@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/security-runtime/src/checks/install-posture/index.mjs

@@ -0,0 +1,123 @@
+// install-posture (REQ-011): is the product's install path protected? Reports a dependency firewall in CI workflows, pnpm build-script
+// restrictions and npm ignore-scripts. Warning only: category "posture" never blocks, and the check is not required in any mode.
+import fs from 'node:fs';
+import path from 'node:path';
+import { listFiles } from '../../core/detect.mjs';
+import { parsePnpmLock } from '../_lib/lockfiles.mjs';
+
+export const id = 'install-posture';
+export const title = 'Install-time protection posture (dependency firewall, pnpm builds, npm ignore-scripts)';
+export const modes = ['scan', 'deep', 'release'];
+export const requiredIn = [];
+export const timeoutSec = 120;
+
+const base = (f) => f.slice(f.lastIndexOf('/') + 1);
+const INSTALL = /\b(?:npm\s+(?:ci|install|i)\b|pnpm\s+(?:install|i|add)\b|yarn(?:\s+(?:install|add))?\s*(?:$|--)|yarn\s+(?:install|add)\b|bun\s+(?:install|i)\b|pip3?\s+install\b|python3?\s+-m\s+pip\s+install\b|uv\s+(?:sync|pip\s+install)\b|poetry\s+install\b)/;
+// Aikido Safe Chain (safe-chain, @aikidosec/safe-chain, aikido setup actions) and Socket Firewall (sfw).
+const FIREWALL = [/safe-chain/i, /aikido/i, /(^|[\s"'`/@])sfw(?=$|[\s"'`])/m, /socket[-\s]?firewall/i];
+const stripComments = (text) => text.split(/\r?\n/).map((l) => (/^\s*#/.test(l) ? '' : l.replace(/\s+#.*$/, ''))).join('\n');
+const read = (repo, rel) => { try { return fs.readFileSync(path.join(repo, rel), 'utf8'); } catch { return null; } };
+
+export function applies(ctx) {
+  const d = ctx.detection;
+  return d.workflows.length || d.packageJsons.length || d.lockfiles.length
+    ? true
+    : { applies: false, reason: 'no CI workflows or package manager files were found' };
+}
+
+const posture = (o) => ({ category: 'posture', tool: 'vsg', confidence: 'high', refs: [], ...o });
+
+export async function run(ctx) {
+  const repo = ctx.repo;
+  const d = ctx.detection;
+  const files = listFiles(repo);
+  const findings = [];
+  const evidence = { workflows: [], pnpm: [], npm: [] };
+
+  // ---- CI workflows ----
+  const texts = new Map(d.workflows.map((f) => [f, stripComments(read(repo, f) ?? '')]));
+  const isAction = (f) => /\/actions\//.test(f);
+  const actionProtected = [...texts].some(([f, t]) => isAction(f) && FIREWALL.some((re) => re.test(t)));
+  for (const [file, text] of texts) {
+    if (isAction(file) || !text.split(/\r?\n/).some((l) => INSTALL.test(l))) continue;
+    const protectedHere = FIREWALL.some((re) => re.test(text)) || actionProtected;
+    evidence.workflows.push({ file, installSteps: true, firewall: protectedHere });
+    findings.push(posture(protectedHere
+      ? { severity: 'info', key: 'firewall-present', ruleId: 'install-posture/firewall-present', location: { file }, title: `CI installs run through a dependency firewall: ${file}`, description: 'This workflow installs dependencies and references Aikido Safe Chain or Socket Firewall.', evidence: file, fix: '' }
+      : {
+        severity: 'medium', key: 'firewall-absent', ruleId: 'install-posture/firewall-absent', location: { file },
+        title: `CI installs run without a dependency firewall: ${file}`,
+        description: 'This workflow installs dependencies with no Aikido Safe Chain (safe-chain, aikido setup action) or Socket Firewall (sfw) in front of the package manager, so a freshly published malicious package is installed without a check.',
+        evidence: `${file} runs a package install and mentions no dependency firewall.`,
+        fix: 'Install Aikido Safe Chain in the workflow before the install step (Richard approves any CI change), or prefix installs with sfw. See the Safe Chain documentation for the setup step.',
+      }));
+  }
+  if (!evidence.workflows.length) evidence.workflows.push({ note: d.workflows.length ? 'workflows contain no package install steps' : 'no CI workflows found' });
+
+  // ---- pnpm ----
+  const pnpmLocks = d.lockfiles.filter((l) => l.manager === 'pnpm');
+  const workspaceFiles = files.filter((f) => base(f) === 'pnpm-workspace.yaml');
+  const npmrcFiles = files.filter((f) => base(f) === '.npmrc');
+  const pkgJsons = d.packageJsons.map((f) => ({ file: f, json: (() => { try { return JSON.parse(read(repo, f) ?? ''); } catch { return null; } })() }));
+  const dangerous = [];
+  let hasAllowList = false;
+  for (const f of workspaceFiles) {
+    const t = stripComments(read(repo, f) ?? '');
+    if (/^\s*dangerouslyAllowAllBuilds\s*:\s*true\b/m.test(t)) dangerous.push(f);
+    if (/^\s*(onlyBuiltDependencies|neverBuiltDependencies)\s*:/m.test(t)) hasAllowList = true;
+  }
+  for (const { file, json } of pkgJsons) {
+    if (json?.pnpm?.dangerouslyAllowAllBuilds === true) dangerous.push(file);
+    if (json?.pnpm?.onlyBuiltDependencies || json?.pnpm?.neverBuiltDependencies) hasAllowList = true;
+  }
+  for (const f of npmrcFiles) {
+    const t = stripComments(read(repo, f) ?? '');
+    if (/^\s*dangerously-allow-all-builds\s*=\s*true\b/m.test(t)) dangerous.push(f);
+    if (/^\s*(only-built-dependencies|never-built-dependencies)/m.test(t)) hasAllowList = true;
+  }
+  for (const file of [...new Set(dangerous)]) {
+    findings.push(posture({
+      severity: 'high', key: 'pnpm-allow-all-builds', ruleId: 'install-posture/pnpm-allow-all-builds', location: { file },
+      title: `pnpm runs every dependency's build script: ${file}`,
+      description: 'dangerouslyAllowAllBuilds is true, so any dependency (including a newly compromised one) can run install-time scripts on developer machines and CI. This is a warning and does not block the release.',
+      evidence: `${file} sets dangerouslyAllowAllBuilds: true`,
+      fix: 'Remove dangerouslyAllowAllBuilds and list only the packages that need build scripts under onlyBuiltDependencies.',
+    }));
+  }
+  for (const l of pnpmLocks) {
+    const text = read(repo, l.file);
+    let withScripts = 0;
+    try { withScripts = parsePnpmLock(text ?? '').filter((p) => p.installScript).length; } catch { /* unreadable lockfile: no install-script count */ }
+    evidence.pnpm.push({ lockfile: l.file, packagesWithBuildScripts: withScripts, allowListConfigured: hasAllowList, dangerouslyAllowAllBuilds: dangerous.length > 0 });
+    if (withScripts > 0 && !hasAllowList && !dangerous.length) {
+      findings.push(posture({
+        severity: 'info', key: 'pnpm-no-only-built', ruleId: 'install-posture/pnpm-no-only-built', location: { file: l.file },
+        title: `pnpm has no onlyBuiltDependencies list although ${withScripts} dependencies have build scripts`,
+        description: 'Without an explicit allowlist, which dependency build scripts may run depends on the pnpm version in use.',
+        evidence: `${l.file}: ${withScripts} packages require a build step; no onlyBuiltDependencies setting was found.`,
+        fix: 'Add onlyBuiltDependencies to pnpm-workspace.yaml (or the pnpm field of package.json) listing only the packages that need to build.',
+      }));
+    }
+  }
+
+  // ---- npm ----
+  const npmLocks = d.lockfiles.filter((l) => l.manager === 'npm');
+  if (npmLocks.length) {
+    const rcWith = npmrcFiles.filter((f) => /^\s*ignore-scripts\s*=\s*true\b/m.test(stripComments(read(repo, f) ?? '')));
+    evidence.npm.push({ lockfiles: npmLocks.map((l) => l.file), ignoreScripts: rcWith });
+    findings.push(posture(rcWith.length
+      ? { severity: 'info', key: 'npm-ignore-scripts-set', ruleId: 'install-posture/npm-ignore-scripts-set', location: { file: rcWith[0] }, title: 'npm ignores dependency install scripts (.npmrc ignore-scripts=true)', description: 'Dependency lifecycle scripts do not run during npm install.', evidence: `${rcWith[0]} sets ignore-scripts=true`, fix: '' }
+      : {
+        severity: 'low', key: 'npm-ignore-scripts-unset', ruleId: 'install-posture/npm-ignore-scripts-unset', location: { file: npmLocks[0].file },
+        title: '.npmrc does not set ignore-scripts=true',
+        description: 'npm runs install-time scripts of every dependency. Malicious packages commonly use them to steal credentials.',
+        evidence: `No .npmrc with ignore-scripts=true was found next to ${npmLocks.map((l) => l.file).join(', ')}.`,
+        fix: 'Set ignore-scripts=true in .npmrc and run the few build scripts you need explicitly (for example npm rebuild <package>).',
+      }));
+  }
+  if (!evidence.pnpm.length) delete evidence.pnpm;
+  if (!evidence.npm.length) delete evidence.npm;
+  return { status: 'ran', reason: '', findings, evidence: { 'posture.json': JSON.stringify(evidence, null, 2) } };
+}
+
+export default { id, title, modes, requiredIn, timeoutSec, applies, run };

package/dist/security-runtime/src/checks/licenses/index.mjs

@@ -0,0 +1,143 @@
+// licenses (REQ-020): per-package licenses from OSV-Scanner (--licenses, JSON) checked against a deny list.
+// Default deny: AGPL-*, SSPL-*, and GPL-* when the product is distributed as a desktop or mobile app. vsg.config.json "licenseAllow"
+// lists SPDX ids the owner has accepted. Warning only: category "license" never blocks.
+import fs from 'node:fs';
+import path from 'node:path';
+import { listFiles } from '../../core/detect.mjs';
+import { osvExcludeArgs } from '../_lib/osv.mjs';
+
+export const id = 'licenses';
+export const title = 'Dependency licenses (AGPL, SSPL and distributed-app GPL)';
+export const modes = ['deep', 'release'];
+export const requiredIn = ['deep', 'release'];
+export const timeoutSec = 600;
+
+const base = (f) => f.slice(f.lastIndexOf('/') + 1);
+const PY_PACKAGERS = /(^|[^a-z0-9_.-])(pyinstaller|cx[-_.]?freeze|nuitka|py2exe|briefcase)($|[^a-z0-9_.-])/i;
+
+export function applies(ctx) {
+  const d = ctx.detection;
+  return d.lockfiles.length > 0 || (d.manifests ?? []).some((m) => /^requirements.*\.txt$/.test(base(m)))
+    ? true
+    : { applies: false, reason: 'no lockfile or requirements file was found' };
+}
+
+/** 'mobile' (Expo), 'desktop' (Python with a Windows packaging marker), or null. */
+export function distributionKind(ctx) {
+  if (ctx.detection.expo) return 'mobile';
+  if (!ctx.detection.python) return null;
+  const files = listFiles(ctx.repo);
+  if (files.some((f) => f.toLowerCase().endsWith('.spec'))) return 'desktop';
+  for (const f of files.filter((x) => /^requirements.*\.txt$/.test(base(x)) || ['pyproject.toml', 'Pipfile', 'setup.py'].includes(base(x)))) {
+    try { if (PY_PACKAGERS.test(fs.readFileSync(path.join(ctx.repo, f), 'utf8'))) return 'desktop'; } catch { /* unreadable file: no marker */ }
+  }
+  return null;
+}
+
+// ---- SPDX expression handling: OR means the user may pick, AND means every part applies ----
+function tokens(expr) { return expr.match(/\(|\)|[^\s()]+/g) ?? []; }
+function parseExpr(tk) {
+  let pos = 0;
+  const peek = () => tk[pos];
+  const orExpr = () => {
+    const parts = [andExpr()];
+    while (peek()?.toUpperCase() === 'OR') { pos++; parts.push(andExpr()); }
+    return parts.length === 1 ? parts[0] : { or: parts };
+  };
+  const andExpr = () => {
+    const parts = [atom()];
+    while (peek()?.toUpperCase() === 'AND') { pos++; parts.push(atom()); }
+    return parts.length === 1 ? parts[0] : { and: parts };
+  };
+  const atom = () => {
+    const t = tk[pos++];
+    if (t === '(') { const e = orExpr(); if (peek() === ')') pos++; return e; }
+    if (peek()?.toUpperCase() === 'WITH') pos += 2; // exceptions are ignored: the base license decides
+    return { id: String(t ?? '') };
+  };
+  return orExpr();
+}
+
+/** Returns the denied license ids in an expression, or [] when the expression is acceptable. */
+export function deniedIn(expression, { denyGpl, allow = new Set() }) {
+  const denied = (id) => {
+    const u = id.toUpperCase().replace(/\+$/, '');
+    if (allow.has(u)) return false;
+    return /^AGPL-/.test(u) || /^SSPL-/.test(u) || (denyGpl && /^GPL-/.test(u));
+  };
+  const walk = (n) => {
+    if (n.id !== undefined) return denied(n.id) ? [n.id] : [];
+    if (n.and) return n.and.flatMap(walk);
+    const per = n.or.map(walk);
+    return per.every((p) => p.length) ? per.flat() : [];
+  };
+  let tree;
+  try { tree = parseExpr(tokens(String(expression))); } catch { return []; }
+  return walk(tree);
+}
+
+const relFile = (repo, p) => path.relative(path.resolve(repo), path.resolve(p)).split(path.sep).join('/');
+const UNKNOWN = (l) => !l || /^(unknown|unlicensed|none|noassertion)$/i.test(l);
+
+export async function run(ctx) {
+  const res = await ctx.runTool('osv-scanner', [
+    'scan', 'source', '-r', '--format', 'json', '--all-packages', '--licenses', '--no-resolve', '--allow-no-lockfiles', '--no-ignore',
+    ...osvExcludeArgs(ctx),
+    '.',
+  ]);
+  if (res.status !== 'ran') return { status: 'not_run', reason: res.reason };
+  if (res.truncated) return { status: 'not_run', reason: 'OSV-Scanner output was too large to read completely.' };
+  if (res.exitCode !== 0 && res.exitCode !== 1) {
+    const tail = res.stderr.trim().split(/\r?\n/).slice(-3).join(' | ');
+    return { status: 'not_run', reason: `OSV-Scanner failed with exit code ${res.exitCode}${tail ? `: ${tail}` : ''}. Check network access (license data comes from deps.dev).` };
+  }
+  let osv;
+  try { osv = JSON.parse(res.stdout.replace(/^/, '')); } catch { return { status: 'not_run', reason: 'OSV-Scanner did not return valid JSON.' }; }
+
+  const kind = distributionKind(ctx);
+  const denyGpl = kind !== null;
+  const allow = new Set((ctx.config?.licenseAllow ?? []).map((l) => String(l).toUpperCase()));
+  const findings = [];
+  const counts = new Map();
+  const unknown = [];
+  let packages = 0;
+  for (const r of osv.results ?? []) {
+    const file = relFile(ctx.repo, r.source?.path ?? '');
+    for (const p of r.packages ?? []) {
+      packages++;
+      const lic = (p.licenses ?? []).map(String);
+      for (const l of lic) counts.set(l, (counts.get(l) ?? 0) + 1);
+      if (!lic.length || lic.every(UNKNOWN)) { unknown.push(`${p.package.name}@${p.package.version}`); continue; }
+      const expression = lic.join(' AND ');
+      const hits = [...new Set(deniedIn(expression, { denyGpl, allow }))];
+      if (!hits.length) continue;
+      const why = hits.some((h) => /^GPL-/i.test(h)) && !hits.some((h) => /^(AGPL|SSPL)-/i.test(h))
+        ? `GPL licenses are denied by default for ${kind === 'mobile' ? 'mobile (Expo)' : 'distributed desktop (Python plus Windows packaging)'} apps because shipping the app distributes the dependency`
+        : `${hits.join(', ')} is a network-copyleft license (AGPL and SSPL are denied by default)`;
+      findings.push({
+        category: 'license', severity: 'medium', confidence: 'high', key: `license:${hits.sort().join('+')}`, tool: 'osv-scanner', ruleId: `license/${hits[0]}`,
+        location: { file, package: p.package.name, version: p.package.version, ecosystem: p.package.ecosystem },
+        title: `${hits.join(', ')} license: ${p.package.name}@${p.package.version}`,
+        description: `${p.package.name}@${p.package.version} is licensed ${lic.join(', ')}. ${why}. This is a warning and does not block the release.`,
+        evidence: `${p.package.name}@${p.package.version} (${p.package.ecosystem}) in ${file}: ${lic.join(', ')}`,
+        refs: [], fix: `Replace the dependency, get a commercial license, or have Richard confirm the use is acceptable and add ${hits.join(', ')} to "licenseAllow" in vsg.config.json.`,
+      });
+    }
+  }
+  if (unknown.length) {
+    findings.push({
+      category: 'license', severity: 'info', confidence: 'medium', key: 'license-unknown', tool: 'osv-scanner', ruleId: 'license/unknown', location: {},
+      title: `${unknown.length} dependencies have no license data`,
+      description: 'OSV-Scanner could not determine a license for these packages, so they could not be checked against the deny list.',
+      evidence: unknown.slice(0, 20).join(', ') + (unknown.length > 20 ? `, and ${unknown.length - 20} more` : ''), refs: [], fix: 'Check these packages by hand if the product is distributed.',
+    });
+  }
+  const summary = [...counts].sort((a, b) => b[1] - a[1]).map(([name, count]) => ({ name, count }));
+  return {
+    status: 'ran', reason: '', findings, toolVersion: ctx.registry?.get('osv-scanner')?.version ?? null,
+    dataVersions: { licenses: 'deps.dev via OSV-Scanner' },
+    evidence: { 'licenses.json': JSON.stringify({ distribution: kind, denyGpl, allow: [...allow], packages, summary, unknown }, null, 2) },
+  };
+}
+
+export default { id, title, modes, requiredIn, timeoutSec, applies, run };

package/dist/security-runtime/src/checks/live-basic/index.mjs

@@ -0,0 +1,77 @@
+// live-basic (REQ-023): passive observations of a registered target. Security headers, cookie flags, CORS with an untrusted
+// Origin, a fixed list of sensitive files (with a random-path baseline) and source maps. Ordinary GETs only.
+import { analyzeCookies, analyzeCors, analyzeHeaders, UNTRUSTED_ORIGIN } from '../../live/analyze.mjs';
+import { probeSensitiveFiles } from '../../live/exposure.mjs';
+
+export const id = 'live-basic';
+export const title = 'Live site: headers, cookies, CORS, exposed files, source maps';
+export const modes = ['url', 'release'];
+export const requiredIn = ['url', 'release'];
+export const timeoutSec = 900;
+
+const MAX_MAPS = 20;
+const MAP_REF = /\/\/[#@]\s*sourceMappingURL=([^\s'"]+)/;
+const live = (f) => ({ category: 'live', confidence: 'high', tool: 'vsg-live', refs: [], ...f });
+
+// always applies: without a target the run reports not_run, so a required check can never be silently skipped
+export const applies = () => true;
+
+async function sourceMaps(session) {
+  const { items } = await session.scripts();
+  const findings = [];
+  let probed = 0;
+  for (const s of items) {
+    const tail = s.body.subarray(Math.max(0, s.body.length - 4096)).toString('utf8');
+    const ref = MAP_REF.exec(tail)?.[1] ?? s.headers.get('sourcemap') ?? s.headers.get('x-sourcemap');
+    if (!ref) continue;
+    const base = {
+      ruleId: 'source-map', key: `source-map:${new URL(s.url).pathname}`, severity: 'medium', confidence: 'confirmed',
+      fix: 'Do not deploy source maps to production (or serve them only to authenticated developers, or upload them to your error tracker instead). Disable production browser source maps in the build.', cwe: [540],
+    };
+    if (ref.startsWith('data:')) {
+      findings.push(live({ ...base, title: `Source map embedded in ${new URL(s.url).pathname}`, location: { url: s.url }, description: 'The script carries its original source code inline, so anyone can read the unminified source.', evidence: 'sourceMappingURL is an inline data: URI.' }));
+      continue;
+    }
+    if (probed >= MAX_MAPS) continue;
+    let mapUrl;
+    try { mapUrl = new URL(ref, s.url); } catch { continue; }
+    if (mapUrl.origin !== session.origin) continue;
+    probed++;
+    let res;
+    try { res = await session.get(mapUrl.href, { maxBytes: 65_536 }); } catch { continue; }
+    if (res.status !== 200 || !/"(sources|mappings)"\s*:/.test(res.body.toString('utf8'))) continue;
+    findings.push(live({ ...base, key: `source-map:${mapUrl.pathname}`, title: `Source map is publicly readable: ${mapUrl.pathname}`, location: { url: mapUrl.href }, description: 'The site publishes a source map, so anyone can reconstruct the original, readable source code of the script. That shows internal routes, comments and logic that make attacks easier.', evidence: `Referenced by ${new URL(s.url).pathname}; HTTP 200 and the content has source-map fields.` }));
+  }
+  return { findings, probed };
+}
+
+export async function run(ctx) {
+  const session = ctx.live;
+  if (!session) return { status: 'not_run', reason: 'No target URL was given. Pass a registered URL (vsg release --url <preview>).' };
+  const displayUrl = session.displayUrl ?? session.url;
+  let page;
+  try { page = await session.page(); } catch (e) { return { status: 'not_run', reason: `Could not read ${displayUrl}: ${e.message}` }; }
+  if (page.status < 200 || page.status >= 400) return { status: 'not_run', reason: `${displayUrl} returned HTTP ${page.status}, so its headers could not be assessed. Check that the site is up and does not block automated requests.` };
+
+  const findings = [...analyzeHeaders(page.headers, displayUrl), ...analyzeCookies(page.headers.getSetCookie?.() ?? [], displayUrl)];
+  let cors = null;
+  try {
+    cors = await session.get(session.url, { headers: { origin: UNTRUSTED_ORIGIN }, maxBytes: 65_536 });
+    findings.push(...analyzeCors(cors.headers, displayUrl));
+  } catch (e) { return { status: 'not_run', reason: `The CORS probe for ${displayUrl} failed: ${e.message}` }; }
+
+  const files = await probeSensitiveFiles(session);
+  findings.push(...files.findings);
+  if (files.probed.length && files.probed.every((p) => p.error)) return { status: 'not_run', reason: `None of the sensitive-file probes for ${displayUrl} could be read: ${files.probed[0].error}` };
+
+  let maps;
+  try { maps = await sourceMaps(session); } catch (e) { return { status: 'not_run', reason: `Could not read the scripts served by ${displayUrl}: ${e.message}` }; }
+  findings.push(...maps.findings);
+
+  return {
+    status: 'ran', reason: '', findings,
+    evidence: { 'summary.json': { url: displayUrl, entryStatus: page.status, sensitiveFilesProbed: files.probed, soft404BaselineStatus: files.baselineStatus, mapsProbed: maps.probed, requestsSoFar: session.requests.length } },
+  };
+}
+
+export default { id, title, modes, requiredIn, timeoutSec, applies, run };

package/dist/security-runtime/src/checks/live-js-secrets/index.mjs

@@ -0,0 +1,100 @@
+// live-js-secrets (REQ-012, REQ-023): secrets in the JavaScript a registered site serves. Fetches the entry HTML, collects same-origin
+// scripts (including Next.js _next/static chunks), caps at 200 files and 50 MB, and scans each with Betterleaks. Any secret is
+// Critical. JWTs are decoded: a Supabase service_role token is Critical; anon keys and project URLs are recorded in evidence only.
+import { hitToFinding, ROTATE, scanSecretsInBuffer } from '../_lib/secrets.mjs';
+import { scrubUrl } from '../../core/findings.mjs';
+import { inspectJwts, supabaseRefs } from '../../live/secrets.mjs';
+
+export const id = 'live-js-secrets';
+export const title = 'Live site: secrets in served JavaScript';
+export const modes = ['url', 'release'];
+export const requiredIn = ['url', 'release'];
+export const timeoutSec = 1800;
+
+// always applies: without a target the run reports not_run, so a required check can never be silently skipped
+export const applies = () => true;
+
+async function pool(items, limit, fn) {
+  const queue = [...items];
+  await Promise.all(Array.from({ length: Math.min(limit, queue.length) }, async () => { while (queue.length) await fn(queue.shift()); }));
+}
+
+export async function run(ctx) {
+  const session = ctx.live;
+  if (!session) return { status: 'not_run', reason: 'No target URL was given. Pass a registered URL (vsg release --url <preview>).' };
+  const displayUrl = session.displayUrl ?? scrubUrl(session.url);
+  let page;
+  let scripts;
+  try {
+    page = await session.page();
+    if (page.status < 200 || page.status >= 400) return { status: 'not_run', reason: `${displayUrl} returned HTTP ${page.status}, so its JavaScript could not be read. Check that the site is up and does not block automated requests.` };
+    if (page.truncated) return { status: 'not_run', reason: `Live JavaScript coverage is incomplete for ${displayUrl}: the entry HTML was truncated before all referenced scripts could be collected. Rerun after the entry page is readable in full.` };
+    scripts = await session.scripts();
+  } catch (e) { return { status: 'not_run', reason: `Could not read ${displayUrl}: ${e.message}` }; }
+
+  const truncated = scripts.items.filter((s) => s.truncated).map((s) => scrubUrl(s.url));
+  const failed = scripts.failed.map((s) => ({ ...s, url: scrubUrl(s.url) }));
+  if (failed.length || truncated.length || scripts.capped) {
+    const gaps = [];
+    if (failed.length) gaps.push(`${failed.length} referenced script(s) could not be read`);
+    if (truncated.length) gaps.push(`${truncated.length} referenced script(s) were truncated`);
+    if (scripts.capped) gaps.push(`the scan stopped at the file or size cap (${scripts.notScanned} script(s) were not scanned)`);
+    return {
+      status: 'not_run', reason: `Live JavaScript coverage is incomplete for ${displayUrl}: ${gaps.join('; ')}. Rerun after all referenced scripts are readable and within the scan cap.`,
+      evidence: { 'summary.json': { url: displayUrl, documentsScanned: 1 + scripts.items.length, bytes: scripts.bytes, capped: scripts.capped, failed, truncated, validated: ctx.mode === 'release' && !ctx.flags?.noValidate } },
+    };
+  }
+
+  const validate = ctx.mode === 'release' && !ctx.flags?.noValidate;
+  const docs = [{ url: page.url, body: page.body }, ...scripts.items.map((s) => ({ url: s.url, body: s.body }))];
+  const findings = [];
+  const anon = new Map();
+  const projects = new Set();
+  let failure = null;
+
+  await pool(docs, 4, async (doc) => {
+    if (failure) return;
+    const pathName = new URL(doc.url).pathname || '/';
+    const text = doc.body.toString('utf8');
+    for (const ref of supabaseRefs(text)) projects.add(ref);
+    const jwts = inspectJwts(text);
+    const handled = new Set();
+    for (const j of jwts) {
+      if (j.role === 'service_role') {
+        handled.add(j.hash);
+        findings.push({
+          category: 'secret', severity: 'critical', confidence: 'confirmed', tool: 'vsg-live', ruleId: 'supabase-service-role-jwt', key: `service-role:${j.hash}`,
+          location: { url: doc.url }, title: 'Supabase service_role key in served JavaScript',
+          description: 'A JWT whose payload has role "service_role" is served to every visitor. That key bypasses Row Level Security, so anyone can read and change all data in the project.',
+          evidence: `${j.redacted} (role service_role${j.ref ? `, project ${j.ref}` : ''})`, refs: [], cwe: [798],
+          fix: `${ROTATE} For Supabase, rotate the JWT secret or the service key in the project settings, and use the service key only in server code.`,
+        });
+      } else if (j.role === 'anon') {
+        handled.add(j.hash);
+        anon.set(j.hash, { redacted: j.redacted, ref: j.ref, file: pathName });
+      }
+    }
+    const res = await scanSecretsInBuffer(ctx, doc.body, { name: pathName, validate });
+    if (res.status !== 'ran') { failure ||= res.reason; return; }
+    for (const hit of res.hits) {
+      if (handled.has(hit.hash)) continue; // a JWT already classified above (anon keys are public by design)
+      const f = hitToFinding(hit, {
+        category: 'secret', severity: 'critical', where: 'in served JavaScript',
+        fix: `${ROTATE} Then find which source value or public-prefixed environment variable (NEXT_PUBLIC_, EXPO_PUBLIC_, VITE_) reached the bundle and rebuild.`,
+      });
+      f.location = { url: doc.url };
+      findings.push(f);
+    }
+  });
+  if (failure) return { status: 'not_run', reason: failure };
+
+  return {
+    status: 'ran', reason: '', findings, toolVersion: ctx.registry?.get('betterleaks')?.version ?? null,
+    evidence: {
+      'summary.json': { url: displayUrl, documentsScanned: docs.length, bytes: scripts.bytes, capped: scripts.capped, failed, validated: validate },
+      'supabase.json': { projects: [...projects].sort(), anonKeys: [...anon.values()].map((a) => ({ ...a, note: 'anon keys are public by design; recorded for review, not reported' })) },
+    },
+  };
+}
+
+export default { id, title, modes, requiredIn, timeoutSec, applies, run };

package/dist/security-runtime/src/checks/malware/clamav.mjs

@@ -0,0 +1,17 @@
+// ClamAV adapter (Linux): clamscan -r -i --no-summary. Exit 0 clean, 1 found, 2 error. vsg never installs ClamAV or updates its signatures.
+export const CLAMAV_TIMEOUT_MS = 30 * 60 * 1000;
+
+/** Parses "<path>: <Signature> FOUND" lines. Returns { status: 'clean' | 'detected' | 'error', detections: [{ file, signature }], reason }. */
+export function parseClamav(stdout, stderr, exitCode) {
+  const detections = [];
+  for (const line of String(stdout ?? '').split(/\r?\n/)) {
+    const m = /^(.+): (\S+) FOUND\s*$/.exec(line);
+    if (m) detections.push({ file: m[1], signature: m[2] });
+  }
+  if (detections.length) return { status: 'detected', detections, reason: '' };
+  if (exitCode === 0) return { status: 'clean', detections, reason: '' };
+  const why = String(stderr ?? '').split(/\r?\n/).find((l) => /error|no supported database|can't|cannot/i.test(l)) ?? String(stderr ?? '').trim().split(/\r?\n/)[0];
+  return { status: 'error', detections, reason: `clamscan exited ${exitCode}${why ? `: ${why.slice(0, 200)}` : ''}` };
+}
+
+export const clamscanArgs = (targets) => ['-r', '-i', '--no-summary', ...targets];

package/dist/security-runtime/src/checks/malware/defender.mjs

@@ -0,0 +1,43 @@
+// Microsoft Defender adapter (Windows): MpCmdRun.exe custom scans, no elevation needed, nothing remediated.
+// Sources: Microsoft Learn, "Use the command line to manage Microsoft Defender Antivirus" (-Scan, -ScanType 3, -File, -DisableRemediation;
+// exit 0 = no malware or remediated, 2 = malware not remediated or scan error; detections are printed in the command output) and the
+// output of a real clean scan ("Scanning <path> found no threats."). The detection block layout (a "Threat" line, then "file" resource
+// lines) follows public MpCmdRun parsers; the parser below accepts both "Threat" and "Threat Name" and any resource kind.
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const DEFENDER_TIMEOUT_MS = 30 * 60 * 1000;
+
+/** MpCmdRun.exe: newest platform folder first, then the inbox copy. Null when not Windows or not found. */
+export function findDefender(env = process.env, platform = process.platform) {
+  if (platform !== 'win32') return null;
+  const candidates = [path.join(env.ProgramFiles ?? 'C:\\Program Files', 'Windows Defender', 'MpCmdRun.exe')];
+  const platformDir = path.join(env.ProgramData ?? 'C:\\ProgramData', 'Microsoft', 'Windows Defender', 'Platform');
+  try { for (const v of fs.readdirSync(platformDir).sort().reverse()) candidates.unshift(path.join(platformDir, v, 'MpCmdRun.exe')); } catch { /* no platform folder */ }
+  return candidates.find((c) => fs.existsSync(c)) ?? null;
+}
+
+export const defenderArgs = (target) => ['-Scan', '-ScanType', '3', '-File', target, '-DisableRemediation'];
+
+/**
+ * Parses MpCmdRun custom-scan output. Returns { status: 'clean' | 'detected' | 'error', threats: [{ name, files: [path] }], reason }.
+ * A reported threat count with no parsable block still counts as a detection (the target path is the location).
+ */
+export function parseDefender(stdout, exitCode, target) {
+  const text = String(stdout ?? '');
+  const threats = [];
+  let current = null;
+  for (const line of text.split(/\r?\n/)) {
+    const t = /^\s*Threat(?:\s+Name|\s+\d+)?\s*:\s*(.+?)\s*$/i.exec(line);
+    if (t) { current = { name: t[1], files: [] }; threats.push(current); continue; }
+    const r = /^\s+(?:file|containerfile|folder|process|regkey|regvalue|webfile|behavior|amsi)\s*:\s*(.+?)\s*$/i.exec(line);
+    if (r && current) current.files.push(r[1].replace(/^_/, ''));
+  }
+  const count = Number(/found\s+(\d+)\s+threats?/i.exec(text)?.[1] ?? 0);
+  if (threats.length || count > 0) {
+    if (!threats.length) threats.push({ name: 'unnamed threat (see the raw Defender output)', files: [target] });
+    return { status: 'detected', threats, reason: '' };
+  }
+  if (exitCode === 0) return { status: 'clean', threats: [], reason: '' };
+  return { status: 'error', threats: [], reason: `MpCmdRun exited ${exitCode} without a detection: the scan did not complete` };
+}