@oculum/scanner 1.0.12 → 1.0.13

package/dist/detect/config/comments.js

@@ -0,0 +1,206 @@
+"use strict";
+/**
+ * Layer 1: Comment Scanning for AI Patterns
+ * Detects suspicious patterns in code comments that may indicate
+ * prompt injection attempts or AI-generated security bypasses
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectAICommentPatterns = detectAICommentPatterns;
+const BASE_CONFIDENCE = 0.15;
+// Patterns that indicate potential prompt injection or AI manipulation
+const AI_COMMENT_PATTERNS = [
+    // Prompt injection attempts
+    {
+        pattern: /ignore\s+(previous|all|above)\s+instructions?/i,
+        name: 'Prompt Injection Attempt',
+        severity: 'high',
+        description: 'Comment contains prompt injection language that could manipulate AI assistants',
+    },
+    {
+        pattern: /disregard\s+(security|safety|previous|all)/i,
+        name: 'Security Disregard Instruction',
+        severity: 'high',
+        description: 'Comment instructs to disregard security measures',
+    },
+    {
+        pattern: /you\s+are\s+now\s+in\s+(developer|debug|admin)\s+mode/i,
+        name: 'Mode Override Attempt',
+        severity: 'high',
+        description: 'Comment attempts to override AI mode or permissions',
+    },
+    {
+        pattern: /override\s+(security|safety)\s+protocols?/i,
+        name: 'Security Override Instruction',
+        severity: 'high',
+        description: 'Comment instructs to override security protocols',
+    },
+    {
+        pattern: /system:\s*ignore/i,
+        name: 'System Prompt Injection',
+        severity: 'critical',
+        description: 'Comment contains system-level prompt injection',
+    },
+    // Developer instructions to skip security
+    {
+        pattern: /skip\s+(security|validation|sanitization|auth)/i,
+        name: 'Security Skip Instruction',
+        severity: 'medium',
+        description: 'Comment instructs to skip security measures',
+    },
+    {
+        pattern: /don['']?t\s+(validate|sanitize|check|verify)/i,
+        name: 'Validation Skip Instruction',
+        severity: 'medium',
+        description: 'Comment instructs to skip validation',
+    },
+    {
+        pattern: /disable\s+(auth|authentication|authorization|csrf|xss)/i,
+        name: 'Security Disable Instruction',
+        severity: 'high',
+        description: 'Comment instructs to disable security features',
+    },
+    // Security-related TODOs - downgraded as these are often addressed or intentional
+    {
+        pattern: /TODO[:\s].*fix.*security/i,
+        name: 'Security TODO',
+        severity: 'low', // Downgraded from medium
+        description: 'Unresolved security-related TODO comment',
+    },
+    {
+        pattern: /FIXME[:\s].*vulnerab/i,
+        name: 'Vulnerability FIXME',
+        severity: 'medium', // Downgraded from high
+        description: 'Unresolved vulnerability-related FIXME comment',
+    },
+    {
+        pattern: /HACK[:\s].*bypass/i,
+        name: 'Security Bypass HACK',
+        severity: 'medium', // Downgraded from high
+        description: 'Hack comment indicating security bypass',
+    },
+    {
+        pattern: /TODO[:\s].*add\s+(auth|authentication|authorization)/i,
+        name: 'Missing Auth TODO',
+        severity: 'low', // Downgraded from high - often outdated or in test code
+        description: 'TODO indicates authentication may need implementation',
+    },
+    {
+        pattern: /TODO[:\s].*implement\s+(validation|sanitization)/i,
+        name: 'Missing Validation TODO',
+        severity: 'low', // Downgraded from medium
+        description: 'TODO indicates validation may need implementation',
+    },
+    // AI-generated placeholder patterns - downgraded to info (usually harmless)
+    {
+        pattern: /TODO[:\s].*add\s+proper\s+error\s+handling/i,
+        name: 'AI Placeholder: Error Handling',
+        severity: 'info', // Downgraded from low
+        description: 'AI-typical placeholder comment for error handling',
+    },
+    {
+        pattern: /TODO[:\s].*implement\s+proper/i,
+        name: 'AI Placeholder: Implementation',
+        severity: 'info', // Downgraded from low
+        description: 'AI-typical placeholder comment for implementation',
+    },
+    {
+        pattern: /add\s+your\s+(code|logic|implementation)\s+here/i,
+        name: 'AI Placeholder: Code Here',
+        severity: 'info', // Downgraded from low
+        description: 'AI-typical placeholder comment',
+    },
+    // Temporary security bypasses
+    {
+        pattern: /temporary\s+(bypass|workaround|fix).*security/i,
+        name: 'Temporary Security Bypass',
+        severity: 'medium', // Downgraded from high
+        description: 'Comment indicates temporary security bypass that may have become permanent',
+    },
+    {
+        pattern: /remove\s+(before|in)\s+production/i,
+        name: 'Pre-Production Code',
+        severity: 'low', // Downgraded from medium
+        description: 'Comment indicates code should be removed before production',
+    },
+];
+// Extract comments from code
+function extractComments(content) {
+    const comments = [];
+    const lines = content.split('\n');
+    let inBlockComment = false;
+    let blockCommentStart = 0;
+    let blockCommentText = '';
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const trimmed = line.trim();
+        // Handle block comments
+        if (inBlockComment) {
+            if (trimmed.includes('*/')) {
+                inBlockComment = false;
+                blockCommentText += ' ' + trimmed.replace(/\*\/.*$/, '');
+                comments.push({
+                    text: blockCommentText,
+                    line: blockCommentStart + 1,
+                    lineContent: lines[blockCommentStart].trim(),
+                });
+                blockCommentText = '';
+            }
+            else {
+                blockCommentText += ' ' + trimmed.replace(/^\*\s*/, '');
+            }
+            continue;
+        }
+        // Start of block comment
+        if (trimmed.includes('/*')) {
+            if (trimmed.includes('*/')) {
+                // Single-line block comment
+                const text = trimmed.replace(/\/\*|\*\//g, '');
+                comments.push({ text, line: i + 1, lineContent: trimmed });
+            }
+            else {
+                inBlockComment = true;
+                blockCommentStart = i;
+                blockCommentText = trimmed.replace(/\/\*/, '');
+            }
+            continue;
+        }
+        // Single-line comments
+        const singleLineMatch = trimmed.match(/\/\/(.*)$|#(.*)$/);
+        if (singleLineMatch) {
+            const text = singleLineMatch[1] || singleLineMatch[2] || '';
+            comments.push({ text, line: i + 1, lineContent: trimmed });
+        }
+    }
+    return comments;
+}
+function detectAICommentPatterns(content, filePath, options) {
+    const vulnerabilities = [];
+    const comments = extractComments(content);
+    for (const comment of comments) {
+        for (const { pattern, name, severity, description } of AI_COMMENT_PATTERNS) {
+            if (pattern.test(comment.text)) {
+                // Most comment-based findings require AI validation to confirm relevance
+                const requiresAIValidation = severity !== 'critical';
+                vulnerabilities.push({
+                    id: `ai-comment-${filePath}-${comment.line}`,
+                    filePath,
+                    lineNumber: comment.line,
+                    lineContent: comment.lineContent,
+                    severity,
+                    category: 'ai_pattern',
+                    title: name,
+                    description,
+                    suggestedFix: 'Review and address this comment. If it indicates a security issue, fix it. If it\'s a prompt injection attempt, remove it.',
+                    confidence: severity === 'critical' || severity === 'high' ? 'high' : 'low', // Lower default confidence
+                    baseConfidence: BASE_CONFIDENCE,
+                    layer: 1,
+                    source: 'config',
+                    requiresAIValidation,
+                });
+                break; // Only report one pattern per comment
+            }
+        }
+    }
+    return vulnerabilities;
+}
+//# sourceMappingURL=comments.js.map

package/dist/detect/config/comments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"comments.js","sourceRoot":"","sources":["../../../src/detect/config/comments.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAuLH,0DAoCC;AAtND,MAAM,eAAe,GAAG,IAAI,CAAA;AAE5B,uEAAuE;AACvE,MAAM,mBAAmB,GAAG;IAC1B,4BAA4B;IAC5B;QACE,OAAO,EAAE,gDAAgD;QACzD,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,gFAAgF;KAC9F;IACD;QACE,OAAO,EAAE,6CAA6C;QACtD,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,kDAAkD;KAChE;IACD;QACE,OAAO,EAAE,wDAAwD;QACjE,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,qDAAqD;KACnE;IACD;QACE,OAAO,EAAE,4CAA4C;QACrD,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,kDAAkD;KAChE;IACD;QACE,OAAO,EAAE,mBAAmB;QAC5B,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,UAAmB;QAC7B,WAAW,EAAE,gDAAgD;KAC9D;IAED,0CAA0C;IAC1C;QACE,OAAO,EAAE,iDAAiD;QAC1D,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,QAAiB;QAC3B,WAAW,EAAE,6CAA6C;KAC3D;IACD;QACE,OAAO,EAAE,+CAA+C;QACxD,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,QAAiB;QAC3B,WAAW,EAAE,sCAAsC;KACpD;IACD;QACE,OAAO,EAAE,yDAAyD;QAClE,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,gDAAgD;KAC9D;IAED,kFAAkF;IAClF;QACE,OAAO,EAAE,2BAA2B;QACpC,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,KAAc,EAAG,yBAAyB;QACpD,WAAW,EAAE,0CAA0C;KACxD;IACD;QACE,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,QAAiB,EAAG,uBAAuB;QACrD,WAAW,EAAE,gDAAgD;KAC9D;IACD;QACE,OAAO,EAAE,oBAAoB;QAC7B,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,QAAiB,EAAG,uBAAuB;QACrD,WAAW,EAAE,yCAAyC;KACvD;IACD;QACE,OAAO,EAAE,uDAAuD;QAChE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,KAAc,EAAG,wDAAwD;QACnF,WAAW,EAAE,uDAAuD;KACrE;IACD;QACE,OAAO,EAAE,mDAAmD;QAC5D,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,KAAc,EAAG,yBAAyB;QACpD,WAAW,EAAE,mDAAmD;KACjE;IAED,4EAA4E;IAC5E;QACE,OAAO,EAAE,6CAA6C;QACtD,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,MAAe,EAAG,sBAAsB;QAClD,WAAW,EAAE,mDAAmD;KACjE;IACD;QACE,OAAO,EAAE,gCAAgC;QACzC,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,MAAe,EAAG,sBAAsB;QAClD,WAAW,EAAE,mDAAmD;KACjE;IACD;QACE,OAAO,EAAE,kDAAkD;QAC3D,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,MAAe,EAAG,sBAAsB;QAClD,WAAW,EAAE,gCAAgC;KAC9C;IAED,8BAA8B;IAC9B;QACE,OAAO,EAAE,gDAAgD;QACzD,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,QAAiB,EAAG,uBAAuB;QACrD,WAAW,EAAE,4EAA4E;KAC1F;IACD;QACE,OAAO,EAAE,oCAAoC;QAC7C,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,KAAc,EAAG,yBAAyB;QACpD,WAAW,EAAE,4DAA4D;KAC1E;CACF,CAAA;AAED,6BAA6B;AAC7B,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,QAAQ,GAA+D,EAAE,CAAA;IAC/E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAEjC,IAAI,cAAc,GAAG,KAAK,CAAA;IAC1B,IAAI,iBAAiB,GAAG,CAAC,CAAA;IACzB,IAAI,gBAAgB,GAAG,EAAE,CAAA;IAEzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAE3B,wBAAwB;QACxB,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,cAAc,GAAG,KAAK,CAAA;gBACtB,gBAAgB,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;gBACxD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,IAAI,EAAE,iBAAiB,GAAG,CAAC;oBAC3B,WAAW,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE;iBAC7C,CAAC,CAAA;gBACF,gBAAgB,GAAG,EAAE,CAAA;YACvB,CAAC;iBAAM,CAAC;gBACN,gBAAgB,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YACzD,CAAC;YACD,SAAQ;QACV,CAAC;QAED,yBAAyB;QACzB,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,4BAA4B;gBAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;gBAC9C,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAA;YAC5D,CAAC;iBAAM,CAAC;gBACN,cAAc,GAAG,IAAI,CAAA;gBACrB,iBAAiB,GAAG,CAAC,CAAA;gBACrB,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;YAChD,CAAC;YACD,SAAQ;QACV,CAAC;QAED,uBAAuB;QACvB,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;QACzD,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAgB,uBAAuB,CACrC,OAAe,EACf,QAAgB,EAChB,OAAiC;IAEjC,MAAM,eAAe,GAAoB,EAAE,CAAA;IAC3C,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAEzC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,mBAAmB,EAAE,CAAC;YAC3E,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,yEAAyE;gBACzE,MAAM,oBAAoB,GAAG,QAAQ,KAAK,UAAU,CAAA;gBAEpD,eAAe,CAAC,IAAI,CAAC;oBACnB,EAAE,EAAE,cAAc,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE;oBAC5C,QAAQ;oBACR,UAAU,EAAE,OAAO,CAAC,IAAI;oBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,QAAQ;oBACR,QAAQ,EAAE,YAAY;oBACtB,KAAK,EAAE,IAAI;oBACX,WAAW;oBACX,YAAY,EAAE,4HAA4H;oBAC1I,UAAU,EAAE,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAG,2BAA2B;oBACzG,cAAc,EAAE,eAAe;oBAC/B,KAAK,EAAE,CAAC;oBACV,MAAM,EAAE,QAAiB;oBACvB,oBAAoB;iBACrB,CAAC,CAAA;gBACF,MAAK,CAAC,sCAAsC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAA;AACxB,CAAC"}

package/dist/detect/config/file-flags.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Layer 1: File Extension Red Flags
+ * Detects dangerous files that should not be in a repository
+ */
+import type { Vulnerability } from '../../shared/types';
+import type { ParsedFile } from '../../shared/parsed-file';
+export declare function detectDangerousFiles(content: string, filePath: string, options?: {
+    parsed?: ParsedFile;
+}): Vulnerability[];
+//# sourceMappingURL=file-flags.d.ts.map

package/dist/detect/config/file-flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-flags.d.ts","sourceRoot":"","sources":["../../../src/detect/config/file-flags.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAyB,MAAM,oBAAoB,CAAA;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAwD1D,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,UAAU,CAAA;CAAE,GAChC,aAAa,EAAE,CA6EjB"}

package/dist/detect/config/file-flags.js

@@ -0,0 +1,124 @@
+"use strict";
+/**
+ * Layer 1: File Extension Red Flags
+ * Detects dangerous files that should not be in a repository
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectDangerousFiles = detectDangerousFiles;
+const file_classifier_1 = require("../../parse/file-classifier");
+const BASE_CONFIDENCE = 0.60;
+// Dangerous file extensions and names that should not be committed
+const DANGEROUS_FILE_PATTERNS = [
+    // Private keys
+    { pattern: /\.pem$/i, name: 'PEM Private Key', severity: 'critical' },
+    { pattern: /\.key$/i, name: 'Private Key File', severity: 'critical' },
+    { pattern: /\.p12$/i, name: 'PKCS#12 Certificate', severity: 'critical' },
+    { pattern: /\.pfx$/i, name: 'PFX Certificate', severity: 'critical' },
+    { pattern: /\.p8$/i, name: 'PKCS#8 Private Key', severity: 'critical' },
+    // SSH keys
+    { pattern: /id_rsa$/i, name: 'RSA SSH Private Key', severity: 'critical' },
+    { pattern: /id_dsa$/i, name: 'DSA SSH Private Key', severity: 'critical' },
+    { pattern: /id_ecdsa$/i, name: 'ECDSA SSH Private Key', severity: 'critical' },
+    { pattern: /id_ed25519$/i, name: 'Ed25519 SSH Private Key', severity: 'critical' },
+    // Environment files (should be gitignored)
+    { pattern: /^\.env$/i, name: 'Environment File', severity: 'critical' },
+    { pattern: /^\.env\.local$/i, name: 'Local Environment File', severity: 'critical' },
+    { pattern: /^\.env\.production$/i, name: 'Production Environment File', severity: 'critical' },
+    { pattern: /^\.env\.development$/i, name: 'Development Environment File', severity: 'high' },
+    { pattern: /^\.env\.staging$/i, name: 'Staging Environment File', severity: 'high' },
+    // Credential files
+    { pattern: /\.pgpass$/i, name: 'PostgreSQL Password File', severity: 'critical' },
+    { pattern: /\.npmrc$/i, name: 'NPM Configuration (may contain tokens)', severity: 'high' },
+    { pattern: /\.pypirc$/i, name: 'PyPI Configuration (may contain tokens)', severity: 'high' },
+    { pattern: /\.netrc$/i, name: 'Netrc File (contains credentials)', severity: 'critical' },
+    { pattern: /\.htpasswd$/i, name: 'Apache Password File', severity: 'critical' },
+    // Database files
+    { pattern: /\.sqlite$/i, name: 'SQLite Database', severity: 'medium' },
+    { pattern: /\.sqlite3$/i, name: 'SQLite Database', severity: 'medium' },
+    { pattern: /\.db$/i, name: 'Database File', severity: 'medium' },
+    // Backup files that may contain secrets
+    { pattern: /\.bak$/i, name: 'Backup File', severity: 'low' },
+    { pattern: /\.backup$/i, name: 'Backup File', severity: 'low' },
+    { pattern: /\.old$/i, name: 'Old File Backup', severity: 'low' },
+    // Keystore files
+    { pattern: /\.jks$/i, name: 'Java Keystore', severity: 'high' },
+    { pattern: /\.keystore$/i, name: 'Keystore File', severity: 'high' },
+];
+// Files that are okay in certain contexts but should be reviewed
+const CONTEXT_SENSITIVE_PATTERNS = [
+    { pattern: /\.env\.example$/i, name: 'Environment Example File', checkContent: true },
+    { pattern: /\.env\.sample$/i, name: 'Environment Sample File', checkContent: true },
+    { pattern: /\.env\.template$/i, name: 'Environment Template File', checkContent: true },
+];
+function detectDangerousFiles(content, filePath, options) {
+    const vulnerabilities = [];
+    const fileName = filePath.split('/').pop() || '';
+    // Check for dangerous file patterns
+    const inToolingDir = (0, file_classifier_1.isToolingDirectory)(filePath);
+    for (const { pattern, name, severity } of DANGEROUS_FILE_PATTERNS) {
+        if (pattern.test(fileName) || pattern.test(filePath)) {
+            // Downgrade severity to 'info' for files in tooling directories
+            // These are typically build scripts, CLI tools, etc. where certain file patterns are expected
+            const effectiveSeverity = inToolingDir ? 'info' : severity;
+            vulnerabilities.push({
+                id: `file-flag-${filePath}`,
+                filePath,
+                lineNumber: 1,
+                lineContent: `File: ${fileName}`,
+                severity: effectiveSeverity,
+                category: 'dangerous_file',
+                title: `Dangerous file detected: ${name}`,
+                description: inToolingDir
+                    ? `This file type (${name}) is in a tooling/scripts directory and may be expected there. Review to ensure no actual secrets are committed.`
+                    : `This file type (${name}) should not be committed to version control as it may contain sensitive information.`,
+                suggestedFix: 'Add this file to .gitignore and remove it from the repository. If it contains secrets, rotate them immediately.',
+                confidence: inToolingDir ? 'medium' : 'high',
+                baseConfidence: BASE_CONFIDENCE,
+                layer: 1,
+                source: 'config',
+            });
+        }
+    }
+    // Check context-sensitive files for actual secrets
+    for (const { pattern, name, checkContent } of CONTEXT_SENSITIVE_PATTERNS) {
+        if ((pattern.test(fileName) || pattern.test(filePath)) && checkContent) {
+            // Check if the example/sample file contains what looks like real values
+            const suspiciousPatterns = [
+                /[a-zA-Z0-9_]+=sk-[a-zA-Z0-9]{20,}/, // API keys
+                /[a-zA-Z0-9_]+=ghp_[a-zA-Z0-9]{36,}/, // GitHub tokens
+                /[a-zA-Z0-9_]+=eyJ[a-zA-Z0-9_-]+\./, // JWT tokens
+                /password\s*=\s*[^\s$]{8,}/i, // Passwords (not env vars)
+            ];
+            const lines = options?.parsed?.lines ?? content.split('\n');
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                // Skip lines that reference environment variables
+                if (line.includes('${') || line.includes('$env:') || line.includes('process.env')) {
+                    continue;
+                }
+                for (const suspicious of suspiciousPatterns) {
+                    if (suspicious.test(line)) {
+                        vulnerabilities.push({
+                            id: `file-flag-content-${filePath}-${i + 1}`,
+                            filePath,
+                            lineNumber: i + 1,
+                            lineContent: line.trim(),
+                            severity: 'high',
+                            category: 'dangerous_file',
+                            title: `${name} may contain real secrets`,
+                            description: 'This example/sample file appears to contain real secret values instead of placeholders.',
+                            suggestedFix: 'Replace real values with placeholders like YOUR_API_KEY_HERE or use environment variable references.',
+                            confidence: 'medium',
+                            baseConfidence: BASE_CONFIDENCE,
+                            layer: 1,
+                            source: 'config',
+                        });
+                        break;
+                    }
+                }
+            }
+        }
+    }
+    return vulnerabilities;
+}
+//# sourceMappingURL=file-flags.js.map

package/dist/detect/config/file-flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-flags.js","sourceRoot":"","sources":["../../../src/detect/config/file-flags.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AA2DH,oDAiFC;AAxID,iEAAgE;AAEhE,MAAM,eAAe,GAAG,IAAI,CAAA;AAE5B,mEAAmE;AACnE,MAAM,uBAAuB,GAAG;IAC9B,eAAe;IACf,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAmB,EAAE;IAC9E,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,UAAmB,EAAE;IAC/E,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,UAAmB,EAAE;IAClF,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAmB,EAAE;IAC9E,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,UAAmB,EAAE;IAEhF,WAAW;IACX,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,UAAmB,EAAE;IACnF,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,UAAmB,EAAE;IACnF,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,UAAmB,EAAE;IACvF,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,UAAmB,EAAE;IAE3F,2CAA2C;IAC3C,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,UAAmB,EAAE;IAChF,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,wBAAwB,EAAE,QAAQ,EAAE,UAAmB,EAAE;IAC7F,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,6BAA6B,EAAE,QAAQ,EAAE,UAAmB,EAAE;IACvG,EAAE,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,8BAA8B,EAAE,QAAQ,EAAE,MAAe,EAAE;IACrG,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,0BAA0B,EAAE,QAAQ,EAAE,MAAe,EAAE;IAE7F,mBAAmB;IACnB,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,0BAA0B,EAAE,QAAQ,EAAE,UAAmB,EAAE;IAC1F,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,wCAAwC,EAAE,QAAQ,EAAE,MAAe,EAAE;IACnG,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,yCAAyC,EAAE,QAAQ,EAAE,MAAe,EAAE;IACrG,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,mCAAmC,EAAE,QAAQ,EAAE,UAAmB,EAAE;IAClG,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,UAAmB,EAAE;IAExF,iBAAiB;IACjB,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAiB,EAAE;IAC/E,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAiB,EAAE;IAChF,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAiB,EAAE;IAEzE,wCAAwC;IACxC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAc,EAAE;IACrE,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAc,EAAE;IACxE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,KAAc,EAAE;IAEzE,iBAAiB;IACjB,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAe,EAAE;IACxE,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAe,EAAE;CAC9E,CAAA;AAED,iEAAiE;AACjE,MAAM,0BAA0B,GAAG;IACjC,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,0BAA0B,EAAE,YAAY,EAAE,IAAI,EAAE;IACrF,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,yBAAyB,EAAE,YAAY,EAAE,IAAI,EAAE;IACnF,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,2BAA2B,EAAE,YAAY,EAAE,IAAI,EAAE;CACxF,CAAA;AAED,SAAgB,oBAAoB,CAClC,OAAe,EACf,QAAgB,EAChB,OAAiC;IAEjC,MAAM,eAAe,GAAoB,EAAE,CAAA;IAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAA;IAEhD,oCAAoC;IACpC,MAAM,YAAY,GAAG,IAAA,oCAAkB,EAAC,QAAQ,CAAC,CAAA;IAEjD,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,uBAAuB,EAAE,CAAC;QAClE,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrD,gEAAgE;YAChE,8FAA8F;YAC9F,MAAM,iBAAiB,GAA0B,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA;YAEjF,eAAe,CAAC,IAAI,CAAC;gBACnB,EAAE,EAAE,aAAa,QAAQ,EAAE;gBAC3B,QAAQ;gBACR,UAAU,EAAE,CAAC;gBACb,WAAW,EAAE,SAAS,QAAQ,EAAE;gBAChC,QAAQ,EAAE,iBAAiB;gBAC3B,QAAQ,EAAE,gBAAgB;gBAC1B,KAAK,EAAE,4BAA4B,IAAI,EAAE;gBACzC,WAAW,EAAE,YAAY;oBACvB,CAAC,CAAC,mBAAmB,IAAI,kHAAkH;oBAC3I,CAAC,CAAC,mBAAmB,IAAI,uFAAuF;gBAClH,YAAY,EAAE,iHAAiH;gBAC/H,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;gBAC5C,cAAc,EAAE,eAAe;gBAC/B,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,QAAiB;aAC1B,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,0BAA0B,EAAE,CAAC;QACzE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;YACvE,wEAAwE;YACxE,MAAM,kBAAkB,GAAG;gBACzB,mCAAmC,EAAG,WAAW;gBACjD,oCAAoC,EAAE,gBAAgB;gBACtD,mCAAmC,EAAG,aAAa;gBACnD,4BAA4B,EAAW,2BAA2B;aACnE,CAAA;YAED,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC3D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;gBACrB,kDAAkD;gBAClD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;oBAClF,SAAQ;gBACV,CAAC;gBAED,KAAK,MAAM,UAAU,IAAI,kBAAkB,EAAE,CAAC;oBAC5C,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1B,eAAe,CAAC,IAAI,CAAC;4BACnB,EAAE,EAAE,qBAAqB,QAAQ,IAAI,CAAC,GAAG,CAAC,EAAE;4BAC5C,QAAQ;4BACR,UAAU,EAAE,CAAC,GAAG,CAAC;4BACjB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;4BACxB,QAAQ,EAAE,MAAM;4BAChB,QAAQ,EAAE,gBAAgB;4BAC1B,KAAK,EAAE,GAAG,IAAI,2BAA2B;4BACzC,WAAW,EAAE,yFAAyF;4BACtG,YAAY,EAAE,sGAAsG;4BACpH,UAAU,EAAE,QAAQ;4BACpB,cAAc,EAAE,eAAe;4BAC/B,KAAK,EAAE,CAAC;4BACd,MAAM,EAAE,QAAiB;yBACpB,CAAC,CAAA;wBACF,MAAK;oBACP,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAA;AACxB,CAAC"}

package/dist/detect/config/index.d.ts

@@ -0,0 +1,7 @@
+export { detectSensitiveURLs, aggregateLocalhostFindings } from './urls';
+export { detectDangerousFiles } from './file-flags';
+export { detectAICommentPatterns } from './comments';
+export { checkPackageAdvisories } from './osv-check';
+export { checkPackages } from './package-check';
+export { detectAgentSkillInjection } from './agent-skill-injection';
+//# sourceMappingURL=index.d.ts.map

package/dist/detect/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/detect/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,QAAQ,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA"}

package/dist/detect/config/index.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectAgentSkillInjection = exports.checkPackages = exports.checkPackageAdvisories = exports.detectAICommentPatterns = exports.detectDangerousFiles = exports.aggregateLocalhostFindings = exports.detectSensitiveURLs = void 0;
+var urls_1 = require("./urls");
+Object.defineProperty(exports, "detectSensitiveURLs", { enumerable: true, get: function () { return urls_1.detectSensitiveURLs; } });
+Object.defineProperty(exports, "aggregateLocalhostFindings", { enumerable: true, get: function () { return urls_1.aggregateLocalhostFindings; } });
+var file_flags_1 = require("./file-flags");
+Object.defineProperty(exports, "detectDangerousFiles", { enumerable: true, get: function () { return file_flags_1.detectDangerousFiles; } });
+var comments_1 = require("./comments");
+Object.defineProperty(exports, "detectAICommentPatterns", { enumerable: true, get: function () { return comments_1.detectAICommentPatterns; } });
+var osv_check_1 = require("./osv-check");
+Object.defineProperty(exports, "checkPackageAdvisories", { enumerable: true, get: function () { return osv_check_1.checkPackageAdvisories; } });
+var package_check_1 = require("./package-check");
+Object.defineProperty(exports, "checkPackages", { enumerable: true, get: function () { return package_check_1.checkPackages; } });
+var agent_skill_injection_1 = require("./agent-skill-injection");
+Object.defineProperty(exports, "detectAgentSkillInjection", { enumerable: true, get: function () { return agent_skill_injection_1.detectAgentSkillInjection; } });
+//# sourceMappingURL=index.js.map

package/dist/detect/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/detect/config/index.ts"],"names":[],"mappings":";;;AAAA,+BAAwE;AAA/D,2GAAA,mBAAmB,OAAA;AAAE,kHAAA,0BAA0B,OAAA;AACxD,2CAAmD;AAA1C,kHAAA,oBAAoB,OAAA;AAC7B,uCAAoD;AAA3C,mHAAA,uBAAuB,OAAA;AAChC,yCAAoD;AAA3C,mHAAA,sBAAsB,OAAA;AAC/B,iDAA+C;AAAtC,8GAAA,aAAa,OAAA;AACtB,iEAAmE;AAA1D,kIAAA,yBAAyB,OAAA"}

package/dist/detect/config/osv-check.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Layer 3: OSV/Security Advisory Integration
+ * Checks packages against OSV.dev for known vulnerabilities
+ *
+ * Features:
+ * - Queries OSV.dev API for known malicious/vulnerable packages
+ * - Caches advisories for efficiency
+ * - Supports npm and PyPI ecosystems
+ */
+import type { Vulnerability, VulnerabilitySeverity } from '../../shared/types';
+interface OSVVulnerability {
+    id: string;
+    summary?: string;
+    details?: string;
+    severity?: Array<{
+        type: string;
+        score: string;
+    }>;
+    references?: Array<{
+        type: string;
+        url: string;
+    }>;
+    affected?: Array<{
+        package: {
+            name: string;
+            ecosystem: string;
+        };
+        ranges?: Array<{
+            type: string;
+            events: Array<{
+                introduced?: string;
+                fixed?: string;
+            }>;
+        }>;
+    }>;
+    database_specific?: {
+        malicious?: boolean;
+        severity?: string;
+    };
+}
+interface CachedAdvisory {
+    timestamp: number;
+    advisories: OSVVulnerability[];
+}
+declare const advisoryCache: Map<string, CachedAdvisory>;
+/**
+ * Get cache key for a package
+ */
+declare function getCacheKey(name: string, ecosystem: string): string;
+/**
+ * Query OSV.dev for vulnerabilities affecting a single package
+ */
+declare function queryOSV(packageName: string, ecosystem: 'npm' | 'PyPI', version?: string): Promise<OSVVulnerability[]>;
+/**
+ * Query OSV.dev for multiple packages in batch
+ */
+declare function queryOSVBatch(packages: Array<{
+    name: string;
+    ecosystem: 'npm' | 'PyPI';
+    version?: string;
+}>): Promise<Map<string, OSVVulnerability[]>>;
+/**
+ * Determine severity from OSV vulnerability
+ */
+declare function mapOSVSeverity(vuln: OSVVulnerability): VulnerabilitySeverity;
+/**
+ * Check if vulnerability is for a malicious package
+ */
+declare function isMaliciousPackage(vuln: OSVVulnerability): boolean;
+/**
+ * Check packages in a file for known vulnerabilities via OSV.dev
+ */
+export declare function checkPackageAdvisories(content: string, filePath: string): Promise<Vulnerability[]>;
+export { queryOSV, queryOSVBatch, mapOSVSeverity, isMaliciousPackage, getCacheKey, advisoryCache, };
+//# sourceMappingURL=osv-check.d.ts.map

package/dist/detect/config/osv-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"osv-check.d.ts","sourceRoot":"","sources":["../../../src/detect/config/osv-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAmC9E,UAAU,gBAAgB;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,EAAE,MAAM,CAAA;KACd,CAAC,CAAA;IACF,UAAU,CAAC,EAAE,KAAK,CAAC;QACjB,IAAI,EAAE,MAAM,CAAA;QACZ,GAAG,EAAE,MAAM,CAAA;KACZ,CAAC,CAAA;IACF,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,OAAO,EAAE;YACP,IAAI,EAAE,MAAM,CAAA;YACZ,SAAS,EAAE,MAAM,CAAA;SAClB,CAAA;QACD,MAAM,CAAC,EAAE,KAAK,CAAC;YACb,IAAI,EAAE,MAAM,CAAA;YACZ,MAAM,EAAE,KAAK,CAAC;gBAAE,UAAU,CAAC,EAAE,MAAM,CAAC;gBAAC,KAAK,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC,CAAA;SACvD,CAAC,CAAA;KACH,CAAC,CAAA;IACF,iBAAiB,CAAC,EAAE;QAClB,SAAS,CAAC,EAAE,OAAO,CAAA;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,CAAA;CACF;AAUD,UAAU,cAAc;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,gBAAgB,EAAE,CAAA;CAC/B;AAMD,QAAA,MAAM,aAAa,6BAAoC,CAAA;AAEvD;;GAEG;AACH,iBAAS,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE5D;AAoCD;;GAEG;AACH,iBAAe,QAAQ,CACrB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,KAAK,GAAG,MAAM,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA4C7B;AAED;;GAEG;AACH,iBAAe,aAAa,CAC1B,QAAQ,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,KAAK,GAAG,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAC7E,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAgE1C;AAMD;;GAEG;AACH,iBAAS,cAAc,CAAC,IAAI,EAAE,gBAAgB,GAAG,qBAAqB,CA2BrE;AAED;;GAEG;AACH,iBAAS,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAI3D;AAMD;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,EAAE,CAAC,CAkG1B;AAGD,OAAO,EACL,QAAQ,EACR,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,CAAA"}