@oops-catcher/core 0.1.0

package/dist/rules/containers_v1.js

@@ -0,0 +1,392 @@
+import yaml from 'js-yaml';
+import { lineForIndex } from '../engine/line.js';
+import { redactExcerpt } from '../output/redact.js';
+import { stableFingerprint } from '../engine/fingerprint.js';
+// ── helpers ──────────────────────────────────────────────────────────────────
+const DOCKER_SOCK = '/var/run/docker.sock';
+const CRED_DIRS = ['/.ssh', '/.aws', '/.config/gcloud'];
+const REMOTE_SCRIPT = /\b(curl|wget)\b[^|#\n]*\|\s*(ba)?sh/g;
+function isComposeFile(path) {
+    return (path.endsWith('docker-compose.yml') ||
+        path.endsWith('docker-compose.yaml') ||
+        path.endsWith('compose.yml') ||
+        path.endsWith('compose.yaml'));
+}
+function isDevcontainer(path) {
+    return path.endsWith('devcontainer.json');
+}
+function isDockerfile(path) {
+    const base = path.split('/').pop() ?? path;
+    return base === 'Dockerfile' || base.startsWith('Dockerfile.');
+}
+function lineForText(content, text) {
+    const index = content.indexOf(text);
+    if (index === -1)
+        return undefined;
+    return lineForIndex(content, index);
+}
+function hasDockerSockMount(value) {
+    if (typeof value === 'string')
+        return value.includes(DOCKER_SOCK);
+    if (Array.isArray(value))
+        return value.some(hasDockerSockMount);
+    if (value && typeof value === 'object') {
+        const obj = value;
+        return Object.values(obj).some(hasDockerSockMount);
+    }
+    return false;
+}
+function hasCredDirMount(value) {
+    if (typeof value === 'string') {
+        const hit = CRED_DIRS.find((d) => value.includes(d));
+        return hit ?? null;
+    }
+    if (Array.isArray(value)) {
+        for (const v of value) {
+            const hit = hasCredDirMount(v);
+            if (hit)
+                return hit;
+        }
+    }
+    if (value && typeof value === 'object') {
+        for (const v of Object.values(value)) {
+            const hit = hasCredDirMount(v);
+            if (hit)
+                return hit;
+        }
+    }
+    return null;
+}
+function deepSearch(value, predicate) {
+    if (typeof value === 'string')
+        return predicate(value);
+    if (Array.isArray(value))
+        return value.some((v) => deepSearch(v, predicate));
+    if (value && typeof value === 'object') {
+        return Object.values(value).some((v) => deepSearch(v, predicate));
+    }
+    return false;
+}
+function parseYaml(content) {
+    try {
+        return yaml.load(content);
+    }
+    catch {
+        return null;
+    }
+}
+function parseJson(content) {
+    try {
+        return JSON.parse(content);
+    }
+    catch {
+        return null;
+    }
+}
+// ── rules ─────────────────────────────────────────────────────────────────────
+export const containersV1Rules = [
+    // CON001 — Docker socket mounted
+    {
+        id: 'CON001',
+        title: 'Docker socket mounted',
+        defaultSeverity: 'critical',
+        appliesTo: (path) => isDevcontainer(path) || isComposeFile(path),
+        run: (ctx) => {
+            const findings = [];
+            const line = lineForText(ctx.content, DOCKER_SOCK);
+            const redactedExcerpt = line !== undefined
+                ? redactExcerpt(DOCKER_SOCK, ctx.config.output.redact)
+                : undefined;
+            if (isDevcontainer(ctx.path)) {
+                const parsed = parseJson(ctx.content);
+                if (!parsed)
+                    return [];
+                if (hasDockerSockMount(parsed?.['mounts'])) {
+                    findings.push({
+                        ruleId: 'CON001',
+                        severity: 'critical',
+                        path: ctx.path,
+                        line,
+                        message: 'Docker socket mounted in devcontainer',
+                        why: 'Mounting the Docker socket grants host-level control inside the container.',
+                        fix: 'Remove the socket mount or switch to a safer build workflow.',
+                        redactedExcerpt,
+                        fingerprint: stableFingerprint(`CON001:${ctx.path}:${line ?? 0}:devcontainer`),
+                    });
+                }
+            }
+            else {
+                const parsed = parseYaml(ctx.content);
+                if (!parsed)
+                    return [];
+                const services = (parsed['services'] ?? {});
+                const hasSock = Object.values(services).some((service) => {
+                    if (!service || typeof service !== 'object')
+                        return false;
+                    return hasDockerSockMount(service['volumes']);
+                });
+                if (hasSock) {
+                    findings.push({
+                        ruleId: 'CON001',
+                        severity: 'critical',
+                        path: ctx.path,
+                        line,
+                        message: 'Docker socket mounted in compose',
+                        why: 'Mounting the Docker socket grants host-level control inside the container.',
+                        fix: 'Remove the socket mount or use a safer build service.',
+                        redactedExcerpt,
+                        fingerprint: stableFingerprint(`CON001:${ctx.path}:${line ?? 0}:compose`),
+                    });
+                }
+            }
+            return findings;
+        },
+    },
+    // CON002 — Privileged container
+    {
+        id: 'CON002',
+        title: 'Privileged container',
+        defaultSeverity: 'critical',
+        appliesTo: (path) => isComposeFile(path) || isDevcontainer(path) || isDockerfile(path),
+        run: (ctx) => {
+            const findings = [];
+            if (isDockerfile(ctx.path)) {
+                if (/\bRUN\b[^\n]*--privileged/.test(ctx.content)) {
+                    const line = lineForText(ctx.content, '--privileged');
+                    findings.push({
+                        ruleId: 'CON002',
+                        severity: 'critical',
+                        path: ctx.path,
+                        line,
+                        message: 'Privileged flag used in Dockerfile RUN',
+                        why: 'Privileged containers bypass isolation and can escape to the host.',
+                        fix: 'Remove the --privileged flag.',
+                        fingerprint: stableFingerprint(`CON002:${ctx.path}:${line ?? 0}`),
+                    });
+                }
+                return findings;
+            }
+            if (isDevcontainer(ctx.path)) {
+                const parsed = parseJson(ctx.content);
+                if (!parsed)
+                    return [];
+                if (deepSearch(parsed, (s) => s.includes('--privileged'))) {
+                    const line = lineForText(ctx.content, '--privileged');
+                    findings.push({
+                        ruleId: 'CON002',
+                        severity: 'critical',
+                        path: ctx.path,
+                        line,
+                        message: 'Privileged flag in devcontainer',
+                        why: 'Privileged containers bypass isolation.',
+                        fix: 'Remove the --privileged flag.',
+                        fingerprint: stableFingerprint(`CON002:${ctx.path}:${line ?? 0}:devcontainer`),
+                    });
+                }
+                return findings;
+            }
+            // Compose
+            const parsed = parseYaml(ctx.content);
+            if (!parsed)
+                return [];
+            const services = (parsed['services'] ?? {});
+            for (const [name, service] of Object.entries(services)) {
+                if (!service || typeof service !== 'object')
+                    continue;
+                const svc = service;
+                if (svc['privileged'] === true) {
+                    const line = lineForText(ctx.content, 'privileged: true');
+                    findings.push({
+                        ruleId: 'CON002',
+                        severity: 'critical',
+                        path: ctx.path,
+                        line,
+                        message: `Privileged container in service '${name}'`,
+                        why: 'Privileged containers bypass isolation and can escape to the host.',
+                        fix: 'Remove privileged: true from the service definition.',
+                        fingerprint: stableFingerprint(`CON002:${ctx.path}:${name}`),
+                    });
+                }
+            }
+            return findings;
+        },
+    },
+    // CON003 — Host networking
+    {
+        id: 'CON003',
+        title: 'Host networking enabled',
+        defaultSeverity: 'critical',
+        appliesTo: (path) => isComposeFile(path) || isDevcontainer(path),
+        run: (ctx) => {
+            const findings = [];
+            if (isDevcontainer(ctx.path)) {
+                const parsed = parseJson(ctx.content);
+                if (!parsed)
+                    return [];
+                if (deepSearch(parsed, (s) => s === 'host')) {
+                    const line = lineForText(ctx.content, 'host');
+                    findings.push({
+                        ruleId: 'CON003',
+                        severity: 'critical',
+                        path: ctx.path,
+                        line,
+                        message: 'Host networking in devcontainer',
+                        why: 'Host networking reduces container isolation.',
+                        fix: 'Use a bridge network instead.',
+                        fingerprint: stableFingerprint(`CON003:${ctx.path}:devcontainer`),
+                    });
+                }
+                return findings;
+            }
+            const parsed = parseYaml(ctx.content);
+            if (!parsed)
+                return [];
+            const services = (parsed['services'] ?? {});
+            for (const [name, service] of Object.entries(services)) {
+                if (!service || typeof service !== 'object')
+                    continue;
+                const svc = service;
+                if (svc['network_mode'] === 'host') {
+                    const line = lineForText(ctx.content, 'network_mode: host');
+                    findings.push({
+                        ruleId: 'CON003',
+                        severity: 'critical',
+                        path: ctx.path,
+                        line,
+                        message: `Host networking in service '${name}'`,
+                        why: 'Host networking reduces container isolation.',
+                        fix: "Remove network_mode: host and use a bridge network.",
+                        fingerprint: stableFingerprint(`CON003:${ctx.path}:${name}`),
+                    });
+                }
+            }
+            return findings;
+        },
+    },
+    // CON004 — Container runs as root
+    {
+        id: 'CON004',
+        title: 'Container runs as root',
+        defaultSeverity: 'warning',
+        appliesTo: (path) => isDevcontainer(path) || isDockerfile(path),
+        run: (ctx) => {
+            if (isDockerfile(ctx.path)) {
+                // Heuristic: no USER instruction = runs as root
+                if (!/^\s*USER\s+/m.test(ctx.content)) {
+                    return [
+                        {
+                            ruleId: 'CON004',
+                            severity: 'warning',
+                            path: ctx.path,
+                            message: 'No USER instruction in Dockerfile (runs as root)',
+                            why: 'Containers that run as root increase blast radius if compromised.',
+                            fix: 'Add a USER instruction to run as a non-root user.',
+                            fingerprint: stableFingerprint(`CON004:${ctx.path}:no-user`),
+                        },
+                    ];
+                }
+                return [];
+            }
+            // devcontainer: remoteUser = root
+            const parsed = parseJson(ctx.content);
+            if (!parsed)
+                return [];
+            if (parsed['remoteUser'] === 'root') {
+                return [
+                    {
+                        ruleId: 'CON004',
+                        severity: 'warning',
+                        path: ctx.path,
+                        message: 'remoteUser set to root in devcontainer',
+                        why: 'Running as root in a container increases blast radius.',
+                        fix: 'Set remoteUser to a non-root user.',
+                        fingerprint: stableFingerprint(`CON004:${ctx.path}:remoteUser`),
+                    },
+                ];
+            }
+            return [];
+        },
+    },
+    // CON101 — Credential directories mounted
+    {
+        id: 'CON101',
+        title: 'Credential directory mounted',
+        defaultSeverity: 'warning',
+        appliesTo: (path) => isComposeFile(path) || isDevcontainer(path),
+        run: (ctx) => {
+            const findings = [];
+            if (isDevcontainer(ctx.path)) {
+                const parsed = parseJson(ctx.content);
+                if (!parsed)
+                    return [];
+                const hit = hasCredDirMount(parsed);
+                if (hit) {
+                    const line = lineForText(ctx.content, hit);
+                    findings.push({
+                        ruleId: 'CON101',
+                        severity: 'warning',
+                        path: ctx.path,
+                        line,
+                        message: `Credential directory mounted in devcontainer (${hit})`,
+                        why: 'Mounting credential directories exposes host secrets inside containers.',
+                        fix: 'Remove the mount or use short-lived credentials instead.',
+                        fingerprint: stableFingerprint(`CON101:${ctx.path}:devcontainer:${hit}`),
+                    });
+                }
+                return findings;
+            }
+            const parsed = parseYaml(ctx.content);
+            if (!parsed)
+                return [];
+            const services = (parsed['services'] ?? {});
+            for (const [name, service] of Object.entries(services)) {
+                if (!service || typeof service !== 'object')
+                    continue;
+                const svc = service;
+                const hit = hasCredDirMount(svc['volumes']);
+                if (hit) {
+                    const line = lineForText(ctx.content, hit);
+                    findings.push({
+                        ruleId: 'CON101',
+                        severity: 'warning',
+                        path: ctx.path,
+                        line,
+                        message: `Credential directory mounted in service '${name}' (${hit})`,
+                        why: 'Mounting credential directories exposes host secrets inside containers.',
+                        fix: 'Remove the mount or use short-lived credentials instead.',
+                        fingerprint: stableFingerprint(`CON101:${ctx.path}:${name}:${hit}`),
+                    });
+                }
+            }
+            return findings;
+        },
+    },
+    // CON102 — Remote script execution
+    {
+        id: 'CON102',
+        title: 'Remote script execution in dev setup',
+        defaultSeverity: 'warning',
+        appliesTo: (path) => isDockerfile(path) || isDevcontainer(path),
+        run: (ctx) => {
+            const findings = [];
+            for (const match of ctx.content.matchAll(REMOTE_SCRIPT)) {
+                const index = match.index ?? 0;
+                const line = lineForIndex(ctx.content, index);
+                const matched = match[0];
+                findings.push({
+                    ruleId: 'CON102',
+                    severity: 'warning',
+                    path: ctx.path,
+                    line,
+                    message: `Remote script piped to shell: ${matched.slice(0, 60)}`,
+                    why: 'Piping remote scripts to a shell is risky; the script could change without notice.',
+                    fix: 'Pin the script URL to a specific commit hash and validate its checksum.',
+                    redactedExcerpt: matched.slice(0, 80),
+                    fingerprint: stableFingerprint(`CON102:${ctx.path}:${line}`),
+                });
+            }
+            return findings;
+        },
+    },
+];
+//# sourceMappingURL=containers_v1.js.map

package/dist/rules/containers_v1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containers_v1.js","sourceRoot":"","sources":["../../src/rules/containers_v1.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,SAAS,CAAC;AAG3B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,gFAAgF;AAEhF,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAE3C,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;AAExD,MAAM,aAAa,GAAG,sCAAsC,CAAC;AAE7D,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,CACL,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;IAC3C,OAAO,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,IAAY;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACnC,OAAO,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAChE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,OAAO,GAAG,IAAI,IAAI,CAAC;IACrB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,EAAE,CAAC;YAChE,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,SAAiC;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7E,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAA4B,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,MAAM,CAAC,MAAM,iBAAiB,GAAW;IACvC,iCAAiC;IACjC;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,uBAAuB;QAC9B,eAAe,EAAE,UAAU;QAC3B,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC;QAChE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACnD,MAAM,eAAe,GAAG,IAAI,KAAK,SAAS;gBACxC,CAAC,CAAC,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBACtD,CAAC,CAAC,SAAS,CAAC;YAEd,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACtC,IAAI,CAAC,MAAM;oBAAE,OAAO,EAAE,CAAC;gBACvB,IAAI,kBAAkB,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;oBAC3C,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,QAAQ;wBAChB,QAAQ,EAAE,UAAU;wBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,IAAI;wBACJ,OAAO,EAAE,uCAAuC;wBAChD,GAAG,EAAE,4EAA4E;wBACjF,GAAG,EAAE,8DAA8D;wBACnE,eAAe;wBACf,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC;qBAC/E,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACtC,IAAI,CAAC,MAAM;oBAAE,OAAO,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAA4B,CAAC;gBACvE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;oBACvD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;wBAAE,OAAO,KAAK,CAAC;oBAC1D,OAAO,kBAAkB,CAAE,OAAmC,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC7E,CAAC,CAAC,CAAC;gBACH,IAAI,OAAO,EAAE,CAAC;oBACZ,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,QAAQ;wBAChB,QAAQ,EAAE,UAAU;wBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,IAAI;wBACJ,OAAO,EAAE,kCAAkC;wBAC3C,GAAG,EAAE,4EAA4E;wBACjF,GAAG,EAAE,uDAAuD;wBAC5D,eAAe;wBACf,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC;qBAC1E,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;IAED,gCAAgC;IAChC;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,sBAAsB;QAC7B,eAAe,EAAE,UAAU;QAC3B,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC;QACtF,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,QAAQ,GAAc,EAAE,CAAC;YAE/B,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,IAAI,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBAClD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;oBACtD,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,QAAQ;wBAChB,QAAQ,EAAE,UAAU;wBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,IAAI;wBACJ,OAAO,EAAE,wCAAwC;wBACjD,GAAG,EAAE,oEAAoE;wBACzE,GAAG,EAAE,+BAA+B;wBACpC,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;qBAClE,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACtC,IAAI,CAAC,MAAM;oBAAE,OAAO,EAAE,CAAC;gBACvB,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;oBAC1D,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;oBACtD,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,QAAQ;wBAChB,QAAQ,EAAE,UAAU;wBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,IAAI;wBACJ,OAAO,EAAE,iCAAiC;wBAC1C,GAAG,EAAE,yCAAyC;wBAC9C,GAAG,EAAE,+BAA+B;wBACpC,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC;qBAC/E,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,UAAU;YACV,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAA4B,CAAC;YACvE,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;oBAAE,SAAS;gBACtD,MAAM,GAAG,GAAG,OAAkC,CAAC;gBAC/C,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;oBAC1D,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,QAAQ;wBAChB,QAAQ,EAAE,UAAU;wBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,IAAI;wBACJ,OAAO,EAAE,oCAAoC,IAAI,GAAG;wBACpD,GAAG,EAAE,oEAAoE;wBACzE,GAAG,EAAE,sDAAsD;wBAC3D,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;qBAC7D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;IAED,2BAA2B;IAC3B;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,yBAAyB;QAChC,eAAe,EAAE,UAAU;QAC3B,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC;QAChE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,QAAQ,GAAc,EAAE,CAAC;YAE/B,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACtC,IAAI,CAAC,MAAM;oBAAE,OAAO,EAAE,CAAC;gBACvB,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;oBAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;oBAC9C,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,QAAQ;wBAChB,QAAQ,EAAE,UAAU;wBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,IAAI;wBACJ,OAAO,EAAE,iCAAiC;wBAC1C,GAAG,EAAE,8CAA8C;wBACnD,GAAG,EAAE,+BAA+B;wBACpC,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,eAAe,CAAC;qBAClE,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAA4B,CAAC;YACvE,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;oBAAE,SAAS;gBACtD,MAAM,GAAG,GAAG,OAAkC,CAAC;gBAC/C,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,MAAM,EAAE,CAAC;oBACnC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;oBAC5D,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,QAAQ;wBAChB,QAAQ,EAAE,UAAU;wBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,IAAI;wBACJ,OAAO,EAAE,+BAA+B,IAAI,GAAG;wBAC/C,GAAG,EAAE,8CAA8C;wBACnD,GAAG,EAAE,qDAAqD;wBAC1D,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;qBAC7D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;IAED,kCAAkC;IAClC;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,wBAAwB;QAC/B,eAAe,EAAE,SAAS;QAC1B,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC;QAC/D,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YACX,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,gDAAgD;gBAChD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtC,OAAO;wBACL;4BACE,MAAM,EAAE,QAAQ;4BAChB,QAAQ,EAAE,SAAS;4BACnB,IAAI,EAAE,GAAG,CAAC,IAAI;4BACd,OAAO,EAAE,kDAAkD;4BAC3D,GAAG,EAAE,mEAAmE;4BACxE,GAAG,EAAE,mDAAmD;4BACxD,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,UAAU,CAAC;yBAC7D;qBACF,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,kCAAkC;YAClC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,CAAC;YACvB,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,MAAM,EAAE,CAAC;gBACpC,OAAO;oBACL;wBACE,MAAM,EAAE,QAAQ;wBAChB,QAAQ,EAAE,SAAS;wBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,OAAO,EAAE,wCAAwC;wBACjD,GAAG,EAAE,wDAAwD;wBAC7D,GAAG,EAAE,oCAAoC;wBACzC,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,aAAa,CAAC;qBAChE;iBACF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;KACF;IAED,0CAA0C;IAC1C;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,8BAA8B;QACrC,eAAe,EAAE,SAAS;QAC1B,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC;QAChE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,QAAQ,GAAc,EAAE,CAAC;YAE/B,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACtC,IAAI,CAAC,MAAM;oBAAE,OAAO,EAAE,CAAC;gBACvB,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;oBAC3C,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,QAAQ;wBAChB,QAAQ,EAAE,SAAS;wBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,IAAI;wBACJ,OAAO,EAAE,iDAAiD,GAAG,GAAG;wBAChE,GAAG,EAAE,yEAAyE;wBAC9E,GAAG,EAAE,0DAA0D;wBAC/D,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,iBAAiB,GAAG,EAAE,CAAC;qBACzE,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAA4B,CAAC;YACvE,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;oBAAE,SAAS;gBACtD,MAAM,GAAG,GAAG,OAAkC,CAAC;gBAC/C,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC5C,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;oBAC3C,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,QAAQ;wBAChB,QAAQ,EAAE,SAAS;wBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,IAAI;wBACJ,OAAO,EAAE,4CAA4C,IAAI,MAAM,GAAG,GAAG;wBACrE,GAAG,EAAE,yEAAyE;wBAC9E,GAAG,EAAE,0DAA0D;wBAC/D,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;qBACpE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;IAED,mCAAmC;IACnC;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,sCAAsC;QAC7C,eAAe,EAAE,SAAS;QAC1B,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC;QAC/D,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,QAAQ,GAAc,EAAE,CAAC;YAE/B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;gBAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,SAAS;oBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,IAAI;oBACJ,OAAO,EAAE,iCAAiC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;oBAChE,GAAG,EAAE,oFAAoF;oBACzF,GAAG,EAAE,yEAAyE;oBAC9E,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBACrC,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;iBAC7D,CAAC,CAAC;YACL,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;CACF,CAAC"}

package/dist/rules/registry.d.ts

@@ -0,0 +1,4 @@
+import { Ruleset } from './types.js';
+export declare const RULESETS: Ruleset[];
+export declare function getRulesets(ids: string[]): Ruleset[];
+//# sourceMappingURL=registry.d.ts.map

package/dist/rules/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/rules/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAKrC,eAAO,MAAM,QAAQ,EAAE,OAAO,EAI7B,CAAC;AAEF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAEpD"}

package/dist/rules/registry.js

@@ -0,0 +1,12 @@
+import { secretsV1Rules } from './secrets_v1.js';
+import { containersV1Rules } from './containers_v1.js';
+import { aiArtifactsV1Rules } from './ai_artifacts_v1.js';
+export const RULESETS = [
+    { id: 'secrets_v1', rules: secretsV1Rules },
+    { id: 'containers_v1', rules: containersV1Rules },
+    { id: 'ai_artifacts_v1', rules: aiArtifactsV1Rules },
+];
+export function getRulesets(ids) {
+    return RULESETS.filter((set) => ids.includes(set.id));
+}
+//# sourceMappingURL=registry.js.map

package/dist/rules/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/rules/registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,MAAM,CAAC,MAAM,QAAQ,GAAc;IACjC,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE;IAC3C,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,EAAE;IACjD,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,kBAAkB,EAAE;CACrD,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,GAAa;IACvC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/rules/secrets_v1.d.ts

@@ -0,0 +1,9 @@
+import { Rule } from './types.js';
+declare const PRIVATE_KEY_BLOCK: RegExp;
+declare const GITHUB_TOKEN: RegExp;
+declare const AWS_ACCESS_KEY: RegExp;
+declare const STRIPE_LIVE_KEY: RegExp;
+declare const SLACK_TOKEN: RegExp;
+export declare const secretsV1Rules: Rule[];
+export { PRIVATE_KEY_BLOCK, GITHUB_TOKEN, AWS_ACCESS_KEY, STRIPE_LIVE_KEY, SLACK_TOKEN };
+//# sourceMappingURL=secrets_v1.d.ts.map

package/dist/rules/secrets_v1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets_v1.d.ts","sourceRoot":"","sources":["../../src/rules/secrets_v1.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAKlC,QAAA,MAAM,iBAAiB,QAA0D,CAAC;AAClF,QAAA,MAAM,YAAY,QAAwD,CAAC;AAC3E,QAAA,MAAM,cAAc,QAA4B,CAAC;AAEjD,QAAA,MAAM,eAAe,QAAoC,CAAC;AAC1D,QAAA,MAAM,WAAW,QAA0C,CAAC;AAmC5D,eAAO,MAAM,cAAc,EAAE,IAAI,EAuOhC,CAAC;AAGF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC"}