@oomerevren/tryforge 0.1.2 → 0.1.3

package/dist/cli/src/core/lock.js

@@ -1,9 +1,35 @@
 import { existsSync, readFileSync, writeFileSync } from "fs";
 import { join, resolve } from "path";
 import { parse } from "smol-toml";
+import { loadPackageDetail } from "./registry.js";
+/** Build a lock entry with pinned integrity (source URL + sha256). */
+export function lockEntryFor(name, version, type, meta, source = "registry") {
+    return {
+        name,
+        version,
+        type,
+        ...(meta.tarball ? { tarball: meta.tarball } : {}),
+        ...(meta.sha256 ? { sha256: meta.sha256 } : {}),
+        source,
+    };
+}
 export function lockPath(cwd = process.cwd()) {
     return join(resolve(cwd), "forge.lock");
 }
+function toEntry(x) {
+    const entry = {
+        name: String(x.name),
+        version: String(x.version),
+        type: String(x.type ?? "skill"),
+    };
+    if (typeof x.tarball === "string" && x.tarball.length > 0)
+        entry.tarball = x.tarball;
+    if (typeof x.sha256 === "string" && x.sha256.length > 0)
+        entry.sha256 = x.sha256;
+    if (typeof x.source === "string" && x.source.length > 0)
+        entry.source = x.source;
+    return entry;
+}
 export function readLock(cwd = process.cwd()) {
     const p = lockPath(cwd);
     if (!existsSync(p))
@@ -14,28 +40,89 @@ export function readLock(cwd = process.cwd()) {
         const pkgs = parsed.packages;
         if (!Array.isArray(pkgs))
             return null;
-        const packages = pkgs.map((x) => ({
-            name: String(x.name),
-            version: String(x.version),
-            type: String(x.type ?? "skill"),
-        }));
+        const packages = pkgs.map(toEntry);
         return { packages };
     }
     catch {
         return null;
     }
 }
+function escapeTomlString(s) {
+    return s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+/** Deterministic writer: entries sorted by name, fixed field order, LF only. */
 export function writeLock(entries, cwd = process.cwd()) {
     const p = lockPath(cwd);
     // smol-toml stringify doesn't support array-of-tables well via object; craft manually
     // Use [[packages]] TOML array of tables
-    const lines = ['# Generated by Forge — do not edit manually', ''];
-    for (const e of entries) {
+    const sorted = [...entries].sort((a, b) => a.name.localeCompare(b.name));
+    const lines = ["# Generated by Forge — do not edit manually", ""];
+    for (const e of sorted) {
         lines.push("[[packages]]");
-        lines.push(`name = "${e.name}"`);
-        lines.push(`version = "${e.version}"`);
-        lines.push(`type = "${e.type}"`);
+        lines.push(`name = "${escapeTomlString(e.name)}"`);
+        lines.push(`version = "${escapeTomlString(e.version)}"`);
+        lines.push(`type = "${escapeTomlString(e.type)}"`);
+        if (e.tarball)
+            lines.push(`tarball = "${escapeTomlString(e.tarball)}"`);
+        if (e.sha256)
+            lines.push(`sha256 = "${escapeTomlString(e.sha256)}"`);
+        if (e.source)
+            lines.push(`source = "${escapeTomlString(e.source)}"`);
         lines.push("");
     }
     writeFileSync(p, lines.join("\n"));
 }
+/**
+ * Security barrier for --frozen installs. For every locked entry:
+ * - the locked version must still exist in the registry (else "yanked")
+ * - a locked real sha256 must equal the registry sha256 (else "hash-mismatch")
+ * - a placeholder/mock sha256 is reported as "unverified" (fatal unless
+ *   the caller explicitly allows mock via opts.allowMock)
+ * Returns the issue list (empty = lock is trustworthy). Never throws on
+ * registry I/O — transport failures surface as yanked with the cause inline.
+ */
+export async function verifyLockIntegrity(lock, opts = {}) {
+    const issues = [];
+    for (const entry of lock.packages) {
+        let detail;
+        try {
+            detail = await loadPackageDetail(entry.name);
+        }
+        catch (e) {
+            issues.push({
+                name: entry.name,
+                kind: "yanked",
+                message: `${entry.name}: registry read failed (${e.message}) — refusing frozen install`,
+            });
+            continue;
+        }
+        const meta = detail.versions[entry.version];
+        if (!meta) {
+            issues.push({
+                name: entry.name,
+                kind: "yanked",
+                message: `${entry.name}@${entry.version} is yanked (version missing from registry) — refusing frozen install`,
+            });
+            continue;
+        }
+        const lockedSha = entry.sha256 ?? "";
+        const registrySha = meta.sha256 ?? "";
+        const lockedIsPlaceholder = lockedSha.startsWith("placeholder") || lockedSha === "";
+        if (lockedIsPlaceholder && !opts.allowMock) {
+            issues.push({
+                name: entry.name,
+                kind: "unverified",
+                message: `${entry.name}@${entry.version} has no pinned integrity hash — refusing frozen install (re-run without --frozen, or pass --mock to allow mock content)`,
+            });
+            continue;
+        }
+        if (!lockedIsPlaceholder && registrySha !== "" && lockedSha !== registrySha) {
+            issues.push({
+                name: entry.name,
+                kind: "hash-mismatch",
+                message: `${entry.name}@${entry.version} integrity mismatch: lock=${lockedSha.slice(0, 12)}… registry=${registrySha.slice(0, 12)}… — refusing frozen install`,
+            });
+        }
+    }
+    return issues;
+}

package/dist/cli/src/core/merge.js

@@ -0,0 +1,108 @@
+// cli/src/core/merge.ts — Non-destructive 3-way merge engine (Phase 2).
+//
+// Forge-managed sections inside user-owned text files (CLAUDE.md, AGENTS.md,
+// .windsurfrules, .cursor/rules/*.mdc) are delimited by markers:
+//
+//   <!-- FORGE:START id="<slug>" version="<version>" -->
+//   ...skill instructions...
+//   <!-- FORGE:END id="<slug>" -->
+//
+// Rules:
+// - User content outside markers is NEVER touched (byte-preserved).
+// - Re-install / version bump replaces only the marked block (idempotent).
+// - Uninstall removes only the marked block; if the file is blank afterwards
+//   AND forge created it, the file is deleted (no litter).
+// - Missing file is created with just the block.
+// - Marker ids are restricted to [a-z0-9-/_.@] to block marker injection.
+import { existsSync, readFileSync, writeFileSync, rmSync, mkdirSync } from "fs";
+import { dirname } from "path";
+const ID_RE = /^[a-z0-9\-/_.@]+$/i;
+export function forgeStartMarker(id, version) {
+    assertSafeId(id);
+    return `<!-- FORGE:START id="${id}" version="${version}" -->`;
+}
+export function forgeEndMarker(id) {
+    assertSafeId(id);
+    return `<!-- FORGE:END id="${id}" -->`;
+}
+function assertSafeId(id) {
+    if (!ID_RE.test(id) || id.includes("-->") || id.includes("\n")) {
+        throw new Error(`[forge] invalid forge block id "${id}" — marker injection refused`);
+    }
+}
+function blockPattern(id) {
+    assertSafeId(id);
+    const esc = id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    // Matches a full block including a single trailing newline when present.
+    return new RegExp(`<!-- FORGE:START id="${esc}" version="[^"]*" -->\\r?\\n[\\s\\S]*?<!-- FORGE:END id="${esc}" -->\\r?\\n?`);
+}
+function ensureParentDir(filePath) {
+    const dir = dirname(filePath);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+}
+/** Read a forge-managed block body for an id, or null when absent. */
+export function readForgeBlock(filePath, id) {
+    if (!existsSync(filePath))
+        return null;
+    const raw = readFileSync(filePath, "utf-8");
+    const m = raw.match(blockPattern(id));
+    if (!m)
+        return null;
+    const lines = m[0].split("\n");
+    // strip first (START) and last (END, possibly with trailing "") lines
+    return lines.slice(1, lines[lines.length - 1] === "" ? -2 : -1).join("\n");
+}
+/**
+ * Insert or replace the forge block for `id`. Returns "created" | "updated" |
+ * "unchanged" (byte-identical block already present — no write performed).
+ */
+export function upsertForgeBlock(filePath, id, version, body) {
+    assertSafeId(id);
+    const cleanBody = body.replace(/\r\n/g, "\n").replace(/\n+$/, "") + "\n";
+    const block = `${forgeStartMarker(id, version)}\n${cleanBody}${forgeEndMarker(id)}\n`;
+    if (!existsSync(filePath)) {
+        ensureParentDir(filePath);
+        writeFileSync(filePath, block);
+        return "created";
+    }
+    const raw = readFileSync(filePath, "utf-8");
+    const pattern = blockPattern(id);
+    if (pattern.test(raw)) {
+        const next = raw.replace(pattern, block);
+        if (next === raw)
+            return "unchanged";
+        writeFileSync(filePath, next);
+        return "updated";
+    }
+    const sep = raw.length > 0 && !raw.endsWith("\n") ? "\n" : "";
+    const gap = raw.length > 0 && !raw.endsWith("\n\n") ? "\n" : "";
+    writeFileSync(filePath, `${raw}${sep}${gap}${block}`);
+    return "updated";
+}
+/**
+ * Remove the forge block for `id`. Returns true when a block was removed.
+ * When the file holds nothing but whitespace afterwards AND `deleteIfEmpty`
+ * is set (forge-created files), the file itself is deleted.
+ */
+export function removeForgeBlock(filePath, id, opts = {}) {
+    if (!existsSync(filePath))
+        return false;
+    const raw = readFileSync(filePath, "utf-8");
+    const pattern = blockPattern(id);
+    if (!pattern.test(raw))
+        return false;
+    const next = raw.replace(pattern, "").replace(/^\n+/, "").replace(/\n{3,}/g, "\n\n");
+    if (next.trim().length === 0 && opts.deleteIfEmpty !== false) {
+        rmSync(filePath, { force: true });
+        return true;
+    }
+    writeFileSync(filePath, next);
+    return true;
+}
+/** True when the file contains a forge block for `id`. */
+export function hasForgeBlock(filePath, id) {
+    if (!existsSync(filePath))
+        return false;
+    return blockPattern(id).test(readFileSync(filePath, "utf-8"));
+}

package/dist/cli/src/core/plugin.js

@@ -1,5 +1,5 @@
-// cli/src/core/plugin.ts — Epoch 1e: adapter plugin sistemi
-// Adapter'ları CLI çekirdeğinden ayırarak dinamik yükleme
+// cli/src/core/plugin.ts — Epoch 1e: adapter plugin system
+// Dynamically load adapters, decoupled from the CLI core
 import { existsSync, readdirSync } from "fs";
 import { join } from "path";
 /**

package/dist/cli/src/core/project.js

@@ -15,14 +15,14 @@ export function loadProjectToml(path) {
         raw = readFileSync(path, "utf-8");
     }
     catch (e) {
-        throw new Error(`Cannot read ${path}: ${e.message}`);
+        throw new Error(`Cannot read ${path}: ${e.message}`, { cause: e });
     }
     let parsed;
     try {
         parsed = parse(raw);
     }
     catch (e) {
-        throw new Error(`${path}: invalid TOML — ${e.message}`);
+        throw new Error(`${path}: invalid TOML — ${e.message}`, { cause: e });
     }
     // detect author [package] file (not a project install target)
     if (parsed.package && !parsed.dependencies && !parsed.project) {
@@ -41,9 +41,125 @@ export function loadProjectToml(path) {
     }
     const forge = parsed.forge;
     const project = parsed.project;
-    return { project, dependencies, forge, package: parsed.package };
+    // [agents.<role>] — shared agent roles with model + system prompt
+    let agents;
+    if (parsed.agents !== undefined) {
+        if (typeof parsed.agents !== "object" || Array.isArray(parsed.agents)) {
+            throw new Error(`${path}: [agents] must be a table of roles`);
+        }
+        agents = {};
+        for (const [role, def] of Object.entries(parsed.agents)) {
+            if (typeof def !== "object" || def === null || Array.isArray(def)) {
+                throw new Error(`${path}: [agents.${role}] must be a table`);
+            }
+            const d = def;
+            if (d.model !== undefined && typeof d.model !== "string") {
+                throw new Error(`${path}: [agents.${role}].model must be a string`);
+            }
+            if (d.system_prompt !== undefined && typeof d.system_prompt !== "string") {
+                throw new Error(`${path}: [agents.${role}].system_prompt must be a string`);
+            }
+            agents[role] = {
+                ...(typeof d.model === "string" ? { model: d.model } : {}),
+                ...(typeof d.system_prompt === "string" ? { system_prompt: d.system_prompt } : {}),
+            };
+        }
+    }
+    // [skills] — name = "version" | { version, source, ref }
+    let skills;
+    if (parsed.skills !== undefined) {
+        if (typeof parsed.skills !== "object" || Array.isArray(parsed.skills)) {
+            throw new Error(`${path}: [skills] must be a table`);
+        }
+        skills = {};
+        for (const [skillName, def] of Object.entries(parsed.skills)) {
+            if (typeof def === "string") {
+                skills[skillName] = { version: def };
+            }
+            else if (typeof def === "object" && def !== null && !Array.isArray(def)) {
+                const d = def;
+                const ref = {};
+                if (d.version !== undefined) {
+                    if (typeof d.version !== "string")
+                        throw new Error(`${path}: [skills.${skillName}].version must be a string`);
+                    ref.version = d.version;
+                }
+                if (d.source !== undefined) {
+                    if (typeof d.source !== "string")
+                        throw new Error(`${path}: [skills.${skillName}].source must be a string`);
+                    ref.source = d.source;
+                }
+                if (d.ref !== undefined) {
+                    if (typeof d.ref !== "string")
+                        throw new Error(`${path}: [skills.${skillName}].ref must be a string`);
+                    ref.ref = d.ref;
+                }
+                skills[skillName] = ref;
+            }
+            else {
+                throw new Error(`${path}: [skills.${skillName}] must be a version string or { version, source, ref }`);
+            }
+        }
+    }
+    // [mcp.servers.<name>] — MCP server definitions
+    let mcp;
+    const rawMcp = parsed.mcp;
+    if (rawMcp !== undefined) {
+        if (typeof rawMcp !== "object" || Array.isArray(rawMcp)) {
+            throw new Error(`${path}: [mcp] must be a table`);
+        }
+        const servers = {};
+        const rawServers = (rawMcp.servers ?? {});
+        if (typeof rawServers !== "object" || Array.isArray(rawServers)) {
+            throw new Error(`${path}: [mcp.servers] must be a table`);
+        }
+        for (const [serverName, def] of Object.entries(rawServers)) {
+            if (typeof def !== "object" || def === null || Array.isArray(def)) {
+                throw new Error(`${path}: [mcp.servers.${serverName}] must be a table`);
+            }
+            const d = def;
+            if (typeof d.command !== "string" || d.command.length === 0) {
+                throw new Error(`${path}: [mcp.servers.${serverName}].command is required`);
+            }
+            if (d.args !== undefined && (!Array.isArray(d.args) || !d.args.every((a) => typeof a === "string"))) {
+                throw new Error(`${path}: [mcp.servers.${serverName}].args must be string[]`);
+            }
+            if (d.env !== undefined && (typeof d.env !== "object" || d.env === null || Array.isArray(d.env))) {
+                throw new Error(`${path}: [mcp.servers.${serverName}].env must be a table`);
+            }
+            servers[serverName] = {
+                command: d.command,
+                ...(Array.isArray(d.args) ? { args: d.args } : {}),
+                ...(typeof d.env === "object" && d.env !== null ? { env: d.env } : {}),
+            };
+        }
+        mcp = { servers };
+    }
+    // [permissions] — install-time boundaries
+    let permissions;
+    if (parsed.permissions !== undefined) {
+        if (typeof parsed.permissions !== "object" || Array.isArray(parsed.permissions)) {
+            throw new Error(`${path}: [permissions] must be a table`);
+        }
+        const p = parsed.permissions;
+        for (const key of ["allowed_paths", "denied_paths"]) {
+            const v = p[key];
+            if (v !== undefined && (!Array.isArray(v) || !v.every((a) => typeof a === "string"))) {
+                throw new Error(`${path}: [permissions].${key} must be string[]`);
+            }
+        }
+        if (p.allow_network !== undefined && typeof p.allow_network !== "boolean") {
+            throw new Error(`${path}: [permissions].allow_network must be a boolean`);
+        }
+        permissions = {
+            ...(Array.isArray(p.allowed_paths) ? { allowed_paths: p.allowed_paths } : {}),
+            ...(Array.isArray(p.denied_paths) ? { denied_paths: p.denied_paths } : {}),
+            ...(typeof p.allow_network === "boolean" ? { allow_network: p.allow_network } : {}),
+        };
+    }
+    return { project, dependencies, forge, agents, skills, mcp, permissions, package: parsed.package };
 }
-export function validateProjectToml(p, pathForMsg = "forge.toml") {
+export function validateProjectToml(p) {
     const errs = [];
     for (const [name, range] of Object.entries(p.dependencies)) {
         if (!DEP_NAME_RE.test(name))
@@ -56,5 +172,21 @@ export function validateProjectToml(p, pathForMsg = "forge.toml") {
     if (p.forge?.harnesses !== undefined && !Array.isArray(p.forge.harnesses)) {
         errs.push(`[forge].harnesses must be an array`);
     }
+    if (p.skills) {
+        for (const [skillName, ref] of Object.entries(p.skills)) {
+            if (ref.version && !ref.source && !isValidRange(ref.version)) {
+                errs.push(`Invalid semver range for skill "${skillName}": "${ref.version}"`);
+            }
+            if (ref.source !== undefined && ref.source.length === 0) {
+                errs.push(`Empty source for skill "${skillName}"`);
+            }
+        }
+    }
+    if (p.mcp?.servers) {
+        for (const [serverName, def] of Object.entries(p.mcp.servers)) {
+            if (!def.command)
+                errs.push(`[mcp.servers.${serverName}].command is required`);
+        }
+    }
     return errs;
 }

package/dist/cli/src/core/registry.js

@@ -4,14 +4,14 @@ import { toSlug } from "./store.js";
 import { maxSatisfying } from "./semver.js";
 import { loadConfig } from "./config.js";
 function registryRoot() {
-    // Epoch 1d: config.registry desteği — uzak index URL'si kullanıcı tarafından belirtilebilir
+    // Epoch 1d: config.registry support — remote index URL can be user-provided
     try {
         const cfg = loadConfig();
         if (cfg.registry && /^https?:\/\//.test(cfg.registry)) {
             return cfg.registry;
         }
     }
-    catch { }
+    catch { /* config override is optional; fall back to bundled registry */ }
     const candidates = [
         join(import.meta.dirname ?? "./", "../../../registry"),
         join(import.meta.dirname ?? "./", "../../../../registry"),
@@ -25,7 +25,7 @@ function registryRoot() {
 }
 export async function loadIndex() {
     const root = registryRoot();
-    // Epoch 1d: uzak registry URL'si desteği
+    // Epoch 1d: remote registry URL support
     if (/^https?:\/\//.test(root)) {
         try {
             const res = await fetch(root + "/index.json");
@@ -34,7 +34,7 @@ export async function loadIndex() {
             return await res.json();
         }
         catch (e) {
-            throw new Error(`Remote registry fetch failed: ${e.message}`);
+            throw new Error(`Remote registry fetch failed: ${e.message}`, { cause: e });
         }
     }
     const p = join(root, "index.json");
@@ -45,7 +45,7 @@ export async function loadIndex() {
 export async function loadPackageDetail(pkg) {
     const root = registryRoot();
     const slug = toSlug(pkg);
-    // Epoch 1d: uzak registry URL'si desteği
+    // Epoch 1d: remote registry URL support
     if (/^https?:\/\//.test(root)) {
         try {
             const res = await fetch(`${root}/packages/${slug}.json`);
@@ -54,7 +54,7 @@ export async function loadPackageDetail(pkg) {
             return await res.json();
         }
         catch (e) {
-            throw new Error(`Package not found: ${pkg} (${e.message})`);
+            throw new Error(`Package not found: ${pkg} (${e.message})`, { cause: e });
         }
     }
     const p = join(root, "packages", `${slug}.json`);
@@ -75,7 +75,7 @@ export async function resolveVersion(pkg, requested) {
     if (detail.versions[requested]) {
         return { detail, version: requested, versionMeta: detail.versions[requested] };
     }
-    // semver range (Faz 10: semver.ts tek kaynak) — pick highest satisfying
+    // semver range (Phase 10: semver.ts is the single source) — pick highest satisfying
     const picked = maxSatisfying(Object.keys(detail.versions), requested);
     if (!picked)
         throw new Error(`No version satisfying ${requested} for ${pkg}. Available: ${Object.keys(detail.versions).join(", ")}`);
@@ -91,8 +91,8 @@ export function parsePackageArg(arg) {
     }
     return { name: arg };
 }
-// --- semver helpers Faz 10'da semver.ts'e taşındı (tek kaynak) ---
-// Bu dosya geriye dönük uyumluluk için re-export eder.
+// --- semver helpers moved to semver.ts in Phase 10 (single source) ---
+// This file re-exports for backwards compatibility.
 export { parseSemver, compareSemver, satisfiesRange, maxSatisfying, isValidRange } from "./semver.js";
 export async function searchPackages(query, opts = {}) {
     const index = await loadIndex();

package/dist/cli/src/core/scan.js

@@ -0,0 +1,159 @@
+// cli/src/core/scan.ts — Static security scanner (Phase 3).
+//
+// AI agents execute third-party skills/prompts, so every package is scanned
+// BEFORE install and BY audit afterwards. Three rule families:
+//
+//   shell-danger  — destructive/remote-code shell in scripts
+//                   (rm -rf /, curl|bash, fork bombs, cred theft)
+//   prompt-inject — hidden instruction overrides + exfiltration in prompts
+//                   (ignore-previous, send secrets to http, embedded keys)
+//   perm-violation — package content touching project [permissions].denied_paths
+//
+// Severity: high blocks installs (fail-closed, exit 1); medium/low warn.
+// Scanners are regex-based, dependency-free, and deterministic.
+import { existsSync, readFileSync, readdirSync, statSync } from "fs";
+import { join, relative, extname, basename } from "path";
+const PROMPT_EXTS = [".md", ".mdc", ".txt", ".json", ".yaml", ".yml", ".toml"];
+const RULES = [
+    // --- shell-danger (high) ---
+    { id: "rm-rf-root", family: "shell-danger", severity: "high", pattern: /\brm\s+(-[a-z]*r[a-z]*f|--recursive\s+--force)\s+\/( |$)/, message: "recursive delete rooted at /", exts: [] },
+    { id: "curl-pipe-shell", family: "shell-danger", severity: "high", pattern: /\bcurl\b[^\n|]*\|\s*(bash|sh)(\s|$)/, message: "curl piped into a shell (remote code execution)", exts: [] },
+    { id: "wget-pipe-shell", family: "shell-danger", severity: "high", pattern: /\bwget\b[^\n|]*\|\s*(bash|sh)(\s|$)/, message: "wget piped into a shell (remote code execution)", exts: [] },
+    { id: "fork-bomb", family: "shell-danger", severity: "high", pattern: /:\(\)\s*\{\s*:\s*\|\s*:\s*&?\s*\}\s*;?/, message: "shell fork bomb", exts: [] },
+    { id: "disk-wipe", family: "shell-danger", severity: "high", pattern: /\b(mkfs|dd\s+[^\n]*of=\/dev\/)/, message: "disk wipe / raw device write", exts: [] },
+    { id: "chmod-777-root", family: "shell-danger", severity: "high", pattern: /\bchmod\s+(-R\s+)?777\s+\//, message: "chmod 777 on a system path", exts: [] },
+    { id: "reverse-shell", family: "shell-danger", severity: "high", pattern: /\bnc(\.exe)?\s+[^\n]*-e\s+\S|bash\s+-i\s+>&\s*\/dev\/tcp\//, message: "reverse shell", exts: [] },
+    { id: "ssh-key-theft", family: "shell-danger", severity: "high", pattern: /\b(cat|type|Get-Content)\s+[^\n]*(id_rsa|id_ed25519|\.ssh\/)/, message: "reads private SSH keys", exts: [] },
+    { id: "powershell-encoded", family: "shell-danger", severity: "high", pattern: /powershell[^\n]*-(e(nc(odedcommand)?)?)\b/i, message: "encoded PowerShell payload", exts: [] },
+    // --- shell-danger (medium) ---
+    { id: "sudo-curl", family: "shell-danger", severity: "medium", pattern: /\bsudo\s+(curl|wget)\b/, message: "privileged download", exts: [] },
+    { id: "env-exfil-curl", family: "shell-danger", severity: "medium", pattern: /\bcurl\b[^\n]*\$(?:\{(?:AWS_|GITHUB_|OPENAI_|ANTHROPIC_|API_KEY|TOKEN|SECRET))/, message: "curl sends a secret-looking env var", exts: [] },
+    // --- prompt-inject (high) ---
+    { id: "ignore-instructions", family: "prompt-inject", severity: "high", pattern: /\b(ignore|disregard)\s+(all\s+)?(previous|prior|above)\s+instructions\b/i, message: "instruction override (prompt injection)", exts: PROMPT_EXTS },
+    { id: "system-role-hijack", family: "prompt-inject", severity: "high", pattern: /you are now (a|an|the)\b.{0,80}?(assistant|agent|system|root|admin)/i, message: "role hijack (prompt injection)", exts: PROMPT_EXTS },
+    { id: "send-secrets-http", family: "prompt-inject", severity: "high", pattern: /\b(send|post|upload|exfiltrat\w*)\b[^\n]{0,120}?(api[\s_-]?key|secret|token|password|private[\s_-]?key)[^\n]{0,80}?\bhttps?:\/\//i, message: "instructs secret exfiltration over http", exts: PROMPT_EXTS },
+    // --- prompt-inject (medium) ---
+    { id: "embedded-aws-key", family: "prompt-inject", severity: "medium", pattern: /\bAKIA[0-9A-Z]{16}\b/, message: "embedded AWS access key", exts: [] },
+    { id: "embedded-github-token", family: "prompt-inject", severity: "medium", pattern: /\bghp_[a-zA-Z0-9]{20,}\b/, message: "embedded GitHub token", exts: [] },
+    { id: "embedded-private-key", family: "prompt-inject", severity: "medium", pattern: /-----BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY-----/, message: "embedded private key", exts: [] },
+    { id: "read-env-file", family: "prompt-inject", severity: "medium", pattern: /\b(cat|type|Get-Content|read)\s+[^\n]*\.env\b/i, message: "reads .env secrets file", exts: PROMPT_EXTS },
+];
+const MAX_FILE_BYTES = 512 * 1024;
+const SKIP_DIRS = new Set(["node_modules", ".git", ".hg", ".svn", "__pycache__", "dist", "build", ".cache"]);
+function listTextFiles(dir, out = []) {
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const e of entries) {
+        if (e.name.startsWith(".forge-"))
+            continue;
+        const full = join(dir, e.name);
+        if (e.isDirectory()) {
+            if (!SKIP_DIRS.has(e.name))
+                listTextFiles(full, out);
+        }
+        else if (e.isFile()) {
+            try {
+                if (statSync(full).size <= MAX_FILE_BYTES)
+                    out.push(full);
+            }
+            catch {
+                /* unreadable — skip */
+            }
+        }
+    }
+    return out;
+}
+function snippet(line) {
+    const t = line.trim();
+    return t.length > 120 ? `${t.slice(0, 120)}…` : t;
+}
+/** Scan one package content dir. Deterministic: files sorted, rules ordered. */
+export function scanPackageDir(dir, opts = {}) {
+    const findings = [];
+    if (!existsSync(dir))
+        return findings;
+    const files = listTextFiles(dir).sort();
+    for (const file of files) {
+        const rel = relative(dir, file).replace(/\\/g, "/");
+        const ext = extname(file).toLowerCase();
+        let raw;
+        try {
+            raw = readFileSync(file, "utf-8");
+        }
+        catch {
+            continue;
+        }
+        if (raw.indexOf("\0") !== -1)
+            continue; // binary
+        const lines = raw.split("\n");
+        for (const rule of RULES) {
+            if (rule.exts.length > 0 && !rule.exts.includes(ext) && basename(file) !== "Dockerfile")
+                continue;
+            for (let i = 0; i < lines.length; i++) {
+                // reset stateful regexes
+                rule.pattern.lastIndex = 0;
+                if (rule.pattern.test(lines[i])) {
+                    findings.push({
+                        rule: rule.id,
+                        family: rule.family,
+                        severity: rule.severity,
+                        file: rel,
+                        line: i + 1,
+                        match: snippet(lines[i]),
+                        message: rule.message,
+                    });
+                    break; // one hit per rule per file keeps output stable
+                }
+            }
+        }
+    }
+    findings.push(...checkPermissions(dir, files, opts.permissions));
+    findings.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line || a.rule.localeCompare(b.rule));
+    return findings;
+}
+function globToRegExp(glob) {
+    // Minimal glob: * matches any run except /, **/ matches any depth.
+    const token = "FORGEGLOBSTAR";
+    const esc = glob
+        .replace(/[.+^${}()|[\]\\]/g, "\\$&")
+        .replace(/\*\*\//g, token)
+        .replace(/\*/g, "[^/]*")
+        .split(token)
+        .join(".*");
+    return new RegExp(`(^|/)${esc}$`, "i");
+}
+/** Flag package content touching project [permissions].denied_paths. */
+export function checkPermissions(dir, files, permissions) {
+    const denied = permissions?.denied_paths ?? [];
+    if (denied.length === 0)
+        return [];
+    const patterns = denied.map(globToRegExp);
+    const out = [];
+    for (const file of files) {
+        const rel = relative(dir, file).replace(/\\/g, "/");
+        const base = basename(file);
+        if (patterns.some((p) => p.test(rel) || p.test(base))) {
+            out.push({
+                rule: "denied-path-content",
+                family: "perm-violation",
+                severity: "high",
+                file: rel,
+                line: 0,
+                match: rel,
+                message: `package ships content matching project denied_paths (${rel})`,
+            });
+        }
+    }
+    return out;
+}
+export function countBySeverity(findings) {
+    const out = { high: 0, medium: 0, low: 0 };
+    for (const f of findings)
+        out[f.severity]++;
+    return out;
+}