@ps-neko/nekowork 0.2.0-alpha.4 → 0.2.0-alpha.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ps-neko/nekowork",
-  "version": "0.2.0-alpha.4",
+  "version": "0.2.0-alpha.5",
   "description": "Local verification gate for AI-written code diffs. Deterministic rules decide the verdict, never the LLM. No auto-commit, push, or deploy — you decide at the Human Gate.",
   "keywords": [
     "ai-code-review",

package/scripts/lib/diff-parser.js

@@ -276,10 +276,15 @@ function synthesizeUntrackedDiff(cwd) {
  * @returns {string} concatenated unified-diff chunks
  */
 const SYNTH_FILE_SIZE_LIMIT = 2 * 1024 * 1024; // 2 MB per file
+const SYNTH_TOTAL_SIZE_LIMIT = 64 * 1024 * 1024; // 64 MB aggregate (guards full-scan OOM)
 
 function synthesizeFilesAsDiff(cwd, relPaths) {
   let chunks = '';
+  let truncated = false;
   for (const rel of relPaths) {
+    // Aggregate cap: stop accumulating once the synthesized diff is very large,
+    // so a huge full-scan / untracked tree cannot exhaust memory.
+    if (chunks.length >= SYNTH_TOTAL_SIZE_LIMIT) { truncated = true; break; }
     const full = path.join(cwd, rel);
     let content;
     try {
@@ -300,6 +305,11 @@ function synthesizeFilesAsDiff(cwd, relPaths) {
     chunks += `@@ -0,0 +1,${lines.length} @@\n`;
     for (const line of lines) chunks += `+${line}\n`;
   }
+  if (truncated) {
+    process.stderr.write(
+      `warning: diff synthesis truncated at ${Math.round(SYNTH_TOTAL_SIZE_LIMIT / (1024 * 1024))}MB; some files were not scanned. Narrow the scope (avoid --full-scan on very large trees).\n`,
+    );
+  }
   return chunks;
 }
 

package/scripts/lib/rules/auto-apply-commit-push.js

@@ -28,8 +28,9 @@ const PATTERNS = [
   },
   {
     id: 'rm-rf-variable',
-    // rm -r -f or rm -rf with variable expansion in the path
-    re: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\b[^\n]*\$\{?\w/g,
+    // rm with recursive+force flags (combined `-rf`/`-fr` or separated `-r -f`/`-f -r`)
+    // and variable expansion in the path.
+    re: /\brm\s+(?=-[a-zA-Z]*(?:rf|fr)|-[a-zA-Z]*r[a-zA-Z]*\s+-[a-zA-Z]*f|-[a-zA-Z]*f[a-zA-Z]*\s+-[a-zA-Z]*r)-[a-zA-Z][^\n]*\$\{?\w/g,
     severity: 'critical',
     title: 'rm -rf with variable path',
     description: 'Removing with a variable path is dangerous — if the variable is empty, the parent directory is wiped.',
@@ -39,7 +40,7 @@ const PATTERNS = [
     id: 'rm-rf-system',
     // rm -rf on a root-like path (not allowed: /tmp, /var/{log,cache,tmp},
     // /home/<u>, /root/<x>, /node_modules — common safe targets)
-    re: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\s+\/(?!tmp(?:\/|$|\s)|var\/(?:log|cache|tmp)\/|home\/\w|root\/\w|node_modules\/|opt\/render\/)\S*/g,
+    re: /\brm\s+(?=-[a-zA-Z]*(?:rf|fr)|-[a-zA-Z]*r[a-zA-Z]*\s+-[a-zA-Z]*f|-[a-zA-Z]*f[a-zA-Z]*\s+-[a-zA-Z]*r)-[a-zA-Z][^\n]*?\s+\/(?!tmp(?:\/|$|\s)|var\/(?:log|cache|tmp)\/|home\/\w|root\/\w|node_modules\/|opt\/render\/)\S*/g,
     severity: 'critical',
     title: 'rm -rf on system path',
     description: 'Removing system paths is destructive and rarely intentional in a build/automation script.',

package/scripts/lib/rules/secret-fallback.js

@@ -18,9 +18,10 @@ import { addedLines as collectAddedLines } from '../diff-parser.js';
 const PATTERNS = [
   {
     id: 'env-or-literal',
-    re: /process\.env\.(\w+)\s*\|\|\s*(["'`])([^"'`\n]+)\2/g,
-    pickEnv: m => m[1],
-    pickLiteral: m => m[3],
+    // dot form  process.env.X || "lit"  and bracket form  process.env['X'] || "lit"
+    re: /process\.env(?:\.(\w+)|\[(["'`])(\w+)\2\])\s*\|\|\s*(["'`])([^"'`\n]+)\4/g,
+    pickEnv: m => m[1] || m[3],
+    pickLiteral: m => m[5],
   },
   {
     id: 'nullish-fallback',
@@ -42,9 +43,12 @@ const PATTERNS = [
   },
   {
     id: 'config-or-literal',
-    re: /\b([A-Za-z_]\w*\.(?:apiKey|secret|secretKey|token|password|key|jwt|auth))\s*\|\|\s*(["'`])([^"'`\n]+)\2/g,
+    // dot form  obj.secretProp || "lit"  and bracket form  obj['SECRET_KEY'] || "lit".
+    // The bracket key is gated to secret-keyword names so generic config defaults
+    // (e.g. config['timeout'] || 5000) do not match.
+    re: /\b([A-Za-z_]\w*\.(?:apiKey|secret|secretKey|token|password|key|jwt|auth)|[A-Za-z_]\w*\[(["'`])[\w-]*(?:KEY|TOKEN|SECRET|PASSWORD|PASS|AUTH|JWT|API|CREDENTIAL|apiKey|secretKey)[\w-]*\2\])\s*\|\|\s*(["'`])([^"'`\n]+)\3/g,
     pickEnv: m => m[1],
-    pickLiteral: m => m[3],
+    pickLiteral: m => m[4],
   },
   {
     id: 'config-fallback-property',