@nikhil_telkar/codeshield 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 Nikhil Telkar
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

package/README.md

@@ -1,3 +1,290 @@
-# Temporary Holding Version
+# CodeShield
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+> **A fast, zero-dependency security scanner for AI-generated codebases.**
+
+AI coding assistants (Cursor, Copilot, ChatGPT, Claude, v0, Bolt) are extraordinary at writing code quickly, but they frequently reproduce dangerous security anti-patterns: hardcoding secrets, hallucinating nonexistent npm packages, string-concatenating SQL queries, using `Math.random()` for security tokens, or omitting basic security headers.
+
+**CodeShield** acts as a lightweight security guardrail for your development workflow and CI/CD pipelines.
+
+---
+
+## ⚡ 30-Second Quick Start
+
+No installation required. Run directly with `npx`:
+
+```bash
+# Scan current directory
+npx codeshield scan .
+
+# Automatically apply safe fixes (.gitignore, .env.example)
+npx codeshield fix .
+
+# Check if an npm package is real, safe, or a typosquat
+npx codeshield verify express
+```
+
+Or install globally:
+
+```bash
+npm install -g codeshield
+codeshield scan .
+```
+
+---
+
+## 🖥️ Example Terminal Output
+
+```text
+CodeShield — scanning /Users/dev/my-ai-app
+(offline mode: npm registry checks skipped)
+
+────────────────────────────────────────────────────────────
+Security Score : 54/100 [Grade C] (Needs Attention)
+Files Scanned  : 42 files
+Findings       : 4 [1 critical, 2 high, 1 medium]
+Duration       : 32ms
+────────────────────────────────────────────────────────────
+
+🎯 Fix These First (Top Priorities):
+
+🔴 CRITICAL [SEC-001] Hardcoded AWS Access Key
+  Location : src/config/aws.ts:14
+  CWE      : CWE-798
+  Why      : An AWS Access Key ID was found directly in your code. Anyone with access
+             to this repo can compromise your AWS account and spin up costly resources.
+  Fix      : Move credentials to process.env.AWS_ACCESS_KEY_ID or use IAM roles.
+  Prompt   : Refactor src/config/aws.ts to load AWS credentials from
+             process.env.AWS_ACCESS_KEY_ID and process.env.AWS_SECRET_ACCESS_KEY.
+             Update .env.example with placeholders.
+
+🟠 HIGH [DEP-001] Likely Hallucinated npm Package
+  Location : package.json:18
+  CWE      : CWE-829
+  Why      : "auth0-express-secure-kit" does not exist in the npm registry.
+             AI models often hallucinate plausible-sounding package names.
+  Fix      : Remove the package from package.json and replace it with an official library.
+  Prompt   : The dependency "auth0-express-secure-kit" does not exist on npm.
+             Rewrite our auth integration using the official "express-openid-connect" SDK.
+
+🟡 MEDIUM [ENV-001] .env File Not in .gitignore
+  Location : .env:1
+  CWE      : CWE-552
+  Why      : A .env file containing environment variables exists but is not ignored by git.
+  Fix      : Run `codeshield fix` to automatically add .env to .gitignore.
+```
+
+---
+
+## 🔍 What CodeShield Checks
+
+CodeShield evaluates codebases across four core dimensions:
+
+### 1. Secrets Scanner (`src/scanners/secrets.ts`)
+- **AWS Credentials:** Hardcoded `AKIA...` access keys and credentials (`CWE-798`).
+- **Stripe Keys:** Live API keys (`sk_live_...`) (`CWE-798`).
+- **GitHub Tokens:** Personal access tokens (`ghp_...`, `github_pat_...`) (`CWE-798`).
+- **AI Provider API Keys:** OpenAI (`sk-...`), Anthropic (`sk-ant-...`) keys (`CWE-798`).
+- **Supabase Service Keys:** Hardcoded `service_role` JWTs (`CWE-798`).
+- **Database Connection Strings:** URLs containing credentials (`postgres://user:pass@host/db`) (`CWE-256`).
+- **Private Key Headers:** Unencrypted PEM blocks (`BEGIN RSA/OPENSSH PRIVATE KEY`) (`CWE-312`).
+- **Hardcoded JWT Secrets:** Literal strings passed to `jwt.sign()` (`CWE-798`).
+- **High-Entropy Generic Secrets:** Assignments to API key / secret variables (`CWE-798`).
+- **Client-Side Secret Leakage:** Private keys placed in `NEXT_PUBLIC_*` or `VITE_*` variables (`CWE-200`).
+
+### 2. Environment Scanner (`src/scanners/env.ts`)
+- **Unignored `.env` Files:** Real credentials exposed to git tracking (`CWE-552`).
+- **Committed `.env` Files:** Credentials already committed into git (`CWE-552`).
+- **Missing `.env.example`:** Repositories with `.env` but no sanitized template for teammates (`CWE-552`).
+- **Production Source Maps:** `productionBrowserSourceMaps: true` or `sourcemap: true` leaking proprietary source code in production bundles (`CWE-540`).
+
+### 3. Dependency Scanner (`src/scanners/dependencies.ts`)
+- **Hallucinated Packages (DEP-001):** Packages in `package.json` that do not exist on npm (`CWE-829`).
+- **Newly Published Packages (DEP-002):** Dependencies published $< 30$ days ago (`CWE-829`).
+- **Install Scripts (DEP-003):** Packages with `preinstall`, `install`, or `postinstall` lifecycle hooks that run arbitrary shell code (`CWE-829`).
+- **Typosquatting (DEP-004):** Dependencies 1 edit away from popular libraries (`expres`, `reakt`, `lodahs`) (`CWE-829`).
+- **Registry Errors (DEP-005):** Unreachable packages reported as "Could not check" (never silently passed as safe).
+
+### 4. Code Scanner (`src/scanners/code.ts`)
+- **Arbitrary Code Execution:** `eval()` and `new Function()` (`CWE-95`).
+- **SQL Injection:** String concatenation in `db.query()`, `prisma.$queryRawUnsafe()`, etc. (`CWE-89`).
+- **NoSQL Injection:** Raw `req.body` or `req.query` passed directly into MongoDB/Mongoose filters (`CWE-943`).
+- **Command Injection:** `child_process.exec()` called with variables (`CWE-78`).
+- **Insecure Randomness:** `Math.random()` used for passwords, secrets, or tokens (`CWE-338`).
+- **Broken Cryptography:** MD5 or SHA-1 used for password hashing (`CWE-328`).
+- **Cross-Site Scripting (XSS):** `dangerouslySetInnerHTML` or `element.innerHTML` with dynamic variables (`CWE-79`).
+- **Permissive CORS:** `cors({ origin: '*' })` with credentials enabled (`CWE-942`).
+- **Insecure Cookies:** `res.cookie()` without `httpOnly: true` or `secure: true` (`CWE-1004`, `CWE-614`).
+- **Indefinite JWTs:** `jwt.sign()` calls missing an `expiresIn` option (`CWE-613`).
+- **Missing Helmet:** Express applications without the `helmet` security header middleware (`CWE-693`).
+- **Stack Trace Leakage:** Returning `err.stack` in HTTP responses (`CWE-209`).
+- **Client-Side Supabase Admin:** Using Supabase `service_role` keys inside frontend files (`CWE-200`).
+
+---
+
+## 🛠️ CLI Commands & Options
+
+```text
+Usage:
+  codeshield scan [path] [options]    Scan directory (default: current dir)
+  codeshield fix [path] [--yes]       Apply safe, reversible fixes automatically
+  codeshield verify <package>         Check a single npm package
+  codeshield --help                   Show this help
+  codeshield --version                Show version
+```
+
+### Scan Options
+
+| Option | Description |
+| :--- | :--- |
+| `--detailed` | Show full metadata for all findings (CWE, rule ID, file, line, explanation). |
+| `--json` | Output machine-readable JSON (ideal for CI pipelines). |
+| `--sarif` | Output static analysis results in SARIF v2.1.0 format (for GitHub Security). |
+| `--fail-on <severity>` | Set exit code to 1 if any findings match or exceed `<severity>` (`critical`, `high`, `medium`, `low`, `info`). Default: `info`. |
+| `--severity <severity>` | Filter the report to only include findings at or above `<severity>`. Default: `info`. |
+| `--offline` | Skip all npm registry lookups (runs purely offline). |
+
+### Fix Options
+
+| Option | Description |
+| :--- | :--- |
+| `-y, --yes` | Apply safe fixes automatically without an interactive prompt. |
+
+*Safety guarantee:* `codeshield fix` only applies reversible, non-destructive changes (`.gitignore` additions, creating `.env.example`). It creates `.codeshield.bak` backups before modifying files and never writes outside the scan root.
+
+### Exit Codes
+
+| Code | Meaning |
+| :---: | :--- |
+| `0` | **Passed:** No findings at or above the `--fail-on` threshold. |
+| `1` | **Failed:** One or more findings detected at or above the `--fail-on` threshold. |
+| `2` | **Tool Error:** Invalid CLI arguments, missing files, or unreadable directory. |
+
+---
+
+## 📊 How the Security Score Works
+
+CodeShield calculates an objective score between **0 and 100**:
+
+$$\text{Score} = \max\left(0, 100 - \sum \text{Deductions}\right)$$
+
+### Severity Weights & Deductions
+
+| Severity | Points Deducted per Finding | Maximum Deductions per Rule |
+| :--- | :---: | :---: |
+| **Critical** | -25 | Max 2 findings counted (-50) |
+| **High** | -15 | Max 2 findings counted (-30) |
+| **Medium** | -8 | Max 2 findings counted (-16) |
+| **Low** | -3 | Max 2 findings counted (-6) |
+| **Info** | -1 | Max 2 findings counted (-2) |
+
+### Anti-Noise Rule Capping
+To ensure that a single noisy rule in a large codebase does not artificially zero out your score, deductions are capped at **2 findings per individual rule**.
+
+### Grade Scale
+
+- **90–100 [Grade A]** — Excellent: No critical or high issues found.
+- **75–89 [Grade B]** — Good: Minor low/medium issues.
+- **50–74 [Grade C]** — Needs Attention: High-risk findings present.
+- **25–49 [Grade D]** — Poor: Multiple severe vulnerabilities.
+- **0–24 [Grade F]** — Failing: Immediate remediation required.
+
+---
+
+## 🤖 CI / CD Integration
+
+### GitHub Actions Workflow
+
+Add `.github/workflows/security.yml`:
+
+```yaml
+name: CodeShield Security Scan
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      # Option A: Fail the build on high/critical findings
+      - name: Run CodeShield Scan
+        run: npx codeshield scan . --fail-on high
+
+      # Option B: Upload SARIF report to GitHub Advanced Security tab
+      - name: Generate SARIF report
+        if: always()
+        run: npx codeshield scan . --sarif > results.sarif
+
+      - name: Upload SARIF to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: results.sarif
+```
+
+---
+
+## 🔒 Privacy & Security Statement
+
+- **100% Local Execution:** CodeShield never uploads your source code, filenames, or directory paths to external servers.
+- **Zero Telemetry:** No analytics, no phone-home pings, no cookies, no tracking.
+- **Zero Runtime Dependencies:** Zero third-party packages installed in production. Zero supply chain risk.
+- **Strict Read-Only Scanning:** CodeShield inspects text files using Node built-in file APIs. It **never** dynamically evaluates, requires, or imports your code.
+- **Optional Network Access:** The only network request CodeShield can make is an HTTPS query to `https://registry.npmjs.org/<package>` to verify npm packages during `codeshield verify` or standard scans. Pass `--offline` to run completely disconnected from the network.
+
+---
+
+## ⚠️ Honest Limitations
+
+> **"CodeShield catches common security mistakes; it does not prove your code is secure."**
+
+1. **Heuristic Pattern Matching:** CodeShield scans for known insecure patterns, signatures, and anti-patterns common to AI-generated code. It does not perform symbolic execution or full AST taint tracking across modules.
+2. **Obfuscation & Dynamic Code:** Heavily obfuscated code or multi-step indirect injections (e.g., retrieving a malicious SQL string from a third-party microservice) will not be detected.
+3. **Business Logic Vulnerabilities:** Flaws in business logic (such as missing multi-tenant authorization checks or broken role-based access control) require human review and threat modeling.
+4. **Defense in Depth:** CodeShield is designed as a fast pre-commit check and CI gate. It should be used alongside comprehensive unit/integration testing, dynamic testing (DAST), and professional security audits.
+
+---
+
+## 🧩 How to Add a Rule
+
+CodeShield uses a data-driven rule registry. To add a new rule:
+
+1. Open [`src/scanners/code.ts`](file:///Users/nikhiltelkar19gmail.com/Desktop/CODESHILD/src/scanners/code.ts) (or `secrets.ts` / `env.ts`).
+2. Add a rule object to `CODE_RULES`:
+
+```typescript
+{
+  id: 'COD-014',
+  severity: 'high',
+  cwe: 'CWE-312',
+  title: 'Sensitive Token Stored in LocalStorage',
+  explanation: 'Storing session tokens in localStorage exposes them to XSS attacks.',
+  fix: 'Store tokens in HttpOnly, secure cookies instead.',
+  prompt: 'Refactor this code to store auth tokens in HttpOnly secure cookies instead of localStorage.',
+  matches(line: string, _file: ScannedFile): boolean {
+    return /localStorage\.setItem\s*\(\s*['"`](?:token|jwt|auth)['"`]/i.test(line);
+  },
+}
+```
+
+3. Add unit tests and ReDoS performance benchmarks in `tests/code.test.ts`.
+4. Run `npm test` to verify.
+
+See [CONTRIBUTING.md](file:///Users/nikhiltelkar19gmail.com/Desktop/CODESHILD/CONTRIBUTING.md) for full instructions and best practices.
+
+---
+
+## 📄 License
+
+[MIT](file:///Users/nikhiltelkar19gmail.com/Desktop/CODESHILD/LICENSE) © 2026 Nikhil Telkar

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export declare function runCli(argv?: string[]): Promise<number>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AA4LA,wBAAsB,MAAM,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAyFpF"}

package/dist/cli.js

@@ -0,0 +1,237 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parseArgs } from 'node:util';
+import { secretsScanner } from './scanners/secrets.js';
+import { envScanner } from './scanners/env.js';
+import { codeScanner } from './scanners/code.js';
+import { fetchRegistry } from './utils/registry.js';
+import { isValidNpmName } from './scanners/dependencies.js';
+import { runScanAsync } from './engine/runner.js';
+import { SEVERITY_RANK, SEVERITIES } from './utils/constants.js';
+import { sanitize } from './utils/sanitize.js';
+import { renderReport, calculateScore } from './report/index.js';
+import { runFix } from './fix/fixer.js';
+import { readLastScan, saveLastScan, compareWithLastScan } from './fix/history.js';
+function getVersion() {
+    try {
+        const currentDir = dirname(fileURLToPath(import.meta.url));
+        const pkgPath = resolve(currentDir, '..', 'package.json');
+        const content = readFileSync(pkgPath, 'utf8');
+        const parsed = JSON.parse(content);
+        return parsed.version ?? '0.1.0';
+    }
+    catch {
+        return '0.1.0';
+    }
+}
+function isValidSeverity(s) {
+    return SEVERITIES.includes(s);
+}
+const HELP_TEXT = `
+CodeShield — Security scanner for AI-generated codebases
+
+Usage:
+  codeshield scan [path] [options]    Scan directory (default: current dir)
+  codeshield fix [path] [--yes]       Apply safe, reversible fixes automatically
+  codeshield verify <package>         Check a single npm package
+  codeshield --help                   Show this help
+  codeshield --version                Show version
+
+Scan options:
+  --detailed                          Show all findings with full metadata
+  --json                              Output results as JSON (for CI)
+  --sarif                             Output results as SARIF v2.1.0
+  --fail-on <severity>                Exit code 1 if findings >= severity
+                                      (critical|high|medium|low|info, default: info)
+  --severity <severity>               Minimum severity to include in report
+                                      (critical|high|medium|low|info, default: info)
+  --offline                           Skip npm registry network checks
+
+Fix options:
+  -y, --yes                           Skip confirmation prompt and apply fixes
+
+Examples:
+  codeshield scan .
+  codeshield scan ./my-project --detailed
+  codeshield scan . --fail-on high
+  codeshield scan . --json
+  codeshield scan . --sarif > results.sarif
+  codeshield fix .
+  codeshield fix ./my-project --yes
+  codeshield verify express
+
+Exit codes:
+  0   Passed (no findings at or above fail-on threshold)
+  1   Findings detected at or above fail-on threshold
+  2   Tool error
+`.trim();
+async function runVerify(pkgName) {
+    const safeName = sanitize(pkgName);
+    if (!isValidNpmName(pkgName)) {
+        console.error(`Error: "${safeName}" is not a valid npm package name.`);
+        return 2;
+    }
+    console.log(`Checking "${safeName}" on npm registry…`);
+    const result = await fetchRegistry(pkgName, 5_000);
+    if (result.status === 'not-found') {
+        console.log(`\n🔴 CRITICAL [DEP-001] Package does not exist on npm.`);
+        console.log(`  "${safeName}" was not found in the npm registry.`);
+        console.log(`  This may be a hallucinated package name from an AI tool.`);
+        console.log(`  Verify at https://www.npmjs.com/package/${safeName}`);
+        return 1;
+    }
+    if (result.status === 'error') {
+        console.error(`\n⚠️  Could not check "${safeName}": ${sanitize(result.reason)}`);
+        console.error(`  The package has NOT been verified as safe.`);
+        return 2;
+    }
+    const { data } = result;
+    const thirtyDaysMs = 30 * 24 * 60 * 60 * 1000;
+    let hasFindings = false;
+    console.log(`\n✅ Package "${safeName}" exists on npm.`);
+    if (data.created) {
+        console.log(`  First published : ${data.created}`);
+        if (Date.now() - Date.parse(data.created) < thirtyDaysMs) {
+            console.log(`  🟠 HIGH [DEP-002] Published less than 30 days ago — verify this is intentional.`);
+            hasFindings = true;
+        }
+    }
+    const dangerScripts = ['install', 'postinstall', 'preinstall'].filter((s) => s in data.latestScripts);
+    if (dangerScripts.length > 0) {
+        console.log(`  🟠 HIGH [DEP-003] Has install script(s): ${dangerScripts.join(', ')}`);
+        console.log(`  Audit the script source before installing.`);
+        hasFindings = true;
+    }
+    if (!hasFindings) {
+        console.log(`  No issues found. Always review packages before use.`);
+    }
+    return hasFindings ? 1 : 0;
+}
+async function runScan(opts) {
+    const root = resolve(opts.targetPath);
+    const isStructuredOutput = opts.mode === 'json' || opts.mode === 'sarif';
+    if (!isStructuredOutput) {
+        console.log(`CodeShield — scanning ${root}`);
+        if (opts.offline)
+            console.log('(offline mode: npm registry checks skipped)');
+    }
+    let result;
+    try {
+        result = await runScanAsync({
+            root,
+            minSeverity: opts.minSeverity,
+            scanners: [secretsScanner, envScanner, codeScanner],
+            depOptions: { offline: opts.offline },
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error during scan: ${sanitize(msg)}`);
+        return 2;
+    }
+    const scoreDetails = calculateScore(result.findings);
+    const previousScan = readLastScan(root);
+    let historyText;
+    if (previousScan) {
+        const comparison = compareWithLastScan(previousScan, scoreDetails.score, result.findings);
+        historyText = comparison.summaryText;
+    }
+    saveLastScan(root, scoreDetails.score, scoreDetails.grade, result.findings);
+    const output = renderReport(result, {
+        mode: opts.mode,
+        version: getVersion(),
+        ...(historyText ? { historyText } : {}),
+    });
+    console.log(output);
+    const failOnRank = SEVERITY_RANK[opts.failOn] ?? 0;
+    const hasFailingFindings = result.findings.some((f) => (SEVERITY_RANK[f.severity] ?? 0) >= failOnRank);
+    return hasFailingFindings ? 1 : 0;
+}
+export async function runCli(argv = process.argv.slice(2)) {
+    try {
+        const { values, positionals } = parseArgs({
+            args: argv,
+            options: {
+                help: { type: 'boolean', short: 'h', default: false },
+                version: { type: 'boolean', short: 'v', default: false },
+                offline: { type: 'boolean', default: false },
+                detailed: { type: 'boolean', default: false },
+                json: { type: 'boolean', default: false },
+                sarif: { type: 'boolean', default: false },
+                yes: { type: 'boolean', short: 'y', default: false },
+                severity: { type: 'string', default: 'info' },
+                'fail-on': { type: 'string' },
+            },
+            allowPositionals: true,
+            strict: true,
+        });
+        if (values.version) {
+            console.log(`codeshield v${getVersion()}`);
+            return 0;
+        }
+        if (values.help || positionals.length === 0) {
+            console.log(HELP_TEXT);
+            return 0;
+        }
+        const severityArg = values.severity ?? 'info';
+        if (!isValidSeverity(severityArg)) {
+            console.error(`Error: Invalid severity "${sanitize(severityArg)}". ` +
+                `Valid values: ${SEVERITIES.join(', ')}`);
+            return 2;
+        }
+        const failOnArg = values['fail-on'] ?? severityArg;
+        if (!isValidSeverity(failOnArg)) {
+            console.error(`Error: Invalid fail-on severity "${sanitize(failOnArg)}". ` +
+                `Valid values: ${SEVERITIES.join(', ')}`);
+            return 2;
+        }
+        let mode = 'simple';
+        if (values.json)
+            mode = 'json';
+        else if (values.sarif)
+            mode = 'sarif';
+        else if (values.detailed)
+            mode = 'detailed';
+        const command = positionals[0];
+        if (command === 'scan') {
+            const targetPath = positionals[1] ?? '.';
+            return await runScan({
+                targetPath,
+                offline: values.offline ?? false,
+                minSeverity: severityArg,
+                failOn: failOnArg,
+                mode,
+            });
+        }
+        if (command === 'fix') {
+            const targetPath = positionals[1] ?? '.';
+            return await runFix(targetPath, values.yes ?? false);
+        }
+        if (command === 'verify') {
+            const pkgName = positionals[1];
+            if (!pkgName) {
+                console.error('Error: "verify" requires a package name. Example: codeshield verify express');
+                return 2;
+            }
+            return await runVerify(pkgName);
+        }
+        console.error(`Error: Unknown command "${sanitize(command)}". Run "codeshield --help" for available commands.`);
+        return 2;
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.error(`Error: ${sanitize(message)}`);
+        return 2;
+    }
+}
+const isDirectlyExecuted = process.argv[1] !== undefined &&
+    (process.argv[1] === fileURLToPath(import.meta.url) ||
+        process.argv[1].endsWith('/codeshield') ||
+        process.argv[1].endsWith('\\codeshield'));
+if (isDirectlyExecuted) {
+    const exitCode = await runCli();
+    process.exit(exitCode);
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAc,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEnF,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAyB,CAAC;QAC3D,OAAO,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,OAAQ,UAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCjB,CAAC,IAAI,EAAE,CAAC;AAET,KAAK,UAAU,SAAS,CAAC,OAAe;IACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEnC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,WAAW,QAAQ,oCAAoC,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,oBAAoB,CAAC,CAAC;IAEvD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEnD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,MAAM,QAAQ,sCAAsC,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,6CAA6C,QAAQ,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,0BAA0B,QAAQ,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IACxB,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC9C,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,kBAAkB,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,YAAY,EAAE,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;YACjG,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAI,CAAC,SAAS,EAAE,aAAa,EAAE,YAAY,CAAW,CAAC,MAAM,CAC9E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,aAAa,CAC/B,CAAC;IACF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,8CAA8C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC5D,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAUD,KAAK,UAAU,OAAO,CAAC,IAAwB;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC;IAEzE,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,YAAY,CAAC;YAC1B,IAAI;YACJ,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,CAAC,cAAc,EAAE,UAAU,EAAE,WAAW,CAAC;YACnD,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,sBAAsB,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,WAA+B,CAAC;IAEpC,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,UAAU,GAAG,mBAAmB,CAAC,YAAY,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1F,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IACvC,CAAC;IAED,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5E,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE;QAClC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,UAAU,EAAE;QACrB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEpB,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAC7C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,UAAU,CACtD,CAAC;IAEF,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;YACxC,IAAI,EAAE,IAAI;YACV,OAAO,EAAE;gBACP,IAAI,EAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC3D,OAAO,EAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC3D,OAAO,EAAK,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC/C,QAAQ,EAAI,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC/C,IAAI,EAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC/C,KAAK,EAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC/C,GAAG,EAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC3D,QAAQ,EAAI,EAAE,IAAI,EAAE,QAAQ,EAAG,OAAO,EAAE,MAAM,EAAE;gBAChD,SAAS,EAAG,EAAE,IAAI,EAAE,QAAQ,EAAE;aAC/B;YACD,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,eAAe,UAAU,EAAE,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,CAAC;QACX,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvB,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC;QAC9C,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CACX,4BAA4B,QAAQ,CAAC,WAAW,CAAC,KAAK;gBACtD,iBAAiB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzC,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC;QACnD,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CACX,oCAAoC,QAAQ,CAAC,SAAS,CAAC,KAAK;gBAC5D,iBAAiB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzC,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QAED,IAAI,IAAI,GAAe,QAAQ,CAAC;QAChC,IAAI,MAAM,CAAC,IAAI;YAAE,IAAI,GAAG,MAAM,CAAC;aAC1B,IAAI,MAAM,CAAC,KAAK;YAAE,IAAI,GAAG,OAAO,CAAC;aACjC,IAAI,MAAM,CAAC,QAAQ;YAAE,IAAI,GAAG,UAAU,CAAC;QAE5C,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC;QAEhC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;YACzC,OAAO,MAAM,OAAO,CAAC;gBACnB,UAAU;gBACV,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK;gBAChC,WAAW,EAAE,WAAW;gBACxB,MAAM,EAAE,SAAS;gBACjB,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;YACzC,OAAO,MAAM,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;gBAC7F,OAAO,CAAC,CAAC;YACX,CAAC;YACD,OAAO,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAED,OAAO,CAAC,KAAK,CACX,2BAA2B,QAAQ,CAAC,OAAO,CAAC,oDAAoD,CACjG,CAAC;QACF,OAAO,CAAC,CAAC;IAEX,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,UAAU,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,kBAAkB,GACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;IAC7B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;AAE9C,IAAI,kBAAkB,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC;IAChC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzB,CAAC"}

package/dist/engine/fileWalker.d.ts

@@ -0,0 +1,15 @@
+import { ScannedFile } from '../types.js';
+export interface FileWalkerOptions {
+    root: string;
+    maxFiles?: number;
+    maxBytes?: number;
+    onSkip?: (filePath: string, reason: string) => void;
+}
+export interface FileWalkerResult {
+    files: ScannedFile[];
+    filesVisited: number;
+    filesSkipped: number;
+    truncated: boolean;
+}
+export declare function walkFiles(root: string, options?: Partial<FileWalkerOptions>): FileWalkerResult;
+//# sourceMappingURL=fileWalker.d.ts.map

package/dist/engine/fileWalker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileWalker.d.ts","sourceRoot":"","sources":["../../src/engine/fileWalker.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAS1C,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CACrD;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,OAAO,CAAC,iBAAiB,CAAM,GAAG,gBAAgB,CAkLlG"}