@oculum/scanner 1.0.14 → 1.0.15

package/dist/parse/call-graph.js

@@ -0,0 +1,386 @@
+"use strict";
+/**
+ * Intra-file Call Graph Builder
+ *
+ * Builds a bidirectional call graph from a parsed AST, tracking which functions
+ * call which other functions within the same file. Used for taint analysis
+ * and understanding code flow in security-relevant contexts.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildCallGraph = buildCallGraph;
+exports.collectFunctions = collectFunctions;
+exports.getCallersOf = getCallersOf;
+exports.getCalleesOf = getCalleesOf;
+exports.getCallChain = getCallChain;
+const ast_1 = require("./ast");
+const call_analysis_1 = require("../detect/ast-rules/helpers/call-analysis");
+const scope_analysis_1 = require("../detect/ast-rules/helpers/scope-analysis");
+const python_helpers_1 = require("../detect/ast-rules/helpers/python-helpers");
+// ============================================================================
+// Graph Building
+// ============================================================================
+const MODULE_SCOPE = '<module>';
+/**
+ * Build a call graph from a parsed AST.
+ * Tracks all function declarations and intra-file call relationships.
+ */
+function buildCallGraph(ast) {
+    const root = ast.tree.rootNode;
+    const functions = new Map();
+    const calls = new Map();
+    const calledBy = new Map();
+    // Step 1: Collect all function declarations
+    collectFunctions(root, functions);
+    // Step 2: Collect aliases for resolving indirect calls
+    const aliases = (0, scope_analysis_1.collectVariableAliases)(root);
+    // Detect language from root node type
+    const isPython = root.type === 'module';
+    // Step 3: Walk all call expressions, resolve targets, build edges
+    (0, ast_1.walkAST)(root, (node) => {
+        if (isPython) {
+            if (node.type !== 'call')
+                return false;
+        }
+        else {
+            if (node.type !== 'call_expression' && node.type !== 'new_expression')
+                return false;
+        }
+        // Resolve the call target (JS or Python)
+        let resolved = null;
+        if (isPython) {
+            resolved = (0, python_helpers_1.resolvePythonCallTarget)(node);
+        }
+        else {
+            resolved = (0, call_analysis_1.resolveCallTarget)(node, aliases);
+        }
+        if (!resolved)
+            return false;
+        // Determine the callee name — for member calls like this.bar() or self.bar()
+        let calleeName = resolved.name;
+        // Only track calls to functions defined in this file
+        if (!functions.has(calleeName)) {
+            // For this.method() / self.method() calls, try ClassName.method
+            if (resolved.type === 'member' && (resolved.object === 'this' || resolved.object === 'self')) {
+                const className = getEnclosingClassName(node);
+                if (className) {
+                    const qualified = `${className}.${resolved.name}`;
+                    if (functions.has(qualified)) {
+                        calleeName = qualified;
+                    }
+                    else {
+                        return false;
+                    }
+                }
+                else {
+                    return false;
+                }
+            }
+            else {
+                return false;
+            }
+        }
+        // Determine the caller
+        const enclosing = (0, ast_1.findEnclosingFunction)(node);
+        const callerName = enclosing ? getFunctionName(enclosing, root) : MODULE_SCOPE;
+        if (!callerName)
+            return false;
+        // Add edge: caller → callee
+        if (!calls.has(callerName))
+            calls.set(callerName, new Set());
+        calls.get(callerName).add(calleeName);
+        if (!calledBy.has(calleeName))
+            calledBy.set(calleeName, new Set());
+        calledBy.get(calleeName).add(callerName);
+        return false;
+    });
+    return { functions, calls, calledBy };
+}
+// ============================================================================
+// Function Collection
+// ============================================================================
+function collectFunctions(root, functions) {
+    (0, ast_1.walkAST)(root, (node) => {
+        let fnNode = null;
+        switch (node.type) {
+            case 'function_declaration':
+            case 'generator_function_declaration':
+                fnNode = parseFunctionDeclaration(node, root);
+                break;
+            case 'variable_declarator':
+                fnNode = parseVariableFunction(node, root);
+                break;
+            case 'method_definition':
+                fnNode = parseMethodDefinition(node, root);
+                break;
+            case 'function_definition':
+                fnNode = parsePythonFunctionDefinition(node, root);
+                break;
+            case 'decorated_definition': {
+                const inner = node.namedChildren.find(c => c.type === 'function_definition');
+                if (inner)
+                    fnNode = parsePythonFunctionDefinition(inner, root);
+                break;
+            }
+        }
+        if (fnNode) {
+            functions.set(fnNode.name, fnNode);
+        }
+        return false;
+    });
+}
+function parseFunctionDeclaration(node, root) {
+    const nameNode = node.childForFieldName('name');
+    if (!nameNode)
+        return null;
+    return {
+        name: nameNode.text,
+        node,
+        params: extractParams(node),
+        isAsync: hasAsyncKeyword(node),
+        isExported: isNodeExported(node, root),
+    };
+}
+function parseVariableFunction(node, root) {
+    const nameNode = node.childForFieldName('name');
+    const valueNode = node.childForFieldName('value');
+    if (!nameNode || !valueNode)
+        return null;
+    if (nameNode.type !== 'identifier')
+        return null;
+    if (valueNode.type !== 'arrow_function' &&
+        valueNode.type !== 'function_expression' &&
+        valueNode.type !== 'function') {
+        return null;
+    }
+    return {
+        name: nameNode.text,
+        node: valueNode,
+        params: extractParams(valueNode),
+        isAsync: hasAsyncKeyword(valueNode),
+        isExported: isNodeExported(node, root),
+    };
+}
+function parseMethodDefinition(node, root) {
+    const nameNode = node.childForFieldName('name');
+    if (!nameNode)
+        return null;
+    // Check if inside a class
+    const className = getEnclosingClassName(node);
+    const methodName = nameNode.text;
+    return {
+        name: className ? `${className}.${methodName}` : methodName,
+        node,
+        params: extractParams(node),
+        isAsync: hasAsyncKeyword(node),
+        isExported: isNodeExported(node, root),
+    };
+}
+// ============================================================================
+// Helpers
+// ============================================================================
+function parsePythonFunctionDefinition(node, root) {
+    const nameNode = node.childForFieldName('name');
+    if (!nameNode)
+        return null;
+    const className = getEnclosingClassName(node);
+    return {
+        name: className ? `${className}.${nameNode.text}` : nameNode.text,
+        node,
+        params: extractPythonParams(node, !!className),
+        isAsync: node.children[0]?.text === 'async',
+        isExported: isPythonTopLevel(node, root),
+    };
+}
+function extractPythonParams(node, isMethod) {
+    const params = node.childForFieldName('parameters');
+    if (!params)
+        return [];
+    const names = [];
+    let isFirst = true;
+    for (const child of params.namedChildren) {
+        let name = null;
+        if (child.type === 'identifier') {
+            name = child.text;
+        }
+        else if (child.type === 'typed_parameter' || child.type === 'default_parameter' || child.type === 'typed_default_parameter') {
+            name = child.namedChildren.find(c => c.type === 'identifier')?.text ?? null;
+        }
+        else if (child.type === 'list_splat_pattern' || child.type === 'dictionary_splat_pattern') {
+            name = child.namedChildren.find(c => c.type === 'identifier')?.text ?? null;
+        }
+        if (name) {
+            if (isMethod && isFirst && (name === 'self' || name === 'cls')) {
+                isFirst = false;
+                continue;
+            }
+            isFirst = false;
+            names.push(name);
+        }
+    }
+    return names;
+}
+function isPythonTopLevel(node, root) {
+    if (root.type !== 'module')
+        return false;
+    let current = node.parent;
+    while (current) {
+        if (current.type === 'module')
+            return true;
+        if (current.type === 'decorated_definition') {
+            current = current.parent;
+            continue;
+        }
+        if (current.type === 'function_definition' || current.type === 'class_definition')
+            return false;
+        current = current.parent;
+    }
+    return false;
+}
+function extractParams(node) {
+    const params = node.childForFieldName('parameters');
+    if (!params)
+        return [];
+    const names = [];
+    for (const child of params.namedChildren) {
+        if (child.type === 'identifier') {
+            names.push(child.text);
+        }
+        else if (child.type === 'required_parameter' || child.type === 'optional_parameter') {
+            const pattern = child.childForFieldName('pattern');
+            if (pattern?.type === 'identifier') {
+                names.push(pattern.text);
+            }
+        }
+        else if (child.type === 'assignment_pattern') {
+            const left = child.childForFieldName('left');
+            if (left?.type === 'identifier') {
+                names.push(left.text);
+            }
+        }
+    }
+    return names;
+}
+function hasAsyncKeyword(node) {
+    // Check for 'async' token in the node's children
+    for (const child of node.children) {
+        if (child.type === 'async')
+            return true;
+        // For arrow functions, async appears before parameters
+        if (child.text === 'async' && child.type !== 'identifier')
+            return true;
+    }
+    return false;
+}
+function isNodeExported(node, _root) {
+    // Check if parent is export_statement
+    let current = node.parent;
+    while (current) {
+        if (current.type === 'export_statement')
+            return true;
+        // Stop climbing at statement boundaries
+        if (current.type === 'program' ||
+            current.type === 'statement_block') {
+            break;
+        }
+        current = current.parent;
+    }
+    return false;
+}
+function getEnclosingClassName(node) {
+    let current = node.parent;
+    while (current) {
+        if (current.type === 'class_declaration' || current.type === 'class' || current.type === 'class_definition') {
+            const nameNode = current.childForFieldName('name');
+            return nameNode?.text ?? null;
+        }
+        current = current.parent;
+    }
+    return null;
+}
+/**
+ * Get the name of a function node. Used to identify the caller
+ * when we find a call expression inside a function body.
+ */
+function getFunctionName(fnNode, root) {
+    // function_declaration / generator_function_declaration → name field
+    if (fnNode.type === 'function_declaration' || fnNode.type === 'generator_function_declaration') {
+        return fnNode.childForFieldName('name')?.text ?? null;
+    }
+    // method_definition → possibly prefixed with class name
+    if (fnNode.type === 'method_definition') {
+        const methodName = fnNode.childForFieldName('name')?.text;
+        if (!methodName)
+            return null;
+        const className = getEnclosingClassName(fnNode);
+        return className ? `${className}.${methodName}` : methodName;
+    }
+    // Python function_definition
+    if (fnNode.type === 'function_definition') {
+        const name = fnNode.childForFieldName('name')?.text;
+        if (!name)
+            return null;
+        const className = getEnclosingClassName(fnNode);
+        return className ? `${className}.${name}` : name;
+    }
+    // arrow_function / function_expression → look at parent variable_declarator
+    if (fnNode.type === 'arrow_function' || fnNode.type === 'function_expression' || fnNode.type === 'function') {
+        const parent = fnNode.parent;
+        if (parent?.type === 'variable_declarator') {
+            const nameNode = parent.childForFieldName('name');
+            if (nameNode?.type === 'identifier')
+                return nameNode.text;
+        }
+        // Could be assigned in an assignment_expression
+        if (parent?.type === 'assignment_expression') {
+            const left = parent.childForFieldName('left');
+            if (left?.type === 'identifier')
+                return left.text;
+        }
+    }
+    return null;
+}
+// ============================================================================
+// Query Functions
+// ============================================================================
+/**
+ * Get all functions that call the given function.
+ */
+function getCallersOf(graph, functionName) {
+    const callers = graph.calledBy.get(functionName);
+    return callers ? [...callers] : [];
+}
+/**
+ * Get all functions called by the given function.
+ */
+function getCalleesOf(graph, functionName) {
+    const callees = graph.calls.get(functionName);
+    return callees ? [...callees] : [];
+}
+/**
+ * Find a call path from one function to another using BFS.
+ * Returns the chain as an array including both endpoints, or null if no path exists.
+ */
+function getCallChain(graph, from, to) {
+    if (from === to)
+        return [from];
+    const visited = new Set();
+    const queue = [{ node: from, path: [from] }];
+    visited.add(from);
+    while (queue.length > 0) {
+        const { node, path } = queue.shift();
+        const callees = graph.calls.get(node);
+        if (!callees)
+            continue;
+        for (const callee of callees) {
+            if (callee === to) {
+                return [...path, callee];
+            }
+            if (!visited.has(callee)) {
+                visited.add(callee);
+                queue.push({ node: callee, path: [...path, callee] });
+            }
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=call-graph.js.map

package/dist/parse/call-graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"call-graph.js","sourceRoot":"","sources":["../../src/parse/call-graph.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAoCH,wCAwEC;AAMD,4CAmCC;AA8ND,oCAGC;AAKD,oCAGC;AAMD,oCAwBC;AAzZD,+BAAsE;AACtE,6EAA6E;AAC7E,+EAAmF;AACnF,+EAAoF;AAoBpF,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E,MAAM,YAAY,GAAG,UAAU,CAAA;AAE/B;;;GAGG;AACH,SAAgB,cAAc,CAAC,GAAc;IAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAA;IAC9B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAA;IACjD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAA;IAC5C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAA;IAE/C,4CAA4C;IAC5C,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IAEjC,uDAAuD;IACvD,MAAM,OAAO,GAAG,IAAA,uCAAsB,EAAC,IAAI,CAAC,CAAA;IAE5C,sCAAsC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAA;IAEvC,kEAAkE;IAClE,IAAA,aAAO,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QACrB,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,KAAK,CAAA;QACxC,CAAC;aAAM,CAAC;YACN,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;gBAAE,OAAO,KAAK,CAAA;QACrF,CAAC;QAED,yCAAyC;QACzC,IAAI,QAAQ,GAA2D,IAAI,CAAA;QAC3E,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,GAAG,IAAA,wCAAuB,EAAC,IAAI,CAAC,CAAA;QAC1C,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,IAAA,iCAAiB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC7C,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAA;QAE3B,6EAA6E;QAC7E,IAAI,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAA;QAE9B,qDAAqD;QACrD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,gEAAgE;YAChE,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC7F,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAA;gBAC7C,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAA;oBACjD,IAAI,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;wBAC7B,UAAU,GAAG,SAAS,CAAA;oBACxB,CAAC;yBAAM,CAAC;wBACN,OAAO,KAAK,CAAA;oBACd,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,MAAM,SAAS,GAAG,IAAA,2BAAqB,EAAC,IAAI,CAAC,CAAA;QAC7C,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAA;QAE9E,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAA;QAE7B,4BAA4B;QAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,GAAG,EAAE,CAAC,CAAA;QAC5D,KAAK,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAEtC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,GAAG,EAAE,CAAC,CAAA;QAClE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAEzC,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;AACvC,CAAC;AAED,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E,SAAgB,gBAAgB,CAAC,IAAuB,EAAE,SAAoC;IAC5F,IAAA,aAAO,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QACrB,IAAI,MAAM,GAAwB,IAAI,CAAA;QAEtC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,sBAAsB,CAAC;YAC5B,KAAK,gCAAgC;gBACnC,MAAM,GAAG,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;gBAC7C,MAAK;YAEP,KAAK,qBAAqB;gBACxB,MAAM,GAAG,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;gBAC1C,MAAK;YAEP,KAAK,mBAAmB;gBACtB,MAAM,GAAG,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;gBAC1C,MAAK;YAEP,KAAK,qBAAqB;gBACxB,MAAM,GAAG,6BAA6B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;gBAClD,MAAK;YAEP,KAAK,sBAAsB,CAAC,CAAC,CAAC;gBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAA;gBAC5E,IAAI,KAAK;oBAAE,MAAM,GAAG,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;gBAC9D,MAAK;YACP,CAAC;QACH,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACpC,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAuB,EAAE,IAAuB;IAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC/C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAE1B,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,IAAI;QACJ,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC;QAC3B,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC;QAC9B,UAAU,EAAE,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC;KACvC,CAAA;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAuB,EAAE,IAAuB;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAA;IACjD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IACxC,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAA;IAE/C,IACE,SAAS,CAAC,IAAI,KAAK,gBAAgB;QACnC,SAAS,CAAC,IAAI,KAAK,qBAAqB;QACxC,SAAS,CAAC,IAAI,KAAK,UAAU,EAC7B,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC;QAChC,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC;QACnC,UAAU,EAAE,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC;KACvC,CAAA;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAuB,EAAE,IAAuB;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC/C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAE1B,0BAA0B;IAC1B,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAA;IAC7C,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAA;IAEhC,OAAO;QACL,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,UAAU;QAC3D,IAAI;QACJ,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC;QAC3B,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC;QAC9B,UAAU,EAAE,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC;KACvC,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,SAAS,6BAA6B,CAAC,IAAuB,EAAE,IAAuB;IACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC/C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC1B,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAA;IAC7C,OAAO;QACL,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI;QACjE,IAAI;QACJ,MAAM,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC;QAC9C,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO;QAC3C,UAAU,EAAE,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC;KACzC,CAAA;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAuB,EAAE,QAAiB;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAA;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IACtB,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzC,IAAI,IAAI,GAAkB,IAAI,CAAA;QAC9B,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAChC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;QACnB,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;YAC9H,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,IAAI,IAAI,IAAI,CAAA;QAC7E,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,IAAI,KAAK,CAAC,IAAI,KAAK,0BAA0B,EAAE,CAAC;YAC5F,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,IAAI,IAAI,IAAI,CAAA;QAC7E,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,QAAQ,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAC/D,OAAO,GAAG,KAAK,CAAA;gBACf,SAAQ;YACV,CAAC;YACD,OAAO,GAAG,KAAK,CAAA;YACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAuB,EAAE,IAAuB;IACxE,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACxC,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAA;IACzB,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC1C,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;YAAC,SAAQ;QAAC,CAAC;QACnF,IAAI,OAAO,CAAC,IAAI,KAAK,qBAAqB,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB;YAAE,OAAO,KAAK,CAAA;QAC/F,OAAO,GAAG,OAAO,CAAC,MAAM,CAAA;IAC1B,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAuB;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAA;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IAEtB,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACxB,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACtF,MAAM,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;YAClD,IAAI,OAAO,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;gBACnC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;YAC5C,IAAI,IAAI,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;gBAChC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,eAAe,CAAC,IAAuB;IAC9C,iDAAiD;IACjD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAA;QACvC,uDAAuD;QACvD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,IAAI,CAAA;IACxE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAAuB,EAAE,KAAwB;IACvE,sCAAsC;IACtC,IAAI,OAAO,GAA6B,IAAI,CAAC,MAAM,CAAA;IACnD,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB;YAAE,OAAO,IAAI,CAAA;QACpD,wCAAwC;QACxC,IACE,OAAO,CAAC,IAAI,KAAK,SAAS;YAC1B,OAAO,CAAC,IAAI,KAAK,iBAAiB,EAClC,CAAC;YACD,MAAK;QACP,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAA;IAC1B,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAuB;IACpD,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAA;IACzB,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,KAAK,mBAAmB,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAC5G,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;YAClD,OAAO,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAA;QAC/B,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAA;IAC1B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,MAAyB,EAAE,IAAuB;IACzE,qEAAqE;IACrE,IAAI,MAAM,CAAC,IAAI,KAAK,sBAAsB,IAAI,MAAM,CAAC,IAAI,KAAK,gCAAgC,EAAE,CAAC;QAC/F,OAAO,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,IAAI,CAAA;IACvD,CAAC;IAED,wDAAwD;IACxD,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,CAAA;QACzD,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAA;QAC5B,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;QAC/C,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,UAAU,CAAA;IAC9D,CAAC;IAED,6BAA6B;IAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,CAAA;QACnD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;QAC/C,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAClD,CAAC;IAED,4EAA4E;IAC5E,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,IAAI,MAAM,CAAC,IAAI,KAAK,qBAAqB,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC5G,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;QAC5B,IAAI,MAAM,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;YACjD,IAAI,QAAQ,EAAE,IAAI,KAAK,YAAY;gBAAE,OAAO,QAAQ,CAAC,IAAI,CAAA;QAC3D,CAAC;QACD,gDAAgD;QAChD,IAAI,MAAM,EAAE,IAAI,KAAK,uBAAuB,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;YAC7C,IAAI,IAAI,EAAE,IAAI,KAAK,YAAY;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAA;QACnD,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;GAEG;AACH,SAAgB,YAAY,CAAC,KAAgB,EAAE,YAAoB;IACjE,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAChD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACpC,CAAC;AAED;;GAEG;AACH,SAAgB,YAAY,CAAC,KAAgB,EAAE,YAAoB;IACjE,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAC7C,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACpC,CAAC;AAED;;;GAGG;AACH,SAAgB,YAAY,CAAC,KAAgB,EAAE,IAAY,EAAE,EAAU;IACrE,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IAE9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,MAAM,KAAK,GAA4C,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACrF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAEjB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,EAAG,CAAA;QACrC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACrC,IAAI,CAAC,OAAO;YAAE,SAAQ;QAEtB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAA;YAC1B,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBACnB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/parse/file-classifier.d.ts

@@ -126,6 +126,17 @@ export declare function isFileLoaderContext(filePath: string): boolean;
  * .claude/tools/ subdirectories are flagged.
  */
 export declare function isAgentSkillFile(filePath: string): boolean;
+/**
+ * Check if file is an AI rules/configuration file (superset of isAgentSkillFile)
+ * Includes all agent skill paths PLUS broader AI tool config files that are
+ * targets for the "Rules File Backdoor" attack (invisible Unicode payloads,
+ * stealth instructions).
+ *
+ * Covers: .cursorrules, .windsurfrules, CLAUDE.md (root), .cursor/*, .claude/*,
+ * .gemini/*, .github/copilot-instructions.md, .github/agents/*, Windsurf
+ * global_rules.md, .mdc files in AI directories, etc.
+ */
+export declare function isAIRulesFile(filePath: string): boolean;
 /**
  * Check if line uses environment variable reference (not hardcoded)
  */

package/dist/parse/file-classifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-classifier.d.ts","sourceRoot":"","sources":["../../src/parse/file-classifier.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAoB1D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAoB1D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAWvD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAY5D;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAkBvD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAcvD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAY7D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAiCtD;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAahE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAmB7D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAe7D;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAWxE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAyB1D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EAAE,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAoCT;AAMD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAsB7D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAO5D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQ7D;AAMD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAwC1D;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAWvD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAWtD;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EAAE,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAiCT;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EAAE,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAeT;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EAAE,EACf,SAAS,EAAE,MAAM,GAChB;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CA+C7C;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAgCvE;AAMD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAiD/E;AAED;;GAEG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAE,MAAW,GAAG,OAAO,CA0BpH;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAE,MAAW,GAAG,OAAO,CA0CvG;AAMD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAiD5E;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CA6BrG;AAMD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,aAAa,GAAG,cAAc,GAAG,iBAAiB,CAuBpD;AAMD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,YAAY,EAAE,OAAO,CAAA;IACrB,+DAA+D;IAC/D,eAAe,EAAE,OAAO,CAAA;IACxB,oDAAoD;IACpD,UAAU,EAAE,OAAO,CAAA;IACnB,yCAAyC;IACzC,YAAY,EAAE,OAAO,CAAA;IACrB,kDAAkD;IAClD,YAAY,EAAE,OAAO,CAAA;CACtB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAetD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,CAQ9D"}
+{"version":3,"file":"file-classifier.d.ts","sourceRoot":"","sources":["../../src/parse/file-classifier.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAoB1D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CA0B1D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAavD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAY5D;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAkBvD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAevD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAY7D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAiCtD;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAahE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAmB7D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAe7D;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAYxE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAyB1D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EAAE,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAoCT;AAMD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAsB7D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAO5D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQ7D;AAMD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAwC1D;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAgCvD;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAWvD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAWtD;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EAAE,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAiCT;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EAAE,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAeT;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EAAE,EACf,SAAS,EAAE,MAAM,GAChB;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CA+C7C;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAgCvE;AAMD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAiD/E;AAED;;GAEG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAE,MAAW,GAAG,OAAO,CA0BpH;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAE,MAAW,GAAG,OAAO,CA0CvG;AAMD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAiD5E;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CA6BrG;AAMD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,aAAa,GAAG,cAAc,GAAG,iBAAiB,CAuBpD;AAMD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,YAAY,EAAE,OAAO,CAAA;IACrB,+DAA+D;IAC/D,eAAe,EAAE,OAAO,CAAA;IACxB,oDAAoD;IACpD,UAAU,EAAE,OAAO,CAAA;IACnB,yCAAyC;IACzC,YAAY,EAAE,OAAO,CAAA;IACrB,kDAAkD;IAClD,YAAY,EAAE,OAAO,CAAA;CACtB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAetD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,CAQ9D"}

package/dist/parse/file-classifier.js

@@ -25,6 +25,7 @@ exports.isDesktopAppContext = isDesktopAppContext;
 exports.isMcpServerContext = isMcpServerContext;
 exports.isFileLoaderContext = isFileLoaderContext;
 exports.isAgentSkillFile = isAgentSkillFile;
+exports.isAIRulesFile = isAIRulesFile;
 exports.isEnvVarReference = isEnvVarReference;
 exports.isNextPublicEnvVar = isNextPublicEnvVar;
 exports.isComment = isComment;
@@ -84,9 +85,9 @@ function isTestOrMockFile(filePath) {
     const testPatterns = [
         /\.(test|spec)\.(ts|tsx|js|jsx)$/i,
         /\/__tests__\//i,
-        /\/test\//i,
-        /\/tests\//i,
-        /\/testing\//i, // testing directories (e.g., docker/testing/)
+        /(^|\/)test\//i,
+        /(^|\/)tests\//i,
+        /(^|\/)testing\//i, // testing directories (e.g., docker/testing/)
         /\/mock/i,
         /\/mocks\//i,
         /\/fixtures?\//i,
@@ -98,6 +99,12 @@ function isTestOrMockFile(filePath) {
         /\/playwright\//i, // Playwright tests
         /\/vitest\//i, // Vitest
         /\/jest\//i, // Jest
+        /\.Tests\./i, // C# test project namespace (e.g., StockCraft.Infrastructure.Tests)
+        /\.Test\./i, // C# test project namespace singular
+        /\.test\.cs$/i, // C# test file suffix
+        /\.spec\.cs$/i, // C# spec file suffix
+        /Test\.cs$/i, // Files ending in Test.cs
+        /Tests\.cs$/i, // Files ending in Tests.cs
     ];
     return testPatterns.some(pattern => pattern.test(filePath));
 }
@@ -110,10 +117,12 @@ function isExampleFile(filePath) {
         filePath.includes('.sample') ||
         filePath.includes('.template') ||
         filePath.includes('README') ||
-        filePath.includes('/examples/') ||
-        filePath.includes('/example/') ||
-        filePath.includes('/demo/') ||
-        filePath.includes('/demos/'));
+        filePath.includes('/examples/') || filePath.startsWith('examples/') ||
+        filePath.includes('/example/') || filePath.startsWith('example/') ||
+        filePath.includes('/demo/') || filePath.startsWith('demo/') ||
+        filePath.includes('/demos/') || filePath.startsWith('demos/') ||
+        filePath.includes('.Development.') ||
+        filePath.toLowerCase().includes('launchsettings'));
 }
 /**
  * Check if file is in an examples/demo directory
@@ -122,14 +131,14 @@ function isExampleFile(filePath) {
  */
 function isExampleDirectory(filePath) {
     const examplePatterns = [
-        /\/examples?\//i,
-        /\/demos?\//i,
-        /\/templates?\//i,
-        /\/samples?\//i,
-        /\/tutorials?\//i,
-        /\/cookbook\//i,
-        /\/quickstart\//i,
-        /\/getting-started\//i,
+        /(^|\/)examples?\//i,
+        /(^|\/)demos?\//i,
+        /(^|\/)templates?\//i,
+        /(^|\/)samples?\//i,
+        /(^|\/)tutorials?\//i,
+        /(^|\/)cookbook\//i,
+        /(^|\/)quickstart\//i,
+        /(^|\/)getting-started\//i,
     ];
     return examplePatterns.some(pattern => pattern.test(filePath));
 }
@@ -161,6 +170,7 @@ function isLibraryCode(filePath) {
 function isFixtureFile(filePath) {
     const fixturePatterns = [
         /__fixtures__\//i,
+        /__testfixtures__\//i,
         /\.fixture\./i,
         /fixtures?\//i,
         /testdata\//i,
@@ -302,6 +312,7 @@ function isEducationalVulnerabilityFile(filePath) {
         /\/vuln-examples?\//i,
         /\/challenge-\d+/i, // OWASP Juice Shop challenges
         /\/exploit-examples?\//i,
+        /\/codefixes?\//i, // OWASP Juice Shop code fix exercises
     ];
     return patterns.some(p => p.test(filePath));
 }
@@ -489,6 +500,43 @@ function isAgentSkillFile(filePath) {
     ];
     return skillPatterns.some(p => p.test(filePath));
 }
+/**
+ * Check if file is an AI rules/configuration file (superset of isAgentSkillFile)
+ * Includes all agent skill paths PLUS broader AI tool config files that are
+ * targets for the "Rules File Backdoor" attack (invisible Unicode payloads,
+ * stealth instructions).
+ *
+ * Covers: .cursorrules, .windsurfrules, CLAUDE.md (root), .cursor/*, .claude/*,
+ * .gemini/*, .github/copilot-instructions.md, .github/agents/*, Windsurf
+ * global_rules.md, .mdc files in AI directories, etc.
+ */
+function isAIRulesFile(filePath) {
+    // First check: all agent skill files are also AI rules files
+    if (isAgentSkillFile(filePath))
+        return true;
+    const rulesPatterns = [
+        // Root CLAUDE.md (not matched by isAgentSkillFile)
+        /\/CLAUDE\.md$/i,
+        /^CLAUDE\.md$/i,
+        // .cursorrules / .windsurfrules at root (bare paths without directory prefix)
+        /^\.cursorrules$/i,
+        /^\.windsurfrules$/i,
+        // Windsurf
+        /\/\.windsurfrules$/i,
+        /\/global_rules\.md$/i,
+        // Gemini
+        /\/\.gemini\//i,
+        // Cursor extended paths
+        /\/\.cursor\/commands\//i,
+        /\/\.cursor\/tools\//i,
+        // Claude extended paths
+        /\/\.claude\/settings\.json$/i,
+        /\/\.claude\/instructions\.md$/i,
+        // .mdc files (Cursor rules format)
+        /\.mdc$/i,
+    ];
+    return rulesPatterns.some(p => p.test(filePath));
+}
 // ============================================================================
 // Code Line Context Detection
 // ============================================================================