE_TLS_REJECT_UNAUTHORIZED\s*[=:]\s*["']?0|\b(requests|httpx|session|client|Client|AsyncClient|urlopen)\b.*\bverify\s*=\s*False|InsecureSkipVerify\s*:\s*true|CERT_NONE/.test(l),
         ...DRAFT,
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lintsure/core",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Lintsure engine: rules, framework knowledge and reports for readiness checks of AI-written code. Not an audit or legal advice.",
   "license": "Apache-2.0",
   "type": "module",