@profullstack/threatcrush 0.2.2 → 0.4.0

package/dist/index.js

@@ -1074,7 +1074,7 @@ var require_suggestSimilar = __commonJS({
   "../../node_modules/.pnpm/commander@13.1.0/node_modules/commander/lib/suggestSimilar.js"(exports2) {
     "use strict";
     var maxDistance = 3;
-    function editDistance(a, b) {
+    function editDistance2(a, b) {
       if (Math.abs(a.length - b.length) > maxDistance)
         return Math.max(a.length, b.length);
       const d = [];
@@ -1120,7 +1120,7 @@ var require_suggestSimilar = __commonJS({
       const minSimilarity = 0.4;
       candidates.forEach((candidate) => {
         if (candidate.length <= 1) return;
-        const distance = editDistance(word, candidate);
+        const distance = editDistance2(word, candidate);
         const length = Math.max(word.length, candidate.length);
         const similarity = (length - distance) / length;
         if (similarity > minSimilarity) {
@@ -3917,7 +3917,7 @@ var init_ipc_client = __esm({
         if (!(0, import_node_fs2.existsSync)(this.socketPath)) {
           throw new Error(`threatcrushd socket not found at ${this.socketPath}`);
         }
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve5, reject) => {
           const sock = (0, import_node_net.createConnection)(this.socketPath);
           const timer = setTimeout(() => {
             sock.destroy();
@@ -3930,7 +3930,7 @@ var init_ipc_client = __esm({
             sock.on("data", (chunk) => this.onData(chunk.toString()));
             sock.on("close", () => this.onClose());
             sock.on("error", () => this.onClose());
-            resolve3();
+            resolve5();
           });
           sock.once("error", (err) => {
             clearTimeout(timer);
@@ -3946,8 +3946,8 @@ var init_ipc_client = __esm({
         if (!this.socket) throw new Error("not connected");
         const id = this.nextId++;
         const frame = params ? { id, method, params } : { id, method };
-        return new Promise((resolve3, reject) => {
-          this.pending.set(id, { resolve: resolve3, reject });
+        return new Promise((resolve5, reject) => {
+          this.pending.set(id, { resolve: resolve5, reject });
           this.socket.write(JSON.stringify(frame) + "\n", (err) => {
             if (err) {
               this.pending.delete(id);
@@ -7363,20 +7363,20 @@ var require_parse_async = __commonJS({
       const index = 0;
       const blocksize = opts.blocksize || 40960;
       const parser = new TOMLParser();
-      return new Promise((resolve3, reject) => {
-        setImmediate(parseAsyncNext, index, blocksize, resolve3, reject);
+      return new Promise((resolve5, reject) => {
+        setImmediate(parseAsyncNext, index, blocksize, resolve5, reject);
       });
-      function parseAsyncNext(index2, blocksize2, resolve3, reject) {
+      function parseAsyncNext(index2, blocksize2, resolve5, reject) {
         if (index2 >= str.length) {
           try {
-            return resolve3(parser.finish());
+            return resolve5(parser.finish());
           } catch (err) {
             return reject(prettyError(err, str));
           }
         }
         try {
           parser.parse(str.slice(index2, index2 + blocksize2));
-          setImmediate(parseAsyncNext, index2 + blocksize2, blocksize2, resolve3, reject);
+          setImmediate(parseAsyncNext, index2 + blocksize2, blocksize2, resolve5, reject);
         } catch (err) {
           reject(prettyError(err, str));
         }
@@ -7402,7 +7402,7 @@ var require_parse_stream = __commonJS({
     function parseReadable(stm) {
       const parser = new TOMLParser();
       stm.setEncoding("utf8");
-      return new Promise((resolve3, reject) => {
+      return new Promise((resolve5, reject) => {
         let readable;
         let ended = false;
         let errored = false;
@@ -7410,7 +7410,7 @@ var require_parse_stream = __commonJS({
           ended = true;
           if (readable) return;
           try {
-            resolve3(parser.finish());
+            resolve5(parser.finish());
           } catch (err) {
             reject(err);
           }
@@ -8260,8 +8260,8 @@ var source_default = chalk;
 // src/index.ts
 var import_readline = __toESM(require("readline"));
 var import_node_child_process10 = require("child_process");
-var import_node_fs27 = require("fs");
-var import_node_path16 = require("path");
+var import_node_fs29 = require("fs");
+var import_node_path19 = require("path");
 var import_node_os8 = require("os");
 
 // src/commands/monitor.ts
@@ -8323,6 +8323,7 @@ var NGINX_REGEX = /^(\S+) \S+ \S+ \[([^\]]+)\] "(\S+) (\S+) \S+" (\d{3}) (\d+) "
 var AUTH_REGEX = /^(\w+\s+\d+\s+[\d:]+)\s+\S+\s+(\S+?)(?:\[\d+\])?:\s+(.*)/;
 var SYSLOG_REGEX = /^(\w+\s+\d+\s+[\d:]+)\s+\S+\s+(\S+?)(?:\[\d+\])?:\s+(.*)/;
 var IP_REGEX = /(?:from|FROM)\s+(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/;
+var INVALID_USER_REGEX = /(?:for\s+invalid\s+user)\s+(\S+?)(?:\s+from|\s*$)/;
 var USER_REGEX = /(?:for|user)\s+(\S+?)(?:\s+from|\s*$)/;
 var ATTACK_PATTERNS = {
   sqli: [
@@ -8376,7 +8377,7 @@ function parseAuthLog(line) {
   const match = line.match(AUTH_REGEX);
   if (!match) return null;
   const ipMatch = match[3].match(IP_REGEX);
-  const userMatch = match[3].match(USER_REGEX);
+  const userMatch = match[3].match(INVALID_USER_REGEX) || match[3].match(USER_REGEX);
   return {
     timestamp: parseSyslogTimestamp(match[1]),
     raw: line,
@@ -8404,10 +8405,25 @@ function parseSyslog(line) {
   };
 }
 function detectAttackPattern(path) {
+  const candidates = /* @__PURE__ */ new Set([path]);
+  let current = path;
+  for (let i = 0; i < 2; i++) {
+    let decoded = null;
+    try {
+      decoded = decodeURIComponent(current);
+    } catch {
+      decoded = null;
+    }
+    if (decoded === null || decoded === current) break;
+    candidates.add(decoded);
+    current = decoded;
+  }
   for (const [type, patterns] of Object.entries(ATTACK_PATTERNS)) {
     for (const pattern of patterns) {
-      if (pattern.test(path)) {
-        return type;
+      for (const candidate of candidates) {
+        if (pattern.test(candidate)) {
+          return type;
+        }
       }
     }
   }
@@ -8421,20 +8437,19 @@ function autoDetectParser(line) {
   return parseSyslog(line);
 }
 function parseNginxTimestamp(s) {
-  try {
-    const cleaned = s.replace(/(\d{2})\/(\w{3})\/(\d{4}):/, "$2 $1, $3 ");
-    return new Date(cleaned);
-  } catch {
-    return /* @__PURE__ */ new Date();
-  }
+  const cleaned = s.replace(/(\d{2})\/(\w{3})\/(\d{4}):/, "$2 $1, $3 ");
+  const d = new Date(cleaned);
+  return Number.isNaN(d.getTime()) ? /* @__PURE__ */ new Date() : d;
 }
 function parseSyslogTimestamp(s) {
-  try {
-    const withYear = `${s} ${(/* @__PURE__ */ new Date()).getFullYear()}`;
-    return new Date(withYear);
-  } catch {
-    return /* @__PURE__ */ new Date();
+  const now = /* @__PURE__ */ new Date();
+  let d = /* @__PURE__ */ new Date(`${s} ${now.getFullYear()}`);
+  if (Number.isNaN(d.getTime())) return now;
+  if (d.getTime() > now.getTime()) {
+    const prev = /* @__PURE__ */ new Date(`${s} ${now.getFullYear() - 1}`);
+    if (!Number.isNaN(prev.getTime())) d = prev;
   }
+  return d;
 }
 
 // src/commands/monitor.ts
@@ -8624,8 +8639,8 @@ async function runDemoMode() {
 }
 
 // src/commands/scan.ts
-var import_node_fs5 = require("fs");
-var import_node_path2 = require("path");
+var import_node_fs7 = require("fs");
+var import_node_path5 = require("path");
 
 // ../../node_modules/.pnpm/ora@8.2.0/node_modules/ora/index.js
 var import_node_process7 = __toESM(require("process"), 1);
@@ -9565,58 +9580,1134 @@ function workerId() {
   return `${import_node_os3.default.hostname()}/${process.pid}`;
 }
 
-// src/commands/scan.ts
-var SECRET_PATTERNS = [
-  { name: "AWS Access Key", pattern: /(?:AKIA[0-9A-Z]{16})/g, severity: "critical" },
-  { name: "AWS Secret Key", pattern: /(?:aws_secret_access_key|AWS_SECRET)\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi, severity: "critical" },
-  { name: "GitHub Token", pattern: /(?:ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{82})/g, severity: "critical" },
-  { name: "Generic API Key", pattern: /(?:api[_-]?key|apikey)\s*[=:]\s*['"]([A-Za-z0-9\-_]{20,})['"]?/gi, severity: "high" },
-  { name: "Generic Secret", pattern: /(?:secret|password|passwd|pwd)\s*[=:]\s*['"]([^'"]{8,})['"]?/gi, severity: "high" },
-  { name: "Private Key", pattern: /-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----/g, severity: "critical" },
-  { name: "JWT Token", pattern: /eyJ[A-Za-z0-9-_]+\.eyJ[A-Za-z0-9-_]+\.[A-Za-z0-9-_.+/=]*/g, severity: "high" },
-  { name: "Slack Token", pattern: /xox[bpors]-[A-Za-z0-9-]{10,}/g, severity: "critical" },
-  { name: "Stripe Key", pattern: /(?:sk_live_|pk_live_|sk_test_|pk_test_)[A-Za-z0-9]{20,}/g, severity: "critical" },
-  { name: "Database URL", pattern: /(?:postgres|mysql|mongodb|redis):\/\/[^\s'"]+/gi, severity: "high" },
-  { name: "Bearer Token", pattern: /Bearer\s+[A-Za-z0-9\-_\.]{20,}/g, severity: "medium" },
-  { name: "Hex Token (32+)", pattern: /(?:token|key|secret|auth)\s*[=:]\s*['"]?([0-9a-f]{32,})['"]?/gi, severity: "medium" }
+// src/scan/dependencies.ts
+var import_node_fs5 = require("fs");
+var import_node_path2 = require("path");
+var LOCKFILES = [
+  { file: "package-lock.json", ecosystem: "npm" },
+  { file: "pnpm-lock.yaml", ecosystem: "npm" },
+  { file: "yarn.lock", ecosystem: "npm" },
+  { file: "requirements.txt", ecosystem: "PyPI" },
+  { file: "Pipfile.lock", ecosystem: "PyPI" }
+];
+var MAX_DEPS_PER_LOCKFILE = 50;
+async function scanDependencies(targetPath) {
+  const findings = [];
+  for (const { file, ecosystem } of LOCKFILES) {
+    const lockPath = (0, import_node_path2.join)(targetPath, file);
+    if (!(0, import_node_fs5.existsSync)(lockPath)) continue;
+    let deps;
+    try {
+      deps = parseDependencies(lockPath, file);
+    } catch {
+      continue;
+    }
+    for (const dep of deps.slice(0, MAX_DEPS_PER_LOCKFILE)) {
+      let vulns;
+      try {
+        vulns = await queryOsv(dep.name, dep.version, ecosystem);
+      } catch {
+        continue;
+      }
+      for (const vuln of vulns) {
+        const cvss = vuln.severity?.find((entry) => entry.type === "CVSS_V3")?.score;
+        findings.push({
+          ruleId: "dependency-known-vulnerability",
+          title: "Dependency CVE",
+          file,
+          line: 1,
+          severity: severityFromCvss(cvss),
+          confidence: "evidence",
+          message: `${dep.name}@${dep.version}: ${vuln.summary ?? vuln.id}`,
+          consequence: "A published advisory exists for the exact version resolved in this lockfile.",
+          excerpt: `${vuln.id}${cvss ? ` (CVSS: ${cvss})` : ""}`,
+          category: "dependency"
+        });
+      }
+    }
+  }
+  return findings;
+}
+function severityFromCvss(score) {
+  if (!score) return "medium";
+  const value = Number.parseFloat(score);
+  if (Number.isNaN(value)) return "medium";
+  if (value >= 9) return "critical";
+  if (value >= 7) return "high";
+  if (value >= 4) return "medium";
+  return "low";
+}
+function parseDependencies(lockPath, filename) {
+  const deps = [];
+  if (filename === "package-lock.json") {
+    const lock = JSON.parse((0, import_node_fs5.readFileSync)(lockPath, "utf-8"));
+    const packages = lock.packages ?? lock.dependencies ?? {};
+    for (const [key, value] of Object.entries(packages)) {
+      const name = key.replace(/^node_modules\//, "");
+      const version = value?.version;
+      if (name && version && !name.startsWith(".")) deps.push({ name, version });
+    }
+    return deps;
+  }
+  if (filename === "requirements.txt") {
+    for (const line of (0, import_node_fs5.readFileSync)(lockPath, "utf-8").split("\n")) {
+      const match = /^([a-zA-Z0-9_.-]+)==([0-9.]+)/.exec(line);
+      if (match?.[1] && match[2]) deps.push({ name: match[1], version: match[2] });
+    }
+  }
+  return deps;
+}
+function isValidPackageName(name) {
+  return /^[@a-zA-Z0-9_.\-/]{1,214}$/.test(name);
+}
+function isValidVersion(version) {
+  return /^[0-9a-zA-Z._\-+]{1,50}$/.test(version);
+}
+async function queryOsv(name, version, ecosystem) {
+  if (!isValidPackageName(name) || !isValidVersion(version)) return [];
+  try {
+    const response = await fetch("https://api.osv.dev/v1/query", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ package: { name, ecosystem }, version }),
+      signal: AbortSignal.timeout(5e3)
+    });
+    if (!response.ok) return [];
+    const data = await response.json();
+    return data.vulns ?? [];
+  } catch {
+    return [];
+  }
+}
+
+// src/scan/engine.ts
+var import_node_fs6 = require("fs");
+var import_node_path3 = require("path");
+
+// src/scan/types.ts
+var SEVERITY_ORDER = ["info", "low", "medium", "high", "critical"];
+function severityRank(severity) {
+  const index = SEVERITY_ORDER.indexOf(severity);
+  return index === -1 ? 0 : index;
+}
+function severityFor(declared, confidence) {
+  if (confidence !== "pattern") return declared;
+  return severityRank(declared) > severityRank("medium") ? "medium" : declared;
+}
+
+// src/scan/code-rules.ts
+var UNTRUSTED_JS = /\b(?:req|request|ctx|context)\s*\.\s*(?:body|query|params|param|headers|cookies|url|files)\b|\bprocess\.argv\b|\bwindow\.location\b|\bdocument\.location\b|\blocation\.(?:search|hash|href)\b|\bsearchParams\s*\.\s*(?:get|getAll|has|entries|keys|values|forEach)\b|\bgetParameter\s*\(|\bgetQueryString\s*\(|\bgetInputStream\s*\(/;
+var UNTRUSTED_PY = /\brequest\b|\bparams\b|\bflask\b|\bsys\.argv\b|\bos\.environ\b\s*\[/;
+var UNTRUSTED_RB = /\bparams\s*\[|\brequest\b|\bcookies\s*\[/;
+var UNTRUSTED_GO = /\br\s*\.\s*(?:URL|Form|Body|Header|PostForm)\b|\bFormValue\s*\(|\bQuery\s*\(\s*\)\s*\.\s*Get\s*\(|\bmux\.Vars\s*\(/;
+var UNTRUSTED_JAVA = /\bgetParameter\s*\(|\bgetQueryString\s*\(|\bgetHeader\s*\(|\bgetInputStream\s*\(|\bgetCookies\s*\(|\b@RequestParam\b|\b@PathVariable\b/;
+function untrustedPatternFor(language) {
+  switch (language) {
+    case "python":
+      return UNTRUSTED_PY;
+    case "ruby":
+      return UNTRUSTED_RB;
+    case "go":
+      return UNTRUSTED_GO;
+    case "java":
+      return UNTRUSTED_JAVA;
+    default:
+      return UNTRUSTED_JS;
+  }
+}
+var GENERIC_GUARD = (
+  // `esc(`, `aEsc(`, `htmlEscape(`, `escapeHtml(` — the escaper is almost
+  // never *named* `escapeHtml` in real code. It gets aliased to something
+  // short because it is called on nearly every interpolation, so matching only
+  // the long spellings reported the codebases that escape most rigorously.
+  //
+  // The identifier must END at the escaper (with at most a known output-context
+  // suffix). An earlier, looser form also matched `describe(`, which would have
+  // silenced findings across every test file in every repository.
+  /\ballow(?:ed|list|_list|ed_hosts)?\b|\bwhitelist\b|\b\w{0,6}[Ee]sc(?:ape)?(?:[Hh]tml|HTML|[Xx]ml|XML|[Ss]ql|[Aa]ttr|[Jj]s|[Uu]ri|[Uu]rl)?\s*\(|\bhtml_escape\b|\bhtmlspecialchars\s*\(|\bsanitiz\w*\b|\bencoded\b|\brealpath\b|\bcommonpath\b|\bresolve\(\)\.startsWith\b|\bprocess\.env\b|\bos\.environ\b|\bgetenv\b|\bENV\s*\[|setObjectInputFilter|ObjectInputFilter/i
+);
+var XXE_GUARD = /FEATURE_SECURE_PROCESSING|setExpandEntityReferences|disallow-doctype-decl|external-general-entities|external-parameter-entities|setXIncludeAware\s*\(\s*false/;
+var CODE_SINK = /\bglobalThis\s*\[|\bconstructor\b|\beval\b|\bFunction\b|\brun\s*\(|\bvm\s*\.\s*run/;
+var EXFIL_SINK = /\bconsole\s*\.\s*(?:log|debug|info|warn|error)\s*\(|\bfetch\s*\(|\baxios\b|\brequest\s*\(|\.\s*send\s*\(/;
+var SQL_KEYWORDS = "SELECT|INSERT\\s+INTO|INSERT|UPDATE|DELETE\\s+FROM|DELETE|DROP|UNION\\s+SELECT";
+var SQL_IN_DOUBLE = `"[^"\\n]*(?:${SQL_KEYWORDS})\\b[^"\\n]*"`;
+var SQL_IN_SINGLE = `'[^'\\n]*(?:${SQL_KEYWORDS})\\b[^'\\n]*'`;
+var SQL_STRING = `(?:${SQL_IN_DOUBLE}|${SQL_IN_SINGLE})`;
+var CODE_RULES = [
+  // ── Injection: SQL ───────────────────────────────────────────────────────
+  {
+    id: "sql-string-concatenation",
+    title: "SQL assembled by concatenation or interpolation",
+    consequence: "A quote in the interpolated value changes the query\u2019s meaning \u2014 the query runs as the attacker wrote it, not as you wrote it.",
+    cwe: "CWE-89",
+    severity: "critical",
+    // The tail is what distinguishes assembly from parameterisation. A bound
+    // query leaves a comma after the closing quote (`"… = $1", [id]`) and
+    // matches none of these.
+    pattern: new RegExp(
+      `${SQL_STRING}\\s*\\+|${SQL_STRING}\\s*%\\s*[\\w(]|${SQL_STRING}\\s*\\.\\s*format\\s*\\(|\\+\\s*(?:"[^"\\n]*|'[^'\\n]*)(?:WHERE|ORDER\\s+BY|VALUES|SET)\\b`,
+      "i"
+    )
+  },
+  {
+    id: "sql-template-interpolation",
+    title: "SQL built from a template literal or f-string",
+    consequence: "Template interpolation is string concatenation with nicer syntax \u2014 it binds nothing and escapes nothing.",
+    cwe: "CWE-89",
+    severity: "critical",
+    pattern: new RegExp(
+      `\`[^\`\\n]*(?:${SQL_KEYWORDS})\\b[^\`\\n]*\\$\\{|\\bf"[^"\\n]*(?:${SQL_KEYWORDS})\\b[^"\\n]*\\{|\\bf'[^'\\n]*(?:${SQL_KEYWORDS})\\b[^'\\n]*\\{`,
+      "i"
+    )
+  },
+  {
+    id: "sql-format-call",
+    title: "SQL text produced by a format helper",
+    consequence: "`Sprintf`/`String.format` substitute without quoting; the resulting string is concatenated SQL by another name.",
+    cwe: "CWE-89",
+    severity: "critical",
+    languages: ["go", "java"],
+    pattern: new RegExp(
+      `\\b(?:fmt\\.Sprintf|String\\.format)\\s*\\(\\s*"[^"\\n]*(?:${SQL_KEYWORDS})\\b`,
+      "i"
+    )
+  },
+  {
+    id: "rb-sql-interpolation",
+    title: "ActiveRecord query built by string interpolation",
+    consequence: '`where("\u2026 #{value}")` interpolates before the adapter sees it, so no binding ever happens.',
+    cwe: "CWE-89",
+    severity: "critical",
+    languages: ["ruby"],
+    pattern: /\b(?:where|find_by_sql|execute|select_all|select_values|order|group|pluck)\s*[( ]\s*(?:"[^"\n]*|'[^'\n]*)#\{/
+  },
+  // ── Injection: OS command ────────────────────────────────────────────────
+  {
+    id: "js-shell-exec-interpolation",
+    title: "shell execution with an interpolated string",
+    consequence: "A `;` or `$(\u2026)` in the interpolated value runs as the server user.",
+    cwe: "CWE-78",
+    severity: "critical",
+    languages: ["javascript", "typescript"],
+    pattern: /\b(?:exec|execSync|spawn|spawnSync)\s*\(\s*(?:`[^`]*\$\{|['"][^'"]*['"]\s*\+|[a-zA-Z_$][\w$]*\s*\+)/
+  },
+  {
+    id: "py-shell-command-string",
+    title: "shell command built from a string",
+    consequence: "`os.system` and `shell=True` hand the string to `/bin/sh`, which happily interprets metacharacters.",
+    cwe: "CWE-78",
+    severity: "critical",
+    languages: ["python"],
+    pattern: /\bos\.(?:system|popen)\s*\(\s*(?:f?['"][^'"]*['"]\s*(?:\+|%|\.\s*format)|f['"]|[a-zA-Z_]\w*\s*[,)])|\bsubprocess\.(?:run|call|check_call|check_output|Popen)\s*\([^)]*\bshell\s*=\s*True/
+  },
+  {
+    id: "go-shell-exec-command",
+    title: "exec.Command invoking a shell",
+    consequence: "Passing `sh -c` re-introduces the shell that `exec.Command`\u2019s argv interface exists to avoid.",
+    cwe: "CWE-78",
+    severity: "critical",
+    languages: ["go"],
+    pattern: /\bexec\.Command(?:Context)?\s*\(\s*(?:ctx\s*,\s*)?"(?:\/bin\/)?(?:sh|bash|zsh|cmd|powershell)"\s*,\s*"(?:-c|\/c)"/
+  },
+  {
+    id: "rb-backtick-interpolation",
+    title: "backtick command with interpolation",
+    consequence: "Ruby backticks are a shell invocation; `#{}` inside one is command injection.",
+    cwe: "CWE-78",
+    severity: "critical",
+    languages: ["ruby"],
+    pattern: /`[^`\n]*#\{|\bsystem\s*\(\s*["'][^"'\n]*#\{|%x\[[^\]]*#\{/
+  },
+  // ── Injection: dynamic code ──────────────────────────────────────────────
+  {
+    id: "js-dynamic-code-execution",
+    title: "dynamic code execution",
+    consequence: "Any string reaching this call executes as code with the process\u2019 privileges.",
+    cwe: "CWE-95",
+    severity: "critical",
+    languages: ["javascript", "typescript"],
+    pattern: /\beval\s*\(|\bnew\s+Function\s*\(|\bvm\s*\.\s*run(?:InThisContext|InNewContext|InContext)\s*\(|\bset(?:Timeout|Interval)\s*\(\s*(?:['"`]|(?:req|request|ctx|params|query|body)\b)/
+  },
+  {
+    id: "js-indirect-code-sink",
+    title: "code sink reached indirectly",
+    consequence: "Resolving `eval`/`Function` through `globalThis[\u2026]` or `.constructor` hides the sink from literal matching. Legitimate code has no reason to.",
+    cwe: "CWE-506",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\bglobalThis\s*\[\s*[a-zA-Z_$][\w$]*\s*\]|\(\s*function\s*\(\s*\)\s*\{\s*\}\s*\)\s*\.\s*constructor/
+  },
+  {
+    id: "js-encoded-payload-execution",
+    title: "encoded blob decoded next to a code sink",
+    consequence: "A base64 literal that is decoded and executed is the standard shape of a planted backdoor; the encoding exists to defeat review.",
+    cwe: "CWE-506",
+    severity: "critical",
+    languages: ["javascript", "typescript"],
+    pattern: /\bBuffer\.from\s*\(\s*[\w.$]+\s*,\s*['"]base64['"]\s*\)|\batob\s*\(\s*[\w.$]+\s*\)/,
+    requires: CODE_SINK,
+    guardBack: 6,
+    guardForward: 3
+  },
+  {
+    id: "py-dynamic-code-execution",
+    title: "dynamic code execution",
+    consequence: "Any string reaching this call executes as Python with the process\u2019 privileges.",
+    cwe: "CWE-95",
+    severity: "critical",
+    languages: ["python"],
+    pattern: /\b(?:eval|exec)\s*\(\s*(?!['"]\s*\))[a-zA-Z_(f'"]/,
+    needsContext: true
+  },
+  {
+    id: "rb-dynamic-dispatch",
+    title: "dynamic code execution or unrestricted #send",
+    consequence: "`eval` runs arbitrary Ruby; unrestricted `#send` lets the caller invoke any method on the receiver, including private ones.",
+    cwe: "CWE-95",
+    severity: "critical",
+    languages: ["ruby"],
+    pattern: /\beval\s*\(|\binstance_eval\s*\(|\bclass_eval\s*\(|\.\s*send\s*\(\s*(?:params|request|args)\b/
+  },
+  // ── Cross-site scripting ─────────────────────────────────────────────────
+  {
+    id: "js-unescaped-html-sink",
+    title: "unescaped HTML rendering",
+    consequence: "A script tag in the value executes in the victim\u2019s session \u2014 stored or reflected XSS.",
+    cwe: "CWE-79",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\bdangerouslySetInnerHTML\s*=|\.\s*(?:innerHTML|outerHTML)\s*=\s*(?!\s*['"`]\s*['"`]\s*;?\s*$)|\bdocument\s*\.\s*write(?:ln)?\s*\(|\.\s*insertAdjacentHTML\s*\(/,
+    /**
+     * A whole-statement assignment of a string with no interpolation and no
+     * concatenation carries no data, so it cannot carry attacker data. This
+     * was the single largest source of noise: a codebase that builds its UI
+     * with innerHTML reports every static heading and spinner as XSS, and a
+     * rule that flags 40 safe lines to catch one real one gets switched off.
+     *
+     * Line-scoped on purpose — see `lineGuard`.
+     */
+    lineGuard: /(?:innerHTML|outerHTML)\s*=\s*(?:'[^'\\]*'|"[^"\\]*"|`[^`$\\]*`)\s*;?\s*$/
+  },
+  {
+    id: "java-html-writer-concatenation",
+    title: "HTML written to the response by concatenation",
+    consequence: "The servlet writer performs no encoding; a value concatenated into markup is rendered as markup.",
+    cwe: "CWE-79",
+    severity: "high",
+    languages: ["java"],
+    pattern: /\b(?:println|print|write)\s*\(\s*"[^"\n]*<[^"\n]*"\s*\+/
+  },
+  {
+    id: "rb-unescaped-output",
+    title: "Rails output escaping bypassed",
+    consequence: "`html_safe` and `raw` tell Rails the string is already safe. If it came from a parameter, it is not.",
+    cwe: "CWE-79",
+    severity: "high",
+    languages: ["ruby"],
+    pattern: /\.\s*html_safe\b|\braw\s*\(\s*(?:params|request|@)|\blink_to\s+[^,\n]+,\s*params\s*\[/
+  },
+  {
+    id: "py-template-autoescape-off",
+    title: "template rendering with escaping disabled",
+    consequence: "With autoescape off \u2014 or a `|safe` filter \u2014 every interpolated value is rendered as markup.",
+    cwe: "CWE-79",
+    severity: "high",
+    languages: ["python"],
+    pattern: /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*False|\|\s*safe\b|\bMarkup\s*\(\s*(?!['"])/
+  },
+  {
+    id: "py-template-from-input",
+    title: "template compiled from a non-literal source",
+    consequence: "Server-side template injection. In Jinja2 the sandbox is escapable, so this escalates from XSS to remote code execution.",
+    cwe: "CWE-1336",
+    severity: "critical",
+    languages: ["python"],
+    pattern: /\bTemplate\s*\(\s*(?!['"])[a-zA-Z_]/,
+    needsContext: true
+  },
+  // ── Server-side request forgery ──────────────────────────────────────────
+  {
+    id: "js-ssrf-outbound-request",
+    title: "outbound request to a non-constant URL",
+    consequence: "An attacker who controls the URL reaches the cloud metadata endpoint, localhost, and every service on the private network.",
+    cwe: "CWE-918",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\bfetch\s*\(\s*[a-zA-Z_$][\w$]*\s*[,)]|\bhttps?\s*\.\s*(?:get|request)\s*\(\s*[a-zA-Z_$][\w$]*\s*[,)]|\baxios\s*\.\s*get\s*\(\s*[a-zA-Z_$][\w$]*\s*[,)]/,
+    needsContext: true
+  },
+  {
+    id: "py-ssrf-outbound-request",
+    title: "outbound request to a non-constant URL",
+    consequence: "An attacker who controls the URL reaches the cloud metadata endpoint, localhost, and every service on the private network.",
+    cwe: "CWE-918",
+    severity: "high",
+    languages: ["python"],
+    pattern: /\brequests\.(?:get|request|head)\s*\(\s*[a-zA-Z_]\w*\s*[,)]|\burlopen\s*\(\s*[a-zA-Z_]\w*\s*[,)]|\bhttpx\.get\s*\(\s*[a-zA-Z_]\w*\s*[,)]/,
+    needsContext: true
+  },
+  {
+    id: "go-ssrf-outbound-request",
+    title: "outbound request to a non-constant URL",
+    consequence: "An attacker who controls the URL reaches the cloud metadata endpoint, localhost, and every service on the private network.",
+    cwe: "CWE-918",
+    severity: "high",
+    languages: ["go"],
+    pattern: /\bhttp\.(?:Get|Post|Head)\s*\(\s*(?:[a-zA-Z_]\w*\s*[,)]|"[^"]*"\s*\+)/,
+    needsContext: true
+  },
+  // ── Open redirect ────────────────────────────────────────────────────────
+  {
+    id: "js-open-redirect",
+    title: "redirect to a non-constant destination",
+    consequence: "Your domain becomes the credible first hop of a phishing chain; the victim sees your hostname in the link they clicked.",
+    cwe: "CWE-601",
+    severity: "medium",
+    languages: ["javascript", "typescript"],
+    pattern: /\b(?:res|response)\s*\.\s*redirect\s*\(\s*[a-zA-Z_$][\w$]*\s*\)|\bwindow\s*\.\s*location(?:\s*\.\s*(?:href|replace))?\s*(?:=\s*[a-zA-Z_$]|\(\s*[a-zA-Z_$][\w$]*\s*\))/,
+    needsContext: true
+  },
+  // ── Deserialisation ──────────────────────────────────────────────────────
+  {
+    id: "py-unsafe-deserialization",
+    title: "deserialisation of untrusted data",
+    consequence: "`pickle` and `yaml.load` instantiate arbitrary types during parsing \u2014 a crafted payload is remote code execution, not a parse error.",
+    cwe: "CWE-502",
+    severity: "critical",
+    languages: ["python"],
+    pattern: /\bpickle\.loads?\s*\(|\bcPickle\.loads?\s*\(|\bmarshal\.loads\s*\(|\byaml\.load\s*\(|\bjsonpickle\.decode\s*\(/
+  },
+  {
+    id: "java-unsafe-deserialization",
+    title: "Java deserialisation without a class filter",
+    consequence: "A gadget chain in the classpath turns `readObject()` on attacker bytes into remote code execution.",
+    cwe: "CWE-502",
+    severity: "critical",
+    languages: ["java"],
+    pattern: /\breadObject\s*\(\s*\)|\bnew\s+ObjectInputStream\s*\(/,
+    guardBack: 8,
+    // The stream is constructed, *then* filtered. Without a forward window the
+    // guarded case matches on its constructor line and reports a correct
+    // implementation as a finding.
+    guardForward: 6
+  },
+  {
+    id: "js-unsafe-yaml-load",
+    title: "YAML parsed with type resolution enabled",
+    consequence: "A crafted document can instantiate arbitrary types during parsing.",
+    cwe: "CWE-502",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\byaml\s*\.\s*load\s*\((?![^)]*safe)|\bloadAll\s*\([^)]*unsafe/i
+  },
+  // ── XML external entities ────────────────────────────────────────────────
+  {
+    id: "java-xxe-parser-defaults",
+    title: "XML parser left on its insecure defaults",
+    consequence: "External entity expansion reads local files and makes outbound requests on the parser\u2019s behalf \u2014 file disclosure and SSRF from a document.",
+    cwe: "CWE-611",
+    severity: "high",
+    languages: ["java"],
+    pattern: /\b(?:DocumentBuilderFactory|SAXParserFactory|XMLInputFactory|TransformerFactory|SchemaFactory)\s*\.\s*newInstance\s*\(\s*\)/,
+    guard: XXE_GUARD,
+    guardBack: 4,
+    guardForward: 8
+  },
+  {
+    id: "java-xxe-parse-call",
+    title: "XML parsed by a builder that was never hardened",
+    consequence: "The expansion happens at `parse()`. Flagging only the factory misses the line where the document is actually read.",
+    cwe: "CWE-611",
+    severity: "high",
+    languages: ["java"],
+    // Receiver-qualified so `LocalDate.parse(s)` and friends stay out of it.
+    pattern: /\b\w*(?:[Bb]uilder|[Pp]arser|[Rr]eader)\s*\.\s*parse\s*\(/,
+    guard: XXE_GUARD,
+    guardBack: 6,
+    guardForward: 4
+  },
+  // ── Path traversal ───────────────────────────────────────────────────────
+  {
+    id: "py-path-traversal",
+    title: "file opened at a path built from input",
+    consequence: "A `../` sequence \u2014 or an absolute path \u2014 reads or writes outside the intended directory.",
+    cwe: "CWE-22",
+    severity: "high",
+    languages: ["python"],
+    pattern: /\bopen\s*\(\s*(?:os\.path\.join\s*\(|[a-zA-Z_]\w*\s*\+|f['"])/,
+    needsContext: true
+  },
+  {
+    id: "js-path-traversal",
+    title: "file path built from a variable",
+    consequence: "A `../` sequence in the value reads or writes outside the intended directory.",
+    cwe: "CWE-22",
+    severity: "medium",
+    languages: ["javascript", "typescript"],
+    pattern: /\b(?:readFile|readFileSync|writeFile|writeFileSync|createReadStream|createWriteStream|unlink|unlinkSync|sendFile)\s*\(\s*(?:`[^`]*\$\{|[a-zA-Z_$][\w$]*\s*\+|path\.join\s*\([^)]*(?:req|request)\b)/,
+    needsContext: true
+  },
+  // ── Cryptography, tokens, randomness ─────────────────────────────────────
+  {
+    id: "js-jwt-decode-without-verify",
+    title: "JWT decoded without verifying the signature",
+    consequence: "`decode` parses the claims and checks nothing. Anyone can mint a token with any `sub` and any `role`.",
+    cwe: "CWE-347",
+    severity: "critical",
+    languages: ["javascript", "typescript"],
+    pattern: /\bjwt\s*\.\s*decode\s*\(|\bjsonwebtoken\s*\.\s*decode\s*\(|\bdecodeJwt\s*\(/
+  },
+  {
+    id: "tls-verification-disabled",
+    title: "TLS certificate verification disabled",
+    consequence: "Every connection made this way is trivially interceptable; the encryption is decorative.",
+    cwe: "CWE-295",
+    severity: "high",
+    pattern: /rejectUnauthorized\s*:\s*false|NODE_TLS_REJECT_UNAUTHORIZED\s*[=:]\s*['"]?0|strictSSL\s*:\s*false|\bverify\s*=\s*False\b|InsecureSkipVerify\s*:\s*true/
+  },
+  {
+    id: "weak-hash-on-credential",
+    title: "broken hash used on a credential",
+    consequence: "MD5 and SHA-1 are fast and collision-prone; hashed passwords are recoverable.",
+    cwe: "CWE-327",
+    severity: "high",
+    pattern: /(?:createHash|hashlib|MessageDigest\.getInstance|Digest::)\s*[.(]?\s*['"]?(?:md5|MD5|sha1|SHA-?1)['"]?\s*\)?[\s\S]{0,80}(?:password|passwd|secret|token|credential)/i
+  },
+  {
+    id: "insecure-randomness-for-secret",
+    title: "predictable randomness used for a security value",
+    consequence: "`Math.random`/`random.random` are predictable; tokens, session ids and reset codes built from them are guessable.",
+    cwe: "CWE-338",
+    severity: "high",
+    pattern: /(?:token|secret|password|salt|nonce|session|otp|reset|apikey|api_key)[\w]*\s*[:=][^;\n]{0,60}(?:Math\s*\.\s*random\s*\(|\brandom\s*\.\s*(?:random|randint|choice)\s*\(|\brand\s*\()/i
+  },
+  {
+    id: "redos-nested-quantifier",
+    title: "regex with nested unbounded quantifiers",
+    consequence: "Catastrophic backtracking: a crafted input of a few dozen characters pins a CPU core for minutes.",
+    cwe: "CWE-1333",
+    severity: "medium",
+    pattern: /\([^)\n]*[+*]\s*\)\s*[+*]|\([^)\n]*\{\d+,\}\s*\)\s*[+*{]/
+  },
+  // ── Temporary files ──────────────────────────────────────────────────────
+  {
+    id: "insecure-temp-file",
+    title: "predictable temporary file path",
+    consequence: "A predictable name in a world-writable directory is a symlink attack: an attacker pre-creates the path and your process writes through it.",
+    cwe: "CWE-377",
+    severity: "medium",
+    // A hardcoded path under /tmp is the finding whether or not it is
+    // formatted: `"/tmp/application.log.tmp"` is worse than the PID-based one,
+    // because every process on the host can predict it exactly.
+    pattern: /\btempfile\.mktemp\s*\(|\bos\.tmpnam\s*\(|['"]\/tmp\/[^'"\n]+['"]|['"]\/tmp\/[^'"\n]*\{|\bFile\.createTempFile\s*\(/
+  },
+  // ── Information exposure ─────────────────────────────────────────────────
+  {
+    id: "py-stack-trace-returned",
+    title: "stack trace returned to the caller",
+    consequence: "Tracebacks leak absolute paths, dependency versions and source fragments \u2014 the reconnaissance an attacker would otherwise have to guess at.",
+    cwe: "CWE-209",
+    severity: "medium",
+    languages: ["python"],
+    pattern: /\breturn\b[^\n]*\btraceback\.(?:format_exc|format_exception|print_exc)\s*\(|\breturn\b[^\n]*\bstr\s*\(\s*e\s*\)/
+  },
+  {
+    id: "js-environment-exfiltration",
+    title: "process environment serialised into a payload",
+    consequence: "The environment is where every secret lives. Serialising it whole into a request body is credential exfiltration regardless of the endpoint.",
+    cwe: "CWE-532",
+    severity: "critical",
+    languages: ["javascript", "typescript"],
+    pattern: /\bJSON\.stringify\s*\(\s*\{?[^)]*\bprocess\.env\b(?!\s*\.)/,
+    guard: false
+  },
+  {
+    id: "js-credential-logged",
+    title: "credential read from the environment into a log sink",
+    consequence: "CI retains job logs, and on public forks it publishes them. A token printed once is a token leaked permanently.",
+    cwe: "CWE-532",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\b(?:token|apiKey|api_key|secret|password|credential|auth)\w*\s*:\s*process\.env\.\w+/i,
+    requires: EXFIL_SINK,
+    guard: false,
+    guardBack: 4,
+    guardForward: 1
+  },
+  // ── Prototype pollution ──────────────────────────────────────────────────
+  {
+    id: "js-prototype-pollution",
+    title: "write to a prototype-reachable key",
+    consequence: "An attacker-supplied `__proto__` key changes behaviour for every object in the process, including ones it never touched.",
+    cwe: "CWE-1321",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\[\s*['"]__proto__['"]\s*\]|\bObject\s*\.\s*assign\s*\(\s*[\w.$]*\.prototype\b|\.\s*__proto__\s*=/
+  }
+];
+var COMMENT_PREFIX = /^\s*(?:\/\/|\/\*|\*|#|--|<!--)/;
+var DEFINITION_PREFIX = /^\s*(?:(?:export|public|private|protected|static|final|async|abstract)\s+)*(?:def|function|func|class|module|interface|struct|impl|fn|sub)\b/;
+function isComment(line) {
+  return COMMENT_PREFIX.test(line);
+}
+function proseLines(lines) {
+  const inside = /* @__PURE__ */ new Set();
+  let delimiter = null;
+  lines.forEach((line, index) => {
+    if (delimiter) {
+      inside.add(index);
+      if (line.includes(delimiter)) delimiter = null;
+      return;
+    }
+    for (const candidate of ['"""', "'''"]) {
+      const start = line.indexOf(candidate);
+      if (start === -1) continue;
+      if (line.indexOf(candidate, start + candidate.length) !== -1) return;
+      delimiter = candidate;
+      inside.add(index);
+      return;
+    }
+  });
+  return inside;
+}
+function skippable(line, index, prose) {
+  return isComment(line) || DEFINITION_PREFIX.test(line) || (prose?.has(index) ?? false);
+}
+function windowText(lines, index, back, forward, prose) {
+  const from = Math.max(0, index - back);
+  const to = Math.min(lines.length - 1, index + forward);
+  const collected = [];
+  for (let i = from; i <= to; i += 1) {
+    const line = lines[i] ?? "";
+    if (i !== index && skippable(line, i, prose)) continue;
+    collected.push(line);
+  }
+  return collected.join("\n");
+}
+function evaluateRule(rule, ctx) {
+  if (rule.languages && !rule.languages.includes(ctx.language)) return null;
+  const line = ctx.lines[ctx.index] ?? "";
+  if (isComment(line) || ctx.prose?.has(ctx.index)) return null;
+  if (!rule.pattern.test(line)) return null;
+  const back = rule.guardBack ?? 8;
+  const forward = rule.guardForward ?? 0;
+  const context = windowText(ctx.lines, ctx.index, back, forward, ctx.prose);
+  if (rule.requires && !rule.requires.test(context)) return null;
+  if (rule.lineGuard?.test(line)) return null;
+  const guard = rule.guard === void 0 ? GENERIC_GUARD : rule.guard;
+  if (guard && (guard.test(line) || guard.test(context))) return null;
+  const untrusted = untrustedPatternFor(ctx.language);
+  const contextual = untrusted.test(line) || untrusted.test(context);
+  if (rule.needsContext && !contextual) return null;
+  const confidence = contextual ? "contextual" : "pattern";
+  return { rule, confidence, severity: severityFor(rule.severity, confidence) };
+}
+
+// src/scan/manifest-rules.ts
+var POPULAR_NPM = [
+  "react",
+  "react-dom",
+  "lodash",
+  "express",
+  "axios",
+  "chalk",
+  "commander",
+  "debug",
+  "moment",
+  "dayjs",
+  "uuid",
+  "dotenv",
+  "typescript",
+  "webpack",
+  "vite",
+  "rollup",
+  "eslint",
+  "prettier",
+  "jest",
+  "vitest",
+  "mocha",
+  "chai",
+  "sinon",
+  "request",
+  "node-fetch",
+  "cross-env",
+  "rimraf",
+  "glob",
+  "minimist",
+  "yargs",
+  "inquirer",
+  "colors",
+  "ora",
+  "semver",
+  "ws",
+  "socket.io",
+  "mongoose",
+  "sequelize",
+  "knex",
+  "pg",
+  "mysql",
+  "mysql2",
+  "redis",
+  "ioredis",
+  "jsonwebtoken",
+  "bcrypt",
+  "passport",
+  "cors",
+  "helmet",
+  "morgan",
+  "body-parser",
+  "multer",
+  "nodemailer",
+  "puppeteer",
+  "playwright",
+  "cheerio",
+  "sharp",
+  "canvas",
+  "esbuild",
+  "babel",
+  "postcss",
+  "tailwindcss",
+  "next",
+  "nuxt",
+  "vue",
+  "svelte",
+  "angular",
+  "rxjs",
+  "zod"
+];
+var POPULAR_PYPI = [
+  "requests",
+  "urllib3",
+  "numpy",
+  "pandas",
+  "scipy",
+  "flask",
+  "django",
+  "fastapi",
+  "sqlalchemy",
+  "pydantic",
+  "click",
+  "jinja2",
+  "pyyaml",
+  "boto3",
+  "botocore",
+  "setuptools",
+  "wheel",
+  "pip",
+  "six",
+  "certifi",
+  "idna",
+  "chardet",
+  "attrs",
+  "python-dateutil",
+  "pytz",
+  "pytest",
+  "tox",
+  "black",
+  "flake8",
+  "mypy",
+  "isort",
+  "beautifulsoup4",
+  "lxml",
+  "pillow",
+  "matplotlib",
+  "seaborn",
+  "scikit-learn",
+  "tensorflow",
+  "torch",
+  "transformers",
+  "openai",
+  "anthropic",
+  "httpx",
+  "aiohttp",
+  "celery",
+  "redis",
+  "psycopg2",
+  "pymongo",
+  "cryptography",
+  "paramiko",
+  "colorama"
+];
+var INTERNAL_MARKER = /(?:^|[-_/@])(?:internal|private|corp|intranet|inhouse|confidential)(?:$|[-_/])/i;
+function normalizeName(name) {
+  return name.toLowerCase().replace(/^@/, "").replace(/[-_.\s]/g, "");
+}
+function editDistance(a, b, cap = 3) {
+  if (a === b) return 0;
+  if (Math.abs(a.length - b.length) > cap) return cap + 1;
+  const rows = [];
+  for (let i = 0; i <= a.length; i += 1) {
+    rows.push(new Array(b.length + 1).fill(0));
+    rows[i][0] = i;
+  }
+  for (let j = 0; j <= b.length; j += 1) rows[0][j] = j;
+  for (let i = 1; i <= a.length; i += 1) {
+    for (let j = 1; j <= b.length; j += 1) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      let best = Math.min(
+        rows[i - 1][j] + 1,
+        rows[i][j - 1] + 1,
+        rows[i - 1][j - 1] + cost
+      );
+      if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
+        best = Math.min(best, rows[i - 2][j - 2] + 1);
+      }
+      rows[i][j] = best;
+    }
+  }
+  return rows[a.length][b.length];
+}
+function detectTyposquat(name, ecosystem) {
+  const popular = ecosystem === "npm" ? POPULAR_NPM : POPULAR_PYPI;
+  const lower = name.toLowerCase().replace(/^@[^/]+\//, "");
+  if (popular.includes(lower)) return null;
+  if (lower.length < 4) return null;
+  const normalized = normalizeName(lower);
+  for (const candidate of popular) {
+    const candidateNormalized = normalizeName(candidate);
+    if (normalized === candidateNormalized) return { impersonates: candidate, kind: "separator" };
+    if (editDistance(normalized, candidateNormalized, 1) === 1) {
+      return { impersonates: candidate, kind: "edit" };
+    }
+  }
+  return null;
+}
+var LIFECYCLE_SCRIPTS = ["preinstall", "install", "postinstall", "prepare", "prepublish"];
+function scanPackageJson(text) {
+  const findings = [];
+  const lines = text.split("\n");
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return findings;
+  }
+  const lineOf = (needle) => {
+    const index = lines.findIndex((line) => line.includes(`"${needle}"`));
+    return index === -1 ? 1 : index + 1;
+  };
+  const depBuckets = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+  for (const bucket of depBuckets) {
+    const deps = parsed[bucket];
+    if (!deps || typeof deps !== "object") continue;
+    for (const name of Object.keys(deps)) {
+      const line = lineOf(name);
+      if (INTERNAL_MARKER.test(name)) {
+        findings.push({
+          ruleId: "manifest-dependency-confusion",
+          title: "internal-looking package resolved from a public registry",
+          line,
+          severity: "critical",
+          cwe: "CWE-1357",
+          message: `"${name}" names itself as internal but carries no registry pin`,
+          consequence: "Whoever registers this name publicly first wins the resolution, and their code runs in your build.",
+          excerpt: (lines[line - 1] ?? "").trim()
+        });
+        continue;
+      }
+      const squat = detectTyposquat(name, "npm");
+      if (squat) {
+        findings.push({
+          ruleId: "manifest-typosquat",
+          title: "dependency name close to a popular package",
+          line,
+          severity: "high",
+          cwe: "CWE-1357",
+          message: squat.kind === "separator" ? `"${name}" differs from "${squat.impersonates}" only in punctuation` : `"${name}" is one edit from "${squat.impersonates}"`,
+          consequence: "A reviewer scanning a diff reads the name they expected. The package that installs is the one that was written.",
+          excerpt: (lines[line - 1] ?? "").trim()
+        });
+      }
+    }
+  }
+  const scripts = parsed.scripts;
+  if (scripts && typeof scripts === "object") {
+    for (const [name, body] of Object.entries(scripts)) {
+      if (!LIFECYCLE_SCRIPTS.includes(name)) continue;
+      findings.push({
+        ruleId: "manifest-install-lifecycle-script",
+        title: "install-time lifecycle script",
+        line: lineOf(name),
+        severity: "medium",
+        cwe: "CWE-506",
+        message: `"${name}" runs automatically on install: ${String(body).slice(0, 120)}`,
+        consequence: "Lifecycle scripts run with the installing user\u2019s privileges and network access, before any code is reviewed. It is the execution vector every notable npm compromise has used.",
+        excerpt: (lines[lineOf(name) - 1] ?? "").trim()
+      });
+    }
+  }
+  return findings;
+}
+function scanRequirementsTxt(text) {
+  const findings = [];
+  const lines = text.split("\n");
+  lines.forEach((raw, index) => {
+    const line = raw.trim();
+    if (!line || line.startsWith("#") || line.startsWith("-")) return;
+    const match = /^([A-Za-z0-9_.-]+)\s*(?:[=<>!~]=|@|$)/.exec(line);
+    const name = match?.[1];
+    if (!name) return;
+    if (INTERNAL_MARKER.test(name)) {
+      findings.push({
+        ruleId: "manifest-dependency-confusion",
+        title: "internal-looking package resolved from a public index",
+        line: index + 1,
+        severity: "critical",
+        cwe: "CWE-1357",
+        message: `"${name}" names itself as internal but carries no index pin`,
+        consequence: "pip resolves the highest version across every configured index, so a public package of the same name shadows the private one.",
+        excerpt: line
+      });
+      return;
+    }
+    const squat = detectTyposquat(name, "pypi");
+    if (squat) {
+      findings.push({
+        ruleId: "manifest-typosquat",
+        title: "dependency name close to a popular package",
+        line: index + 1,
+        severity: "high",
+        cwe: "CWE-1357",
+        message: squat.kind === "separator" ? `"${name}" differs from "${squat.impersonates}" only in punctuation` : `"${name}" is one edit from "${squat.impersonates}"`,
+        consequence: "A reviewer scanning a diff reads the name they expected. The package that installs is the one that was written.",
+        excerpt: line
+      });
+    }
+  });
+  return findings;
+}
+
+// src/scan/secret-rules.ts
+var SECRET_RULES = [
+  {
+    id: "secret-aws-access-key",
+    name: "AWS Access Key",
+    pattern: /\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\b/,
+    severity: "critical",
+    cwe: "CWE-798",
+    consequence: "Paired with a secret key, grants the API access of whatever IAM principal issued it."
+  },
+  {
+    id: "secret-aws-secret-key",
+    name: "AWS Secret Access Key",
+    pattern: /(?:aws_secret_access_key|AWS_SECRET(?:_ACCESS_KEY)?)\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/i,
+    severity: "critical",
+    cwe: "CWE-798",
+    consequence: "The other half of an AWS credential pair; on its own it is still the hard half to guess."
+  },
+  {
+    id: "secret-github-token",
+    name: "GitHub Token",
+    pattern: /\b(?:ghp_[A-Za-z0-9]{36}|gho_[A-Za-z0-9]{36}|ghu_[A-Za-z0-9]{36}|ghs_[A-Za-z0-9]{36}|ghr_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{60,})\b/,
+    severity: "critical",
+    cwe: "CWE-798",
+    consequence: "Repository read or write as the issuing account, including the ability to push workflow changes."
+  },
+  {
+    id: "secret-npm-token",
+    name: "npm Token",
+    pattern: /\bnpm_[A-Za-z0-9]{36}\b/,
+    severity: "critical",
+    cwe: "CWE-798",
+    consequence: "Publish rights to every package the account owns \u2014 a supply-chain compromise in one command."
+  },
+  {
+    id: "secret-private-key",
+    name: "Private Key",
+    pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----/,
+    severity: "critical",
+    cwe: "CWE-798",
+    consequence: "Key material, committed. Rotation is the only remediation."
+  },
+  {
+    id: "secret-slack-token",
+    name: "Slack Token",
+    pattern: /\bxox[bpoasr]-[A-Za-z0-9-]{10,}/,
+    severity: "critical",
+    cwe: "CWE-798",
+    consequence: "Read and post access to the workspace as the installing app."
+  },
+  {
+    id: "secret-slack-webhook",
+    name: "Slack Webhook URL",
+    pattern: /https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9_+\/-]{6,}/,
+    severity: "high",
+    cwe: "CWE-798",
+    consequence: "The URL *is* the credential \u2014 anyone holding it can post to that channel."
+  },
+  {
+    id: "secret-stripe-key",
+    name: "Stripe Key",
+    pattern: /\b(?:sk_live_|rk_live_|sk_test_|rk_test_)[A-Za-z0-9]{20,}\b/,
+    severity: "critical",
+    cwe: "CWE-798",
+    consequence: "Charge, refund and customer-data access against the account."
+  },
+  {
+    id: "secret-sendgrid-key",
+    name: "SendGrid API Key",
+    pattern: /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/,
+    severity: "critical",
+    cwe: "CWE-798",
+    consequence: "Send mail as the domain \u2014 the credential behind most convincing phishing from a real sender."
+  },
+  {
+    id: "secret-google-api-key",
+    name: "Google API Key",
+    pattern: /\bAIza[0-9A-Za-z_-]{35}\b/,
+    severity: "high",
+    cwe: "CWE-798",
+    consequence: "Quota theft at minimum; API access to whatever the key was scoped to at worst."
+  },
+  {
+    id: "secret-openai-key",
+    name: "OpenAI API Key",
+    pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{32,}\b/,
+    severity: "critical",
+    cwe: "CWE-798",
+    consequence: "Billed inference against the owner\u2019s account, with no per-key spend limit by default."
+  },
+  {
+    id: "secret-anthropic-key",
+    name: "Anthropic API Key",
+    pattern: /\bsk-ant-(?:api\d{2}-)?[A-Za-z0-9_-]{32,}\b/,
+    severity: "critical",
+    cwe: "CWE-798",
+    consequence: "Billed inference against the owner\u2019s account."
+  },
+  {
+    id: "secret-database-url",
+    name: "Database URL with credentials",
+    // Requires a credential segment before the `@` — `postgres://localhost/db`
+    // is a hostname, not a secret.
+    pattern: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|clickhouse):\/\/[^\s'"@\/]*:[^\s'"@\/]*@[^\s'"]+/i,
+    severity: "high",
+    cwe: "CWE-798",
+    consequence: "Direct database access, usually bypassing every application-level authorisation check."
+  },
+  {
+    id: "secret-jwt",
+    name: "JSON Web Token",
+    pattern: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_.+/=-]*/,
+    severity: "medium",
+    cwe: "CWE-798",
+    consequence: "Session or service identity until it expires \u2014 and committed tokens are usually long-lived."
+  },
+  {
+    id: "secret-generic-api-key",
+    name: "Generic API Key",
+    // Quoted assignment only. An unquoted value in a `.env` is covered by the
+    // vendor-prefixed rules above; matching it here is what starts flagging
+    // ARNs and parameter-store paths.
+    pattern: /(?:api[_-]?key|apikey|access[_-]?token|auth[_-]?token)\s*[=:]\s*['"]([A-Za-z0-9\-_.]{20,})['"]/i,
+    severity: "high",
+    cwe: "CWE-798",
+    consequence: "Whatever the third-party service lets the key do, for as long as it stays valid."
+  },
+  {
+    id: "secret-generic-credential",
+    name: "Hardcoded Credential",
+    pattern: /(?:secret|password|passwd|pwd|token)\s*[=:]\s*['"]([^'"\s]{8,})['"]/i,
+    severity: "high",
+    cwe: "CWE-798",
+    consequence: "A password in source is a password in every clone, fork and CI cache of that source."
+  },
+  {
+    id: "secret-hex-token",
+    name: "High-entropy Hex Token",
+    pattern: /(?:token|key|secret|auth|signing)\w*\s*[=:]\s*['"]?([0-9a-f]{32,})['"]?/i,
+    severity: "medium",
+    cwe: "CWE-798",
+    consequence: "Signing secrets and session keys are usually hex; a leaked one forges anything they sign."
+  }
 ];
-var MISCONFIG_FILES = [
-  { pattern: ".env", message: ".env file found \u2014 may contain secrets" },
-  { pattern: ".env.local", message: ".env.local file found \u2014 may contain secrets" },
-  { pattern: ".env.production", message: ".env.production file found \u2014 may contain secrets" },
-  { pattern: "id_rsa", message: "Private SSH key found" },
-  { pattern: "id_ed25519", message: "Private SSH key found" },
-  { pattern: ".pem", message: "PEM certificate/key file found" },
-  { pattern: ".p12", message: "PKCS#12 keystore found" },
-  { pattern: ".keystore", message: "Keystore file found" }
+var KNOWN_PLACEHOLDERS = [
+  // Deliberately NOT here: AWS's published documentation key/secret pair
+  // (`AKIAIOSFODNN7EXAMPLE`, `wJalrXUtnFEMI/…`). GitHub allow-lists them, and
+  // the argument for following suit is that they authenticate nothing. The
+  // argument against is stronger: they appear in a repository because someone
+  // pasted a credentials template and left it there, and the remediation —
+  // move this to the secret manager — is identical to the one for a live key.
+  // Exempting them means the scanner goes quiet on the file most likely to
+  // acquire a real key next.
+  /\bEXAMPLE_?KEY\b/i,
+  /\bYOUR_[A-Z_]*(?:KEY|TOKEN|SECRET|PASSWORD)\b/,
+  /\b(?:xxx+|X{4,}|\*{4,}|<[a-z-]+>)\b/,
+  /\bchangeme\b/i
 ];
+function isKnownPlaceholder(text) {
+  return KNOWN_PLACEHOLDERS.some((pattern) => pattern.test(text));
+}
+function redactSecret(line) {
+  return line.replace(/([A-Za-z0-9+/=_.-]{12,})/g, (match) => {
+    if (match.length <= 12) return match;
+    return `${match.slice(0, 3)}${"*".repeat(Math.min(16, match.length - 3))}`;
+  });
+}
+var SENSITIVE_FILES = [
+  { pattern: ".env", message: "Environment file committed \u2014 the usual home of every runtime credential", severity: "high" },
+  { pattern: ".env.local", message: "Local environment file committed", severity: "high" },
+  { pattern: ".env.production", message: "Production environment file committed", severity: "critical" },
+  { pattern: "id_rsa", message: "Private SSH key committed", severity: "critical" },
+  { pattern: "id_ed25519", message: "Private SSH key committed", severity: "critical" },
+  { pattern: "id_ecdsa", message: "Private SSH key committed", severity: "critical" },
+  { pattern: ".pem", message: "PEM certificate or key file committed", severity: "high" },
+  { pattern: ".p12", message: "PKCS#12 keystore committed", severity: "high" },
+  { pattern: ".pfx", message: "PKCS#12 keystore committed", severity: "high" },
+  { pattern: ".keystore", message: "Java keystore committed", severity: "high" }
+  // Deliberately not `.npmrc`. Its presence is normal; only an `_authToken`
+  // line in it is a credential, and that is a content match, not a filename
+  // match. Reporting the file itself trades a real finding for a chore.
+];
+
+// src/scan/engine.ts
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
   ".next",
+  ".nuxt",
   "dist",
   "build",
+  "out",
   "__pycache__",
   ".venv",
+  "venv",
   "vendor",
   ".terraform",
   "coverage",
-  ".cache"
+  ".cache",
+  ".pnpm-store",
+  "target",
+  ".gradle",
+  ".idea",
+  ".vscode",
+  "bower_components",
+  ".svelte-kit"
 ]);
 var SCAN_EXTENSIONS = /* @__PURE__ */ new Set([
   ".ts",
   ".js",
   ".tsx",
   ".jsx",
+  ".mjs",
+  ".cjs",
+  ".mts",
+  ".cts",
   ".py",
   ".rb",
   ".go",
   ".java",
+  ".kt",
+  ".scala",
   ".php",
   ".rs",
   ".c",
+  ".cc",
   ".cpp",
   ".h",
+  ".hpp",
+  ".cs",
+  ".swift",
   ".yml",
   ".yaml",
   ".json",
@@ -9627,283 +10718,628 @@ var SCAN_EXTENSIONS = /* @__PURE__ */ new Set([
   ".env",
   ".sh",
   ".bash",
+  ".zsh",
   ".tf",
   ".hcl",
   ".xml",
   ".properties",
-  ".gradle"
+  ".gradle",
+  ".txt",
+  ".md",
+  ".sql",
+  ".erb",
+  ".ejs",
+  ".vue",
+  ".svelte"
 ]);
-async function runScan(targetPath) {
+var LANGUAGE_BY_EXTENSION = {
+  ".js": "javascript",
+  ".jsx": "javascript",
+  ".mjs": "javascript",
+  ".cjs": "javascript",
+  ".ts": "typescript",
+  ".tsx": "typescript",
+  ".mts": "typescript",
+  ".cts": "typescript",
+  ".vue": "javascript",
+  ".svelte": "javascript",
+  ".ejs": "javascript",
+  ".py": "python",
+  ".rb": "ruby",
+  ".erb": "ruby",
+  ".go": "go",
+  ".java": "java",
+  ".kt": "java",
+  ".scala": "java",
+  ".php": "php",
+  ".sh": "shell",
+  ".bash": "shell",
+  ".zsh": "shell",
+  ".yml": "config",
+  ".yaml": "config",
+  ".json": "config",
+  ".toml": "config",
+  ".ini": "config",
+  ".cfg": "config",
+  ".conf": "config",
+  ".env": "config",
+  ".tf": "config",
+  ".hcl": "config",
+  ".properties": "config"
+};
+function languageOf(filename) {
+  if (filename.startsWith(".env") || filename.endsWith(".env")) return "config";
+  return LANGUAGE_BY_EXTENSION[(0, import_node_path3.extname)(filename).toLowerCase()] ?? "other";
+}
+var SUPPRESS_NEXT = /threatcrush-disable-next-line(?:\s+([\w-]+))?/;
+var SUPPRESS_LINE = /threatcrush-disable-line(?:\s+([\w-]+))?/;
+function collectSuppressions(lines) {
+  const byLine = /* @__PURE__ */ new Map();
+  let count = 0;
+  const add = (index, ruleId) => {
+    const existing = byLine.get(index) ?? /* @__PURE__ */ new Set();
+    existing.add(ruleId ?? "*");
+    byLine.set(index, existing);
+    count += 1;
+  };
+  lines.forEach((line, index) => {
+    const next = SUPPRESS_NEXT.exec(line);
+    if (next) add(index + 1, next[1]);
+    const same = SUPPRESS_LINE.exec(line);
+    if (same && !next) add(index, same[1]);
+  });
+  return { byLine, count };
+}
+function isSuppressed(suppressions, index, ruleId) {
+  const rules = suppressions.byLine.get(index);
+  if (!rules) return false;
+  return rules.has("*") || rules.has(ruleId);
+}
+function isTestPath(relativePath) {
+  const p = relativePath.replace(/\\/g, "/");
+  return /(?:^|\/)(?:tests?|__tests__|__mocks__|spec|specs|fixtures?|mocks?|e2e|testdata)\//i.test(p) || /(?:^|\/)(?:test|conftest)_[^/]+$/i.test(p) || /[._-](?:test|spec)\.[a-z]+$/i.test(p) || /_test\.[a-z]+$/i.test(p);
+}
+function scanText(relativePath, text, language = languageOf(relativePath)) {
   const findings = [];
-  try {
-    scanDirectory(targetPath, targetPath, findings, () => {
+  const lines = text.split("\n");
+  const suppressions = collectSuppressions(lines);
+  const inTests = isTestPath(relativePath);
+  lines.forEach((line, index) => {
+    for (const rule of SECRET_RULES) {
+      const match = rule.pattern.exec(line);
+      if (!match) continue;
+      if (isKnownPlaceholder(match[0])) continue;
+      if (isSuppressed(suppressions, index, rule.id)) continue;
+      findings.push({
+        ruleId: rule.id,
+        title: rule.name,
+        file: relativePath,
+        line: index + 1,
+        // Reported but not blocking in tests — see isTestPath.
+        severity: inTests ? "low" : rule.severity,
+        // A matched credential format is the finding, not a proxy for one.
+        confidence: "evidence",
+        message: inTests ? `Possible ${rule.name} detected in a test file \u2014 usually a fixture, still worth confirming it is not a live credential` : `Possible ${rule.name} detected`,
+        consequence: rule.consequence,
+        cwe: rule.cwe,
+        excerpt: redactSecret(line.trim()).slice(0, 200),
+        sensitive: true,
+        category: "secret"
+      });
+    }
+  });
+  const prose = proseLines(lines);
+  lines.forEach((_line, index) => {
+    for (const rule of CODE_RULES) {
+      if (isSuppressed(suppressions, index, rule.id)) continue;
+      const match = evaluateRule(rule, { lines, index, language, prose });
+      if (!match) continue;
+      findings.push({
+        ruleId: rule.id,
+        title: rule.title,
+        file: relativePath,
+        line: index + 1,
+        severity: match.severity,
+        confidence: match.confidence,
+        message: `${rule.title} (${rule.cwe})`,
+        consequence: rule.consequence,
+        cwe: rule.cwe,
+        excerpt: (lines[index] ?? "").trim().slice(0, 200),
+        category: "code"
+      });
+    }
+  });
+  return findings;
+}
+function scanManifest(relativePath, filename, text) {
+  const manifestFindings = filename === "package.json" ? scanPackageJson(text) : filename === "requirements.txt" ? scanRequirementsTxt(text) : [];
+  return manifestFindings.map((finding) => ({
+    ruleId: finding.ruleId,
+    title: finding.title,
+    file: relativePath,
+    line: finding.line,
+    severity: finding.severity,
+    confidence: "evidence",
+    message: finding.message,
+    consequence: finding.consequence,
+    cwe: finding.cwe,
+    excerpt: finding.excerpt.slice(0, 200),
+    category: "manifest"
+  }));
+}
+function scanPath(targetPath, options = {}) {
+  const maxFileBytes = options.maxFileBytes ?? 1024 * 1024;
+  const allowed = options.categories ? new Set(options.categories) : null;
+  const findings = [];
+  const unreadable = [];
+  let filesScanned = 0;
+  let suppressed = 0;
+  const rootIsDirectory = (() => {
+    try {
+      return (0, import_node_fs6.statSync)(targetPath).isDirectory();
+    } catch {
+      return true;
+    }
+  })();
+  const walkRoot = rootIsDirectory ? targetPath : (0, import_node_path3.dirname)(targetPath);
+  const scanFile = (fullPath, filename) => {
+    const relativePath = toRelative(walkRoot, fullPath);
+    const extension = (0, import_node_path3.extname)(filename).toLowerCase();
+    const isManifest = filename === "package.json" || filename === "requirements.txt";
+    const scannable = SCAN_EXTENSIONS.has(extension) || filename.startsWith(".env");
+    if (!scannable && !isManifest) {
+      recordSensitiveFile(filename, relativePath, findings, []);
+      return;
+    }
+    let text;
+    let handle;
+    try {
+      handle = (0, import_node_fs6.openSync)(fullPath, "r");
+    } catch {
+      unreadable.push(relativePath);
+      return;
+    }
+    try {
+      if ((0, import_node_fs6.fstatSync)(handle).size > maxFileBytes) return;
+      text = (0, import_node_fs6.readFileSync)(handle, "utf-8");
+    } catch {
+      unreadable.push(relativePath);
+      return;
+    } finally {
+      try {
+        (0, import_node_fs6.closeSync)(handle);
+      } catch {
+      }
+    }
+    filesScanned += 1;
+    options.onFile?.(relativePath);
+    suppressed += collectSuppressions(text.split("\n")).count;
+    const fileFindings = [
+      ...scanText(relativePath, text, languageOf(filename)),
+      ...isManifest ? scanManifest(relativePath, filename, text) : []
+    ];
+    findings.push(...fileFindings);
+    recordSensitiveFile(filename, relativePath, findings, fileFindings);
+  };
+  const walk = (currentPath) => {
+    let entries;
+    try {
+      entries = (0, import_node_fs6.readdirSync)(currentPath, { withFileTypes: true });
+    } catch {
+      unreadable.push(toRelative(walkRoot, currentPath));
+      return;
+    }
+    for (const entry of entries) {
+      const fullPath = (0, import_node_path3.join)(currentPath, entry.name);
+      if (entry.isDirectory()) {
+        if (SKIP_DIRS.has(entry.name)) continue;
+        walk(fullPath);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      scanFile(fullPath, entry.name);
+    }
+  };
+  if (rootIsDirectory) {
+    walk(targetPath);
+  } else {
+    scanFile(targetPath, (0, import_node_path3.basename)(targetPath));
+  }
+  const filtered = allowed ? findings.filter((f) => allowed.has(f.category)) : findings;
+  filtered.sort(
+    (a, b) => severityRank(b.severity) - severityRank(a.severity) || a.file.localeCompare(b.file) || a.line - b.line
+  );
+  return { findings: filtered, filesScanned, unreadable, suppressed, root: walkRoot };
+}
+function recordSensitiveFile(filename, relativePath, sink, fileFindings) {
+  if (fileFindings.length > 0) return;
+  for (const sensitive of SENSITIVE_FILES) {
+    const matches = filename === sensitive.pattern || filename.endsWith(sensitive.pattern);
+    if (!matches) continue;
+    sink.push({
+      ruleId: "sensitive-file-committed",
+      title: "Sensitive file",
+      file: relativePath,
+      line: 1,
+      severity: sensitive.severity,
+      confidence: "evidence",
+      message: sensitive.message,
+      consequence: "Anything in this file is in every clone, fork and CI cache of the repository.",
+      cwe: "CWE-538",
+      excerpt: "",
+      sensitive: true,
+      category: "file"
     });
-    const depFindings = await scanDependencies(targetPath);
-    findings.push(...depFindings);
-  } catch (err) {
-    return {
-      type: "scan",
-      target: targetPath,
-      findings: [],
-      severity_summary: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },
-      summary: `Scan failed: ${err.message}`,
-      error: err.message
-    };
+    return;
+  }
+}
+function toRelative(base, target) {
+  const rel = (0, import_node_path3.relative)(base, target);
+  return (rel === "" ? target : rel).split(import_node_path3.sep).join("/");
+}
+function meetsFailThreshold(findings, threshold) {
+  if (threshold.length === 0) return false;
+  const floor = Math.min(...threshold.map(severityRank));
+  return findings.some((finding) => severityRank(finding.severity) >= floor);
+}
+
+// src/scan/sarif.ts
+var import_node_path4 = require("path");
+var SARIF_VERSION = "2.1.0";
+var SARIF_SCHEMA = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json";
+function sarifLevel(severity) {
+  switch (severity) {
+    case "critical":
+    case "high":
+      return "error";
+    case "medium":
+      return "warning";
+    case "low":
+      return "note";
+    default:
+      return "none";
+  }
+}
+function securitySeverity(severity) {
+  switch (severity) {
+    case "critical":
+      return "9.0";
+    case "high":
+      return "7.0";
+    case "medium":
+      return "5.0";
+    case "low":
+      return "3.0";
+    default:
+      return "1.0";
+  }
+}
+function toArtifactUri(filePath, base, prefix = "", root = base) {
+  const absolute = (0, import_node_path4.isAbsolute)(filePath) ? filePath : (0, import_node_path4.resolve)(root, filePath);
+  const relativePath = (0, import_node_path4.relative)(base, absolute);
+  const escapedOut = relativePath.startsWith("..") || relativePath === "";
+  const chosen = escapedOut ? absolute : relativePath;
+  const posix = chosen.split(import_node_path4.sep).join("/").replace(/^\.\//, "");
+  if (!prefix || escapedOut) return posix;
+  const trimmed = prefix.replace(/^\/+|\/+$/g, "");
+  return trimmed ? `${trimmed}/${posix}` : posix;
+}
+function buildSarif(findings, options) {
+  const rules = /* @__PURE__ */ new Map();
+  for (const finding of findings) {
+    if (rules.has(finding.ruleId)) continue;
+    const tags = ["security"];
+    if (finding.cwe) tags.push(`external/cwe/${finding.cwe.toLowerCase()}`);
+    tags.push(`threatcrush/${finding.category}`);
+    const description = finding.consequence ? `${finding.title}. ${finding.consequence}` : finding.title;
+    rules.set(finding.ruleId, {
+      id: finding.ruleId,
+      name: finding.ruleId,
+      shortDescription: { text: finding.title },
+      fullDescription: { text: description },
+      help: {
+        text: description,
+        markdown: finding.consequence ? `**${finding.title}**
+
+${finding.consequence}` : `**${finding.title}**`
+      },
+      defaultConfiguration: { level: sarifLevel(finding.severity) },
+      properties: {
+        tags,
+        "security-severity": securitySeverity(finding.severity),
+        // SARIF's vocabulary for how much the rule is claiming. It lines up
+        // with the confidence model: a bare construct match is `medium`, a
+        // match with visible untrusted input is `high`.
+        precision: finding.confidence === "pattern" ? "medium" : "high"
+      }
+    });
+  }
+  const base = options.base ?? process.cwd();
+  const root = options.root ?? base;
+  const results = findings.map((finding) => ({
+    ruleId: finding.ruleId,
+    level: sarifLevel(finding.severity),
+    message: { text: finding.message },
+    locations: [
+      {
+        physicalLocation: {
+          artifactLocation: {
+            uri: toArtifactUri(finding.file, base, options.pathPrefix, root),
+            uriBaseId: "%SRCROOT%"
+          },
+          region: {
+            // Clamped, never 0. A whole-file finding has no line; SARIF has no
+            // way to say that, and 0 fails validation outright.
+            startLine: Math.max(1, finding.line),
+            snippet: { text: finding.excerpt }
+          }
+        }
+      }
+    ],
+    partialFingerprints: {
+      primaryLocationLineHash: `${finding.ruleId}:${finding.file}:${Math.max(1, finding.line)}`
+    },
+    properties: {
+      severity: finding.severity,
+      confidence: finding.confidence,
+      category: finding.category,
+      ...finding.cwe ? { cwe: finding.cwe } : {}
+    }
+  }));
+  return {
+    $schema: SARIF_SCHEMA,
+    version: SARIF_VERSION,
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "ThreatCrush",
+            version: options.toolVersion,
+            informationUri: "https://threatcrush.com",
+            rules: [...rules.values()]
+          }
+        },
+        results,
+        columnKind: "utf16CodeUnits"
+      }
+    ]
+  };
+}
+
+// src/commands/scan.ts
+function readVersion() {
+  for (const candidate of [
+    (0, import_node_path5.join)(__dirname, "..", "package.json"),
+    (0, import_node_path5.join)(__dirname, "..", "..", "package.json")
+  ]) {
+    try {
+      return JSON.parse((0, import_node_fs7.readFileSync)(candidate, "utf-8")).version ?? "0.0.0";
+    } catch {
+    }
+  }
+  return "0.0.0";
+}
+var PKG_VERSION = readVersion();
+function parseFailOn(raw) {
+  if (!raw) return [];
+  const requested = raw.split(",").map((part) => part.trim().toLowerCase()).filter(Boolean);
+  const unknown = requested.filter((name) => !SEVERITY_ORDER.includes(name));
+  if (unknown.length > 0) {
+    throw new Error(
+      `unknown severity in --fail-on: ${unknown.join(", ")} (expected ${SEVERITY_ORDER.join(", ")})`
+    );
   }
-  const structured = findings.map((f) => ({
-    type: f.type,
-    severity: f.severity,
-    message: f.message,
-    location: `${f.file}:${f.line}`,
-    details: { file: f.file, line: f.line, snippet: f.snippet }
+  return requested;
+}
+function toRunResult(targetPath, findings, filesScanned) {
+  const structured = findings.map((finding) => ({
+    type: finding.title,
+    severity: finding.severity,
+    message: finding.message,
+    location: `${finding.file}:${finding.line}`,
+    details: {
+      file: finding.file,
+      line: finding.line,
+      snippet: finding.excerpt,
+      ruleId: finding.ruleId,
+      confidence: finding.confidence,
+      ...finding.cwe ? { cwe: finding.cwe } : {}
+    }
   }));
-  const summary = summarize(structured);
+  const counts = summarize(structured);
   return {
     type: "scan",
     target: targetPath,
     findings: structured,
-    severity_summary: summary,
-    summary: findings.length === 0 ? "No security issues found" : `${findings.length} issue(s): ${summary.critical}C ${summary.high}H ${summary.medium}M ${summary.low}L`
+    severity_summary: counts,
+    summary: findings.length === 0 ? `No issues found across ${filesScanned} files` : `${findings.length} issue(s): ${counts.critical}C ${counts.high}H ${counts.medium}M ${counts.low}L`
   };
 }
-async function scanCommand(targetPath) {
-  banner();
-  logger.info(`Scanning ${source_default.white(targetPath)} for security issues...
+function failedResult(targetPath, message) {
+  return {
+    type: "scan",
+    target: targetPath,
+    findings: [],
+    severity_summary: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },
+    summary: `Scan failed: ${message}`,
+    error: message
+  };
+}
+async function runScan(targetPath) {
+  try {
+    const report = scanPath(targetPath);
+    const findings = [...report.findings, ...await scanDependencies(targetPath)];
+    return toRunResult(targetPath, findings, report.filesScanned);
+  } catch (err) {
+    return failedResult(targetPath, err.message);
+  }
+}
+async function scanCommand(targetPath, options = {}) {
+  const format = options.format ?? "text";
+  const machineReadable = format !== "text";
+  const say = machineReadable ? (line) => process.stderr.write(`${line}
+`) : (line) => process.stdout.write(`${line}
 `);
-  const spinner = ora({ text: "Scanning files...", color: "green" }).start();
-  const findings = [];
-  let filesScanned = 0;
+  if (!(0, import_node_fs7.existsSync)(targetPath)) {
+    say(source_default.red(`Scan target does not exist: ${targetPath}`));
+    process.exitCode = 2;
+    return failedResult(targetPath, `no such path: ${targetPath}`);
+  }
+  if (!machineReadable) {
+    banner();
+    logger.info(`Scanning ${source_default.white(targetPath)} for security issues...
+`);
+  }
+  const spinner = machineReadable ? null : ora({ text: "Scanning files...", color: "green" }).start();
+  let outcome;
   try {
-    scanDirectory(targetPath, targetPath, findings, () => {
-      filesScanned++;
-      spinner.text = `Scanning files... (${filesScanned} files)`;
+    let seen = 0;
+    const report = scanPath(targetPath, {
+      onFile: () => {
+        seen += 1;
+        if (spinner) spinner.text = `Scanning files... (${seen} files)`;
+      }
     });
-  } catch (err) {
-    spinner.fail(`Scan failed: ${err.message}`);
-    return {
-      type: "scan",
-      target: targetPath,
-      findings: [],
-      severity_summary: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },
-      summary: `Scan failed: ${err.message}`,
-      error: err.message
+    if (options.dependencies) {
+      if (spinner) spinner.text = "Querying OSV.dev for dependency advisories...";
+      report.findings.push(...await scanDependencies(targetPath));
+    }
+    outcome = {
+      result: toRunResult(targetPath, report.findings, report.filesScanned),
+      findings: report.findings,
+      filesScanned: report.filesScanned,
+      unreadable: report.unreadable,
+      suppressed: report.suppressed,
+      root: report.root
     };
+  } catch (err) {
+    spinner?.fail(`Scan failed: ${err.message}`);
+    process.exitCode = 2;
+    return failedResult(targetPath, err.message);
   }
-  spinner.succeed(`Scanned ${filesScanned} files
+  spinner?.succeed(`Scanned ${outcome.filesScanned} files
 `);
-  const structured = findings.map((f) => ({
-    type: f.type,
-    severity: f.severity,
-    message: f.message,
-    location: `${f.file}:${f.line}`,
-    details: { file: f.file, line: f.line, snippet: f.snippet }
-  }));
-  const sevCounts = summarize(structured);
+  if (outcome.unreadable.length > 0) {
+    say(
+      source_default.yellow(
+        `  ! ${outcome.unreadable.length} path(s) could not be read and were NOT scanned`
+      )
+    );
+    if (options.verbose) {
+      for (const path of outcome.unreadable) say(source_default.gray(`      ${path}`));
+    }
+  }
+  if (outcome.suppressed > 0) {
+    say(
+      source_default.gray(
+        `  \xB7 ${outcome.suppressed} finding(s) suppressed by inline threatcrush-disable comments`
+      )
+    );
+  }
+  if (machineReadable) {
+    emitMachineReadable(format, outcome, targetPath, options, say);
+  } else {
+    printHuman(outcome);
+  }
+  const failOn = options.failOn ?? [];
+  if (meetsFailThreshold(outcome.findings, failOn)) {
+    say(
+      source_default.red(
+        `
+  \u2717 findings at or above ${[...failOn].join("/")} \u2014 failing as requested by --fail-on`
+      )
+    );
+    process.exitCode = 1;
+  }
+  return outcome.result;
+}
+function emitMachineReadable(format, outcome, targetPath, options, say) {
+  const payload = format === "sarif" ? buildSarif(outcome.findings, {
+    toolVersion: PKG_VERSION,
+    pathPrefix: options.pathPrefix,
+    // Relative to the working directory, NOT the scan root. `threatcrush
+    // scan vulns` from a repo root must emit `vulns/secrets/x.env`, not
+    // `secrets/x.env` — the second form matches nothing in the
+    // consumer's view of the repository, so every finding lands
+    // "outside" whatever it scoped to and a working scan reads as 0%.
+    // This is the single most expensive mistake in the whole pipeline
+    // and it fails silently. `--path-prefix` covers the remaining case:
+    // a scan run from inside the subdirectory it is scanning.
+    base: process.cwd(),
+    root: (0, import_node_path5.resolve)(outcome.root)
+  }) : {
+    tool: "threatcrush",
+    version: PKG_VERSION,
+    target: targetPath,
+    filesScanned: outcome.filesScanned,
+    unreadable: outcome.unreadable,
+    suppressed: outcome.suppressed,
+    summary: outcome.result.severity_summary,
+    findings: outcome.findings
+  };
+  const serialized = `${JSON.stringify(payload, null, 2)}
+`;
+  if (options.output) {
+    (0, import_node_fs7.mkdirSync)((0, import_node_path5.dirname)((0, import_node_path5.resolve)(options.output)), { recursive: true });
+    (0, import_node_fs7.writeFileSync)(options.output, serialized, "utf-8");
+    say(
+      source_default.gray(
+        `  ${format.toUpperCase()} written to ${options.output} (${outcome.findings.length} finding(s))`
+      )
+    );
+    return;
+  }
+  process.stdout.write(serialized);
+}
+function printHuman(outcome) {
+  const { findings, filesScanned } = outcome;
   if (findings.length === 0) {
     console.log(source_default.green.bold("  \u2713 No security issues found!"));
     console.log();
-    return {
-      type: "scan",
-      target: targetPath,
-      findings: [],
-      severity_summary: sevCounts,
-      summary: `No issues found across ${filesScanned} files`
-    };
+    return;
   }
-  const critical = findings.filter((f) => f.severity === "critical");
-  const high = findings.filter((f) => f.severity === "high");
-  const medium = findings.filter((f) => f.severity === "medium");
-  const low = findings.filter((f) => f.severity === "low");
+  const counts = outcome.result.severity_summary;
   console.log(source_default.white.bold("  Scan Results"));
   console.log(source_default.gray("  " + "\u2500".repeat(70)));
   console.log(
-    `  ${source_default.red.bold(critical.length + " critical")}  ${source_default.red(high.length + " high")}  ${source_default.yellow(medium.length + " medium")}  ${source_default.gray(low.length + " low")}`
+    `  ${source_default.red.bold(counts.critical + " critical")}  ${source_default.red(counts.high + " high")}  ${source_default.yellow(counts.medium + " medium")}  ${source_default.gray(counts.low + " low")}`
   );
   console.log(source_default.gray("  " + "\u2500".repeat(70)));
   console.log();
-  const allFindings = [...critical, ...high, ...medium, ...low];
-  for (const finding of allFindings) {
-    const sev = finding.severity === "critical" ? source_default.bgRed.white.bold(` ${finding.severity.toUpperCase()} `) : finding.severity === "high" ? source_default.red(`[${finding.severity.toUpperCase()}]`) : finding.severity === "medium" ? source_default.yellow(`[${finding.severity.toUpperCase()}]`) : source_default.gray(`[${finding.severity.toUpperCase()}]`);
-    console.log(`  ${sev} ${source_default.white.bold(finding.type)}`);
-    console.log(`    ${source_default.gray("File:")} ${source_default.cyan(finding.file)}:${source_default.yellow(String(finding.line))}`);
+  for (const finding of findings) {
+    const label = finding.severity.toUpperCase();
+    const badge = finding.severity === "critical" ? source_default.bgRed.white.bold(` ${label} `) : finding.severity === "high" ? source_default.red(`[${label}]`) : finding.severity === "medium" ? source_default.yellow(`[${label}]`) : source_default.gray(`[${label}]`);
+    console.log(`  ${badge} ${source_default.white.bold(finding.title)}`);
+    console.log(
+      `    ${source_default.gray("File:")} ${source_default.cyan(finding.file)}:${source_default.yellow(String(finding.line))}`
+    );
     console.log(`    ${source_default.gray("Info:")} ${finding.message}`);
-    if (finding.snippet) {
-      const redacted = finding.snippet.replace(
-        /(['"]?)([A-Za-z0-9+/=\-_]{16,})(['"]?)/g,
-        "$1" + source_default.red("*".repeat(16)) + "$3"
-      );
-      console.log(`    ${source_default.gray("Code:")} ${redacted.trim()}`);
+    if (finding.consequence) {
+      console.log(`    ${source_default.gray("Risk:")} ${source_default.dim(finding.consequence)}`);
+    }
+    if (finding.excerpt) {
+      console.log(`    ${source_default.gray("Code:")} ${finding.excerpt}`);
     }
+    console.log(
+      `    ${source_default.gray("Rule:")} ${source_default.dim(finding.ruleId)}` + (finding.cwe ? source_default.dim(` \xB7 ${finding.cwe}`) : "") + source_default.dim(` \xB7 confidence: ${finding.confidence}`)
+    );
     console.log();
   }
   console.log(source_default.gray("  " + "\u2500".repeat(70)));
-  console.log(`  ${source_default.white.bold(`${findings.length} issue(s) found`)} across ${filesScanned} files`);
+  console.log(
+    `  ${source_default.white.bold(`${findings.length} issue(s) found`)} across ${filesScanned} files`
+  );
   console.log();
-  return {
-    type: "scan",
-    target: targetPath,
-    findings: structured,
-    severity_summary: sevCounts,
-    summary: `${findings.length} issue(s): ${sevCounts.critical}C ${sevCounts.high}H ${sevCounts.medium}M ${sevCounts.low}L`
-  };
-}
-function scanDirectory(basePath, currentPath, findings, onFile) {
-  let entries;
-  try {
-    entries = (0, import_node_fs5.readdirSync)(currentPath, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    const fullPath = (0, import_node_path2.join)(currentPath, entry.name);
-    if (entry.isDirectory()) {
-      if (SKIP_DIRS.has(entry.name)) continue;
-      scanDirectory(basePath, fullPath, findings, onFile);
-      continue;
-    }
-    if (!entry.isFile()) continue;
-    for (const mc of MISCONFIG_FILES) {
-      if (entry.name === mc.pattern || entry.name.endsWith(mc.pattern)) {
-        findings.push({
-          file: (0, import_node_path2.relative)(basePath, fullPath),
-          line: 0,
-          type: "Sensitive File",
-          severity: "high",
-          message: mc.message,
-          snippet: ""
-        });
-      }
-    }
-    const ext = (0, import_node_path2.extname)(entry.name).toLowerCase();
-    if (!SCAN_EXTENSIONS.has(ext) && !entry.name.startsWith(".env")) continue;
-    try {
-      const stat = (0, import_node_fs5.statSync)(fullPath);
-      if (stat.size > 1024 * 1024) continue;
-    } catch {
-      continue;
-    }
-    onFile();
-    let content;
-    try {
-      content = (0, import_node_fs5.readFileSync)(fullPath, "utf-8");
-    } catch {
-      continue;
-    }
-    const lines = content.split("\n");
-    for (let i = 0; i < lines.length; i++) {
-      const line = lines[i];
-      if (line.trim().startsWith("//") && !line.includes("password") && !line.includes("secret")) continue;
-      for (const pattern of SECRET_PATTERNS) {
-        pattern.pattern.lastIndex = 0;
-        if (pattern.pattern.test(line)) {
-          findings.push({
-            file: (0, import_node_path2.relative)(basePath, fullPath),
-            line: i + 1,
-            type: pattern.name,
-            severity: pattern.severity,
-            message: `Possible ${pattern.name} detected`,
-            snippet: line.length > 120 ? line.slice(0, 120) + "..." : line
-          });
-        }
-      }
-    }
-  }
-}
-async function scanDependencies(targetPath) {
-  const findings = [];
-  const lockfiles = [
-    { file: "package-lock.json", ecosystem: "npm" },
-    { file: "pnpm-lock.yaml", ecosystem: "npm" },
-    { file: "yarn.lock", ecosystem: "npm" },
-    { file: "requirements.txt", ecosystem: "PyPI" },
-    { file: "Pipfile.lock", ecosystem: "PyPI" }
-  ];
-  for (const { file, ecosystem } of lockfiles) {
-    const lockPath = (0, import_node_path2.join)(targetPath, file);
-    if (!(0, import_node_fs5.existsSync)(lockPath)) continue;
-    try {
-      const deps = parseDependencies(lockPath, file, ecosystem);
-      for (const dep of deps.slice(0, 50)) {
-        try {
-          const vulns = await queryOsv(dep.name, dep.version, ecosystem);
-          for (const vuln of vulns) {
-            const cvssScore = vuln.severity?.find((s) => s.type === "CVSS_V3")?.score;
-            const severity = cvssScore ? parseFloat(cvssScore) >= 9 ? "critical" : parseFloat(cvssScore) >= 7 ? "high" : parseFloat(cvssScore) >= 4 ? "medium" : "low" : "medium";
-            findings.push({
-              file,
-              line: 0,
-              type: "Dependency CVE",
-              severity,
-              message: `${dep.name}@${dep.version}: ${vuln.summary || vuln.id}`,
-              snippet: `${vuln.id}${cvssScore ? ` (CVSS: ${cvssScore})` : ""}`
-            });
-          }
-        } catch {
-        }
-      }
-    } catch {
-    }
-  }
-  return findings;
-}
-function parseDependencies(lockPath, filename, ecosystem) {
-  const deps = [];
-  if (filename === "package-lock.json") {
-    try {
-      const lock = JSON.parse((0, import_node_fs5.readFileSync)(lockPath, "utf-8"));
-      const packages = lock.packages || lock.dependencies || {};
-      for (const [key, value] of Object.entries(packages)) {
-        const name = key.replace(/^node_modules\//, "");
-        const version = value.version;
-        if (name && version && !name.startsWith(".")) {
-          deps.push({ name, version });
-        }
-      }
-    } catch {
-    }
-  } else if (filename === "requirements.txt") {
-    try {
-      const content = (0, import_node_fs5.readFileSync)(lockPath, "utf-8");
-      for (const line of content.split("\n")) {
-        const match = line.match(/^([a-zA-Z0-9_.-]+)==([0-9.]+)/);
-        if (match) deps.push({ name: match[1], version: match[2] });
-      }
-    } catch {
-    }
-  }
-  return deps;
-}
-function isValidPackageName(name) {
-  return /^[@a-zA-Z0-9_.\-/]{1,214}$/.test(name);
-}
-function isValidVersion(version) {
-  return /^[0-9a-zA-Z._\-+]{1,50}$/.test(version);
-}
-async function queryOsv(name, version, ecosystem) {
-  if (!isValidPackageName(name) || !isValidVersion(version)) return [];
-  try {
-    const res = await fetch("https://api.osv.dev/v1/query", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ package: { name, ecosystem }, version }),
-      signal: AbortSignal.timeout(5e3)
-    });
-    if (!res.ok) return [];
-    const data = await res.json();
-    return data.vulns || [];
-  } catch {
-    return [];
-  }
 }
 
 // src/commands/init.ts
-var import_node_fs8 = require("fs");
+var import_node_fs10 = require("fs");
 var import_node_child_process = require("child_process");
 var import_node_readline3 = __toESM(require("readline"));
 
 // src/core/config.ts
-var import_node_fs6 = require("fs");
-var import_node_path3 = require("path");
+var import_node_fs8 = require("fs");
+var import_node_path6 = require("path");
 var import_toml = __toESM(require_toml());
 var DEFAULT_CONFIG_PATH = "/etc/threatcrush/threatcrushd.conf";
 var DEFAULT_CONFDIR = "/etc/threatcrush/threatcrushd.conf.d";
@@ -9929,11 +11365,11 @@ var DEFAULT_CONFIG = {
 };
 function loadConfig(configPath) {
   const path = configPath || DEFAULT_CONFIG_PATH;
-  if (!(0, import_node_fs6.existsSync)(path)) {
+  if (!(0, import_node_fs8.existsSync)(path)) {
     return { ...DEFAULT_CONFIG };
   }
   try {
-    const raw = (0, import_node_fs6.readFileSync)(path, "utf-8");
+    const raw = (0, import_node_fs8.readFileSync)(path, "utf-8");
     const parsed = import_toml.default.parse(raw);
     return {
       daemon: { ...DEFAULT_CONFIG.daemon, ...parsed.daemon },
@@ -9949,13 +11385,13 @@ function loadConfig(configPath) {
 function loadModuleConfigs(confDir) {
   const dir = confDir || DEFAULT_CONFDIR;
   const configs = /* @__PURE__ */ new Map();
-  if (!(0, import_node_fs6.existsSync)(dir)) {
+  if (!(0, import_node_fs8.existsSync)(dir)) {
     return configs;
   }
-  const files = (0, import_node_fs6.readdirSync)(dir).filter((f) => f.endsWith(".conf"));
+  const files = (0, import_node_fs8.readdirSync)(dir).filter((f) => f.endsWith(".conf"));
   for (const file of files) {
     try {
-      const raw = (0, import_node_fs6.readFileSync)((0, import_node_path3.join)(dir, file), "utf-8");
+      const raw = (0, import_node_fs8.readFileSync)((0, import_node_path6.join)(dir, file), "utf-8");
       const parsed = import_toml.default.parse(raw);
       for (const [name, config] of Object.entries(parsed)) {
         configs.set(name, config);
@@ -9984,23 +11420,23 @@ function generateModuleConfig(moduleName, defaults = {}) {
 }
 
 // src/core/cli-config.ts
-var import_node_fs7 = require("fs");
-var import_node_path4 = require("path");
+var import_node_fs9 = require("fs");
+var import_node_path7 = require("path");
 var import_node_os4 = require("os");
-var CLI_CONFIG_DIR = (0, import_node_path4.join)((0, import_node_os4.homedir)(), ".threatcrush");
-var CLI_CONFIG_PATH = (0, import_node_path4.join)(CLI_CONFIG_DIR, "config.json");
+var CLI_CONFIG_DIR = (0, import_node_path7.join)((0, import_node_os4.homedir)(), ".threatcrush");
+var CLI_CONFIG_PATH = (0, import_node_path7.join)(CLI_CONFIG_DIR, "config.json");
 function readCliConfig() {
   try {
-    return JSON.parse((0, import_node_fs7.readFileSync)(CLI_CONFIG_PATH, "utf-8"));
+    return JSON.parse((0, import_node_fs9.readFileSync)(CLI_CONFIG_PATH, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeCliConfig(config) {
-  if (!(0, import_node_fs7.existsSync)(CLI_CONFIG_DIR)) (0, import_node_fs7.mkdirSync)(CLI_CONFIG_DIR, { recursive: true });
-  (0, import_node_fs7.writeFileSync)(CLI_CONFIG_PATH, JSON.stringify(config, null, 2), "utf-8");
+  if (!(0, import_node_fs9.existsSync)(CLI_CONFIG_DIR)) (0, import_node_fs9.mkdirSync)(CLI_CONFIG_DIR, { recursive: true });
+  (0, import_node_fs9.writeFileSync)(CLI_CONFIG_PATH, JSON.stringify(config, null, 2), "utf-8");
   try {
-    (0, import_node_fs7.chmodSync)(CLI_CONFIG_PATH, 384);
+    (0, import_node_fs9.chmodSync)(CLI_CONFIG_PATH, 384);
   } catch {
   }
 }
@@ -10038,13 +11474,13 @@ var import_node_stream = require("stream");
 var API_URL = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
 function prompt(question) {
   const rl = import_node_readline2.default.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve3) => rl.question(question, (answer) => {
+  return new Promise((resolve5) => rl.question(question, (answer) => {
     rl.close();
-    resolve3(answer.trim());
+    resolve5(answer.trim());
   }));
 }
 function promptPassword(question) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve5) => {
     const muted = new import_node_stream.Writable({
       write(_chunk, _enc, cb) {
         cb();
@@ -10055,7 +11491,7 @@ function promptPassword(question) {
     rl.question("", (answer) => {
       rl.close();
       process.stdout.write("\n");
-      resolve3(answer);
+      resolve5(answer);
     });
   });
 }
@@ -10245,16 +11681,16 @@ function binaryExists(name) {
   }
 }
 function findLogPath(paths) {
-  return paths.find((p) => (0, import_node_fs8.existsSync)(p));
+  return paths.find((p) => (0, import_node_fs10.existsSync)(p));
 }
 async function promptYesNo(question, fallback2) {
   const rl = import_node_readline3.default.createInterface({ input: process.stdin, output: process.stdout });
   const hint = fallback2 ? "(Y/n)" : "(y/N)";
-  return new Promise((resolve3) => rl.question(`${question} ${hint}: `, (answer) => {
+  return new Promise((resolve5) => rl.question(`${question} ${hint}: `, (answer) => {
     rl.close();
     const trimmed = answer.trim().toLowerCase();
-    if (!trimmed) return resolve3(fallback2);
-    resolve3(trimmed === "y" || trimmed === "yes");
+    if (!trimmed) return resolve5(fallback2);
+    resolve5(trimmed === "y" || trimmed === "yes");
   }));
 }
 async function ensureLoggedIn() {
@@ -10361,11 +11797,11 @@ async function initCommand() {
     }
   } else {
     const spinner2 = ora({ text: "Writing configuration files...", color: "green" }).start();
-    (0, import_node_fs8.mkdirSync)(confDDir, { recursive: true });
-    (0, import_node_fs8.mkdirSync)("/var/log/threatcrush", { recursive: true });
-    (0, import_node_fs8.mkdirSync)("/var/lib/threatcrush", { recursive: true });
+    (0, import_node_fs10.mkdirSync)(confDDir, { recursive: true });
+    (0, import_node_fs10.mkdirSync)("/var/log/threatcrush", { recursive: true });
+    (0, import_node_fs10.mkdirSync)("/var/lib/threatcrush", { recursive: true });
     const mainConfig = generateDefaultConfig(detected.map((d) => d.name));
-    (0, import_node_fs8.writeFileSync)(`${configDir}/threatcrushd.conf`, mainConfig);
+    (0, import_node_fs10.writeFileSync)(`${configDir}/threatcrushd.conf`, mainConfig);
     for (const svc of detected) {
       const svcDef = SERVICES_TO_DETECT.find((s) => s.name === svc.name);
       if (!svcDef) continue;
@@ -10374,7 +11810,7 @@ async function initCommand() {
         ...svcDef.moduleConfig,
         log_path: svc.logPath || svcDef.logPaths[0]
       });
-      (0, import_node_fs8.writeFileSync)(`${confDDir}/${modName}.conf`, modConfig);
+      (0, import_node_fs10.writeFileSync)(`${confDDir}/${modName}.conf`, modConfig);
     }
     spinner2.succeed("Configuration written successfully");
     console.log();
@@ -10392,8 +11828,8 @@ async function initCommand() {
 }
 function checkWriteAccess(dir) {
   try {
-    if (!(0, import_node_fs8.existsSync)(dir)) {
-      (0, import_node_fs8.mkdirSync)(dir, { recursive: true });
+    if (!(0, import_node_fs10.existsSync)(dir)) {
+      (0, import_node_fs10.mkdirSync)(dir, { recursive: true });
     }
     return true;
   } catch {
@@ -10402,8 +11838,8 @@ function checkWriteAccess(dir) {
 }
 
 // src/core/module-loader.ts
-var import_node_fs9 = require("fs");
-var import_node_path5 = require("path");
+var import_node_fs11 = require("fs");
+var import_node_path8 = require("path");
 var import_toml2 = __toESM(require_toml());
 init_paths();
 function discoverModules(moduleDir, confDir) {
@@ -10411,22 +11847,22 @@ function discoverModules(moduleDir, confDir) {
   const configs = loadModuleConfigs(confDir || PATHS.confD);
   const searchPaths = [
     moduleDir || PATHS.moduleDir,
-    (0, import_node_path5.resolve)(process.cwd(), "modules")
+    (0, import_node_path8.resolve)(process.cwd(), "modules")
   ];
-  const builtinDir = (0, import_node_path5.resolve)(__dirname || ".", "..", "modules");
-  if ((0, import_node_fs9.existsSync)(builtinDir)) {
+  const builtinDir = (0, import_node_path8.resolve)(__dirname || ".", "..", "modules");
+  if ((0, import_node_fs11.existsSync)(builtinDir)) {
     searchPaths.push(builtinDir);
   }
   for (const basePath of searchPaths) {
-    if (!(0, import_node_fs9.existsSync)(basePath)) continue;
-    const entries = (0, import_node_fs9.readdirSync)(basePath, { withFileTypes: true });
+    if (!(0, import_node_fs11.existsSync)(basePath)) continue;
+    const entries = (0, import_node_fs11.readdirSync)(basePath, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const modPath = (0, import_node_path5.join)(basePath, entry.name);
-      const manifestPath = (0, import_node_path5.join)(modPath, "mod.toml");
-      if (!(0, import_node_fs9.existsSync)(manifestPath)) continue;
+      const modPath = (0, import_node_path8.join)(basePath, entry.name);
+      const manifestPath = (0, import_node_path8.join)(modPath, "mod.toml");
+      if (!(0, import_node_fs11.existsSync)(manifestPath)) continue;
       try {
-        const raw = (0, import_node_fs9.readFileSync)(manifestPath, "utf-8");
+        const raw = (0, import_node_fs11.readFileSync)(manifestPath, "utf-8");
         const manifest = import_toml2.default.parse(raw);
         const config = configs.get(manifest.module.name) || { enabled: true };
         modules.push({
@@ -10545,8 +11981,8 @@ function formatUptime(seconds) {
 
 // src/commands/modules.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs10 = require("fs");
-var import_node_path6 = require("path");
+var import_node_fs12 = require("fs");
+var import_node_path9 = require("path");
 var import_toml3 = __toESM(require_toml());
 init_paths();
 init_pidfile();
@@ -10555,13 +11991,32 @@ function modulesDir() {
   ensureRuntimeDirs();
   return PATHS.moduleDir;
 }
+function safeModuleDirName(name, label = "module name") {
+  if (!/^[A-Za-z0-9._@-]+$/.test(name) || name === "." || name === "..") {
+    throw new Error(`Unsafe ${label}: ${name}`);
+  }
+  return name;
+}
+function moduleDestination(dir, name, label) {
+  return (0, import_node_path9.join)(dir, safeModuleDirName(name, label));
+}
+function assertSafeTarballEntries(tarPath) {
+  const listing = (0, import_node_child_process2.execFileSync)("tar", ["-tzf", tarPath], { encoding: "utf-8" });
+  for (const entry of listing.split("\n").map((line) => line.trim()).filter(Boolean)) {
+    const normalized = entry.replace(/\\/g, "/");
+    const segments = normalized.split("/");
+    if (normalized.startsWith("/") || segments.includes("..")) {
+      throw new Error(`Unsafe tarball entry: ${entry}`);
+    }
+  }
+}
 function validateManifest(modPath) {
-  const manifestPath = (0, import_node_path6.join)(modPath, "mod.toml");
-  if (!(0, import_node_fs10.existsSync)(manifestPath)) {
+  const manifestPath = (0, import_node_path9.join)(modPath, "mod.toml");
+  if (!(0, import_node_fs12.existsSync)(manifestPath)) {
     return { ok: false, error: `mod.toml not found at ${manifestPath}` };
   }
   try {
-    const raw = (0, import_node_fs10.readFileSync)(manifestPath, "utf-8");
+    const raw = (0, import_node_fs12.readFileSync)(manifestPath, "utf-8");
     const parsed = import_toml3.default.parse(raw);
     const name = parsed.module?.name;
     const version = parsed.module?.version;
@@ -10615,8 +12070,8 @@ async function modulesInstallCommand(source) {
   console.log();
   const dir = modulesDir();
   if (source.startsWith("./") || source.startsWith("/") || source.startsWith("~")) {
-    const absPath = (0, import_node_path6.resolve)(source.startsWith("~") ? source.replace("~", process.env.HOME || "") : source);
-    if (!(0, import_node_fs10.existsSync)(absPath)) {
+    const absPath = (0, import_node_path9.resolve)(source.startsWith("~") ? source.replace("~", process.env.HOME || "") : source);
+    if (!(0, import_node_fs12.existsSync)(absPath)) {
       console.log(source_default.red(`  \u2717 Path not found: ${absPath}
 `));
       return;
@@ -10627,8 +12082,15 @@ async function modulesInstallCommand(source) {
 `));
       return;
     }
-    const dest2 = (0, import_node_path6.join)(dir, check.name);
-    if ((0, import_node_fs10.existsSync)(dest2)) {
+    let dest2;
+    try {
+      dest2 = moduleDestination(dir, check.name);
+    } catch (err) {
+      console.log(source_default.red(`  x ${err.message}
+`));
+      return;
+    }
+    if ((0, import_node_fs12.existsSync)(dest2)) {
       console.log(source_default.yellow(`  ! ${check.name} is already installed at ${dest2}`));
       console.log(source_default.dim(`    Run ${source_default.white(`threatcrush modules remove ${check.name}`)} first.
 `));
@@ -10636,7 +12098,7 @@ async function modulesInstallCommand(source) {
     }
     const spinner2 = ora({ text: `Copying module files...`, color: "green" }).start();
     try {
-      (0, import_node_fs10.cpSync)(absPath, dest2, { recursive: true, dereference: true });
+      (0, import_node_fs12.cpSync)(absPath, dest2, { recursive: true, dereference: true });
       spinner2.succeed(`Installed ${source_default.white(check.name)} v${check.version} \u2192 ${dest2}`);
     } catch (err) {
       spinner2.fail(`Copy failed: ${err.message}`);
@@ -10648,9 +12110,17 @@ async function modulesInstallCommand(source) {
   }
   if (source.startsWith("github:") || source.startsWith("https://") || source.startsWith("git@") || source.endsWith(".git")) {
     const gitUrl = source.startsWith("github:") ? `https://github.com/${source.slice("github:".length)}.git` : source;
-    const name = (0, import_node_path6.basename)(gitUrl.replace(/\.git$/, ""));
-    const dest2 = (0, import_node_path6.join)(dir, name);
-    if ((0, import_node_fs10.existsSync)(dest2)) {
+    let name;
+    let dest2;
+    try {
+      name = safeModuleDirName((0, import_node_path9.basename)(gitUrl.replace(/\.git$/, "")), "repository name");
+      dest2 = moduleDestination(dir, name);
+    } catch (err) {
+      console.log(source_default.red(`  x ${err.message}
+`));
+      return;
+    }
+    if ((0, import_node_fs12.existsSync)(dest2)) {
       console.log(source_default.yellow(`  ! ${name} is already installed at ${dest2}`));
       console.log(source_default.dim(`    Run ${source_default.white(`threatcrush modules remove ${name}`)} first.
 `));
@@ -10658,7 +12128,7 @@ async function modulesInstallCommand(source) {
     }
     const spinner2 = ora({ text: `Cloning ${gitUrl}...`, color: "green" }).start();
     try {
-      (0, import_node_child_process2.execSync)(`git clone --depth 1 ${gitUrl} ${dest2}`, { stdio: "pipe" });
+      (0, import_node_child_process2.execFileSync)("git", ["clone", "--depth", "1", "--", gitUrl, dest2], { stdio: "pipe" });
     } catch (err) {
       spinner2.fail(`Clone failed: ${err.message}`);
       return;
@@ -10667,7 +12137,7 @@ async function modulesInstallCommand(source) {
     if (!check.ok) {
       spinner2.fail(check.error);
       try {
-        (0, import_node_fs10.rmSync)(dest2, { recursive: true, force: true });
+        (0, import_node_fs12.rmSync)(dest2, { recursive: true, force: true });
       } catch {
       }
       return;
@@ -10704,8 +12174,15 @@ async function modulesInstallCommand(source) {
   }
   spinner.succeed(`Found ${mod.name} v${mod.version}`);
   const install = mod.install;
-  const dest = (0, import_node_path6.join)(dir, mod.slug);
-  if ((0, import_node_fs10.existsSync)(dest)) {
+  let dest;
+  try {
+    dest = moduleDestination(dir, mod.slug, "module slug");
+  } catch (err) {
+    console.log(source_default.red(`  x ${err.message}
+`));
+    return;
+  }
+  if ((0, import_node_fs12.existsSync)(dest)) {
     console.log(source_default.yellow(`  ! ${mod.slug} is already installed at ${dest}
 `));
     return;
@@ -10713,7 +12190,7 @@ async function modulesInstallCommand(source) {
   if (install.npm_package) {
     const npmSpinner = ora({ text: `Installing ${install.npm_package}...`, color: "green" }).start();
     try {
-      (0, import_node_child_process2.execSync)(`npm install -g ${install.npm_package}`, { stdio: "pipe" });
+      (0, import_node_child_process2.execFileSync)("npm", ["install", "-g", "--", install.npm_package], { stdio: "pipe" });
       npmSpinner.succeed(`Package ${install.npm_package} installed globally`);
     } catch (err) {
       npmSpinner.fail(`npm install failed: ${err.message}`);
@@ -10722,7 +12199,7 @@ async function modulesInstallCommand(source) {
   } else if (install.git_url) {
     const cloneSpinner = ora({ text: "Cloning module repository...", color: "green" }).start();
     try {
-      (0, import_node_child_process2.execSync)(`git clone --depth 1 ${install.git_url} ${dest}`, { stdio: "pipe" });
+      (0, import_node_child_process2.execFileSync)("git", ["clone", "--depth", "1", "--", install.git_url, dest], { stdio: "pipe" });
     } catch (err) {
       cloneSpinner.fail(`Clone failed: ${err.message}`);
       return;
@@ -10731,7 +12208,7 @@ async function modulesInstallCommand(source) {
     if (!check.ok) {
       cloneSpinner.fail(check.error);
       try {
-        (0, import_node_fs10.rmSync)(dest, { recursive: true, force: true });
+        (0, import_node_fs12.rmSync)(dest, { recursive: true, force: true });
       } catch {
       }
       return;
@@ -10745,10 +12222,11 @@ async function modulesInstallCommand(source) {
         dlSpinner.fail(`HTTP ${res.status}`);
         return;
       }
-      const tar = (0, import_node_path6.join)(dir, `${mod.slug}.tar.gz`);
-      (0, import_node_fs10.writeFileSync)(tar, Buffer.from(await res.arrayBuffer()));
-      (0, import_node_child_process2.execSync)(`tar -xzf ${tar} -C ${dir}`, { stdio: "pipe" });
-      (0, import_node_fs10.rmSync)(tar, { force: true });
+      const tar = (0, import_node_path9.join)(dir, `${mod.slug}.tar.gz`);
+      (0, import_node_fs12.writeFileSync)(tar, Buffer.from(await res.arrayBuffer()));
+      assertSafeTarballEntries(tar);
+      (0, import_node_child_process2.execFileSync)("tar", ["-xzf", tar, "-C", dir], { stdio: "pipe" });
+      (0, import_node_fs12.rmSync)(tar, { force: true });
       const check = validateManifest(dest);
       if (!check.ok) {
         dlSpinner.fail(check.error);
@@ -10771,8 +12249,15 @@ async function modulesRemoveCommand(name) {
   console.log(source_default.green.bold("  Module Removal"));
   console.log(source_default.gray("  " + "\u2500".repeat(50)));
   const dir = modulesDir();
-  const target = (0, import_node_path6.join)(dir, name);
-  if (!(0, import_node_fs10.existsSync)(target)) {
+  let target;
+  try {
+    target = moduleDestination(dir, name);
+  } catch (err) {
+    console.log(source_default.red(`  x ${err.message}
+`));
+    return;
+  }
+  if (!(0, import_node_fs12.existsSync)(target)) {
     console.log(source_default.yellow(`  ! No module named "${name}" in ${dir}
 `));
     return;
@@ -10782,7 +12267,7 @@ async function modulesRemoveCommand(name) {
     console.log(source_default.yellow(`  ! Directory name "${name}" does not match manifest name "${check.name}"`));
   }
   try {
-    (0, import_node_fs10.rmSync)(target, { recursive: true, force: true });
+    (0, import_node_fs12.rmSync)(target, { recursive: true, force: true });
     console.log(source_default.green(`  \u2713 Removed ${name} from ${dir}
 `));
   } catch (err) {
@@ -11155,21 +12640,21 @@ async function pentestCommand(targetUrl) {
 
 // src/commands/orgs.ts
 var import_node_os5 = require("os");
-var import_node_fs11 = require("fs");
-var import_node_path7 = require("path");
+var import_node_fs13 = require("fs");
+var import_node_path10 = require("path");
 var API_URL3 = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
-var CONFIG_PATH = (0, import_node_path7.join)((0, import_node_os5.homedir)(), ".threatcrush", "config.json");
+var CONFIG_PATH = (0, import_node_path10.join)((0, import_node_os5.homedir)(), ".threatcrush", "config.json");
 function readConfig() {
   try {
-    return JSON.parse((0, import_node_fs11.readFileSync)(CONFIG_PATH, "utf-8"));
+    return JSON.parse((0, import_node_fs13.readFileSync)(CONFIG_PATH, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeConfig(config) {
-  const dir = (0, import_node_path7.join)((0, import_node_os5.homedir)(), ".threatcrush");
-  if (!(0, import_node_fs11.existsSync)(dir)) (0, import_node_fs11.mkdirSync)(dir, { recursive: true });
-  (0, import_node_fs11.writeFileSync)(CONFIG_PATH, JSON.stringify(config, null, 2));
+  const dir = (0, import_node_path10.join)((0, import_node_os5.homedir)(), ".threatcrush");
+  if (!(0, import_node_fs13.existsSync)(dir)) (0, import_node_fs13.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs13.writeFileSync)(CONFIG_PATH, JSON.stringify(config, null, 2));
 }
 function getAuthHeaders() {
   const config = readConfig();
@@ -11305,13 +12790,13 @@ async function useOrganization(slug) {
 
 // src/commands/servers.ts
 var import_node_os6 = require("os");
-var import_node_fs12 = require("fs");
-var import_node_path8 = require("path");
+var import_node_fs14 = require("fs");
+var import_node_path11 = require("path");
 var API_URL4 = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
-var CONFIG_PATH2 = (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".threatcrush", "config.json");
+var CONFIG_PATH2 = (0, import_node_path11.join)((0, import_node_os6.homedir)(), ".threatcrush", "config.json");
 function readConfig2() {
   try {
-    return JSON.parse((0, import_node_fs12.readFileSync)(CONFIG_PATH2, "utf-8"));
+    return JSON.parse((0, import_node_fs14.readFileSync)(CONFIG_PATH2, "utf-8"));
   } catch {
     return {};
   }
@@ -11414,14 +12899,14 @@ function timeAgo(dateStr) {
 
 // src/commands/connect.ts
 var import_node_os7 = require("os");
-var import_node_fs13 = require("fs");
-var import_node_path9 = require("path");
+var import_node_fs15 = require("fs");
+var import_node_path12 = require("path");
 var import_node_child_process3 = require("child_process");
 var API_URL5 = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
-var CONFIG_PATH3 = (0, import_node_path9.join)((0, import_node_os7.homedir)(), ".threatcrush", "config.json");
+var CONFIG_PATH3 = (0, import_node_path12.join)((0, import_node_os7.homedir)(), ".threatcrush", "config.json");
 function readConfig3() {
   try {
-    return JSON.parse((0, import_node_fs13.readFileSync)(CONFIG_PATH3, "utf-8"));
+    return JSON.parse((0, import_node_fs15.readFileSync)(CONFIG_PATH3, "utf-8"));
   } catch {
     return {};
   }
@@ -11576,19 +13061,19 @@ async function sshConnect(options) {
 
 // src/commands/daemon.ts
 var import_node_child_process7 = require("child_process");
-var import_node_fs22 = require("fs");
-var import_node_path13 = require("path");
-var import_node_fs23 = require("fs");
+var import_node_fs24 = require("fs");
+var import_node_path16 = require("path");
+var import_node_fs25 = require("fs");
 
 // src/daemon/index.ts
-var import_node_fs21 = require("fs");
-var import_node_path12 = require("path");
+var import_node_fs23 = require("fs");
+var import_node_path15 = require("path");
 init_paths();
 init_pidfile();
 
 // src/daemon/ipc-server.ts
 var import_node_net2 = require("net");
-var import_node_fs14 = require("fs");
+var import_node_fs16 = require("fs");
 init_paths();
 
 // src/daemon/event-bus.ts
@@ -11635,13 +13120,13 @@ var IpcServer = class {
   startedAt = /* @__PURE__ */ new Date();
   counters = { events: 0, threats: 0, alerts: 0 };
   async start() {
-    if ((0, import_node_fs14.existsSync)(PATHS.socket)) {
+    if ((0, import_node_fs16.existsSync)(PATHS.socket)) {
       try {
-        (0, import_node_fs14.unlinkSync)(PATHS.socket);
+        (0, import_node_fs16.unlinkSync)(PATHS.socket);
       } catch {
       }
     }
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve5, reject) => {
       this.server = (0, import_node_net2.createServer)((sock) => this.handleClient(sock));
       this.server.on("error", reject);
       this.server.listen(PATHS.socket, () => {
@@ -11658,7 +13143,7 @@ var IpcServer = class {
           } catch {
           }
         }
-        resolve3();
+        resolve5();
       });
     });
   }
@@ -11670,20 +13155,20 @@ var IpcServer = class {
       }
     }
     this.clients.clear();
-    return new Promise((resolve3) => {
+    return new Promise((resolve5) => {
       if (!this.server) {
         try {
-          if ((0, import_node_fs14.existsSync)(PATHS.socket)) (0, import_node_fs14.unlinkSync)(PATHS.socket);
+          if ((0, import_node_fs16.existsSync)(PATHS.socket)) (0, import_node_fs16.unlinkSync)(PATHS.socket);
         } catch {
         }
-        return resolve3();
+        return resolve5();
       }
       this.server.close(() => {
         try {
-          if ((0, import_node_fs14.existsSync)(PATHS.socket)) (0, import_node_fs14.unlinkSync)(PATHS.socket);
+          if ((0, import_node_fs16.existsSync)(PATHS.socket)) (0, import_node_fs16.unlinkSync)(PATHS.socket);
         } catch {
         }
-        resolve3();
+        resolve5();
       });
     });
   }
@@ -11786,14 +13271,14 @@ var IpcServer = class {
 };
 
 // src/daemon/module-host.ts
-var import_node_fs18 = require("fs");
-var import_node_path10 = require("path");
+var import_node_fs20 = require("fs");
+var import_node_path13 = require("path");
 var import_node_url = require("url");
 var import_toml4 = __toESM(require_toml());
 init_paths();
 
 // src/daemon/watchers/log-watcher.ts
-var import_node_fs15 = require("fs");
+var import_node_fs17 = require("fs");
 var import_node_readline4 = require("readline");
 init_state();
 var DEFAULT_SOURCES = [
@@ -11815,9 +13300,9 @@ var LogWatcher = class {
   start() {
     const started = [];
     for (const src of this.sources) {
-      if (!(0, import_node_fs15.existsSync)(src.path)) continue;
+      if (!(0, import_node_fs17.existsSync)(src.path)) continue;
       try {
-        (0, import_node_fs15.accessSync)(src.path, import_node_fs15.constants.R_OK);
+        (0, import_node_fs17.accessSync)(src.path, import_node_fs17.constants.R_OK);
       } catch {
         continue;
       }
@@ -11837,7 +13322,7 @@ var LogWatcher = class {
   }
   tail(src) {
     try {
-      this.positions.set(src.path, (0, import_node_fs15.statSync)(src.path).size);
+      this.positions.set(src.path, (0, import_node_fs17.statSync)(src.path).size);
     } catch {
       this.positions.set(src.path, 0);
     }
@@ -11848,7 +13333,7 @@ var LogWatcher = class {
   poll(src) {
     let stat;
     try {
-      stat = (0, import_node_fs15.statSync)(src.path);
+      stat = (0, import_node_fs17.statSync)(src.path);
     } catch {
       return;
     }
@@ -11858,7 +13343,7 @@ var LogWatcher = class {
       return;
     }
     if (stat.size === prev) return;
-    const stream = (0, import_node_fs15.createReadStream)(src.path, { start: prev, encoding: "utf-8" });
+    const stream = (0, import_node_fs17.createReadStream)(src.path, { start: prev, encoding: "utf-8" });
     stream.on("error", () => this.positions.set(src.path, stat.size));
     const rl = (0, import_node_readline4.createInterface)({ input: stream });
     rl.on("error", () => {
@@ -12051,7 +13536,7 @@ function realtimeToDate(rt) {
 
 // src/modules/network-monitor/index.ts
 var import_node_child_process5 = require("child_process");
-var import_node_fs16 = require("fs");
+var import_node_fs18 = require("fs");
 init_state();
 var NetworkMonitor = class {
   constructor(bus2) {
@@ -12090,7 +13575,7 @@ var NetworkMonitor = class {
   hasConntrackOrSs() {
     const ss = (0, import_node_child_process5.spawnSync)("ss", ["--version"], { stdio: "pipe" });
     if (ss.status === 0) return true;
-    return (0, import_node_fs16.existsSync)("/proc/net/tcp");
+    return (0, import_node_fs18.existsSync)("/proc/net/tcp");
   }
   poll() {
     try {
@@ -12229,7 +13714,7 @@ var NetworkMonitor = class {
 };
 
 // src/modules/dns-monitor/index.ts
-var import_node_fs17 = require("fs");
+var import_node_fs19 = require("fs");
 var import_node_readline5 = require("readline");
 init_state();
 var DNS_LOG_SOURCES = [
@@ -12264,9 +13749,9 @@ var DnsMonitor = class {
   entropyThreshold = 3.5;
   start() {
     const sources = DNS_LOG_SOURCES.filter((p) => {
-      if (!(0, import_node_fs17.existsSync)(p)) return false;
+      if (!(0, import_node_fs19.existsSync)(p)) return false;
       try {
-        (0, import_node_fs17.accessSync)(p, import_node_fs17.constants.R_OK);
+        (0, import_node_fs19.accessSync)(p, import_node_fs19.constants.R_OK);
         return true;
       } catch {
         return false;
@@ -12290,7 +13775,7 @@ var DnsMonitor = class {
   }
   tailLog(path) {
     try {
-      this.positions.set(path, (0, import_node_fs17.statSync)(path).size);
+      this.positions.set(path, (0, import_node_fs19.statSync)(path).size);
     } catch {
       this.positions.set(path, 0);
     }
@@ -12300,7 +13785,7 @@ var DnsMonitor = class {
   pollLog(path) {
     let stat;
     try {
-      stat = (0, import_node_fs17.statSync)(path);
+      stat = (0, import_node_fs19.statSync)(path);
     } catch {
       return;
     }
@@ -12310,7 +13795,7 @@ var DnsMonitor = class {
       return;
     }
     if (stat.size === prev) return;
-    const stream = (0, import_node_fs17.createReadStream)(path, { start: prev, encoding: "utf-8" });
+    const stream = (0, import_node_fs19.createReadStream)(path, { start: prev, encoding: "utf-8" });
     stream.on("error", () => this.positions.set(path, stat.size));
     const rl = (0, import_node_readline5.createInterface)({ input: stream });
     rl.on("line", (line) => this.parseDnsLine(line));
@@ -12542,15 +14027,15 @@ var ModuleHost = class {
     for (const m of builtins) this.modules.set(m.name, m);
   }
   async discoverAndStartInstalled() {
-    if (!(0, import_node_fs18.existsSync)(PATHS.moduleDir)) return;
+    if (!(0, import_node_fs20.existsSync)(PATHS.moduleDir)) return;
     const configs = loadModuleConfigs(PATHS.confD);
-    const entries = (0, import_node_fs18.readdirSync)(PATHS.moduleDir, { withFileTypes: true });
+    const entries = (0, import_node_fs20.readdirSync)(PATHS.moduleDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const manifestPath = (0, import_node_path10.join)(PATHS.moduleDir, entry.name, "mod.toml");
-      if (!(0, import_node_fs18.existsSync)(manifestPath)) continue;
+      const manifestPath = (0, import_node_path13.join)(PATHS.moduleDir, entry.name, "mod.toml");
+      if (!(0, import_node_fs20.existsSync)(manifestPath)) continue;
       try {
-        const manifest = import_toml4.default.parse((0, import_node_fs18.readFileSync)(manifestPath, "utf-8"));
+        const manifest = import_toml4.default.parse((0, import_node_fs20.readFileSync)(manifestPath, "utf-8"));
         const name = manifest.module?.name || entry.name;
         const defaults = manifest.module?.config?.defaults || {};
         const config = {
@@ -12564,7 +14049,7 @@ var ModuleHost = class {
           source: "installed",
           status: config.enabled === false ? "disabled" : "loaded",
           events: 0,
-          path: (0, import_node_path10.join)(PATHS.moduleDir, entry.name),
+          path: (0, import_node_path13.join)(PATHS.moduleDir, entry.name),
           config
         };
         this.modules.set(name, hosted);
@@ -12579,7 +14064,7 @@ var ModuleHost = class {
           status: "error",
           events: 0,
           detail: `manifest load failed: ${String(err.message || err)}`,
-          path: (0, import_node_path10.join)(PATHS.moduleDir, entry.name)
+          path: (0, import_node_path13.join)(PATHS.moduleDir, entry.name)
         });
       }
     }
@@ -12611,17 +14096,17 @@ var ModuleHost = class {
     }
   }
   installedEntrypoint(modulePath) {
-    const packageJson = (0, import_node_path10.join)(modulePath, "package.json");
+    const packageJson = (0, import_node_path13.join)(modulePath, "package.json");
     const candidates = [];
-    if ((0, import_node_fs18.existsSync)(packageJson)) {
+    if ((0, import_node_fs20.existsSync)(packageJson)) {
       try {
-        const pkg = JSON.parse((0, import_node_fs18.readFileSync)(packageJson, "utf-8"));
-        if (pkg.main) candidates.push((0, import_node_path10.join)(modulePath, pkg.main));
+        const pkg = JSON.parse((0, import_node_fs20.readFileSync)(packageJson, "utf-8"));
+        if (pkg.main) candidates.push((0, import_node_path13.join)(modulePath, pkg.main));
       } catch {
       }
     }
-    candidates.push((0, import_node_path10.join)(modulePath, "dist", "index.js"), (0, import_node_path10.join)(modulePath, "index.js"));
-    return candidates.find((candidate) => (0, import_node_fs18.existsSync)(candidate)) || null;
+    candidates.push((0, import_node_path13.join)(modulePath, "dist", "index.js"), (0, import_node_path13.join)(modulePath, "index.js"));
+    return candidates.find((candidate) => (0, import_node_fs20.existsSync)(candidate)) || null;
   }
   isThreatCrushModule(value) {
     return Boolean(
@@ -13142,8 +14627,8 @@ var RuleEngine = class {
 };
 
 // src/daemon/rules/loader.ts
-var import_node_fs19 = require("fs");
-var import_node_path11 = require("path");
+var import_node_fs21 = require("fs");
+var import_node_path14 = require("path");
 
 // src/daemon/rules/default-rules.ts
 var DEFAULT_RULES = [
@@ -13427,11 +14912,11 @@ var RULES_DIR = "/etc/threatcrush/rules.d";
 function loadAllRules(customDir) {
   const rules = [...DEFAULT_RULES];
   const dir = customDir || RULES_DIR;
-  if ((0, import_node_fs19.existsSync)(dir)) {
-    const files = (0, import_node_fs19.readdirSync)(dir).filter((f) => f.endsWith(".json"));
+  if ((0, import_node_fs21.existsSync)(dir)) {
+    const files = (0, import_node_fs21.readdirSync)(dir).filter((f) => f.endsWith(".json"));
     for (const file of files) {
       try {
-        const raw = (0, import_node_fs19.readFileSync)((0, import_node_path11.join)(dir, file), "utf-8");
+        const raw = (0, import_node_fs21.readFileSync)((0, import_node_path14.join)(dir, file), "utf-8");
         const parsed = JSON.parse(raw);
         const customRules = Array.isArray(parsed) ? parsed : [parsed];
         for (const rule of customRules) {
@@ -13456,6 +14941,12 @@ function loadAllRules(customDir) {
 
 // src/daemon/firewall/adapters.ts
 var import_node_child_process6 = require("child_process");
+var import_node_net3 = require("net");
+function assertValidFirewallIp(ip) {
+  if ((0, import_node_net3.isIP)(ip) !== 4) {
+    throw new Error(`Invalid IPv4 address: ${ip}`);
+  }
+}
 var NftablesAdapter = class {
   name = "nftables";
   table = "threatcrush";
@@ -13475,16 +14966,19 @@ var NftablesAdapter = class {
     }
   }
   async block(ip) {
+    assertValidFirewallIp(ip);
     this.ensureSetup();
     (0, import_node_child_process6.execSync)(`nft add element inet ${this.table} ${this.set} '{ ${ip} }'`);
   }
   async unblock(ip) {
+    assertValidFirewallIp(ip);
     try {
       (0, import_node_child_process6.execSync)(`nft delete element inet ${this.table} ${this.set} '{ ${ip} }'`);
     } catch {
     }
   }
   async isBlocked(ip) {
+    assertValidFirewallIp(ip);
     try {
       const output = (0, import_node_child_process6.execSync)(`nft list set inet ${this.table} ${this.set}`, { encoding: "utf-8" });
       return output.includes(ip);
@@ -13519,17 +15013,20 @@ var IptablesAdapter = class {
     }
   }
   async block(ip) {
+    assertValidFirewallIp(ip);
     this.ensureChain();
     if (await this.isBlocked(ip)) return;
     (0, import_node_child_process6.execSync)(`iptables -A ${this.chain} -s ${ip} -j DROP`);
   }
   async unblock(ip) {
+    assertValidFirewallIp(ip);
     try {
       (0, import_node_child_process6.execSync)(`iptables -D ${this.chain} -s ${ip} -j DROP`);
     } catch {
     }
   }
   async isBlocked(ip) {
+    assertValidFirewallIp(ip);
     try {
       const output = (0, import_node_child_process6.execSync)(`iptables -n -L ${this.chain}`, { encoding: "utf-8" });
       return output.includes(ip);
@@ -13558,12 +15055,15 @@ var DryRunAdapter = class {
     return true;
   }
   async block(ip) {
+    assertValidFirewallIp(ip);
     this.blocked.add(ip);
   }
   async unblock(ip) {
+    assertValidFirewallIp(ip);
     this.blocked.delete(ip);
   }
   async isBlocked(ip) {
+    assertValidFirewallIp(ip);
     return this.blocked.has(ip);
   }
   async listBlocked() {
@@ -13579,7 +15079,7 @@ function detectFirewallAdapter() {
 }
 
 // src/daemon/firewall/remediation.ts
-var import_node_fs20 = require("fs");
+var import_node_fs22 = require("fs");
 init_state();
 init_paths();
 var DEFAULT_CONFIG2 = {
@@ -13736,7 +15236,7 @@ var RemediationManager = class {
   }
   logLine(line) {
     try {
-      (0, import_node_fs20.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+      (0, import_node_fs22.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
     } catch {
     }
@@ -13793,9 +15293,9 @@ async function flushTelemetry(timeoutMs = 2e3) {
 }
 
 // src/daemon/index.ts
-function readVersion() {
+function readVersion2() {
   try {
-    const pkg = JSON.parse((0, import_node_fs21.readFileSync)((0, import_node_path12.join)(__dirname, "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse((0, import_node_fs23.readFileSync)((0, import_node_path15.join)(__dirname, "..", "package.json"), "utf-8"));
     return pkg.version || "0.0.0";
   } catch {
     return "0.0.0";
@@ -13803,7 +15303,7 @@ function readVersion() {
 }
 function logLine(line) {
   try {
-    (0, import_node_fs21.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+    (0, import_node_fs23.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
   } catch {
   }
@@ -13824,14 +15324,14 @@ async function runDaemon() {
     logLine(`[daemon] unhandledRejection: ${String(reason)}`);
     captureException(reason);
   });
-  const version = readVersion();
+  const version = readVersion2();
   logLine(`[daemon] starting threatcrushd v${version} mode=${PATHS.mode}`);
   try {
     initStateDB(PATHS.stateDb);
   } catch (err) {
     logLine(`[daemon] state db unavailable: ${err.message}`);
   }
-  const config = loadConfig((0, import_node_fs21.existsSync)(PATHS.configFile) ? PATHS.configFile : void 0);
+  const config = loadConfig((0, import_node_fs23.existsSync)(PATHS.configFile) ? PATHS.configFile : void 0);
   bus.on("event", (event) => {
     logLine(`[event] ${event.severity} ${event.module} ${event.message}`);
   });
@@ -13923,7 +15423,7 @@ async function runDaemon() {
 init_paths();
 init_pidfile();
 init_ipc_client();
-var DAEMON_ENTRY = (0, import_node_path13.join)(__dirname, "daemon.js");
+var DAEMON_ENTRY = (0, import_node_path16.join)(__dirname, "daemon.js");
 async function daemonForeground() {
   await runDaemon();
 }
@@ -13934,7 +15434,7 @@ async function daemonStart() {
     return;
   }
   ensureRuntimeDirs();
-  if (!(0, import_node_fs22.existsSync)(DAEMON_ENTRY)) {
+  if (!(0, import_node_fs24.existsSync)(DAEMON_ENTRY)) {
     console.log(source_default.red(`  Daemon entry not found at ${DAEMON_ENTRY}.`));
     console.log(source_default.dim("  Reinstall with `threatcrush update` or `pnpm run build` in the cli package."));
     return;
@@ -13942,8 +15442,8 @@ async function daemonStart() {
   let out;
   let err;
   try {
-    out = (0, import_node_fs23.openSync)(PATHS.logFile, "a");
-    err = (0, import_node_fs23.openSync)(PATHS.logFile, "a");
+    out = (0, import_node_fs25.openSync)(PATHS.logFile, "a");
+    err = (0, import_node_fs25.openSync)(PATHS.logFile, "a");
   } catch (e) {
     const code = e.code;
     console.log(source_default.red(`  \u2717 Cannot write daemon log at ${PATHS.logFile} (${code ?? "error"}).`));
@@ -14022,19 +15522,19 @@ async function daemonStop() {
 
 // src/commands/service.ts
 var import_node_child_process8 = require("child_process");
-var import_node_fs24 = require("fs");
-var import_node_path14 = require("path");
+var import_node_fs26 = require("fs");
+var import_node_path17 = require("path");
 var UNIT_PATH = "/etc/systemd/system/threatcrushd.service";
 function resolveTemplate() {
-  const templatePath = (0, import_node_path14.join)(__dirname, "systemd", "threatcrushd.service");
-  if (!(0, import_node_fs24.existsSync)(templatePath)) {
+  const templatePath = (0, import_node_path17.join)(__dirname, "systemd", "threatcrushd.service");
+  if (!(0, import_node_fs26.existsSync)(templatePath)) {
     throw new Error(`systemd unit template not found at ${templatePath}`);
   }
-  return (0, import_node_fs24.readFileSync)(templatePath, "utf-8");
+  return (0, import_node_fs26.readFileSync)(templatePath, "utf-8");
 }
 function resolveBinPath() {
   const arg = process.argv[1];
-  if (arg && (0, import_node_fs24.existsSync)(arg)) return arg;
+  if (arg && (0, import_node_fs26.existsSync)(arg)) return arg;
   try {
     return (0, import_node_child_process8.execSync)("command -v threatcrush", { encoding: "utf-8" }).trim();
   } catch {
@@ -14055,7 +15555,7 @@ async function installServiceCommand() {
     return;
   }
   const unit = resolveTemplate().replace("{{BIN_PATH}}", resolveBinPath());
-  (0, import_node_fs24.writeFileSync)(UNIT_PATH, unit, { mode: 420 });
+  (0, import_node_fs26.writeFileSync)(UNIT_PATH, unit, { mode: 420 });
   console.log(source_default.green(`  \u2713 Installed unit file: ${UNIT_PATH}`));
   ensureSystemDirs();
   try {
@@ -14079,17 +15579,17 @@ function ensureSystemDirs() {
   ];
   let admGid = null;
   try {
-    admGid = (0, import_node_fs24.statSync)("/var/log/auth.log").gid;
+    admGid = (0, import_node_fs26.statSync)("/var/log/auth.log").gid;
   } catch {
   }
   for (const { path, sticky } of dirs) {
     try {
-      (0, import_node_fs24.mkdirSync)(path, { recursive: true });
+      (0, import_node_fs26.mkdirSync)(path, { recursive: true });
     } catch {
     }
     if (admGid !== null) {
       try {
-        (0, import_node_fs24.chmodSync)(path, sticky ? 1533 : 509);
+        (0, import_node_fs26.chmodSync)(path, sticky ? 1533 : 509);
         (0, import_node_child_process8.execSync)(`chgrp adm ${path}`, { stdio: "ignore" });
       } catch {
       }
@@ -14116,7 +15616,7 @@ async function uninstallServiceCommand() {
   } catch {
   }
   try {
-    if ((0, import_node_fs24.existsSync)(UNIT_PATH)) {
+    if ((0, import_node_fs26.existsSync)(UNIT_PATH)) {
       (0, import_node_child_process8.execSync)(`rm -f ${UNIT_PATH}`);
       console.log(source_default.green(`  \u2713 Removed unit file: ${UNIT_PATH}`));
     }
@@ -14215,16 +15715,16 @@ function welcomeCommand() {
 }
 
 // src/commands/properties.ts
-var import_node_fs25 = require("fs");
-var import_node_path15 = require("path");
+var import_node_fs27 = require("fs");
+var import_node_path18 = require("path");
 var import_node_readline6 = __toESM(require("readline"));
 var API_URL7 = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
 var KINDS = ["url", "api", "domain", "ip", "repo"];
 function prompt2(question) {
   const rl = import_node_readline6.default.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve3) => rl.question(question, (answer) => {
+  return new Promise((resolve5) => rl.question(question, (answer) => {
     rl.close();
-    resolve3(answer.trim());
+    resolve5(answer.trim());
   }));
 }
 async function requireAuth() {
@@ -14545,8 +16045,8 @@ async function propertiesRunsCommand(opts) {
   }
 }
 function parseImportFile(path) {
-  const ext = (0, import_node_path15.extname)(path).toLowerCase();
-  const raw = (0, import_node_fs25.readFileSync)(path, "utf-8");
+  const ext = (0, import_node_path18.extname)(path).toLowerCase();
+  const raw = (0, import_node_fs27.readFileSync)(path, "utf-8");
   if (ext === ".json") {
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed)) throw new Error("JSON must be an array of objects");
@@ -14736,7 +16236,7 @@ async function rulesCommand(opts) {
 }
 
 // src/commands/harden.ts
-var import_node_fs26 = require("fs");
+var import_node_fs28 = require("fs");
 var import_node_child_process9 = require("child_process");
 function tryExec(cmd) {
   try {
@@ -14747,7 +16247,7 @@ function tryExec(cmd) {
 }
 function tryRead(path) {
   try {
-    return (0, import_node_fs26.readFileSync)(path, "utf-8");
+    return (0, import_node_fs28.readFileSync)(path, "utf-8");
   } catch {
     return null;
   }
@@ -14851,8 +16351,8 @@ function checkSshWeakConfig() {
   };
 }
 function checkAutoUpdates() {
-  const unattended = (0, import_node_fs26.existsSync)("/etc/apt/apt.conf.d/20auto-upgrades") || (0, import_node_fs26.existsSync)("/etc/apt/apt.conf.d/50unattended-upgrades");
-  const dnfAuto = (0, import_node_fs26.existsSync)("/etc/dnf/automatic.conf");
+  const unattended = (0, import_node_fs28.existsSync)("/etc/apt/apt.conf.d/20auto-upgrades") || (0, import_node_fs28.existsSync)("/etc/apt/apt.conf.d/50unattended-upgrades");
+  const dnfAuto = (0, import_node_fs28.existsSync)("/etc/dnf/automatic.conf");
   if (unattended || dnfAuto) {
     return {
       key: "auto-updates",
@@ -14978,7 +16478,7 @@ function checkFail2ban() {
       explanation: "fail2ban is installed and running."
     };
   }
-  if ((0, import_node_fs26.existsSync)("/etc/fail2ban/fail2ban.conf")) {
+  if ((0, import_node_fs28.existsSync)("/etc/fail2ban/fail2ban.conf")) {
     return {
       key: checkKey,
       status: "warn",
@@ -15207,10 +16707,10 @@ async function allowlistCommand(opts) {
 
 // src/index.ts
 init_paths();
-var PKG_VERSION = "0.1.8";
+var PKG_VERSION2 = "0.1.8";
 try {
-  const pkg = JSON.parse((0, import_node_fs27.readFileSync)((0, import_node_path16.join)(__dirname, "..", "package.json"), "utf-8"));
-  PKG_VERSION = pkg.version;
+  const pkg = JSON.parse((0, import_node_fs29.readFileSync)((0, import_node_path19.join)(__dirname, "..", "package.json"), "utf-8"));
+  PKG_VERSION2 = pkg.version;
 } catch {
 }
 var LOGO2 = `
@@ -15225,7 +16725,7 @@ ${source_default.dim("                    C R U S H")}
 var API_URL8 = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
 var PKG_NAME = "@profullstack/threatcrush";
 var DESKTOP_PKG_NAME = "@profullstack/threatcrush-desktop";
-var INSTALL_CONFIG_PATH = (0, import_node_path16.join)((0, import_node_os8.homedir)(), ".threatcrush", "install.json");
+var INSTALL_CONFIG_PATH = (0, import_node_path19.join)((0, import_node_os8.homedir)(), ".threatcrush", "install.json");
 function detectPackageManager() {
   try {
     const npmGlobal = (0, import_node_child_process10.execSync)("npm ls -g --depth=0 --json 2>/dev/null", { encoding: "utf-8" });
@@ -15251,7 +16751,7 @@ function detectPackageManager() {
 }
 function readInstallConfig() {
   try {
-    return JSON.parse((0, import_node_fs27.readFileSync)(INSTALL_CONFIG_PATH, "utf-8"));
+    return JSON.parse((0, import_node_fs29.readFileSync)(INSTALL_CONFIG_PATH, "utf-8"));
   } catch {
     return {};
   }
@@ -15318,7 +16818,7 @@ ${source_default.dim("Examples:")}
   ${source_default.green("$")} threatcrush modules install  ${source_default.dim("# Install a module")}
   ${source_default.green("$")} threatcrush update           ${source_default.dim("# Update to latest")}
   ${source_default.green("$")} threatcrush remove           ${source_default.dim("# Uninstall completely")}`
-).version(PKG_VERSION, "-v, --version", "Show version number").helpOption("-h, --help", "Show this help").addHelpText("after", `
+).version(PKG_VERSION2, "-v, --version", "Show version number").helpOption("-h, --help", "Show this help").addHelpText("after", `
 ${source_default.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500")}
 ${source_default.dim("Modules:")}
   ThreatCrush uses pluggable security modules. Core modules included:
@@ -15354,8 +16854,33 @@ program2.command("logout").description("Clear stored threatcrush.com credentials
 program2.command("whoami").description("Show the currently logged-in threatcrush.com account").action(async () => {
   await whoamiCommand();
 });
-program2.command("scan").description("Scan codebase for vulnerabilities and secrets").argument("[path]", "Path to scan", ".").action(async (targetPath) => {
-  await scanCommand(targetPath);
+program2.command("scan").description("Scan codebase for vulnerabilities and secrets").argument("[path]", "Path to scan", ".").option("-f, --format <format>", "output format: text, json, or sarif", "text").option("-o, --output <file>", "write json/sarif output to a file instead of stdout").option(
+  "--fail-on <severities>",
+  "exit 1 when a finding at or above any of these exists (comma-separated: critical,high,medium,low,info)"
+).option(
+  "--path-prefix <prefix>",
+  "prepend this to SARIF file URIs \u2014 use when the scan root is not the repository root"
+).option("--deps", "also query OSV.dev for advisories against lockfile versions (network)").option("-v, --verbose", "list the paths that could not be read").action(async (targetPath, opts) => {
+  const format = (opts.format ?? "text").toLowerCase();
+  if (!["text", "json", "sarif"].includes(format)) {
+    console.error(source_default.red(`Unknown --format "${opts.format}" (expected text, json, or sarif)`));
+    process.exit(2);
+  }
+  let failOn;
+  try {
+    failOn = parseFailOn(opts.failOn);
+  } catch (err) {
+    console.error(source_default.red(err.message));
+    process.exit(2);
+  }
+  await scanCommand(targetPath, {
+    format,
+    output: opts.output,
+    failOn,
+    pathPrefix: opts.pathPrefix,
+    dependencies: opts.deps,
+    verbose: opts.verbose
+  });
 });
 program2.command("pentest").description("Penetration test URLs and APIs").argument("<url>", "Target URL to pentest").action(async (url) => {
   await pentestCommand(url);
@@ -15401,7 +16926,7 @@ program2.command("uninstall-service").description("Remove the threatcrushd syste
 program2.command("logs").description("Tail daemon logs").action(async () => {
   console.log(LOGO2);
   const logPath = PATHS.logFile;
-  if (!(0, import_node_fs27.existsSync)(logPath)) {
+  if (!(0, import_node_fs29.existsSync)(logPath)) {
     console.log(source_default.yellow(`  No log file found at ${logPath}`));
     console.log(source_default.dim("  Start the daemon first with `threatcrush start`\n"));
     return;
@@ -15414,10 +16939,10 @@ program2.command("logs").description("Tail daemon logs").action(async () => {
 program2.command("activate").description("Activate your license key").action(async () => {
   console.log(LOGO2);
   const rl = import_readline.default.createInterface({ input: process.stdin, output: process.stdout });
-  const key = await new Promise((resolve3) => {
+  const key = await new Promise((resolve5) => {
     rl.question(source_default.green("  Enter your ThreatCrush license key: "), (answer) => {
       rl.close();
-      resolve3(answer.trim());
+      resolve5(answer.trim());
     });
   });
   if (!key) {
@@ -15504,10 +17029,10 @@ program2.command("update").description("Update ThreatCrush CLI and installed bun
 program2.command("remove").description("Uninstall ThreatCrush and the installed bundle").alias("uninstall").action(async () => {
   console.log(LOGO2);
   const rl = import_readline.default.createInterface({ input: process.stdin, output: process.stdout });
-  const confirm = await new Promise((resolve3) => {
+  const confirm = await new Promise((resolve5) => {
     rl.question(source_default.yellow("  Are you sure you want to uninstall ThreatCrush? (y/N): "), (answer) => {
       rl.close();
-      resolve3(answer.trim().toLowerCase());
+      resolve5(answer.trim().toLowerCase());
     });
   });
   if (confirm !== "y" && confirm !== "yes") {
@@ -15606,19 +17131,19 @@ storeCmd.command("search <query>").description("Search for modules in the store"
 });
 storeCmd.command("publish <url>").description("Publish a module from a git URL or web URL").action(async (url) => {
   console.log(LOGO2);
-  const configPath = (0, import_node_path16.join)((0, import_node_os8.homedir)(), ".threatcrush", "config.json");
+  const configPath = (0, import_node_path19.join)((0, import_node_os8.homedir)(), ".threatcrush", "config.json");
   let email = "";
   try {
-    const config = JSON.parse((0, import_node_fs27.readFileSync)(configPath, "utf-8"));
+    const config = JSON.parse((0, import_node_fs29.readFileSync)(configPath, "utf-8"));
     email = config.email || "";
   } catch {
   }
   if (!email) {
     const rl2 = import_readline.default.createInterface({ input: process.stdin, output: process.stdout });
-    email = await new Promise((resolve3) => {
+    email = await new Promise((resolve5) => {
       rl2.question(source_default.green("  Enter your email: "), (answer) => {
         rl2.close();
-        resolve3(answer.trim());
+        resolve5(answer.trim());
       });
     });
     if (!email || !email.includes("@")) {
@@ -15626,9 +17151,9 @@ storeCmd.command("publish <url>").description("Publish a module from a git URL o
       return;
     }
     try {
-      const dir = (0, import_node_path16.join)((0, import_node_os8.homedir)(), ".threatcrush");
-      if (!(0, import_node_fs27.existsSync)(dir)) (0, import_node_fs27.mkdirSync)(dir, { recursive: true });
-      (0, import_node_fs27.writeFileSync)(configPath, JSON.stringify({ email }, null, 2));
+      const dir = (0, import_node_path19.join)((0, import_node_os8.homedir)(), ".threatcrush");
+      if (!(0, import_node_fs29.existsSync)(dir)) (0, import_node_fs29.mkdirSync)(dir, { recursive: true });
+      (0, import_node_fs29.writeFileSync)(configPath, JSON.stringify({ email }, null, 2));
       console.log(source_default.dim(`  Saved email to ${configPath}`));
     } catch {
     }
@@ -15672,10 +17197,10 @@ storeCmd.command("publish <url>").description("Publish a module from a git URL o
   }
   console.log();
   const rl = import_readline.default.createInterface({ input: process.stdin, output: process.stdout });
-  const confirm = await new Promise((resolve3) => {
+  const confirm = await new Promise((resolve5) => {
     rl.question(source_default.yellow("  Publish this module? (y/N): "), (answer) => {
       rl.close();
-      resolve3(answer.trim().toLowerCase());
+      resolve5(answer.trim().toLowerCase());
     });
   });
   if (confirm !== "y" && confirm !== "yes") {