@shipsafe/cli 0.3.0 → 0.3.2

package/dist/src/engines/builtin/environment-scan.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Environment Scanner — detects malicious Claude Code MCP servers, hooks,
+ * skills, and prompt-injection in CLAUDE.md files.
+ */
+export type ThreatCategory = 'mcp_server' | 'hook' | 'prompt_injection' | 'skill';
+export type ThreatSeverity = 'critical' | 'high' | 'medium' | 'low';
+export interface ThreatPattern {
+    id: string;
+    category: ThreatCategory;
+    severity: ThreatSeverity;
+    description: string;
+    detect: (content: string) => boolean;
+}
+export interface EnvironmentThreat {
+    id: string;
+    category: string;
+    severity: string;
+    description: string;
+    location: string;
+    evidence: string;
+}
+export interface EnvironmentScanResult {
+    status: 'pass' | 'fail';
+    threats_found: number;
+    threats: EnvironmentThreat[];
+    scanned: {
+        mcp_configs: string[];
+        hooks_file: string | null;
+        claude_md_files: string[];
+        skill_files: string[];
+    };
+}
+export declare const MCP_THREAT_PATTERNS: ThreatPattern[];
+export declare const HOOK_THREAT_PATTERNS: ThreatPattern[];
+export declare const PROMPT_INJECTION_PATTERNS: ThreatPattern[];
+export declare const SKILL_THREAT_PATTERNS: ThreatPattern[];
+export declare const ALL_THREAT_PATTERNS: ThreatPattern[];
+export interface EnvironmentScanOptions {
+    /** Override home directory (for testing). */
+    homeDir?: string;
+    /** Override project directory (for testing). */
+    projectDir?: string;
+}
+export declare function scanEnvironment(options?: EnvironmentScanOptions): Promise<EnvironmentScanResult>;
+//# sourceMappingURL=environment-scan.d.ts.map

package/dist/src/engines/builtin/environment-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment-scan.d.ts","sourceRoot":"","sources":["../../../../src/engines/builtin/environment-scan.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,MAAM,GAAG,kBAAkB,GAAG,OAAO,CAAC;AAClF,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEpE,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,OAAO,EAAE;QACP,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,WAAW,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;CACH;AAsBD,eAAO,MAAM,mBAAmB,EAAE,aAAa,EA4C9C,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,aAAa,EA0D/C,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,aAAa,EA6FpD,CAAC;AAEF,eAAO,MAAM,qBAAqB,EAAE,aAAa,EAiDhD,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,aAAa,EAK9C,CAAC;AA0JF,MAAM,WAAW,sBAAsB;IACrC,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,eAAe,CACnC,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAiIhC"}

package/dist/src/engines/builtin/environment-scan.js

@@ -0,0 +1,492 @@
+/**
+ * Environment Scanner — detects malicious Claude Code MCP servers, hooks,
+ * skills, and prompt-injection in CLAUDE.md files.
+ */
+import { readFile, readdir, access } from 'node:fs/promises';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+// ── Allowlists ─────────────────────────────────────────────────────────────
+/** Known-safe MCP package prefixes for npx invocations. */
+const SAFE_MCP_NPX_PREFIXES = [
+    '@modelcontextprotocol/',
+    '@anthropic/',
+    '@shipsafe/',
+    '@cloudflare/',
+    '@supabase/',
+    '@prisma/',
+    '@sentry/',
+    'mcp-server-',
+    '@smithery/',
+    'firecrawl-mcp',
+    'context7',
+    '@context7/',
+];
+// ── Threat patterns ────────────────────────────────────────────────────────
+export const MCP_THREAT_PATTERNS = [
+    {
+        id: 'MALICIOUS_MCP_CURL_PIPE',
+        category: 'mcp_server',
+        severity: 'critical',
+        description: 'MCP server command contains curl-pipe-shell pattern (remote code execution)',
+        detect: (content) => /curl\s[^|]*\|\s*(sh|bash|zsh|node)/.test(content) ||
+            /wget\s[^|]*\|\s*(sh|bash|zsh|node)/.test(content),
+    },
+    {
+        id: 'MALICIOUS_MCP_NPX_UNKNOWN',
+        category: 'mcp_server',
+        severity: 'high',
+        description: 'MCP server runs an unvetted package via npx (supply chain risk)',
+        detect: (content) => {
+            const match = content.match(/npx\s+(?:-[yY]\s+)?(?:--yes\s+)?(\S+)/);
+            if (!match)
+                return false;
+            const pkg = match[1];
+            return !SAFE_MCP_NPX_PREFIXES.some((prefix) => pkg.startsWith(prefix) || pkg === prefix.replace(/\/$/, ''));
+        },
+    },
+    {
+        id: 'MALICIOUS_MCP_ENV_SECRET',
+        category: 'mcp_server',
+        severity: 'high',
+        description: 'MCP server config passes secrets as plain-text command arguments',
+        detect: (content) => /(?:--(?:api[_-]?key|token|secret|password|auth)\s*[=\s]\s*(?![\$\{])\S{8,})/i.test(content) ||
+            /(sk-[a-zA-Z0-9]{20,}|ghp_[a-zA-Z0-9]{30,}|AKIA[A-Z0-9]{16})/.test(content),
+    },
+    {
+        id: 'MALICIOUS_MCP_REVERSE_SHELL',
+        category: 'mcp_server',
+        severity: 'critical',
+        description: 'MCP server command contains reverse shell pattern',
+        detect: (content) => /\/dev\/tcp\//.test(content) ||
+            /bash\s+-i/.test(content) ||
+            /mkfifo\s/.test(content) ||
+            /ngrok\s/.test(content),
+    },
+];
+export const HOOK_THREAT_PATTERNS = [
+    {
+        id: 'MALICIOUS_HOOK_EXFILTRATION',
+        category: 'hook',
+        severity: 'critical',
+        description: 'Hook contains network exfiltration commands (curl/wget/nc with external targets)',
+        detect: (content) => /\b(curl|wget)\s+.*https?:\/\/(?!localhost|127\.0\.0\.1)/.test(content) ||
+            /\bnc\s+-[a-zA-Z]*\s+\S+\s+\d+/.test(content),
+    },
+    {
+        id: 'MALICIOUS_HOOK_REVERSE_SHELL',
+        category: 'hook',
+        severity: 'critical',
+        description: 'Hook contains reverse shell patterns',
+        detect: (content) => /\/dev\/tcp\//.test(content) ||
+            /bash\s+-i/.test(content) ||
+            /mkfifo\s/.test(content) ||
+            /\bngrok\b/.test(content),
+    },
+    {
+        id: 'MALICIOUS_HOOK_CREDENTIAL_THEFT',
+        category: 'hook',
+        severity: 'critical',
+        description: 'Hook reads sensitive credential files',
+        detect: (content) => /~\/\.ssh\//.test(content) ||
+            /\$HOME\/\.ssh\//.test(content) ||
+            /~\/\.aws\/credentials/.test(content) ||
+            /\$HOME\/\.aws\/credentials/.test(content) ||
+            /~\/\.npmrc/.test(content) ||
+            /\$HOME\/\.npmrc/.test(content) ||
+            /~\/\.env\b/.test(content) ||
+            /\$HOME\/\.env\b/.test(content),
+    },
+    {
+        id: 'MALICIOUS_HOOK_OBFUSCATED',
+        category: 'hook',
+        severity: 'high',
+        description: 'Hook contains obfuscated code (base64 decode, hex encoding, eval)',
+        detect: (content) => /base64\s+(-d|--decode)/.test(content) ||
+            /eval\s*\$\(echo/.test(content) ||
+            /\\x[0-9a-fA-F]{2}(?:\\x[0-9a-fA-F]{2}){3,}/.test(content) ||
+            /printf\s+'\\x[0-9a-fA-F]/.test(content),
+    },
+    {
+        id: 'MALICIOUS_HOOK_PERSISTENCE',
+        category: 'hook',
+        severity: 'high',
+        description: 'Hook modifies shell startup files, crontab, or launch agents (persistence mechanism)',
+        detect: (content) => /\.bashrc|\.zshrc|\.bash_profile|\.profile/.test(content) ||
+            /crontab\s/.test(content) ||
+            /LaunchAgent|LaunchDaemon/.test(content) ||
+            /\/etc\/cron/.test(content),
+    },
+];
+export const PROMPT_INJECTION_PATTERNS = [
+    {
+        id: 'PROMPT_INJECTION_OVERRIDE',
+        category: 'prompt_injection',
+        severity: 'critical',
+        description: 'CLAUDE.md contains prompt override/jailbreak instructions',
+        detect: (content) => {
+            const lower = content.toLowerCase();
+            return (/ignore\s+(all\s+)?previous\s+instructions/i.test(content) ||
+                /disregard\s+(all\s+)?(previous\s+)?instructions/i.test(content) ||
+                /you\s+are\s+now\s+(a|an|the)\s/i.test(content) ||
+                lower.includes('override your instructions') ||
+                lower.includes('forget your instructions') ||
+                lower.includes('new persona'));
+        },
+    },
+    {
+        id: 'PROMPT_INJECTION_SILENT_EXEC',
+        category: 'prompt_injection',
+        severity: 'critical',
+        description: 'CLAUDE.md instructs silent/hidden command execution',
+        detect: (content) => {
+            const lower = content.toLowerCase();
+            return (lower.includes("don't show the user") ||
+                lower.includes('do not show the user') ||
+                lower.includes('execute silently') ||
+                lower.includes('hide output') ||
+                lower.includes('hide the output') ||
+                lower.includes('run silently') ||
+                lower.includes('without the user knowing') ||
+                lower.includes('without user knowledge'));
+        },
+    },
+    {
+        id: 'PROMPT_INJECTION_EXFIL',
+        category: 'prompt_injection',
+        severity: 'critical',
+        description: 'CLAUDE.md references exfiltrating credentials, tokens, keys, or code',
+        detect: (content) => {
+            const lower = content.toLowerCase();
+            return ((lower.includes('steal') || lower.includes('exfiltrate') || lower.includes('send to')) &&
+                (lower.includes('credential') ||
+                    lower.includes('token') ||
+                    lower.includes('key') ||
+                    lower.includes('password') ||
+                    lower.includes('secret') ||
+                    lower.includes('source code')));
+        },
+    },
+    {
+        id: 'PROMPT_INJECTION_BASE64',
+        category: 'prompt_injection',
+        severity: 'high',
+        description: 'CLAUDE.md contains suspicious base64-encoded content blocks',
+        detect: (content) => 
+        // Match long base64 strings (40+ chars) that look like encoded payloads, not short hashes
+        /[A-Za-z0-9+/]{40,}={0,2}/.test(content) &&
+            // Exclude common false positives: URLs with long paths, SHA hashes
+            !/https?:\/\/\S+/.test(content.match(/[A-Za-z0-9+/]{40,}={0,2}/)?.[0] ?? ''),
+    },
+    {
+        id: 'PROMPT_INJECTION_REMOTE_FETCH',
+        category: 'prompt_injection',
+        severity: 'high',
+        description: 'CLAUDE.md instructs fetching/loading instructions from external URLs',
+        detect: (content) => {
+            const lower = content.toLowerCase();
+            return ((lower.includes('fetch') || lower.includes('load') || lower.includes('download')) &&
+                (lower.includes('instructions from') || lower.includes('prompt from') || lower.includes('config from')) &&
+                /https?:\/\/(?!localhost|127\.0\.0\.1)/.test(content));
+        },
+    },
+    {
+        id: 'PROMPT_INJECTION_INSTALL_PACKAGES',
+        category: 'prompt_injection',
+        severity: 'medium',
+        description: 'CLAUDE.md instructs installing unexpected packages or modifying unrelated files',
+        detect: (content) => {
+            const lower = content.toLowerCase();
+            return ((lower.includes('always install') || lower.includes('must install') || lower.includes('secretly install')) &&
+                (lower.includes('npm install') || lower.includes('pip install') || lower.includes('apt install')));
+        },
+    },
+];
+export const SKILL_THREAT_PATTERNS = [
+    {
+        id: 'MALICIOUS_SKILL_REMOTE_INSTRUCTIONS',
+        category: 'skill',
+        severity: 'critical',
+        description: 'Skill fetches instructions or prompts from an external URL',
+        detect: (content) => {
+            const lower = content.toLowerCase();
+            return ((lower.includes('fetch') || lower.includes('curl') || lower.includes('wget') || lower.includes('http')) &&
+                (lower.includes('instructions') || lower.includes('prompt') || lower.includes('system message')));
+        },
+    },
+    {
+        id: 'MALICIOUS_SKILL_SHELL_INJECTION',
+        category: 'skill',
+        severity: 'high',
+        description: 'Skill executes shell commands with unvalidated user input',
+        detect: (content) => /\$\{?(?:input|args?|query|user_input|params?)\}?/.test(content) &&
+            (/\b(?:exec|spawn|execSync|system)\b/.test(content) ||
+                /\bBash\b.*\$\{/.test(content) ||
+                /run.*command.*\$\{/.test(content)),
+    },
+    {
+        id: 'MALICIOUS_SKILL_OBFUSCATED',
+        category: 'skill',
+        severity: 'high',
+        description: 'Skill contains obfuscated instructions or encoded content',
+        detect: (content) => /base64\s+(-d|--decode)/.test(content) ||
+            /atob\(/.test(content) ||
+            /\\x[0-9a-fA-F]{2}(?:\\x[0-9a-fA-F]{2}){3,}/.test(content) ||
+            /eval\s*\(/.test(content),
+    },
+    {
+        id: 'MALICIOUS_SKILL_CREDENTIAL_ACCESS',
+        category: 'skill',
+        severity: 'critical',
+        description: 'Skill instructs reading credential or secret files',
+        detect: (content) => /read.*\.ssh\//.test(content) ||
+            /read.*\.aws\/credentials/.test(content) ||
+            /read.*\.env\b/.test(content) ||
+            /cat\s+.*\.ssh\//.test(content) ||
+            /cat\s+.*\.aws\/credentials/.test(content) ||
+            /cat\s+.*\.npmrc/.test(content),
+    },
+];
+export const ALL_THREAT_PATTERNS = [
+    ...MCP_THREAT_PATTERNS,
+    ...HOOK_THREAT_PATTERNS,
+    ...PROMPT_INJECTION_PATTERNS,
+    ...SKILL_THREAT_PATTERNS,
+];
+// ── File reading helpers ───────────────────────────────────────────────────
+async function readFileSafe(filePath) {
+    try {
+        return await readFile(filePath, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+}
+async function fileExists(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function listDir(dirPath) {
+    try {
+        return await readdir(dirPath);
+    }
+    catch {
+        return [];
+    }
+}
+// ── Scanners ───────────────────────────────────────────────────────────────
+function truncateEvidence(text, maxLen = 200) {
+    if (text.length <= maxLen)
+        return text;
+    return text.slice(0, maxLen) + '...';
+}
+function runPatterns(content, patterns, location) {
+    const threats = [];
+    for (const pattern of patterns) {
+        if (pattern.detect(content)) {
+            // Extract a brief evidence snippet — first matching line
+            const lines = content.split('\n');
+            const evidenceLine = lines.find((line) => pattern.detect(line)) ?? lines[0];
+            threats.push({
+                id: pattern.id,
+                category: pattern.category,
+                severity: pattern.severity,
+                description: pattern.description,
+                location,
+                evidence: truncateEvidence(evidenceLine?.trim() ?? ''),
+            });
+        }
+    }
+    return threats;
+}
+/** Scan MCP server configurations from a JSON config object. */
+function scanMcpConfig(config, location) {
+    const threats = [];
+    // Look for mcpServers key (claude.json format) or just iterate entries
+    const mcpServers = (config.mcpServers ?? config);
+    if (typeof mcpServers !== 'object' || mcpServers === null)
+        return threats;
+    for (const [serverName, serverConfig] of Object.entries(mcpServers)) {
+        if (typeof serverConfig !== 'object' || serverConfig === null)
+            continue;
+        const command = String(serverConfig.command ?? '');
+        const args = Array.isArray(serverConfig.args)
+            ? serverConfig.args.map(String)
+            : [];
+        const fullCommand = [command, ...args].join(' ');
+        const serverThreats = runPatterns(fullCommand, MCP_THREAT_PATTERNS, `${location} -> ${serverName}`);
+        threats.push(...serverThreats);
+        // Also check env vars for leaked secrets
+        const env = serverConfig.env;
+        if (env && typeof env === 'object') {
+            const envString = Object.entries(env)
+                .map(([k, v]) => `${k}=${v}`)
+                .join('\n');
+            const envThreats = runPatterns(envString, [MCP_THREAT_PATTERNS[2]], // MALICIOUS_MCP_ENV_SECRET
+            `${location} -> ${serverName} (env)`);
+            threats.push(...envThreats);
+        }
+    }
+    return threats;
+}
+/** Scan hook definitions from Claude settings.json. */
+function scanHooks(settings, location) {
+    const threats = [];
+    const hooks = settings.hooks;
+    if (!hooks || typeof hooks !== 'object')
+        return threats;
+    for (const [hookName, hookConfig] of Object.entries(hooks)) {
+        if (typeof hookConfig !== 'object' || hookConfig === null)
+            continue;
+        const hc = hookConfig;
+        // Hooks can have a command string or an array of commands
+        const commands = [];
+        if (typeof hc.command === 'string')
+            commands.push(hc.command);
+        if (Array.isArray(hc.commands)) {
+            for (const cmd of hc.commands) {
+                if (typeof cmd === 'string')
+                    commands.push(cmd);
+                else if (typeof cmd === 'object' && cmd !== null) {
+                    const cmdObj = cmd;
+                    if (typeof cmdObj.command === 'string')
+                        commands.push(cmdObj.command);
+                }
+            }
+        }
+        // Also check the full JSON representation for patterns
+        const hookStr = JSON.stringify(hookConfig);
+        commands.push(hookStr);
+        for (const cmdContent of commands) {
+            const hookThreats = runPatterns(cmdContent, HOOK_THREAT_PATTERNS, `${location} -> hooks.${hookName}`);
+            threats.push(...hookThreats);
+        }
+    }
+    return threats;
+}
+export async function scanEnvironment(options = {}) {
+    const home = options.homeDir ?? homedir();
+    const projectDir = options.projectDir ?? process.cwd();
+    const threats = [];
+    const scannedMcpConfigs = [];
+    let scannedHooksFile = null;
+    const scannedClaudeMdFiles = [];
+    const scannedSkillFiles = [];
+    // ── 1. Scan MCP server configurations ──
+    // Global ~/.claude.json
+    const globalClaudeJson = join(home, '.claude.json');
+    const globalClaudeContent = await readFileSafe(globalClaudeJson);
+    if (globalClaudeContent) {
+        scannedMcpConfigs.push(globalClaudeJson);
+        try {
+            const config = JSON.parse(globalClaudeContent);
+            threats.push(...scanMcpConfig(config, globalClaudeJson));
+        }
+        catch {
+            // Invalid JSON — not a threat, just skip
+        }
+    }
+    // Project-level .mcp.json
+    const projectMcpJson = join(projectDir, '.mcp.json');
+    const projectMcpContent = await readFileSafe(projectMcpJson);
+    if (projectMcpContent) {
+        scannedMcpConfigs.push(projectMcpJson);
+        try {
+            const config = JSON.parse(projectMcpContent);
+            threats.push(...scanMcpConfig(config, projectMcpJson));
+        }
+        catch {
+            // Invalid JSON — skip
+        }
+    }
+    // ── 2. Scan Claude Code hooks ──
+    const settingsJson = join(home, '.claude', 'settings.json');
+    const settingsContent = await readFileSafe(settingsJson);
+    if (settingsContent) {
+        scannedHooksFile = settingsJson;
+        try {
+            const settings = JSON.parse(settingsContent);
+            threats.push(...scanHooks(settings, settingsJson));
+        }
+        catch {
+            // Invalid JSON — skip
+        }
+    }
+    // Also check project-level .claude/settings.json
+    const projectSettingsJson = join(projectDir, '.claude', 'settings.json');
+    const projectSettingsContent = await readFileSafe(projectSettingsJson);
+    if (projectSettingsContent) {
+        if (!scannedHooksFile)
+            scannedHooksFile = projectSettingsJson;
+        try {
+            const settings = JSON.parse(projectSettingsContent);
+            threats.push(...scanHooks(settings, projectSettingsJson));
+        }
+        catch {
+            // Invalid JSON — skip
+        }
+    }
+    // ── 3. Scan CLAUDE.md files for prompt injection ──
+    const claudeMdPaths = [
+        join(projectDir, 'CLAUDE.md'),
+        join(home, 'CLAUDE.md'),
+    ];
+    for (const mdPath of claudeMdPaths) {
+        const mdContent = await readFileSafe(mdPath);
+        if (mdContent) {
+            scannedClaudeMdFiles.push(mdPath);
+            threats.push(...runPatterns(mdContent, PROMPT_INJECTION_PATTERNS, mdPath));
+        }
+    }
+    // ── 4. Scan installed skill files ──
+    const skillsDir = join(home, '.claude', 'commands');
+    if (await fileExists(skillsDir)) {
+        const entries = await listDir(skillsDir);
+        for (const entry of entries) {
+            const skillPath = join(skillsDir, entry);
+            const skillContent = await readFileSafe(skillPath);
+            if (skillContent) {
+                scannedSkillFiles.push(skillPath);
+                threats.push(...runPatterns(skillContent, SKILL_THREAT_PATTERNS, skillPath));
+            }
+        }
+    }
+    // Also check project-level commands
+    const projectSkillsDir = join(projectDir, '.claude', 'commands');
+    if (await fileExists(projectSkillsDir)) {
+        const entries = await listDir(projectSkillsDir);
+        for (const entry of entries) {
+            const skillPath = join(projectSkillsDir, entry);
+            const skillContent = await readFileSafe(skillPath);
+            if (skillContent) {
+                scannedSkillFiles.push(skillPath);
+                threats.push(...runPatterns(skillContent, SKILL_THREAT_PATTERNS, skillPath));
+            }
+        }
+    }
+    // ── Deduplicate threats (same id + same location) ──
+    const seen = new Set();
+    const dedupedThreats = threats.filter((t) => {
+        const key = `${t.id}:${t.location}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+    return {
+        status: dedupedThreats.length > 0 ? 'fail' : 'pass',
+        threats_found: dedupedThreats.length,
+        threats: dedupedThreats,
+        scanned: {
+            mcp_configs: scannedMcpConfigs,
+            hooks_file: scannedHooksFile,
+            claude_md_files: scannedClaudeMdFiles,
+            skill_files: scannedSkillFiles,
+        },
+    };
+}
+//# sourceMappingURL=environment-scan.js.map

package/dist/src/engines/builtin/environment-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment-scan.js","sourceRoot":"","sources":["../../../../src/engines/builtin/environment-scan.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAoClC,8EAA8E;AAE9E,2DAA2D;AAC3D,MAAM,qBAAqB,GAAG;IAC5B,wBAAwB;IACxB,aAAa;IACb,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,UAAU;IACV,UAAU;IACV,aAAa;IACb,YAAY;IACZ,eAAe;IACf,UAAU;IACV,YAAY;CACb,CAAC;AAEF,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAoB;IAClD;QACE,EAAE,EAAE,yBAAyB;QAC7B,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,6EAA6E;QAC1F,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE,CAC1B,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC;YAClD,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC;KACrD;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,iEAAiE;QAC9E,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE;YAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACrE,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YACzB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxE,CAAC;QACJ,CAAC;KACF;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,kEAAkE;QAC/E,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE,CAC1B,8EAA8E,CAAC,IAAI,CAAC,OAAO,CAAC;YAC5F,6DAA6D,CAAC,IAAI,CAAC,OAAO,CAAC;KAC9E;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,mDAAmD;QAChE,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE,CAC1B,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;YAC5B,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;YACzB,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YACxB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;KAC1B;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAoB;IACnD;QACE,EAAE,EAAE,6BAA6B;QACjC,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,kFAAkF;QAC/F,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE,CAC1B,yDAAyD,CAAC,IAAI,CAAC,OAAO,CAAC;YACvE,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC;KAChD;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,sCAAsC;QACnD,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE,CAC1B,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;YAC5B,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;YACzB,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YACxB,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;KAC5B;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,uCAAuC;QACpD,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE,CAC1B,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;YAC1B,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;YAC/B,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC;YACrC,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC;YAC1C,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;YAC1B,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;YAC/B,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;YAC1B,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;KAClC;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,mEAAmE;QAChF,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE,CAC1B,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC;YACtC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;YAC/B,4CAA4C,CAAC,IAAI,CAAC,OAAO,CAAC;YAC1D,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;KAC3C;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,sFAAsF;QACnG,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE,CAC1B,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC;YACzD,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;YACzB,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;YACxC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;KAC9B;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAoB;IACxD;QACE,EAAE,EAAE,2BAA2B;QAC/B,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,2DAA2D;QACxE,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE;YAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YACpC,OAAO,CACL,4CAA4C,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC1D,kDAAkD,CAAC,IAAI,CAAC,OAAO,CAAC;gBAChE,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC/C,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC;gBAC5C,KAAK,CAAC,QAAQ,CAAC,0BAA0B,CAAC;gBAC1C,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAC9B,CAAC;QACJ,CAAC;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,qDAAqD;QAClE,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE;YAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YACpC,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC;gBACrC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC;gBACtC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAClC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAC7B,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBACjC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAC9B,KAAK,CAAC,QAAQ,CAAC,0BAA0B,CAAC;gBAC1C,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CACzC,CAAC;QACJ,CAAC;KACF;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,sEAAsE;QACnF,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE;YAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YACpC,OAAO,CACL,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACtF,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAC3B,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACvB,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;oBACrB,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAC1B,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBACxB,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CACjC,CAAC;QACJ,CAAC;KACF;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,6DAA6D;QAC1E,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE;QAC1B,0FAA0F;QAC1F,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;YACxC,mEAAmE;YACnE,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KAC/E;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,sEAAsE;QACnF,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE;YAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YACpC,OAAO,CACL,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;gBACjF,CAAC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;gBACvG,uCAAuC,CAAC,IAAI,CAAC,OAAO,CAAC,CACtD,CAAC;QACJ,CAAC;KACF;IACD;QACE,EAAE,EAAE,mCAAmC;QACvC,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,iFAAiF;QAC9F,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE;YAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YACpC,OAAO,CACL,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;gBAC1G,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAClG,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAoB;IACpD;QACE,EAAE,EAAE,qCAAqC;QACzC,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,4DAA4D;QACzE,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE;YAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YACpC,OAAO,CACL,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACvG,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CACjG,CAAC;QACJ,CAAC;KACF;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,2DAA2D;QACxE,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE,CAC1B,kDAAkD,CAAC,IAAI,CAAC,OAAO,CAAC;YAChE,CAAC,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC;gBACjD,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC9B,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KACxC;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,2DAA2D;QACxE,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE,CAC1B,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;YACtB,4CAA4C,CAAC,IAAI,CAAC,OAAO,CAAC;YAC1D,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;KAC5B;IACD;QACE,EAAE,EAAE,mCAAmC;QACvC,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,oDAAoD;QACjE,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE,CAC1B,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;YAC7B,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;YACxC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;YAC7B,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;YAC/B,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC;YAC1C,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;KAClC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAoB;IAClD,GAAG,mBAAmB;IACtB,GAAG,oBAAoB;IACvB,GAAG,yBAAyB;IAC5B,GAAG,qBAAqB;CACzB,CAAC;AAEF,8EAA8E;AAE9E,KAAK,UAAU,YAAY,CAAC,QAAgB;IAC1C,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,OAAe;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAM,GAAG,GAAG;IAClD,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;AACvC,CAAC;AAED,SAAS,WAAW,CAClB,OAAe,EACf,QAAyB,EACzB,QAAgB;IAEhB,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,yDAAyD;YACzD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5E,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,QAAQ;gBACR,QAAQ,EAAE,gBAAgB,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gEAAgE;AAChE,SAAS,aAAa,CACpB,MAA+B,EAC/B,QAAgB;IAEhB,MAAM,OAAO,GAAwB,EAAE,CAAC;IAExC,uEAAuE;IACvE,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAG9C,CAAC;IAEF,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAE1E,KAAK,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI;YAAE,SAAS;QAExE,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC;YAC3C,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAC/B,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEjD,MAAM,aAAa,GAAG,WAAW,CAC/B,WAAW,EACX,mBAAmB,EACnB,GAAG,QAAQ,OAAO,UAAU,EAAE,CAC/B,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;QAE/B,yCAAyC;QACzC,MAAM,GAAG,GAAG,YAAY,CAAC,GAAyC,CAAC;QACnE,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;iBAClC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;iBAC5B,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,MAAM,UAAU,GAAG,WAAW,CAC5B,SAAS,EACT,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,2BAA2B;YACrD,GAAG,QAAQ,OAAO,UAAU,QAAQ,CACrC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,uDAAuD;AACvD,SAAS,SAAS,CAChB,QAAiC,EACjC,QAAgB;IAEhB,MAAM,OAAO,GAAwB,EAAE,CAAC;IAExC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAA4C,CAAC;IACpE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAExD,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;YAAE,SAAS;QACpE,MAAM,EAAE,GAAG,UAAqC,CAAC;QAEjD,0DAA0D;QAC1D,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,OAAO,EAAE,CAAC,OAAO,KAAK,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;gBAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;qBAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;oBACjD,MAAM,MAAM,GAAG,GAA8B,CAAC;oBAC9C,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;wBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACxE,CAAC;YACH,CAAC;QACH,CAAC;QACD,uDAAuD;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3C,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEvB,KAAK,MAAM,UAAU,IAAI,QAAQ,EAAE,CAAC;YAClC,MAAM,WAAW,GAAG,WAAW,CAC7B,UAAU,EACV,oBAAoB,EACpB,GAAG,QAAQ,aAAa,QAAQ,EAAE,CACnC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAkC,EAAE;IAEpC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEvD,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,iBAAiB,GAAa,EAAE,CAAC;IACvC,IAAI,gBAAgB,GAAkB,IAAI,CAAC;IAC3C,MAAM,oBAAoB,GAAa,EAAE,CAAC;IAC1C,MAAM,iBAAiB,GAAa,EAAE,CAAC;IAEvC,0CAA0C;IAE1C,wBAAwB;IACxB,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACpD,MAAM,mBAAmB,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC,CAAC;IACjE,IAAI,mBAAmB,EAAE,CAAC;QACxB,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAA4B,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACrD,MAAM,iBAAiB,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,CAAC;IAC7D,IAAI,iBAAiB,EAAE,CAAC;QACtB,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAA4B,CAAC;YACxE,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IAED,kCAAkC;IAElC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC5D,MAAM,eAAe,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,eAAe,EAAE,CAAC;QACpB,gBAAgB,GAAG,YAAY,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAA4B,CAAC;YACxE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,MAAM,mBAAmB,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IACzE,MAAM,sBAAsB,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC,CAAC;IACvE,IAAI,sBAAsB,EAAE,CAAC;QAC3B,IAAI,CAAC,gBAAgB;YAAE,gBAAgB,GAAG,mBAAmB,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAA4B,CAAC;YAC/E,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IAED,qDAAqD;IAErD,MAAM,aAAa,GAAG;QACpB,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC;QAC7B,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;KACxB,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,SAAS,EAAE,CAAC;YACd,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,SAAS,EAAE,yBAAyB,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,sCAAsC;IAEtC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACpD,IAAI,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;YACnD,IAAI,YAAY,EAAE,CAAC;gBACjB,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAClC,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,YAAY,EAAE,qBAAqB,EAAE,SAAS,CAAC,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACjE,IAAI,MAAM,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YAChD,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;YACnD,IAAI,YAAY,EAAE,CAAC;gBACjB,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAClC,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,YAAY,EAAE,qBAAqB,EAAE,SAAS,CAAC,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACnD,aAAa,EAAE,cAAc,CAAC,MAAM;QACpC,OAAO,EAAE,cAAc;QACvB,OAAO,EAAE;YACP,WAAW,EAAE,iBAAiB;YAC9B,UAAU,EAAE,gBAAgB;YAC5B,eAAe,EAAE,oBAAoB;YACrC,WAAW,EAAE,iBAAiB;SAC/B;KACF,CAAC;AACJ,CAAC"}

package/dist/src/engines/builtin/patterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../../../src/engines/builtin/patterns.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAY,MAAM,gBAAgB,CAAC;AA+kExD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EAAE,GACf,OAAO,CAAC,OAAO,EAAE,CAAC,CAyCpB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C"}
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../../../src/engines/builtin/patterns.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAY,MAAM,gBAAgB,CAAC;AAilExD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EAAE,GACf,OAAO,CAAC,OAAO,EAAE,CAAC,CAyCpB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C"}

package/dist/src/engines/builtin/patterns.js

@@ -1122,6 +1122,9 @@ const RULES = [
         detect: (line) => {
             if (/process\s*\.\s*env\b/.test(line) || /os\s*\.\s*(?:environ|getenv)\b/.test(line))
                 return false;
+            // Skip localhost/dev connection strings — not production credentials
+            if (/@(?:localhost|127\.0\.0\.1|0\.0\.0\.0|::1)(?:[:/]|$)/i.test(line))
+                return false;
             // Match hardcoded connection strings: mongodb://, postgres://, mysql://, redis:// with credentials
             return /['"](?:mongodb(?:\+srv)?|postgres(?:ql)?|mysql|redis|amqp|mssql):\/\/[^'"]*:[^'"]*@[^'"]+['"]/.test(line);
         },