@profullstack/threatcrush 0.11.1 → 0.11.3

package/dist/daemon.js

@@ -2022,8 +2022,8 @@ var require_toml = __commonJS({
 });
 
 // src/daemon/index.ts
-var import_node_fs15 = require("fs");
-var import_node_path10 = require("path");
+var import_node_fs17 = require("fs");
+var import_node_path12 = require("path");
 
 // src/daemon/paths.ts
 var import_node_fs = require("fs");
@@ -2107,7 +2107,28 @@ function findRunningDaemon() {
 
 // src/daemon/ipc-server.ts
 var import_node_net = require("net");
+var import_node_fs4 = require("fs");
+
+// src/daemon/control-token.ts
+var import_node_crypto = require("crypto");
 var import_node_fs3 = require("fs");
+var import_node_path2 = require("path");
+var CONTROL_TOKEN_FILE = (0, import_node_path2.join)(PATHS.runDir, "control.token");
+function issueControlToken() {
+  const token = (0, import_node_crypto.randomBytes)(32).toString("hex");
+  (0, import_node_fs3.writeFileSync)(CONTROL_TOKEN_FILE, token, { mode: 384 });
+  try {
+    (0, import_node_fs3.chmodSync)(CONTROL_TOKEN_FILE, 384);
+  } catch {
+  }
+  return token;
+}
+function tokensMatch(expected, provided) {
+  if (typeof provided !== "string" || !provided) return false;
+  const a = Buffer.from(expected);
+  const b = Buffer.from(provided);
+  return a.length === b.length && (0, import_node_crypto.timingSafeEqual)(a, b);
+}
 
 // src/daemon/event-bus.ts
 var import_node_events = require("events");
@@ -2303,10 +2324,12 @@ var IpcServer = class {
   nextClientId = 1;
   startedAt = /* @__PURE__ */ new Date();
   counters = { events: 0, threats: 0, alerts: 0 };
+  controlToken = "";
   async start() {
-    if ((0, import_node_fs3.existsSync)(PATHS.socket)) {
+    this.controlToken = issueControlToken();
+    if ((0, import_node_fs4.existsSync)(PATHS.socket)) {
       try {
-        (0, import_node_fs3.unlinkSync)(PATHS.socket);
+        (0, import_node_fs4.unlinkSync)(PATHS.socket);
       } catch {
       }
     }
@@ -2342,14 +2365,14 @@ var IpcServer = class {
     return new Promise((resolve3) => {
       if (!this.server) {
         try {
-          if ((0, import_node_fs3.existsSync)(PATHS.socket)) (0, import_node_fs3.unlinkSync)(PATHS.socket);
+          if ((0, import_node_fs4.existsSync)(PATHS.socket)) (0, import_node_fs4.unlinkSync)(PATHS.socket);
         } catch {
         }
         return resolve3();
       }
       this.server.close(() => {
         try {
-          if ((0, import_node_fs3.existsSync)(PATHS.socket)) (0, import_node_fs3.unlinkSync)(PATHS.socket);
+          if ((0, import_node_fs4.existsSync)(PATHS.socket)) (0, import_node_fs4.unlinkSync)(PATHS.socket);
         } catch {
         }
         resolve3();
@@ -2435,6 +2458,13 @@ var IpcServer = class {
         for (const ch of req.params.channels) client.subscriptions.add(ch);
         return this.send(client, { id: req.id, ok: true, result: { subscribed: [...client.subscriptions] } });
       case "shutdown":
+        if (!tokensMatch(this.controlToken, req.params?.token)) {
+          return this.send(client, {
+            id: req.id,
+            ok: false,
+            error: "shutdown requires the daemon control token (run as root, or use systemctl)"
+          });
+        }
         this.send(client, { id: req.id, ok: true, result: "shutting down" });
         setTimeout(() => process.emit("SIGTERM"), 50);
         return;
@@ -2455,13 +2485,134 @@ var IpcServer = class {
 };
 
 // src/daemon/module-host.ts
-var import_node_fs8 = require("fs");
-var import_node_path3 = require("path");
+var import_node_fs10 = require("fs");
+var import_node_path5 = require("path");
 var import_node_url = require("url");
 var import_toml2 = __toESM(require_toml());
 
+// src/daemon/module-trust.ts
+var import_node_crypto2 = require("crypto");
+var import_node_fs5 = require("fs");
+var import_node_path3 = require("path");
+var TRUST_FILE = (0, import_node_path3.join)(PATHS.configDir, "trusted-modules.json");
+var PUBLISHER_KEYS_FILE = (0, import_node_path3.join)(PATHS.configDir, "publisher-keys.json");
+var DIGEST_EXCLUDED_DIRS = /* @__PURE__ */ new Set([".git"]);
+function collectFiles(root, dir = root, out = []) {
+  for (const entry of (0, import_node_fs5.readdirSync)(dir, { withFileTypes: true }).sort(
+    (a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0
+  )) {
+    const full = (0, import_node_path3.join)(dir, entry.name);
+    if (entry.isSymbolicLink()) {
+      out.push({ path: full, isSymlink: true });
+    } else if (entry.isDirectory()) {
+      if (DIGEST_EXCLUDED_DIRS.has(entry.name)) continue;
+      collectFiles(root, full, out);
+    } else if (entry.isFile()) {
+      out.push({ path: full, isSymlink: false });
+    }
+  }
+  return out;
+}
+function computeModuleDigest(modulePath) {
+  const hash = (0, import_node_crypto2.createHash)("sha256");
+  for (const entry of collectFiles(modulePath)) {
+    const relPath = (0, import_node_path3.relative)(modulePath, entry.path).split(import_node_path3.sep).join("/");
+    hash.update(relPath);
+    hash.update("\0");
+    if (entry.isSymlink) {
+      hash.update("symlink:");
+      hash.update((0, import_node_fs5.readlinkSync)(entry.path));
+    } else {
+      hash.update("file:");
+      hash.update((0, import_node_fs5.readFileSync)(entry.path));
+    }
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+function readTrustFile() {
+  if (!(0, import_node_fs5.existsSync)(TRUST_FILE)) return { version: 1, modules: {} };
+  try {
+    const parsed = JSON.parse((0, import_node_fs5.readFileSync)(TRUST_FILE, "utf-8"));
+    if (parsed.version !== 1 || typeof parsed.modules !== "object" || !parsed.modules) {
+      return { version: 1, modules: {} };
+    }
+    return { version: 1, modules: parsed.modules };
+  } catch {
+    return { version: 1, modules: {} };
+  }
+}
+function readPublisherKeys() {
+  if (!(0, import_node_fs5.existsSync)(PUBLISHER_KEYS_FILE)) return {};
+  try {
+    const parsed = JSON.parse((0, import_node_fs5.readFileSync)(PUBLISHER_KEYS_FILE, "utf-8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function verifyModuleSignature(modulePath, digest) {
+  const keys = readPublisherKeys();
+  const pinnedKeyIds = Object.keys(keys);
+  const sigPath = (0, import_node_path3.join)(modulePath, "mod.sig");
+  if (pinnedKeyIds.length === 0) {
+    return { ok: true };
+  }
+  if (!(0, import_node_fs5.existsSync)(sigPath)) {
+    return { ok: false, reason: "publisher keys are pinned but the module ships no mod.sig" };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse((0, import_node_fs5.readFileSync)(sigPath, "utf-8"));
+  } catch {
+    return { ok: false, reason: "mod.sig is not valid JSON" };
+  }
+  if (!parsed.keyId || !parsed.signature) {
+    return { ok: false, reason: "mod.sig is missing keyId or signature" };
+  }
+  const publicKey = keys[parsed.keyId];
+  if (!publicKey) {
+    return { ok: false, reason: `mod.sig references unpinned key "${parsed.keyId}"` };
+  }
+  try {
+    const valid = (0, import_node_crypto2.verify)(
+      null,
+      Buffer.from(digest, "hex"),
+      publicKey,
+      Buffer.from(parsed.signature, "base64")
+    );
+    return valid ? { ok: true } : { ok: false, reason: "mod.sig signature does not match" };
+  } catch (err) {
+    return { ok: false, reason: `signature check failed: ${String(err.message || err)}` };
+  }
+}
+function verifyModuleTrust(name, modulePath) {
+  let digest;
+  try {
+    digest = computeModuleDigest(modulePath);
+  } catch (err) {
+    return { ok: false, reason: `could not hash module: ${String(err.message || err)}` };
+  }
+  const signature = verifyModuleSignature(modulePath, digest);
+  if (!signature.ok) return signature;
+  const record = readTrustFile().modules[name];
+  if (!record) {
+    return {
+      ok: false,
+      reason: `not trusted \u2014 review it, then run: threatcrush modules trust ${name}`
+    };
+  }
+  if (record.digest !== digest) {
+    return {
+      ok: false,
+      reason: `contents changed since it was trusted on ${record.trustedAt} \u2014 re-review it, then run: threatcrush modules trust ${name}`
+    };
+  }
+  return { ok: true };
+}
+
 // src/daemon/watchers/log-watcher.ts
-var import_node_fs4 = require("fs");
+var import_node_fs6 = require("fs");
 var import_node_readline = require("readline");
 
 // src/core/log-parser.ts
@@ -2618,9 +2769,9 @@ var LogWatcher = class {
   start() {
     const started = [];
     for (const src of this.sources) {
-      if (!(0, import_node_fs4.existsSync)(src.path)) continue;
+      if (!(0, import_node_fs6.existsSync)(src.path)) continue;
       try {
-        (0, import_node_fs4.accessSync)(src.path, import_node_fs4.constants.R_OK);
+        (0, import_node_fs6.accessSync)(src.path, import_node_fs6.constants.R_OK);
       } catch {
         continue;
       }
@@ -2640,7 +2791,7 @@ var LogWatcher = class {
   }
   tail(src) {
     try {
-      this.positions.set(src.path, (0, import_node_fs4.statSync)(src.path).size);
+      this.positions.set(src.path, (0, import_node_fs6.statSync)(src.path).size);
     } catch {
       this.positions.set(src.path, 0);
     }
@@ -2651,7 +2802,7 @@ var LogWatcher = class {
   poll(src) {
     let stat;
     try {
-      stat = (0, import_node_fs4.statSync)(src.path);
+      stat = (0, import_node_fs6.statSync)(src.path);
     } catch {
       return;
     }
@@ -2661,7 +2812,7 @@ var LogWatcher = class {
       return;
     }
     if (stat.size === prev) return;
-    const stream = (0, import_node_fs4.createReadStream)(src.path, { start: prev, encoding: "utf-8" });
+    const stream = (0, import_node_fs6.createReadStream)(src.path, { start: prev, encoding: "utf-8" });
     stream.on("error", () => this.positions.set(src.path, stat.size));
     const rl = (0, import_node_readline.createInterface)({ input: stream });
     rl.on("error", () => {
@@ -2853,7 +3004,7 @@ function realtimeToDate(rt) {
 
 // src/modules/network-monitor/index.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs5 = require("fs");
+var import_node_fs7 = require("fs");
 var NetworkMonitor = class {
   constructor(bus2) {
     this.bus = bus2;
@@ -2891,7 +3042,7 @@ var NetworkMonitor = class {
   hasConntrackOrSs() {
     const ss = (0, import_node_child_process2.spawnSync)("ss", ["--version"], { stdio: "pipe" });
     if (ss.status === 0) return true;
-    return (0, import_node_fs5.existsSync)("/proc/net/tcp");
+    return (0, import_node_fs7.existsSync)("/proc/net/tcp");
   }
   poll() {
     try {
@@ -3030,7 +3181,7 @@ var NetworkMonitor = class {
 };
 
 // src/modules/dns-monitor/index.ts
-var import_node_fs6 = require("fs");
+var import_node_fs8 = require("fs");
 var import_node_readline2 = require("readline");
 var DNS_LOG_SOURCES = [
   "/var/log/syslog",
@@ -3064,9 +3215,9 @@ var DnsMonitor = class {
   entropyThreshold = 3.5;
   start() {
     const sources = DNS_LOG_SOURCES.filter((p) => {
-      if (!(0, import_node_fs6.existsSync)(p)) return false;
+      if (!(0, import_node_fs8.existsSync)(p)) return false;
       try {
-        (0, import_node_fs6.accessSync)(p, import_node_fs6.constants.R_OK);
+        (0, import_node_fs8.accessSync)(p, import_node_fs8.constants.R_OK);
         return true;
       } catch {
         return false;
@@ -3090,7 +3241,7 @@ var DnsMonitor = class {
   }
   tailLog(path) {
     try {
-      this.positions.set(path, (0, import_node_fs6.statSync)(path).size);
+      this.positions.set(path, (0, import_node_fs8.statSync)(path).size);
     } catch {
       this.positions.set(path, 0);
     }
@@ -3100,7 +3251,7 @@ var DnsMonitor = class {
   pollLog(path) {
     let stat;
     try {
-      stat = (0, import_node_fs6.statSync)(path);
+      stat = (0, import_node_fs8.statSync)(path);
     } catch {
       return;
     }
@@ -3110,7 +3261,7 @@ var DnsMonitor = class {
       return;
     }
     if (stat.size === prev) return;
-    const stream = (0, import_node_fs6.createReadStream)(path, { start: prev, encoding: "utf-8" });
+    const stream = (0, import_node_fs8.createReadStream)(path, { start: prev, encoding: "utf-8" });
     stream.on("error", () => this.positions.set(path, stat.size));
     const rl = (0, import_node_readline2.createInterface)({ input: stream });
     rl.on("line", (line) => this.parseDnsLine(line));
@@ -3239,8 +3390,8 @@ var DnsMonitor = class {
 };
 
 // src/core/config.ts
-var import_node_fs7 = require("fs");
-var import_node_path2 = require("path");
+var import_node_fs9 = require("fs");
+var import_node_path4 = require("path");
 var import_toml = __toESM(require_toml());
 var DEFAULT_CONFIG_PATH = "/etc/threatcrush/threatcrushd.conf";
 var DEFAULT_CONFDIR = "/etc/threatcrush/threatcrushd.conf.d";
@@ -3266,11 +3417,11 @@ var DEFAULT_CONFIG = {
 };
 function loadConfig(configPath) {
   const path = configPath || DEFAULT_CONFIG_PATH;
-  if (!(0, import_node_fs7.existsSync)(path)) {
+  if (!(0, import_node_fs9.existsSync)(path)) {
     return { ...DEFAULT_CONFIG };
   }
   try {
-    const raw = (0, import_node_fs7.readFileSync)(path, "utf-8");
+    const raw = (0, import_node_fs9.readFileSync)(path, "utf-8");
     const parsed = import_toml.default.parse(raw);
     return {
       daemon: { ...DEFAULT_CONFIG.daemon, ...parsed.daemon },
@@ -3286,13 +3437,13 @@ function loadConfig(configPath) {
 function loadModuleConfigs(confDir) {
   const dir = confDir || DEFAULT_CONFDIR;
   const configs = /* @__PURE__ */ new Map();
-  if (!(0, import_node_fs7.existsSync)(dir)) {
+  if (!(0, import_node_fs9.existsSync)(dir)) {
     return configs;
   }
-  const files = (0, import_node_fs7.readdirSync)(dir).filter((f) => f.endsWith(".conf"));
+  const files = (0, import_node_fs9.readdirSync)(dir).filter((f) => f.endsWith(".conf"));
   for (const file of files) {
     try {
-      const raw = (0, import_node_fs7.readFileSync)((0, import_node_path2.join)(dir, file), "utf-8");
+      const raw = (0, import_node_fs9.readFileSync)((0, import_node_path4.join)(dir, file), "utf-8");
       const parsed = import_toml.default.parse(raw);
       for (const [name, config] of Object.entries(parsed)) {
         configs.set(name, config);
@@ -3406,15 +3557,15 @@ var ModuleHost = class {
     for (const m of builtins) this.modules.set(m.name, m);
   }
   async discoverAndStartInstalled() {
-    if (!(0, import_node_fs8.existsSync)(PATHS.moduleDir)) return;
+    if (!(0, import_node_fs10.existsSync)(PATHS.moduleDir)) return;
     const configs = loadModuleConfigs(PATHS.confD);
-    const entries = (0, import_node_fs8.readdirSync)(PATHS.moduleDir, { withFileTypes: true });
+    const entries = (0, import_node_fs10.readdirSync)(PATHS.moduleDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const manifestPath = (0, import_node_path3.join)(PATHS.moduleDir, entry.name, "mod.toml");
-      if (!(0, import_node_fs8.existsSync)(manifestPath)) continue;
+      const manifestPath = (0, import_node_path5.join)(PATHS.moduleDir, entry.name, "mod.toml");
+      if (!(0, import_node_fs10.existsSync)(manifestPath)) continue;
       try {
-        const manifest = import_toml2.default.parse((0, import_node_fs8.readFileSync)(manifestPath, "utf-8"));
+        const manifest = import_toml2.default.parse((0, import_node_fs10.readFileSync)(manifestPath, "utf-8"));
         const name = manifest.module?.name || entry.name;
         const defaults = manifest.module?.config?.defaults || {};
         const config = {
@@ -3428,7 +3579,7 @@ var ModuleHost = class {
           source: "installed",
           status: config.enabled === false ? "disabled" : "loaded",
           events: 0,
-          path: (0, import_node_path3.join)(PATHS.moduleDir, entry.name),
+          path: (0, import_node_path5.join)(PATHS.moduleDir, entry.name),
           config
         };
         this.modules.set(name, hosted);
@@ -3443,7 +3594,7 @@ var ModuleHost = class {
           status: "error",
           events: 0,
           detail: `manifest load failed: ${String(err.message || err)}`,
-          path: (0, import_node_path3.join)(PATHS.moduleDir, entry.name)
+          path: (0, import_node_path5.join)(PATHS.moduleDir, entry.name)
         });
       }
     }
@@ -3455,6 +3606,13 @@ var ModuleHost = class {
       hosted.detail = "no built entrypoint found; run npm install && npm run build in the module directory";
       return;
     }
+    const trust = verifyModuleTrust(hosted.name, hosted.path);
+    if (!trust.ok) {
+      hosted.status = "error";
+      hosted.detail = `refusing to load: ${trust.reason}`;
+      this.bus.announceModule(hosted.name, "error", hosted.detail);
+      return;
+    }
     try {
       const imported = await import((0, import_node_url.pathToFileURL)(entrypoint).href);
       const exported = imported.default || imported.module || imported;
@@ -3475,17 +3633,17 @@ var ModuleHost = class {
     }
   }
   installedEntrypoint(modulePath) {
-    const packageJson = (0, import_node_path3.join)(modulePath, "package.json");
+    const packageJson = (0, import_node_path5.join)(modulePath, "package.json");
     const candidates = [];
-    if ((0, import_node_fs8.existsSync)(packageJson)) {
+    if ((0, import_node_fs10.existsSync)(packageJson)) {
       try {
-        const pkg = JSON.parse((0, import_node_fs8.readFileSync)(packageJson, "utf-8"));
-        if (pkg.main) candidates.push((0, import_node_path3.join)(modulePath, pkg.main));
+        const pkg = JSON.parse((0, import_node_fs10.readFileSync)(packageJson, "utf-8"));
+        if (pkg.main) candidates.push((0, import_node_path5.join)(modulePath, pkg.main));
       } catch {
       }
     }
-    candidates.push((0, import_node_path3.join)(modulePath, "dist", "index.js"), (0, import_node_path3.join)(modulePath, "index.js"));
-    return candidates.find((candidate) => (0, import_node_fs8.existsSync)(candidate)) || null;
+    candidates.push((0, import_node_path5.join)(modulePath, "dist", "index.js"), (0, import_node_path5.join)(modulePath, "index.js"));
+    return candidates.find((candidate) => (0, import_node_fs10.existsSync)(candidate)) || null;
   }
   isThreatCrushModule(value) {
     return Boolean(
@@ -3757,14 +3915,14 @@ function slackChannel(webhookUrl) {
 }
 
 // src/core/cli-config.ts
-var import_node_fs9 = require("fs");
-var import_node_path4 = require("path");
+var import_node_fs11 = require("fs");
+var import_node_path6 = require("path");
 var import_node_os2 = require("os");
-var CLI_CONFIG_DIR = (0, import_node_path4.join)((0, import_node_os2.homedir)(), ".threatcrush");
-var CLI_CONFIG_PATH = (0, import_node_path4.join)(CLI_CONFIG_DIR, "config.json");
+var CLI_CONFIG_DIR = (0, import_node_path6.join)((0, import_node_os2.homedir)(), ".threatcrush");
+var CLI_CONFIG_PATH = (0, import_node_path6.join)(CLI_CONFIG_DIR, "config.json");
 function readCliConfig() {
   try {
-    return JSON.parse((0, import_node_fs9.readFileSync)(CLI_CONFIG_PATH, "utf-8"));
+    return JSON.parse((0, import_node_fs11.readFileSync)(CLI_CONFIG_PATH, "utf-8"));
   } catch {
     return {};
   }
@@ -3783,8 +3941,8 @@ function authHeaders() {
 }
 
 // src/commands/scan.ts
-var import_node_fs12 = require("fs");
-var import_node_path8 = require("path");
+var import_node_fs14 = require("fs");
+var import_node_path10 = require("path");
 
 // ../../node_modules/.pnpm/chalk@5.6.2/node_modules/chalk/source/vendor/ansi-styles/index.js
 var ANSI_BACKGROUND_OFFSET = 10;
@@ -4527,7 +4685,17 @@ var NODE_RULES = [
     // arrangement of nearby lines that makes an echoed origin safe — except a
     // membership test on the value, which is what the guard looks for.
     inherent: true,
-    guard: ORIGIN_ALLOWLIST_GUARD
+    guard: ORIGIN_ALLOWLIST_GUARD,
+    /**
+     * Logging the origin is not reflecting it.
+     *
+     * `origin: request.headers.origin` is the CORS mistake *and* the ordinary
+     * way to record who called — the two are character-for-character
+     * identical, and only what encloses them differs. A response header goes
+     * out to the browser; a log line goes to stdout, where it grants nobody
+     * anything.
+     */
+    enclosingCallGuard: /(?:^|\.)(?:log|debug|info|warn|error|trace|verbose|fatal)$/
   },
   // ── Server-side request forgery ──────────────────────────────────────────
   {
@@ -4621,7 +4789,11 @@ var NODE_RULES = [
     severity: "medium",
     languages: ["javascript", "typescript"],
     pattern: /\bBuffer\s*\.\s*allocUnsafe(?:Slow)?\s*\(|\bnew\s+Buffer\s*\(\s*(?![`'"])[a-zA-Z_$0-9]/,
-    inherent: true
+    inherent: true,
+    // Filling the buffer yourself is the whole reason to call `allocUnsafe`,
+    // so reporting every call reports correct code. What is left reported is
+    // an allocation whose bytes are never written before it escapes.
+    filledBeforeUseGuard: true
   },
   {
     id: "js-oversized-request-body-limit",
@@ -4731,8 +4903,19 @@ var CODE_RULES = [
     // The tail is what distinguishes assembly from parameterisation. A bound
     // query leaves a comma after the closing quote (`"… = $1", [id]`) and
     // matches none of these.
+    //
+    // The clause alternative anchors the keyword to the *start* of the
+    // concatenated fragment, because that is where a clause being appended
+    // actually sits: `sql + "WHERE id = " + id`, `sql + " ORDER BY " + col`.
+    //
+    // Allowing it anywhere in the fragment made the rule read English. `WHERE`
+    // and `SET` are ordinary words, and without a leading `\b` they were not
+    // even required to be whole ones — "any`where`" and "sub`set`" both
+    // matched. A help string reading "lists them anywhere" was reported as
+    // critical SQL injection, which is the kind of finding that teaches a team
+    // the scanner is not worth reading.
     pattern: new RegExp(
-      `${SQL_STRING}\\s*\\+|${SQL_STRING}\\s*%\\s*[\\w(]|${SQL_STRING}\\s*\\.\\s*format\\s*\\(|\\+\\s*(?:"[^"\\n]*|'[^'\\n]*)(?:WHERE|ORDER\\s+BY|VALUES|SET)\\b`,
+      `${SQL_STRING}\\s*\\+|${SQL_STRING}\\s*%\\s*[\\w(]|${SQL_STRING}\\s*\\.\\s*format\\s*\\(|\\+\\s*(?:"|')\\s*\\b(?:WHERE|ORDER\\s+BY|VALUES|SET)\\b`,
       "i"
     )
   },
@@ -4745,7 +4928,26 @@ var CODE_RULES = [
     pattern: new RegExp(
       `\`[^\`\\n]*(?:${SQL_KEYWORDS})\\b[^\`\\n]*\\$\\{|\\bf"[^"\\n]*(?:${SQL_KEYWORDS})\\b[^"\\n]*\\{|\\bf'[^'\\n]*(?:${SQL_KEYWORDS})\\b[^'\\n]*\\{`,
       "i"
-    )
+    ),
+    /**
+     * Interpolating a column list is not interpolating a value.
+     *
+     *     const COLS = `tld, user_id, owner_email, price_usd`;
+     *     get(`SELECT ${COLS} FROM moshpit_tlds WHERE tld = ?`, [tld]);
+     *
+     * That query *is* parameterised: every value the caller supplies rides a
+     * `?`, and the only thing spliced into the text is a constant written a
+     * few lines up. Naming the column list once instead of repeating it in
+     * fourteen queries is ordinary hygiene, and it is the shape this rule met
+     * most often in practice — one repository produced eighteen findings this
+     * way and not one of them could be injected into.
+     *
+     * The guard resolves the interpolations rather than trusting the shape, so
+     * the moment a query mixes a constant with anything else —
+     * `` `SELECT ${COLS} FROM t WHERE id = ${req.query.id}` `` — it is reported
+     * again. `interpolationsAreConstant` requires *every* `${…}` to resolve.
+     */
+    constantInterpolationGuard: true
   },
   {
     id: "sql-format-call",
@@ -4776,7 +4978,8 @@ var CODE_RULES = [
     cwe: "CWE-78",
     severity: "critical",
     languages: ["javascript", "typescript"],
-    pattern: /\b(?:exec|execSync|spawn|spawnSync)\s*\(\s*(?:`[^`]*\$\{|['"][^'"]*['"]\s*\+|[a-zA-Z_$][\w$]*\s*\+)/
+    pattern: /\b(?:exec|execSync|spawn|spawnSync)\s*\(\s*(?:`[^`]*\$\{|['"][^'"]*['"]\s*\+|[a-zA-Z_$][\w$]*\s*\+)/,
+    constantInterpolationGuard: true
   },
   {
     id: "py-shell-command-string",
@@ -4794,7 +4997,22 @@ var CODE_RULES = [
     cwe: "CWE-78",
     severity: "critical",
     languages: ["go"],
-    pattern: /\bexec\.Command(?:Context)?\s*\(\s*(?:ctx\s*,\s*)?"(?:\/bin\/)?(?:sh|bash|zsh|cmd|powershell)"\s*,\s*"(?:-c|\/c)"/
+    pattern: /\bexec\.Command(?:Context)?\s*\(\s*(?:ctx\s*,\s*)?"(?:\/bin\/)?(?:sh|bash|zsh|cmd|powershell)"\s*,\s*"(?:-c|\/c)"/,
+    // A call whose whole argv is string literals cannot be injected into.
+    // `exec.Command("cmd", "/c", "ver")` reads the Windows version; there is no
+    // value in it for an attacker to reach, and the consequence above — that a
+    // shell will interpret metacharacters — describes metacharacters nobody can
+    // supply. gosec's G204 draws the line in the same place, and this was the
+    // single finding a Go project got out of a whole scan before declining the
+    // offer, which is an expensive way to report nothing.
+    //
+    // The guard has to end at the closing paren, so a literal followed by
+    // anything else still reports: `"ls " + dir` leaves a `+` before the `)`,
+    // `fmt.Sprintf(…)` leaves an identifier, and a bare variable leaves a name.
+    // `(?:[^"\\]|\\.)*` rather than `[^"]*` so an escaped quote inside a
+    // literal — `"echo \"hi\""` — does not end the literal early and drop the
+    // guard on a line it should have covered.
+    lineGuard: /\bexec\.Command(?:Context)?\s*\(\s*(?:ctx\s*,\s*)?"(?:\/bin\/)?(?:sh|bash|zsh|cmd|powershell)"\s*,\s*"(?:-c|\/c)"\s*(?:,\s*"(?:[^"\\]|\\.)*")*\s*,?\s*\)/
   },
   {
     id: "rb-backtick-interpolation",
@@ -4863,17 +5081,43 @@ var CODE_RULES = [
     cwe: "CWE-79",
     severity: "high",
     languages: ["javascript", "typescript"],
-    pattern: /\bdangerouslySetInnerHTML\s*=|\.\s*(?:innerHTML|outerHTML)\s*=\s*(?!\s*['"`]\s*['"`]\s*;?\s*$)|\bdocument\s*\.\s*write(?:ln)?\s*\(|\.\s*insertAdjacentHTML\s*\(/,
     /**
+     * The assignment alternative carries its own exemption, as a lookahead, so
+     * that it is decided per assignment rather than per line.
+     *
      * A whole-statement assignment of a string with no interpolation and no
-     * concatenation carries no data, so it cannot carry attacker data. This
-     * was the single largest source of noise: a codebase that builds its UI
-     * with innerHTML reports every static heading and spinner as XSS, and a
-     * rule that flags 40 safe lines to catch one real one gets switched off.
+     * concatenation carries no data, so it cannot carry attacker data. This was
+     * the single largest source of noise: a codebase that builds its UI with
+     * innerHTML reports every static heading and spinner as XSS, and a rule
+     * that flags 40 safe lines to catch one real one gets switched off.
+     *
+     * Two things this has to get right, and a `lineGuard` could get neither:
+     *
+     * A statement ends at its semicolon, not at the newline. Anchoring to `$`
+     * held the exemption for `el.innerHTML = '';` alone on a line and dropped
+     * it the moment anything followed:
      *
-     * Line-scoped on purpose — see `lineGuard`.
+     *     function hide() { out.hidden = true; out.innerHTML = ''; rendered = null; }
+     *
+     * — the same assignment, clearing a node, reported as high-severity XSS
+     * because two neighbours shared its line.
+     *
+     * And an exemption must not become a line-wide amnesty. A guard is tested
+     * against the whole line, so one safe clear would exonerate a real sink
+     * beside it:
+     *
+     *     a.innerHTML = ''; b.innerHTML = userInput;
+     *
+     * As a lookahead the regex decides at each `=` it reaches, so the first
+     * assignment is exempt and the second is still reported.
+     *
+     * The whitespace after `=` is matched *inside* the lookahead rather than
+     * before it. Left outside, `\s*` backtracks to zero width, the lookahead
+     * then starts on the space instead of the quote, fails to see a literal,
+     * and the negative lookahead succeeds — reinstating every finding the
+     * exemption was written to remove.
      */
-    lineGuard: /(?:innerHTML|outerHTML)\s*=\s*(?:'[^'\\]*'|"[^"\\]*"|`[^`$\\]*`)\s*;?\s*$/
+    pattern: /\bdangerouslySetInnerHTML\s*=|\.\s*(?:innerHTML|outerHTML)\s*=(?!\s*(?:'[^'\\\n]*'|"[^"\\\n]*"|`[^`$\\\n]*`)\s*(?:;|$))|\bdocument\s*\.\s*write(?:ln)?\s*\(|\.\s*insertAdjacentHTML\s*\(/
   },
   {
     id: "java-html-writer-concatenation",
@@ -5675,7 +5919,26 @@ var CODE_RULES = [
     cwe: "CWE-346",
     severity: "high",
     languages: ["javascript", "typescript"],
-    pattern: /\$\{[^}\n]*\breq(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname|host)\b|['"`]\s*\+\s*req(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname)\b/
+    pattern: /\$\{[^}\n]*\breq(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname|host)\b|['"`]\s*\+\s*req(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname)\b/,
+    /**
+     * Parsing the request's own URL is not building a link from the Host
+     * header, even though it is spelled with one.
+     *
+     *     const url = new URL(request.url, `http://${request.headers.host}`);
+     *     const token = url.searchParams.get('token');
+     *
+     * `request.url` on a Node server is a path — `/ws?token=…` — and `new URL`
+     * refuses a relative input without a base. The base exists to satisfy the
+     * parser and is thrown away; only the path and query are ever read. Every
+     * Node HTTP handler that wants a query parameter is written this way, so
+     * the rule fired on the framework idiom rather than on the defect.
+     *
+     * Narrow on purpose: the first argument must be `req.url` itself. The
+     * dangerous shape passes a *path* the application chose —
+     * `new URL('/reset?t=…', `https://${req.headers.host}`)` — and that is what
+     * produces an attacker-controlled link. It does not match this guard.
+     */
+    lineGuard: /\bnew\s+URL\s*\(\s*(?:req|request|ctx)(?:uest)?\s*\.\s*url\b\s*,/
   },
   // A recursive-merge prototype-pollution rule (`target[key] = source[key]`
   // with no `__proto__` guard) was built and dropped. The bare copy-by-key is
@@ -5743,6 +6006,94 @@ function fileTextOf(lines) {
 function withoutSingleQuoted(text) {
   return text.replace(/'[^'\n]*'/g, "''");
 }
+function calleeEndingAt(text, open) {
+  let end = open;
+  while (end > 0 && (text[end - 1] === " " || text[end - 1] === "	")) end -= 1;
+  let start = end;
+  while (start > 0 && /[\w$.]/.test(text[start - 1])) start -= 1;
+  return text.slice(start, end);
+}
+function enclosingCallees(lines, index, back) {
+  const before = lines.slice(Math.max(0, index - back), index).join("\n");
+  const stack = [];
+  let quote = null;
+  for (let i = 0; i < before.length; i += 1) {
+    const ch = before[i];
+    if (quote) {
+      if (ch === "\\") i += 1;
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") quote = ch;
+    else if (ch === "(") stack.push(calleeEndingAt(before, i));
+    else if (ch === ")") stack.pop();
+  }
+  return stack;
+}
+function interpolations(line) {
+  const found = [];
+  for (let i = 0; ; ) {
+    const start = line.indexOf("${", i);
+    if (start === -1) break;
+    const end = line.indexOf("}", start + 2);
+    if (end === -1) return null;
+    found.push(line.slice(start + 2, end).trim());
+    i = end + 1;
+  }
+  return found.length > 0 ? found : null;
+}
+function isConstantString(name, fileText) {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(
+    `\\bconst\\s+${escaped}\\s*(?::[^=\\n]+)?=\\s*(?:'[^'\\n]*'|"[^"\\n]*"|\`[^\`$\\n]*\`)`
+  ).test(fileText);
+}
+function interpolationsAreConstant(line, fileText) {
+  const found = interpolations(line);
+  if (!found) return false;
+  return found.every(
+    (expr) => /^[A-Za-z_$][\w$]*$/.test(expr) && isConstantString(expr, fileText)
+  );
+}
+var FILL_LOOKAHEAD = 16;
+var NAME = String.raw`(?<![\w$])([A-Za-z_$][\w$]*)`;
+var ALLOCATION_BINDING = new RegExp(
+  `${NAME}\\s*=\\s*(?:new\\s+Buffer\\s*\\(|Buffer\\s*\\.\\s*allocUnsafe(?:Slow)?\\s*\\()`
+);
+function allocationBinding(line) {
+  return ALLOCATION_BINDING.exec(line)?.[1] ?? null;
+}
+var WRITE_SHAPES = [
+  // `src.copy(name, …)` — name is the destination.
+  /\.\s*copy\s*\(\s*([A-Za-z_$][\w$]*)\s*[,)]/g,
+  // `name.fill(…)`, `name.write*(…)`, `name.set(…)`.
+  new RegExp(`${NAME}\\s*\\.\\s*(?:fill|set|write[A-Za-z0-9]*)\\s*\\(`, "g"),
+  // `name[i] = …`, but not `name[i] === …`.
+  new RegExp(`${NAME}\\s*\\[[^\\]\\n]*\\]\\s*=(?!=)`, "g")
+];
+function writesInto(text, name) {
+  for (const shape of WRITE_SHAPES) {
+    shape.lastIndex = 0;
+    for (let found = shape.exec(text); found !== null; found = shape.exec(text)) {
+      if (found[1] === name) return true;
+    }
+  }
+  return false;
+}
+function bufferFilledBeforeUse(ctx) {
+  const line = ctx.lines[ctx.index] ?? "";
+  if (/\ballocUnsafe(?:Slow)?\s*\([^)\n]*\)\s*\.\s*fill\s*\(/.test(line)) return true;
+  const name = allocationBinding(line);
+  if (!name) return false;
+  if (writesInto(line.slice(line.indexOf("=") + 1), name)) return true;
+  const last = Math.min(ctx.lines.length - 1, ctx.index + FILL_LOOKAHEAD);
+  for (let i = ctx.index + 1; i <= last; i += 1) {
+    const next = ctx.lines[i] ?? "";
+    if (skippable(next, i, ctx.prose)) continue;
+    if (writesInto(next, name)) return true;
+  }
+  return false;
+}
 function evaluateRule(rule, ctx) {
   if (rule.languages && !rule.languages.includes(ctx.language)) return null;
   const line = ctx.lines[ctx.index] ?? "";
@@ -5754,6 +6105,14 @@ function evaluateRule(rule, ctx) {
   const context = windowText(ctx.lines, ctx.index, back, forward, ctx.prose);
   if (rule.requires && !rule.requires.test(context)) return null;
   if (rule.lineGuard?.test(line)) return null;
+  if (rule.enclosingCallGuard) {
+    const callees = enclosingCallees(ctx.lines, ctx.index, back);
+    if (callees.some((callee) => rule.enclosingCallGuard.test(callee))) return null;
+  }
+  if (rule.constantInterpolationGuard && interpolationsAreConstant(line, fileTextOf(ctx.lines))) {
+    return null;
+  }
+  if (rule.filledBeforeUseGuard && bufferFilledBeforeUse(ctx)) return null;
   const guard = rule.guard === void 0 ? GENERIC_GUARD : rule.guard;
   if (guard && (guard.test(line) || guard.test(context))) return null;
   const untrusted = untrustedPatternFor(ctx.language);
@@ -6336,7 +6695,8 @@ var SECRET_RULES = [
     pattern: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_.+/=-]*/,
     severity: "medium",
     cwe: "CWE-798",
-    consequence: "Session or service identity until it expires \u2014 and committed tokens are usually long-lived."
+    consequence: "Session or service identity until it expires \u2014 and committed tokens are usually long-lived.",
+    keywordShaped: true
   },
   {
     id: "secret-generic-api-key",
@@ -6347,7 +6707,8 @@ var SECRET_RULES = [
     pattern: /(?:api[_-]?key|apikey|access[_-]?token|auth[_-]?token)\s*[=:]\s*['"]([A-Za-z0-9\-_.]{20,})['"]/i,
     severity: "high",
     cwe: "CWE-798",
-    consequence: "Whatever the third-party service lets the key do, for as long as it stays valid."
+    consequence: "Whatever the third-party service lets the key do, for as long as it stays valid.",
+    keywordShaped: true
   },
   {
     id: "secret-generic-credential",
@@ -6355,7 +6716,8 @@ var SECRET_RULES = [
     pattern: /(?:secret|password|passwd|pwd|token)\s*[=:]\s*['"]([^'"\s]{8,})['"]/i,
     severity: "high",
     cwe: "CWE-798",
-    consequence: "A password in source is a password in every clone, fork and CI cache of that source."
+    consequence: "A password in source is a password in every clone, fork and CI cache of that source.",
+    keywordShaped: true
   },
   {
     id: "secret-hex-token",
@@ -6363,7 +6725,8 @@ var SECRET_RULES = [
     pattern: /(?:token|key|secret|auth|signing)\w*\s*[=:]\s*['"]?([0-9a-f]{32,})['"]?/i,
     severity: "medium",
     cwe: "CWE-798",
-    consequence: "Signing secrets and session keys are usually hex; a leaked one forges anything they sign."
+    consequence: "Signing secrets and session keys are usually hex; a leaked one forges anything they sign.",
+    keywordShaped: true
   }
 ];
 var KNOWN_PLACEHOLDERS = [
@@ -6394,6 +6757,62 @@ var KNOWN_PLACEHOLDERS = [
 function isKnownPlaceholder(text) {
   return KNOWN_PLACEHOLDERS.some((pattern) => pattern.test(text));
 }
+function isPlaceholderAttribute(line, value) {
+  const at = line.lastIndexOf(value);
+  if (at === -1) return false;
+  return /(?:^|\s)(?:aria-)?placeholder\s*=\s*[{("'`]*$/i.test(line.slice(0, at));
+}
+function isVariableReference(value) {
+  const trimmed = value.trim();
+  const braced = /^\$\{\s*([A-Za-z_][\w.]*)\s*(?::?[-=+?]([\s\S]*))?\}$/.exec(trimmed);
+  if (braced) {
+    const fallback = braced[2];
+    if (fallback === void 0 || fallback.trim() === "") return true;
+    return /^\$\{?[A-Za-z_][\w.]*\}?$/.test(fallback.trim());
+  }
+  return /^\$[A-Za-z_]\w*$/.test(trimmed) || // $VAR
+  /^\$\([\s\S]*\)$/.test(trimmed) || // $(command substitution)
+  /^%[A-Za-z_]\w*%$/.test(trimmed) || // %VAR% on Windows
+  /^\{\{[\s\S]*\}\}$/.test(trimmed) || // {{ template }}
+  /^#\{[\s\S]*\}$/.test(trimmed) || // #{ruby}
+  /^<%=?[\s\S]*%>$/.test(trimmed);
+}
+var FIXTURE_STEMS = [
+  "test",
+  "mock",
+  "fake",
+  "dummy",
+  "stub",
+  "sample",
+  "example",
+  "placeholder",
+  "fixture",
+  "invalid",
+  "expired",
+  "forged",
+  "bogus",
+  "notreal",
+  "nonexistent",
+  "changeme",
+  "foobar",
+  "lorem"
+];
+var KEY_NOISE = /* @__PURE__ */ new Set(["const", "this", "return", "await", "async", "expect", "value"]);
+function words(text) {
+  return text.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[^A-Za-z]+/g, " ").toLowerCase().split(" ").filter(Boolean);
+}
+function isTestFixtureValue(line, value) {
+  const valueWords = words(value);
+  if (valueWords.some((word) => FIXTURE_STEMS.some((stem) => word.startsWith(stem)))) return true;
+  return describesItsOwnKey(line, value);
+}
+function describesItsOwnKey(line, value) {
+  if (value.length > 48) return false;
+  const valueAt = line.lastIndexOf(value);
+  const key = valueAt === -1 ? line : line.slice(0, valueAt);
+  const flattened = words(value).join("");
+  return words(key).filter((word) => word.length >= 4 && !KEY_NOISE.has(word)).some((word) => flattened.includes(word));
+}
 function redactSecret(line) {
   return line.replace(/([A-Za-z0-9+/=_.-]{12,})/g, (match) => {
     if (match.length <= 12) return match;
@@ -6571,9 +6990,9 @@ function languageOfShebang(firstLine) {
 }
 var SUPPRESS_NEXT = /threatcrush-disable-next-line(?:\s+([\w-]+))?/;
 var SUPPRESS_LINE = /threatcrush-disable-line(?:\s+([\w-]+))?/;
-var FOREIGN_CREDENTIAL = /\b(?:nolint:[\w,]*gosec|nosec)\b[^\n]*\bG101\b|\bG101\b[^\n]*\b(?:nolint:[\w,]*gosec|nosec)\b/;
-function foreignCredentialMark(line) {
-  return FOREIGN_CREDENTIAL.test(line);
+var FOREIGN_SECURITY = /\b(?:nolint:[\w,]*gosec|nosec)\b/;
+function foreignSecurityMark(line) {
+  return FOREIGN_SECURITY.test(line);
 }
 function collectSuppressions(lines) {
   const byLine = /* @__PURE__ */ new Map();
@@ -6599,31 +7018,68 @@ function isSuppressed(suppressions, index, ruleId) {
 }
 function isTestPath(relativePath) {
   const p = relativePath.replace(/\\/g, "/");
-  return /(?:^|\/)(?:tests?|__tests__|__mocks__|spec|specs|fixtures?|mocks?|e2e|testdata)\//i.test(p) || /(?:^|\/)(?:test|conftest)_[^/]+$/i.test(p) || /[._-](?:test|spec)\.[a-z]+$/i.test(p) || /_test\.[a-z]+$/i.test(p);
+  return /(?:^|\/)(?:tests?|__tests__|__mocks__|spec|specs|fixtures?|mocks?|e2e|testdata|testutils?|harness)\//i.test(p) || /(?:^|\/)(?:test|conftest)_[^/]+$/i.test(p) || /[._-](?:test|spec)\.[a-z]+$/i.test(p) || /_test\.[a-z]+$/i.test(p);
+}
+function isDocPath(relativePath) {
+  const p = relativePath.replace(/\\/g, "/");
+  return /(?:^|\/)(?:docs?|examples?|samples?)\//i.test(p) || /\.(?:md|mdx|markdown|rst|adoc)$/i.test(p);
+}
+var SOFTENING_ORDER = [
+  "suppressed",
+  "placeholder",
+  "self-describing",
+  "test",
+  "docs"
+];
+function softening(reasons) {
+  return SOFTENING_ORDER.find((reason) => reasons[reason]) ?? null;
 }
+var SECRET_SOFTENING = {
+  test: "in a test file \u2014 usually a fixture, still worth confirming it is not a live credential",
+  docs: "in documentation \u2014 usually an illustrative example, still worth confirming it is not a live credential",
+  suppressed: "on a line already marked as a false positive for another linter's security rule",
+  placeholder: "in example text an empty input field shows, not in data",
+  "self-describing": "in a value that repeats the name of the field holding it \u2014 usually a description of a credential rather than one"
+};
+var CODE_SOFTENING = {
+  test: "in a test file, where the construct is ordinary",
+  docs: "in documentation or example code, which nothing runs",
+  suppressed: "on a line another linter's security suppression already covers",
+  placeholder: "in example text rather than in data",
+  "self-describing": "in a value that describes itself"
+};
 function scanText(relativePath, text, language = languageOf(relativePath)) {
   const findings = [];
   const lines = text.split("\n");
   const suppressions = collectSuppressions(lines);
   const inTests = isTestPath(relativePath);
+  const inDocs = isDocPath(relativePath);
   lines.forEach((line, index) => {
     for (const rule of SECRET_RULES) {
       const match = rule.pattern.exec(line);
       if (!match) continue;
       if (isKnownPlaceholder(match[0])) continue;
       if (isSuppressed(suppressions, index, rule.id)) continue;
-      const marked = foreignCredentialMark(line);
+      const value = match[1] ?? match[0];
+      if (isVariableReference(value)) continue;
+      if (inTests && rule.keywordShaped && isTestFixtureValue(line, value)) continue;
+      const soft = softening({
+        test: inTests,
+        suppressed: foreignSecurityMark(line),
+        placeholder: isPlaceholderAttribute(line, value),
+        "self-describing": rule.keywordShaped === true && describesItsOwnKey(line, value)
+      });
       findings.push({
         ruleId: rule.id,
         title: rule.name,
         file: relativePath,
         line: index + 1,
-        // Reported but not blocking in tests — see isTestPath. The same goes
-        // for a line another linter's credential rule was already told about.
-        severity: inTests || marked ? "low" : rule.severity,
+        // Reported but not blocking wherever context weakens the claim — see
+        // `softening`. Never dropped: the count is the same either way.
+        severity: soft ? "low" : rule.severity,
         // A matched credential format is the finding, not a proxy for one.
         confidence: "evidence",
-        message: inTests ? `Possible ${rule.name} detected in a test file \u2014 usually a fixture, still worth confirming it is not a live credential` : marked ? `Possible ${rule.name} detected on a line already marked as a false positive for another linter's credential rule` : `Possible ${rule.name} detected`,
+        message: soft ? `Possible ${rule.name} detected ${SECRET_SOFTENING[soft]}` : `Possible ${rule.name} detected`,
         consequence: rule.consequence,
         cwe: rule.cwe,
         excerpt: redactSecret(line.trim()).slice(0, 200),
@@ -6638,14 +7094,19 @@ function scanText(relativePath, text, language = languageOf(relativePath)) {
       if (isSuppressed(suppressions, index, rule.id)) continue;
       const match = evaluateRule(rule, { lines, index, language, prose });
       if (!match) continue;
+      const soft = softening({
+        test: inTests,
+        docs: inDocs,
+        suppressed: foreignSecurityMark(lines[index] ?? "")
+      });
       findings.push({
         ruleId: rule.id,
         title: rule.title,
         file: relativePath,
         line: index + 1,
-        severity: match.severity,
+        severity: soft ? "low" : match.severity,
         confidence: match.confidence,
-        message: `${rule.title} (${rule.cwe})`,
+        message: soft ? `${rule.title} (${rule.cwe}) \u2014 ${CODE_SOFTENING[soft]}` : `${rule.title} (${rule.cwe})`,
         consequence: rule.consequence,
         cwe: rule.cwe,
         excerpt: (lines[index] ?? "").trim().slice(0, 200),
@@ -6656,14 +7117,19 @@ function scanText(relativePath, text, language = languageOf(relativePath)) {
   for (const match of evaluateTemplateRules(extensionOf(relativePath), lines)) {
     const index = match.line - 1;
     if (isSuppressed(suppressions, index, match.rule.id)) continue;
+    const soft = softening({
+      test: inTests,
+      docs: inDocs,
+      suppressed: foreignSecurityMark(lines[index] ?? "")
+    });
     findings.push({
       ruleId: match.rule.id,
       title: match.rule.title,
       file: relativePath,
       line: match.line,
-      severity: match.severity,
+      severity: soft ? "low" : match.severity,
       confidence: "pattern",
-      message: `${match.rule.title} (${match.rule.cwe})`,
+      message: soft ? `${match.rule.title} (${match.rule.cwe}) \u2014 ${CODE_SOFTENING[soft]}` : `${match.rule.title} (${match.rule.cwe})`,
       consequence: match.rule.consequence,
       cwe: match.rule.cwe,
       excerpt: (lines[index] ?? "").trim().slice(0, 200),
@@ -6690,8 +7156,8 @@ function scanManifest(relativePath, filename, text) {
 }
 
 // ../../packages/scan/src/node/walk.ts
-var import_node_fs10 = require("fs");
-var import_node_path5 = require("path");
+var import_node_fs12 = require("fs");
+var import_node_path7 = require("path");
 function compileExcludes(patterns) {
   const matchers = patterns.map((p) => p.trim()).filter((p) => p.length > 0 && !p.startsWith("#")).map(compilePattern);
   if (matchers.length === 0) return () => false;
@@ -6762,7 +7228,7 @@ function matchPrefix(parts, segs) {
 }
 function readIgnoreFile(root) {
   try {
-    return (0, import_node_fs10.readFileSync)((0, import_node_path5.join)(root, ".threatcrushignore"), "utf-8").split("\n");
+    return (0, import_node_fs12.readFileSync)((0, import_node_path7.join)(root, ".threatcrushignore"), "utf-8").split("\n");
   } catch {
     return [];
   }
@@ -6778,16 +7244,16 @@ function scanPath(targetPath, options = {}) {
   let excluded = 0;
   const rootIsDirectory = (() => {
     try {
-      return (0, import_node_fs10.statSync)(targetPath).isDirectory();
+      return (0, import_node_fs12.statSync)(targetPath).isDirectory();
     } catch {
       return true;
     }
   })();
-  const walkRoot = rootIsDirectory ? targetPath : (0, import_node_path5.dirname)(targetPath);
+  const walkRoot = rootIsDirectory ? targetPath : (0, import_node_path7.dirname)(targetPath);
   const isExcluded = compileExcludes([...options.exclude ?? [], ...readIgnoreFile(walkRoot)]);
   const scanFile = (fullPath, filename) => {
     const relativePath = toRelative(walkRoot, fullPath);
-    const extension = (0, import_node_path5.extname)(filename).toLowerCase();
+    const extension = (0, import_node_path7.extname)(filename).toLowerCase();
     const isManifest = filename === "package.json" || filename === "requirements.txt";
     const scannable = SCAN_EXTENSIONS.has(extension) || filename.startsWith(".env");
     const mayDeclareInterpreter = !scannable && !isManifest && extension === "";
@@ -6799,26 +7265,26 @@ function scanPath(targetPath, options = {}) {
     let handle;
     let declared = null;
     try {
-      handle = (0, import_node_fs10.openSync)(fullPath, "r");
+      handle = (0, import_node_fs12.openSync)(fullPath, "r");
     } catch {
       unreadable.push(relativePath);
       return;
     }
     try {
-      if ((0, import_node_fs10.fstatSync)(handle).size > maxFileBytes) return;
+      if ((0, import_node_fs12.fstatSync)(handle).size > maxFileBytes) return;
       if (mayDeclareInterpreter) {
         const prefix = Buffer.alloc(128);
-        const read = (0, import_node_fs10.readSync)(handle, prefix, 0, prefix.length, 0);
+        const read = (0, import_node_fs12.readSync)(handle, prefix, 0, prefix.length, 0);
         declared = languageOfShebang(prefix.subarray(0, read).toString("utf-8").split("\n", 1)[0] ?? "");
         if (!declared) return;
       }
-      text = (0, import_node_fs10.readFileSync)(handle, "utf-8");
+      text = (0, import_node_fs12.readFileSync)(handle, "utf-8");
     } catch {
       unreadable.push(relativePath);
       return;
     } finally {
       try {
-        (0, import_node_fs10.closeSync)(handle);
+        (0, import_node_fs12.closeSync)(handle);
       } catch {
       }
     }
@@ -6836,13 +7302,13 @@ function scanPath(targetPath, options = {}) {
   const walk = (currentPath) => {
     let entries;
     try {
-      entries = (0, import_node_fs10.readdirSync)(currentPath, { withFileTypes: true });
+      entries = (0, import_node_fs12.readdirSync)(currentPath, { withFileTypes: true });
     } catch {
       unreadable.push(toRelative(walkRoot, currentPath));
       return;
     }
     for (const entry of entries) {
-      const fullPath = (0, import_node_path5.join)(currentPath, entry.name);
+      const fullPath = (0, import_node_path7.join)(currentPath, entry.name);
       const relativePath = toRelative(walkRoot, fullPath);
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
@@ -6866,7 +7332,7 @@ function scanPath(targetPath, options = {}) {
   } else if (isExcluded(toRelative(walkRoot, targetPath))) {
     excluded += 1;
   } else {
-    scanFile(targetPath, (0, import_node_path5.basename)(targetPath));
+    scanFile(targetPath, (0, import_node_path7.basename)(targetPath));
   }
   if (options.missingControls) findings.push(...controls.findings());
   const filtered = allowed ? findings.filter((f) => allowed.has(f.category)) : findings;
@@ -6898,32 +7364,37 @@ function recordSensitiveFile(filename, relativePath, sink, fileFindings) {
   }
 }
 function toRelative(base, target) {
-  const rel = (0, import_node_path5.relative)(base, target);
-  return (rel === "" ? target : rel).split(import_node_path5.sep).join("/");
+  const rel = (0, import_node_path7.relative)(base, target);
+  return (rel === "" ? target : rel).split(import_node_path7.sep).join("/");
 }
 
 // ../../packages/scan/src/node/dependencies.ts
-var import_node_fs11 = require("fs");
-var import_node_path6 = require("path");
-var LOCKFILES = [
-  { file: "package-lock.json", ecosystem: "npm" },
-  { file: "pnpm-lock.yaml", ecosystem: "npm" },
-  { file: "yarn.lock", ecosystem: "npm" },
-  { file: "requirements.txt", ecosystem: "PyPI" },
-  { file: "Pipfile.lock", ecosystem: "PyPI" }
-];
+var import_node_fs13 = require("fs");
+var import_node_path8 = require("path");
 var MAX_DEPS_PER_LOCKFILE = 50;
 async function scanDependencies(targetPath) {
   const findings = [];
-  for (const { file, ecosystem } of LOCKFILES) {
-    const lockPath = (0, import_node_path6.join)(targetPath, file);
-    if (!(0, import_node_fs11.existsSync)(lockPath)) continue;
+  for (const { file, ecosystem, parse } of LOCKFILES) {
+    const lockPath = (0, import_node_path8.join)(targetPath, file);
+    if (!(0, import_node_fs13.existsSync)(lockPath)) continue;
     let deps;
     try {
-      deps = parseDependencies(lockPath, file);
+      deps = dedupe(parse((0, import_node_fs13.readFileSync)(lockPath, "utf-8")));
     } catch {
       continue;
     }
+    if (deps.length === 0) {
+      findings.push(incompleteFinding(file, "No dependencies could be read from this lockfile."));
+      continue;
+    }
+    if (deps.length > MAX_DEPS_PER_LOCKFILE) {
+      findings.push(
+        incompleteFinding(
+          file,
+          `Only the first ${MAX_DEPS_PER_LOCKFILE} of ${deps.length} locked packages were checked against OSV.`
+        )
+      );
+    }
     for (const dep of deps.slice(0, MAX_DEPS_PER_LOCKFILE)) {
       let vulns;
       try {
@@ -6950,6 +7421,20 @@ async function scanDependencies(targetPath) {
   }
   return findings;
 }
+function incompleteFinding(file, message) {
+  return {
+    ruleId: "dependency-scan-incomplete",
+    title: "Dependency scan incomplete",
+    file,
+    line: 1,
+    severity: "low",
+    confidence: "evidence",
+    message,
+    consequence: "Advisories affecting the unchecked packages would not appear in this report.",
+    excerpt: file,
+    category: "dependency"
+  };
+}
 function severityFromCvss(score) {
   if (!score) return "medium";
   const value = Number.parseFloat(score);
@@ -6959,26 +7444,131 @@ function severityFromCvss(score) {
   if (value >= 4) return "medium";
   return "low";
 }
-function parseDependencies(lockPath, filename) {
+function dedupe(deps) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const dep of deps) {
+    const key = `${dep.name}@${dep.version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    unique.push(dep);
+  }
+  return unique;
+}
+function splitNameVersion(spec) {
+  const at = spec.lastIndexOf("@");
+  if (at <= 0) return null;
+  const name = spec.slice(0, at);
+  const version = spec.slice(at + 1);
+  if (!name || !version) return null;
+  return { name, version };
+}
+function exactVersion(raw) {
+  const version = raw.trim().replace(/^[=v]+/, "");
+  return /^[0-9][0-9a-zA-Z.+-]*$/.test(version) ? version : null;
+}
+function parsePackageLock(content) {
+  const lock = JSON.parse(content);
+  const packages = lock.packages ?? lock.dependencies ?? {};
   const deps = [];
-  if (filename === "package-lock.json") {
-    const lock = JSON.parse((0, import_node_fs11.readFileSync)(lockPath, "utf-8"));
-    const packages = lock.packages ?? lock.dependencies ?? {};
-    for (const [key, value] of Object.entries(packages)) {
-      const name = key.replace(/^node_modules\//, "");
-      const version = value?.version;
-      if (name && version && !name.startsWith(".")) deps.push({ name, version });
+  for (const [key, value] of Object.entries(packages)) {
+    const name = key.replace(/^.*node_modules\//, "");
+    const version = value?.version;
+    if (name && version && !name.startsWith(".")) deps.push({ name, version });
+  }
+  return deps;
+}
+function parsePnpmLock(content) {
+  const deps = [];
+  let inPackages = false;
+  for (const line of content.split("\n")) {
+    if (/^[a-zA-Z]/.test(line)) {
+      inPackages = line.startsWith("packages:");
+      continue;
     }
-    return deps;
+    if (!inPackages) continue;
+    const match = /^ {2}(?! )(.+):\s*$/.exec(line);
+    if (!match?.[1]) continue;
+    let key = match[1].trim().replace(/^['"]|['"]$/g, "");
+    key = key.replace(/^\//, "");
+    key = key.replace(/\(.*$/, "");
+    let name;
+    let rawVersion;
+    const slashed = /^(@?[^@]+)\/([0-9][^/]*)$/.exec(key);
+    if (slashed?.[1] && slashed[2]) {
+      name = slashed[1];
+      rawVersion = slashed[2];
+    } else {
+      const dep = splitNameVersion(key);
+      if (!dep) continue;
+      name = dep.name;
+      rawVersion = dep.version;
+    }
+    const version = exactVersion(rawVersion.replace(/_.*$/, ""));
+    if (version) deps.push({ name, version });
+  }
+  return deps;
+}
+function parseYarnLock(content) {
+  const deps = [];
+  let pendingName = null;
+  for (const line of content.split("\n")) {
+    if (line.startsWith("#") || line.trim() === "") continue;
+    if (!/^\s/.test(line)) {
+      pendingName = null;
+      const header = line.replace(/:\s*$/, "");
+      const first = header.split(",")[0]?.trim().replace(/^['"]|['"]$/g, "");
+      if (!first) continue;
+      if (!first.includes("@") || first === "__metadata") continue;
+      if (/@(?:workspace|file|link|portal|exec|patch):/.test(first)) continue;
+      const dep = splitNameVersion(first.replace(/@npm:/, "@"));
+      if (dep) pendingName = dep.name;
+      continue;
+    }
+    if (!pendingName) continue;
+    const version = /^\s+version:?\s+["']?([^"'\s]+)["']?\s*$/.exec(line);
+    if (!version?.[1]) continue;
+    const exact = exactVersion(version[1]);
+    if (exact) deps.push({ name: pendingName, version: exact });
+    pendingName = null;
   }
-  if (filename === "requirements.txt") {
-    for (const line of (0, import_node_fs11.readFileSync)(lockPath, "utf-8").split("\n")) {
-      const match = /^([a-zA-Z0-9_.-]+)==([0-9.]+)/.exec(line);
-      if (match?.[1] && match[2]) deps.push({ name: match[1], version: match[2] });
+  return deps;
+}
+function parsePipfileLock(content) {
+  const lock = JSON.parse(content);
+  const deps = [];
+  for (const section of ["default", "develop"]) {
+    const packages = lock[section];
+    if (!packages || typeof packages !== "object") continue;
+    for (const [name, value] of Object.entries(packages)) {
+      const version = exactVersion(String(value?.version ?? "").replace(/^==/, ""));
+      if (name && version) deps.push({ name, version });
     }
   }
   return deps;
 }
+function parseRequirementsTxt(content) {
+  const deps = [];
+  for (const raw of content.split("\n")) {
+    const line = raw.split("#")[0]?.split(";")[0]?.trim();
+    if (!line || line.startsWith("-")) continue;
+    const match = /^([a-zA-Z0-9._-]+)\s*(?:\[[^\]]*\])?\s*==\s*([^\s,]+)/.exec(line);
+    if (!match?.[1] || !match[2]) continue;
+    const version = exactVersion(match[2]);
+    if (version) deps.push({ name: match[1], version });
+  }
+  return deps;
+}
+var LOCKFILES = [
+  { file: "package-lock.json", ecosystem: "npm", parse: parsePackageLock },
+  { file: "pnpm-lock.yaml", ecosystem: "npm", parse: parsePnpmLock },
+  { file: "yarn.lock", ecosystem: "npm", parse: parseYarnLock },
+  { file: "requirements.txt", ecosystem: "PyPI", parse: parseRequirementsTxt },
+  { file: "Pipfile.lock", ecosystem: "PyPI", parse: parsePipfileLock }
+];
+var LOCKFILE_PARSERS = Object.fromEntries(
+  LOCKFILES.map((entry) => [entry.file, entry.parse])
+);
 function isValidPackageName(name) {
   return /^[@a-zA-Z0-9_.\-/]{1,214}$/.test(name);
 }
@@ -7003,17 +7593,17 @@ async function queryOsv(name, version, ecosystem) {
 }
 
 // ../../packages/scan/src/node/sarif.ts
-var import_node_crypto = require("crypto");
-var import_node_path7 = require("path");
+var import_node_crypto3 = require("crypto");
+var import_node_path9 = require("path");
 
 // src/commands/scan.ts
 function readVersion() {
   for (const candidate of [
-    (0, import_node_path8.join)(__dirname, "..", "package.json"),
-    (0, import_node_path8.join)(__dirname, "..", "..", "package.json")
+    (0, import_node_path10.join)(__dirname, "..", "package.json"),
+    (0, import_node_path10.join)(__dirname, "..", "..", "package.json")
   ]) {
     try {
-      return JSON.parse((0, import_node_fs12.readFileSync)(candidate, "utf-8")).version ?? "0.0.0";
+      return JSON.parse((0, import_node_fs14.readFileSync)(candidate, "utf-8")).version ?? "0.0.0";
     } catch {
     }
   }
@@ -7474,8 +8064,8 @@ var RuleEngine = class {
 };
 
 // src/daemon/rules/loader.ts
-var import_node_fs13 = require("fs");
-var import_node_path9 = require("path");
+var import_node_fs15 = require("fs");
+var import_node_path11 = require("path");
 
 // src/daemon/rules/default-rules.ts
 var DEFAULT_RULES = [
@@ -7759,11 +8349,11 @@ var RULES_DIR = "/etc/threatcrush/rules.d";
 function loadAllRules(customDir) {
   const rules = [...DEFAULT_RULES];
   const dir = customDir || RULES_DIR;
-  if ((0, import_node_fs13.existsSync)(dir)) {
-    const files = (0, import_node_fs13.readdirSync)(dir).filter((f) => f.endsWith(".json"));
+  if ((0, import_node_fs15.existsSync)(dir)) {
+    const files = (0, import_node_fs15.readdirSync)(dir).filter((f) => f.endsWith(".json"));
     for (const file of files) {
       try {
-        const raw = (0, import_node_fs13.readFileSync)((0, import_node_path9.join)(dir, file), "utf-8");
+        const raw = (0, import_node_fs15.readFileSync)((0, import_node_path11.join)(dir, file), "utf-8");
         const parsed = JSON.parse(raw);
         const customRules = Array.isArray(parsed) ? parsed : [parsed];
         for (const rule of customRules) {
@@ -7926,7 +8516,7 @@ function detectFirewallAdapter() {
 }
 
 // src/daemon/firewall/remediation.ts
-var import_node_fs14 = require("fs");
+var import_node_fs16 = require("fs");
 var DEFAULT_CONFIG2 = {
   enabled: true,
   dry_run: true,
@@ -8081,7 +8671,7 @@ var RemediationManager = class {
   }
   logLine(line) {
     try {
-      (0, import_node_fs14.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+      (0, import_node_fs16.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
     } catch {
     }
@@ -8137,7 +8727,7 @@ async function flushTelemetry(timeoutMs = 2e3) {
 // src/daemon/index.ts
 function readVersion2() {
   try {
-    const pkg = JSON.parse((0, import_node_fs15.readFileSync)((0, import_node_path10.join)(__dirname, "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse((0, import_node_fs17.readFileSync)((0, import_node_path12.join)(__dirname, "..", "package.json"), "utf-8"));
     return pkg.version || "0.0.0";
   } catch {
     return "0.0.0";
@@ -8145,7 +8735,7 @@ function readVersion2() {
 }
 function logLine(line) {
   try {
-    (0, import_node_fs15.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+    (0, import_node_fs17.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
   } catch {
   }
@@ -8173,7 +8763,7 @@ async function runDaemon() {
   } catch (err) {
     logLine(`[daemon] state db unavailable: ${err.message}`);
   }
-  const config = loadConfig((0, import_node_fs15.existsSync)(PATHS.configFile) ? PATHS.configFile : void 0);
+  const config = loadConfig((0, import_node_fs17.existsSync)(PATHS.configFile) ? PATHS.configFile : void 0);
   bus.on("event", (event) => {
     logLine(`[event] ${event.severity} ${event.module} ${event.message}`);
   });