@securecode-ai/mcp 0.5.4 → 0.5.6

package/dist/utils/localTestRunner.js

@@ -1,117 +1,138 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
+/**
+ * Local test runner — drives execution of LLM-generated verification tests
+ * through the verification sandbox.
+ *
+ * SECURITY MODEL (post-rewrite):
+ *   1. `checkTestSafety()` runs first as defense-in-depth. If it blocks,
+ *      we return early without spawning anything.
+ *   2. `detectSandbox()` returns the best available real isolation backend
+ *      (Docker preferred, Deno as a JS/TS-only fallback). If neither is
+ *      available, this runner returns `sandbox-unavailable` — it does NOT
+ *      fall back to executing the script with host privileges.
+ *   3. The sandbox backend executes the script with no network, a
+ *      read-only workspace, a tmpfs /tmp, capped CPU/memory/pids, and a
+ *      scrubbed env (only NODE_ENV and PATH). The verdict is parsed from
+ *      stdout/stderr against `/PASS:/` and `/FAIL:/` markers.
+ *
+ * The previous implementation spread the full `process.env` into the
+ * child and ran via `execFileSync` with no isolation. That allowed
+ * prompt-injected content in scanned source to ride into the
+ * verify-generate prompt and produce a test that exfiltrated secrets.
+ */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SANDBOX_UNAVAILABLE_MESSAGE = void 0;
 exports.runLocalTest = runLocalTest;
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const child_process_1 = require("child_process");
+exports.runTestCommand = runTestCommand;
 const testSafety_1 = require("./testSafety");
-const PASS_PATTERN = /^PASS:\s*(.+)$/m;
-const FAIL_PATTERN = /^FAIL:\s*(.+)$/m;
-const TIMEOUT_MS = 30_000;
-async function runLocalTest(script, runner, workspaceRoot) {
+const effectMock_1 = require("./effectMock");
+const verificationSandbox_1 = require("./verificationSandbox");
+const DEFAULT_TIMEOUT_MS = 30_000;
+/**
+ * The message shown when no isolation backend is available. Exported so the
+ * agent-scan tool can reuse it in its top-level `verifyHint` (instead of
+ * every finding carrying the full text in its `provenReason`).
+ *
+ * Why this matters: without a sandbox, the verify loop returns INCONCLUSIVE
+ * for every high/medium finding. The headline differentiator of Pipeline 2
+ * ("exploit-verified, not just LLM-believed") is offline. The user needs to
+ * know — in one place, with a copy-pasteable install path — what to do.
+ */
+exports.SANDBOX_UNAVAILABLE_MESSAGE = 'No verification sandbox backend (Docker or Deno) was detected locally. ' +
+    'Exploit verification was skipped — the finding is reported as INCONCLUSIVE ' +
+    'with confidence capped at 75%. To enable exploit-verified findings:\n' +
+    '  • Docker (preferred, supports any language): https://docs.docker.com/get-docker\n' +
+    '  • Deno (JS/TS only, lighter install):    https://deno.com/#installation\n' +
+    'If neither is available, the API-side sandbox (on the server) is used as an ' +
+    'automatic fallback — no local install required, but slower (network round-trip per finding).';
+async function runLocalTest(script, runner, workspaceRoot, options) {
+    // 1. Defense-in-depth static check.
     const safety = (0, testSafety_1.checkTestSafety)(script, workspaceRoot);
     if (!safety.allowed) {
-        return { verdict: 'error', output: `Test script blocked: ${safety.reason}`, exitCode: -1 };
+        return { verdict: 'blocked', output: `Test script blocked: ${safety.reason}`, exitCode: -1 };
     }
-    const testDir = path.join(workspaceRoot, '.securecode');
-    if (!fs.existsSync(testDir))
-        fs.mkdirSync(testDir, { recursive: true });
-    const ext = (runner === 'tsx' || runner === 'ts' || runner === 'bun') ? '.test.ts' : '.test.js';
-    const testFile = path.join(testDir, `verify-test-${Date.now()}-${Math.random().toString(36).slice(2, 8)}${ext}`);
-    try {
-        fs.writeFileSync(testFile, script, 'utf8');
-        let stdout = '';
-        let stderr = '';
-        let exitCode = 0;
-        let timedOut = false;
-        try {
-            const isWindows = process.platform === 'win32';
-            let runnerBin;
-            let runnerArgs;
-            if (runner === 'tsx') {
-                runnerBin = 'npx';
-                runnerArgs = ['tsx', testFile];
-            }
-            else if (runner === 'bun' && isWindows) {
-                runnerBin = 'npx';
-                runnerArgs = ['bun', testFile];
-            }
-            else {
-                runnerBin = runner;
-                runnerArgs = [testFile];
-            }
-            stdout = (0, child_process_1.execFileSync)(runnerBin, runnerArgs, {
-                cwd: workspaceRoot,
-                timeout: TIMEOUT_MS,
-                encoding: 'utf8',
-                stdio: ['pipe', 'pipe', 'pipe'],
-                env: { ...process.env, NODE_ENV: 'test' },
-                shell: isWindows,
-            });
-        }
-        catch (err) {
-            stdout = err.stdout || '';
-            stderr = err.stderr || '';
-            exitCode = err.status ?? 1;
-            if (err.signal === 'SIGTERM')
-                timedOut = true;
-        }
-        const output = (stdout + '\n' + stderr).trim();
-        if (timedOut) {
-            return { verdict: 'timeout', output: 'Test timed out after 30s', exitCode: -1 };
-        }
-        if (PASS_PATTERN.test(output)) {
-            return { verdict: 'pass', output, exitCode };
-        }
-        if (FAIL_PATTERN.test(output)) {
-            return { verdict: 'fail', output, exitCode };
-        }
-        if (exitCode === 0) {
-            return { verdict: 'error', output: output + '\nTest exited 0 but did not print PASS: or FAIL:', exitCode };
+    if (options?.setupScript) {
+        const setupSafety = (0, testSafety_1.checkTestSafety)(options.setupScript, workspaceRoot);
+        if (!setupSafety.allowed) {
+            return { verdict: 'blocked', output: `Setup script blocked: ${setupSafety.reason}`, exitCode: -1 };
         }
-        return { verdict: 'error', output, exitCode };
     }
-    catch (err) {
-        return { verdict: 'error', output: err.message || String(err), exitCode: -1 };
+    // 2. Resolve the sandbox backend. Production: detectSandbox(). Tests: inject.
+    const backend = options?.sandboxBackend ?? (0, verificationSandbox_1.detectSandbox)();
+    if (!backend) {
+        return {
+            verdict: 'sandbox-unavailable',
+            output: exports.SANDBOX_UNAVAILABLE_MESSAGE,
+            exitCode: -1,
+        };
     }
-    finally {
+    // 2b. Auto-create effect mock for JS/TS projects (harmless if unused).
+    //     Must happen before the sandbox mounts the workspace.
+    if (runner !== 'python' && runner !== 'python3') {
         try {
-            fs.unlinkSync(testFile);
+            (0, effectMock_1.createEffectMock)(workspaceRoot);
         }
         catch { }
     }
+    // 3. Execute inside the sandbox.
+    const execOpts = {
+        script,
+        runner,
+        workspaceRoot,
+        setupScript: options?.setupScript,
+        timeoutMs: options?.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+        signal: options?.signal,
+    };
+    const result = await backend.execute(execOpts);
+    // Preserve the "exited 0 but no PASS/FAIL marker" message — it's a
+    // useful signal that the test ran but didn't follow the protocol.
+    if (result.verdict === 'error' && result.exitCode === 0) {
+        return {
+            verdict: 'error',
+            output: `${result.output}\nTest exited 0 but did not print PASS: or FAIL:`,
+            exitCode: result.exitCode,
+            backend: result.backend,
+        };
+    }
+    return {
+        verdict: result.verdict,
+        output: result.output,
+        exitCode: result.exitCode,
+        backend: result.backend,
+    };
+}
+/**
+ * Run a validated test command (npm test, pytest, etc.) inside the sandbox.
+ * Uses command mode — no script file is written; the executable + args are
+ * passed directly to the sandbox backend. The sandbox enforces network=none,
+ * read-only workspace, and resource limits.
+ *
+ * Returns the same LocalTestResult shape as runLocalTest, with exit-code-based
+ * verdicts (0 = pass, nonzero = fail).
+ */
+async function runTestCommand(executable, args, workspaceRoot, options) {
+    const backend = options?.sandboxBackend ?? (0, verificationSandbox_1.detectSandbox)();
+    if (!backend) {
+        return {
+            verdict: 'sandbox-unavailable',
+            output: exports.SANDBOX_UNAVAILABLE_MESSAGE,
+            exitCode: -1,
+        };
+    }
+    const execOpts = {
+        mode: 'command',
+        executable,
+        args,
+        workspaceRoot,
+        timeoutMs: options?.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+        signal: options?.signal,
+    };
+    const result = await backend.execute(execOpts);
+    return {
+        verdict: result.verdict,
+        output: result.output,
+        exitCode: result.exitCode,
+        backend: result.backend,
+    };
 }
 //# sourceMappingURL=localTestRunner.js.map

package/dist/utils/localTestRunner.js.map

@@ -1 +1 @@
-{"version":3,"file":"localTestRunner.js","sourceRoot":"","sources":["../../src/utils/localTestRunner.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,oCA2EC;AA1FD,uCAAyB;AACzB,2CAA6B;AAC7B,iDAA6C;AAC7C,6CAA+C;AAQ/C,MAAM,YAAY,GAAG,iBAAiB,CAAC;AACvC,MAAM,YAAY,GAAG,iBAAiB,CAAC;AACvC,MAAM,UAAU,GAAG,MAAM,CAAC;AAEnB,KAAK,UAAU,YAAY,CAC9B,MAAc,EACd,MAAc,EACd,aAAqB;IAErB,MAAM,MAAM,GAAG,IAAA,4BAAe,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,MAAM,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IACxD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAExE,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;IAChG,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IAEjH,IAAI,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAE3C,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,IAAI,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;YAC/C,IAAI,SAAiB,CAAC;YACtB,IAAI,UAAoB,CAAC;YACzB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACnB,SAAS,GAAG,KAAK,CAAC;gBAClB,UAAU,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACnC,CAAC;iBAAM,IAAI,MAAM,KAAK,KAAK,IAAI,SAAS,EAAE,CAAC;gBACvC,SAAS,GAAG,KAAK,CAAC;gBAClB,UAAU,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACJ,SAAS,GAAG,MAAM,CAAC;gBACnB,UAAU,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC;YACD,MAAM,GAAG,IAAA,4BAAY,EAAC,SAAS,EAAE,UAAU,EAAE;gBACzC,GAAG,EAAE,aAAa;gBAClB,OAAO,EAAE,UAAU;gBACnB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE;gBACzC,KAAK,EAAE,SAAS;aACnB,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;YAC1B,QAAQ,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;YAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,QAAQ,GAAG,IAAI,CAAC;QAClD,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAE/C,IAAI,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC;QACpF,CAAC;QAED,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACjD,CAAC;QAED,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,kDAAkD,EAAE,QAAQ,EAAE,CAAC;QAC/G,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC;IAClF,CAAC;YAAS,CAAC;QACP,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IAC7C,CAAC;AACL,CAAC"}
+{"version":3,"file":"localTestRunner.js","sourceRoot":"","sources":["../../src/utils/localTestRunner.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;;AAwCH,oCAsEC;AAWD,wCAoCC;AA3JD,6CAA+C;AAC/C,6CAAgD;AAChD,+DAK+B;AAU/B,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;;;;;GASG;AACU,QAAA,2BAA2B,GACpC,yEAAyE;IACzE,6EAA6E;IAC7E,uEAAuE;IACvE,qFAAqF;IACrF,6EAA6E;IAC7E,8EAA8E;IAC9E,8FAA8F,CAAC;AAE5F,KAAK,UAAU,YAAY,CAC9B,MAAc,EACd,MAAc,EACd,aAAqB,EACrB,OAMC;IAED,oCAAoC;IACpC,MAAM,MAAM,GAAG,IAAA,4BAAe,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,wBAAwB,MAAM,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC;IACjG,CAAC;IAED,IAAI,OAAO,EAAE,WAAW,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,IAAA,4BAAe,EAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,WAAW,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC;QACvG,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,MAAM,OAAO,GAAG,OAAO,EAAE,cAAc,IAAI,IAAA,mCAAa,GAAE,CAAC;IAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO;YACH,OAAO,EAAE,qBAAqB;YAC9B,MAAM,EAAE,mCAA2B;YACnC,QAAQ,EAAE,CAAC,CAAC;SACf,CAAC;IACN,CAAC;IAED,uEAAuE;IACvE,2DAA2D;IAC3D,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC;YAAC,IAAA,6BAAgB,EAAC,aAAa,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACrD,CAAC;IAED,iCAAiC;IACjC,MAAM,QAAQ,GAA0B;QACpC,MAAM;QACN,MAAM;QACN,aAAa;QACb,WAAW,EAAE,OAAO,EAAE,WAAW;QACjC,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,kBAAkB;QACnD,MAAM,EAAE,OAAO,EAAE,MAAM;KAC1B,CAAC;IAEF,MAAM,MAAM,GAAyB,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAErE,mEAAmE;IACnE,kEAAkE;IAClE,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO;YACH,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,kDAAkD;YAC1E,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;SAC1B,CAAC;IACN,CAAC;IAED,OAAO;QACH,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;KAC1B,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,cAAc,CAChC,UAAkB,EAClB,IAAc,EACd,aAAqB,EACrB,OAIC;IAED,MAAM,OAAO,GAAG,OAAO,EAAE,cAAc,IAAI,IAAA,mCAAa,GAAE,CAAC;IAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO;YACH,OAAO,EAAE,qBAAqB;YAC9B,MAAM,EAAE,mCAA2B;YACnC,QAAQ,EAAE,CAAC,CAAC;SACf,CAAC;IACN,CAAC;IAED,MAAM,QAAQ,GAA0B;QACpC,IAAI,EAAE,SAAS;QACf,UAAU;QACV,IAAI;QACJ,aAAa;QACb,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,kBAAkB;QACnD,MAAM,EAAE,OAAO,EAAE,MAAM;KAC1B,CAAC;IAEF,MAAM,MAAM,GAAyB,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAErE,OAAO;QACH,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;KAC1B,CAAC;AACN,CAAC"}

package/dist/utils/runtimeDetect.d.ts

@@ -1,8 +1,18 @@
-export type ProjectRuntime = 'bun' | 'node' | 'deno';
+export type ProjectRuntime = 'bun' | 'node' | 'deno' | 'python';
+export type PackageManager = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'pip' | 'poetry' | 'uv' | null;
+export type Framework = 'electron' | 'next' | 'remix' | 'nuxt' | 'react-native' | 'express' | 'fastify' | 'nestjs' | 'koa' | 'hapi' | 'flask' | 'fastapi' | 'django' | 'react' | 'vue' | 'svelte' | 'cloudflare-workers' | null;
+export type TestabilityTier = 1 | 2 | 3 | 4;
 export interface RuntimeInfo {
     runtime: ProjectRuntime;
     runner: string;
+    packageManager: PackageManager;
+    framework: Framework;
+    frameworkVersion: string | null;
+    testabilityTier: TestabilityTier;
+    canRunLocally: boolean;
+    skipReason?: string;
     hasBunLock: boolean;
+    depsInstalled: boolean;
 }
-export declare function detectRuntime(workspaceRoot: string): RuntimeInfo;
+export declare function detectRuntime(workspaceRoot: string, filePath?: string): RuntimeInfo;
 export declare function computeRelativeImportPath(testFileDir: string, targetFilePath: string): string;

package/dist/utils/runtimeDetect.js

@@ -37,22 +37,259 @@ exports.detectRuntime = detectRuntime;
 exports.computeRelativeImportPath = computeRelativeImportPath;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-function detectRuntime(workspaceRoot) {
-    const hasBunLock = fs.existsSync(path.join(workspaceRoot, 'bun.lockb')) ||
-        fs.existsSync(path.join(workspaceRoot, 'bun.lock')) ||
-        fs.existsSync(path.join(workspaceRoot, 'bunfig.toml'));
-    if (hasBunLock) {
-        return { runtime: 'bun', runner: 'bun', hasBunLock: true };
+const child_process_1 = require("child_process");
+const JS_FRAMEWORK_RULES = [
+    { dep: 'react-native', framework: 'react-native', tier: 4 },
+    { dep: '@cloudflare/workers-types', framework: 'cloudflare-workers', tier: 4 },
+    { dep: 'wrangler', framework: 'cloudflare-workers', tier: 4 },
+    { dep: 'electron', framework: 'electron', tier: 2 },
+    { dep: 'next', framework: 'next', tier: 2 },
+    { dep: '@remix-run/node', framework: 'remix', tier: 2 },
+    { dep: 'remix', framework: 'remix', tier: 2 },
+    { dep: 'nuxt', framework: 'nuxt', tier: 2 },
+    { dep: '@nestjs/core', framework: 'nestjs', tier: 1 },
+    { dep: 'fastify', framework: 'fastify', tier: 1 },
+    { dep: 'express', framework: 'express', tier: 1 },
+    { dep: 'koa', framework: 'koa', tier: 1 },
+    { dep: '@hapi/hapi', framework: 'hapi', tier: 1 },
+    { dep: 'svelte', framework: 'svelte', tier: 3 },
+    { dep: 'vue', framework: 'vue', tier: 3 },
+    { dep: 'react', framework: 'react', tier: 3 },
+];
+const PY_FRAMEWORK_RULES = [
+    { dep: 'fastapi', framework: 'fastapi', tier: 1 },
+    { dep: 'flask', framework: 'flask', tier: 1 },
+    { dep: 'django', framework: 'django', tier: 1 },
+];
+const TIER_SKIP_REASONS = {
+    4: 'Framework requires a runtime that cannot be invoked locally (Metro/worker runtime). Set canTest: false.',
+};
+const probeCache = new Map();
+function probe(bin) {
+    if (probeCache.has(bin))
+        return probeCache.get(bin);
+    let ok = false;
+    try {
+        const r = (0, child_process_1.spawnSync)(bin, ['--version'], {
+            stdio: 'ignore',
+            shell: process.platform === 'win32',
+            timeout: 4000,
+        });
+        ok = r.status === 0;
     }
-    if (fs.existsSync(path.join(workspaceRoot, 'deno.json')) ||
-        fs.existsSync(path.join(workspaceRoot, 'deno.jsonc'))) {
-        return { runtime: 'deno', runner: 'deno', hasBunLock: false };
+    catch {
+        ok = false;
     }
-    return { runtime: 'node', runner: 'tsx', hasBunLock: false };
+    probeCache.set(bin, ok);
+    return ok;
+}
+function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function exists(...files) {
+    return files.some(f => fs.existsSync(f));
+}
+function findNearest(startDir, root, candidates) {
+    let dir = startDir;
+    const rootAbs = path.resolve(root);
+    while (true) {
+        for (const c of candidates) {
+            const p = path.join(dir, c);
+            if (fs.existsSync(p))
+                return { dir, file: p };
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir || !dir.startsWith(rootAbs))
+            break;
+        dir = parent;
+    }
+    return null;
+}
+function detectJsFramework(pkg) {
+    if (!pkg)
+        return { framework: null, version: null, tier: 1 };
+    const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
+    for (const rule of JS_FRAMEWORK_RULES) {
+        if (deps[rule.dep]) {
+            return { framework: rule.framework, version: deps[rule.dep] || null, tier: rule.tier };
+        }
+    }
+    return { framework: null, version: null, tier: 1 };
+}
+function detectPyFramework(startDir, root) {
+    const reqs = findNearest(startDir, root, ['requirements.txt', 'pyproject.toml', 'setup.py', 'Pipfile']);
+    if (!reqs)
+        return { framework: null, version: null, tier: 1 };
+    let text = '';
+    try {
+        text = fs.readFileSync(reqs.file, 'utf8');
+    }
+    catch {
+        return { framework: null, version: null, tier: 1 };
+    }
+    const lower = text.toLowerCase();
+    for (const rule of PY_FRAMEWORK_RULES) {
+        const re = new RegExp(`^\\s*${rule.dep}(\\s*[=><~!]|\\s*$)`, 'im');
+        if (re.test(lower)) {
+            const verMatch = lower.match(new RegExp(`${rule.dep}\\s*[=><~!]*\\s*([0-9][0-9a-zA-Z.\\-]*)`, 'im'));
+            return { framework: rule.framework, version: verMatch ? verMatch[1] : null, tier: rule.tier };
+        }
+    }
+    return { framework: null, version: null, tier: 1 };
+}
+function resolveJsRunner(runtime, pkgManager) {
+    if (runtime === 'bun')
+        return probe('bun') ? 'bun' : 'tsx';
+    if (runtime === 'deno')
+        return probe('deno') ? 'deno' : 'tsx';
+    if (pkgManager === 'pnpm' && probe('pnpm'))
+        return 'pnpm-tsx';
+    if (pkgManager === 'yarn' && probe('yarn'))
+        return 'yarn-tsx';
+    return 'tsx';
+}
+function resolvePythonRunner() {
+    if (probe('python3'))
+        return { runner: 'python3', installed: true };
+    if (probe('python'))
+        return { runner: 'python', installed: true };
+    return { runner: 'python3', installed: false };
+}
+function detectPackageManager(pkg, nearest) {
+    if (pkg?.packageManager) {
+        const pm = String(pkg.packageManager).toLowerCase();
+        if (pm.startsWith('bun'))
+            return 'bun';
+        if (pm.startsWith('pnpm'))
+            return 'pnpm';
+        if (pm.startsWith('yarn'))
+            return 'yarn';
+        if (pm.startsWith('npm'))
+            return 'npm';
+    }
+    if (nearest) {
+        const dir = nearest.dir;
+        if (exists(path.join(dir, 'bun.lockb'), path.join(dir, 'bun.lock')))
+            return 'bun';
+        if (exists(path.join(dir, 'pnpm-lock.yaml')))
+            return 'pnpm';
+        if (exists(path.join(dir, 'yarn.lock')))
+            return 'yarn';
+        if (exists(path.join(dir, 'package-lock.json')))
+            return 'npm';
+    }
+    return 'npm';
+}
+function detectRuntime(workspaceRoot, filePath) {
+    const rootAbs = path.resolve(workspaceRoot);
+    const isPythonFile = filePath ? /\.p(yi?|yx)$/i.test(filePath) : false;
+    if (isPythonFile) {
+        const startDir = filePath
+            ? path.resolve(rootAbs, path.dirname(filePath))
+            : rootAbs;
+        const py = resolvePythonRunner();
+        const { framework, version, tier } = detectPyFramework(startDir, rootAbs);
+        const pkgMan = (() => {
+            if (exists(path.join(startDir, 'poetry.lock')))
+                return 'poetry';
+            if (exists(path.join(startDir, 'uv.lock')))
+                return 'uv';
+            if (exists(path.join(startDir, 'Pipfile')))
+                return 'pip';
+            if (exists(path.join(startDir, 'requirements.txt'), path.join(startDir, 'pyproject.toml')))
+                return 'pip';
+            return null;
+        })();
+        const canRun = py.installed && tier !== 4;
+        return {
+            runtime: 'python',
+            runner: py.runner,
+            packageManager: pkgMan,
+            framework,
+            frameworkVersion: version,
+            testabilityTier: tier,
+            canRunLocally: canRun,
+            skipReason: !py.installed
+                ? 'Python interpreter not found in PATH. Install python3 to run local exploit tests.'
+                : tier === 4 ? TIER_SKIP_REASONS[4] : undefined,
+            hasBunLock: false,
+            depsInstalled: exists(path.join(startDir, '__pycache__')) || exists(path.join(startDir, '.venv'), path.join(startDir, 'venv')),
+        };
+    }
+    const startDir = filePath
+        ? path.resolve(rootAbs, path.dirname(filePath))
+        : rootAbs;
+    const nearestPkg = findNearest(startDir, rootAbs, ['package.json']);
+    const pkg = nearestPkg ? readJson(nearestPkg.file) : null;
+    const hasBunLock = exists(path.join(rootAbs, 'bun.lockb'), path.join(rootAbs, 'bun.lock'), path.join(rootAbs, 'bunfig.toml'));
+    let runtime = 'node';
+    const nearestLock = findNearest(startDir, rootAbs, [
+        'bun.lockb', 'bun.lock', 'bunfig.toml',
+        'deno.json', 'deno.jsonc',
+        'package-lock.json', 'pnpm-lock.yaml', 'yarn.lock',
+    ]);
+    if (pkg?.packageManager && String(pkg.packageManager).toLowerCase().startsWith('bun')) {
+        runtime = 'bun';
+    }
+    else if (pkg?.engines?.bun) {
+        runtime = 'bun';
+    }
+    else if (hasBunLock) {
+        runtime = 'bun';
+    }
+    else if (pkg?.packageManager && String(pkg.packageManager).toLowerCase().startsWith('deno')) {
+        runtime = 'deno';
+    }
+    else if (exists(path.join(rootAbs, 'deno.json'), path.join(rootAbs, 'deno.jsonc'))) {
+        runtime = 'deno';
+    }
+    else if (nearestLock?.file.endsWith('deno.json') || nearestLock?.file.endsWith('deno.jsonc')) {
+        runtime = 'deno';
+    }
+    else {
+        runtime = 'node';
+    }
+    const packageManager = detectPackageManager(pkg, nearestLock);
+    const { framework, version, tier } = detectJsFramework(pkg);
+    const runner = resolveJsRunner(runtime, packageManager);
+    const canRun = tier !== 4;
+    const depsInstalled = (() => {
+        const searchDirs = [startDir, rootAbs];
+        for (const d of searchDirs) {
+            if (exists(path.join(d, 'node_modules')))
+                return true;
+        }
+        if (nearestPkg) {
+            if (exists(path.join(nearestPkg.dir, 'node_modules')))
+                return true;
+        }
+        return false;
+    })();
+    return {
+        runtime,
+        runner,
+        packageManager,
+        framework,
+        frameworkVersion: version,
+        testabilityTier: tier,
+        canRunLocally: canRun,
+        skipReason: tier === 4 ? TIER_SKIP_REASONS[4] : undefined,
+        hasBunLock,
+        depsInstalled,
+    };
 }
 function computeRelativeImportPath(testFileDir, targetFilePath) {
     const rel = path.relative(testFileDir, targetFilePath);
     const normalized = rel.replace(/\\/g, '/');
+    if (/\.p(yi?|yx)$/i.test(targetFilePath)) {
+        const fromRoot = path.relative(path.dirname(testFileDir), targetFilePath).replace(/\\/g, '/');
+        return fromRoot.startsWith('.') ? fromRoot : `./${fromRoot}`;
+    }
     const withoutExt = normalized.replace(/\.(ts|tsx|js|jsx|mjs|cjs)$/, '');
     return withoutExt.startsWith('.') ? withoutExt : `./${withoutExt}`;
 }

package/dist/utils/runtimeDetect.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtimeDetect.js","sourceRoot":"","sources":["../../src/utils/runtimeDetect.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,sCAeC;AAED,8DAKC;AAjCD,uCAAyB;AACzB,2CAA6B;AAU7B,SAAgB,aAAa,CAAC,aAAqB;IAC/C,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACnE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QACnD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;IAE3D,IAAI,UAAU,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC/D,CAAC;IAED,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACpD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAClE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AACjE,CAAC;AAED,SAAgB,yBAAyB,CAAC,WAAmB,EAAE,cAAsB;IACjF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;IACxE,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;AACvE,CAAC"}
+{"version":3,"file":"runtimeDetect.js","sourceRoot":"","sources":["../../src/utils/runtimeDetect.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2KA,sCAgGC;AAED,8DAWC;AAxRD,uCAAyB;AACzB,2CAA6B;AAC7B,iDAA0C;AA2B1C,MAAM,kBAAkB,GAAwE;IAC5F,EAAE,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,EAAE;IAC3D,EAAE,GAAG,EAAE,2BAA2B,EAAE,SAAS,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,EAAE;IAC9E,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,EAAE;IAC7D,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE;IACnD,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE;IAC3C,EAAE,GAAG,EAAE,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;IACvD,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;IAC7C,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE;IAC3C,EAAE,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE;IACrD,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE;IACjD,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE;IACjD,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE;IACzC,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE;IACjD,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE;IAC/C,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE;IACzC,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;CAChD,CAAC;AAEF,MAAM,kBAAkB,GAAwE;IAC5F,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE;IACjD,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;IAC7C,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE;CAClD,CAAC;AAEF,MAAM,iBAAiB,GAA2B;IAC9C,CAAC,EAAE,yGAAyG;CAC/G,CAAC;AAEF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmB,CAAC;AAE9C,SAAS,KAAK,CAAC,GAAW;IACtB,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;IACrD,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,IAAI,CAAC;QACD,MAAM,CAAC,GAAG,IAAA,yBAAS,EAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE;YACpC,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;YACnC,OAAO,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,EAAE,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACL,EAAE,GAAG,KAAK,CAAC;IACf,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxB,OAAO,EAAE,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC1B,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAG,KAAe;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,WAAW,CAChB,QAAgB,EAChB,IAAY,EACZ,UAAoB;IAEpB,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,IAAI,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC5B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;gBAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAClD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,MAAM;QACtD,GAAG,GAAG,MAAM,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAQ;IAC/B,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC7D,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;IAC7E,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3F,CAAC;IACL,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB,EAAE,IAAY;IACrD,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;IACxG,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC9D,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACD,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,GAAG,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,yCAAyC,EAAE,IAAI,CAAC,CAAC,CAAC;YACrG,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QAClG,CAAC;IACL,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,eAAe,CAAC,OAAuB,EAAE,UAA0B;IACxE,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3D,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9D,IAAI,UAAU,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,UAAU,CAAC;IAC9D,IAAI,UAAU,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,UAAU,CAAC;IAC9D,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB;IACxB,IAAI,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAQ,EAAE,OAA6C;IACjF,IAAI,GAAG,EAAE,cAAc,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;QACpD,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACzC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACzC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACV,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACxB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAClF,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC;QAC5D,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC;QACvD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAgB,aAAa,CAAC,aAAqB,EAAE,QAAiB;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAEvE,IAAI,YAAY,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,QAAQ;YACrB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC/C,CAAC,CAAC,OAAO,CAAC;QACd,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;QACjC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE;YACjB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAChE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YACzD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YACzG,OAAO,IAAI,CAAC;QAChB,CAAC,CAAC,EAAE,CAAC;QACL,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,IAAI,IAAI,KAAK,CAAC,CAAC;QAC1C,OAAO;YACH,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,cAAc,EAAE,MAAM;YACtB,SAAS;YACT,gBAAgB,EAAE,OAAO;YACzB,eAAe,EAAE,IAAI;YACrB,aAAa,EAAE,MAAM;YACrB,UAAU,EAAE,CAAC,EAAE,CAAC,SAAS;gBACrB,CAAC,CAAC,mFAAmF;gBACrF,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;YACnD,UAAU,EAAE,KAAK;YACjB,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;SACjI,CAAC;IACN,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ;QACrB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC,CAAC,OAAO,CAAC;IACd,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1D,MAAM,UAAU,GAAG,MAAM,CACrB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CACpC,CAAC;IAEF,IAAI,OAAO,GAAmB,MAAM,CAAC;IACrC,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE;QAC/C,WAAW,EAAE,UAAU,EAAE,aAAa;QACtC,WAAW,EAAE,YAAY;QACzB,mBAAmB,EAAE,gBAAgB,EAAE,WAAW;KACrD,CAAC,CAAC;IAEH,IAAI,GAAG,EAAE,cAAc,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpF,OAAO,GAAG,KAAK,CAAC;IACpB,CAAC;SAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC3B,OAAO,GAAG,KAAK,CAAC;IACpB,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACpB,OAAO,GAAG,KAAK,CAAC;IACpB,CAAC;SAAM,IAAI,GAAG,EAAE,cAAc,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5F,OAAO,GAAG,MAAM,CAAC;IACrB,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QACnF,OAAO,GAAG,MAAM,CAAC;IACrB,CAAC;SAAM,IAAI,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7F,OAAO,GAAG,MAAM,CAAC;IACrB,CAAC;SAAM,CAAC;QACJ,OAAO,GAAG,MAAM,CAAC;IACrB,CAAC;IAED,MAAM,cAAc,GAAG,oBAAoB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC9D,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAExD,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,CAAC;IAC1B,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE;QACxB,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YACzB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC1D,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACb,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACvE,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC,EAAE,CAAC;IACL,OAAO;QACH,OAAO;QACP,MAAM;QACN,cAAc;QACd,SAAS;QACT,gBAAgB,EAAE,OAAO;QACzB,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,MAAM;QACrB,UAAU,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACzD,UAAU;QACV,aAAa;KAChB,CAAC;AACN,CAAC;AAED,SAAgB,yBAAyB,CAAC,WAAmB,EAAE,cAAsB;IACjF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAE3C,IAAI,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9F,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;IACxE,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;AACvE,CAAC"}

package/dist/utils/securityConfig.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Security config discovery — finds and parses security-relevant config
+ * files in the workspace so the agent can reason about ACTUAL config
+ * instead of guessing from prompt rules.
+ *
+ * Replaces the system prompt's hardcoded FP-suppression rules ("config-gated
+ * rate limits are not vulnerabilities") with a tool that lets the agent
+ * check the config and reason about what it finds.
+ *
+ * Security rules:
+ *   - For .env files, return key NAMES and set/unset status only — never values
+ *   - Prefer .env.example over real .env
+ *   - All paths workspace-confined via resolveWorkspacePath
+ *   - Output truncated to 16KB
+ */
+export type ConfigKind = 'auth' | 'cors' | 'rate_limit' | 'headers' | 'env' | 'all';
+export declare function readSecurityConfig(workspaceRoot: string, kind?: ConfigKind): Promise<string>;