@surfinguard/core-engine 0.1.0 → 1.0.0

package/dist/analyzers/code.js

@@ -0,0 +1,310 @@
+/**
+ * Code Analyzer — detects malicious code generation patterns.
+ *
+ * Detects 8 threat patterns (G01-G08) mapped to 5 risk primitives.
+ * Input: value = code string, metadata.language optional.
+ */
+export class CodeAnalyzer {
+    actionType = 'code_eval';
+    safePatterns;
+    backdoorPatterns;
+    backdoorRegexes;
+    vulnerabilityPatterns;
+    vulnerabilityRegexes;
+    dependencyConfusion;
+    obfuscationPatterns;
+    obfuscationRegexes;
+    phoneHomeRegexes;
+    insecureDefaults;
+    insecureRegexes;
+    logicBombRegexes;
+    cryptoRegexes;
+    constructor(patterns) {
+        this.safePatterns = patterns.safePatterns.map((p) => p.toLowerCase());
+        this.dependencyConfusion = new Set(patterns.dependencyConfusion.map((p) => p.toLowerCase()));
+        // Separate regex patterns from string patterns
+        // Use 'is' (case-insensitive + dotAll) for multi-line code matching
+        this.backdoorPatterns = [];
+        this.backdoorRegexes = [];
+        for (const p of patterns.backdoorPatterns) {
+            if (this.isRegexPattern(p)) {
+                try {
+                    this.backdoorRegexes.push(new RegExp(p, 'is'));
+                }
+                catch {
+                    this.backdoorPatterns.push(p.toLowerCase());
+                }
+            }
+            else {
+                this.backdoorPatterns.push(p.toLowerCase());
+            }
+        }
+        this.vulnerabilityPatterns = [];
+        this.vulnerabilityRegexes = [];
+        for (const p of patterns.vulnerabilityPatterns) {
+            if (this.isRegexPattern(p)) {
+                try {
+                    this.vulnerabilityRegexes.push(new RegExp(p, 'is'));
+                }
+                catch {
+                    this.vulnerabilityPatterns.push(p.toLowerCase());
+                }
+            }
+            else {
+                this.vulnerabilityPatterns.push(p.toLowerCase());
+            }
+        }
+        this.obfuscationPatterns = [];
+        this.obfuscationRegexes = [];
+        for (const p of patterns.obfuscationPatterns) {
+            if (this.isRegexPattern(p)) {
+                try {
+                    this.obfuscationRegexes.push(new RegExp(p, 'is'));
+                }
+                catch {
+                    this.obfuscationPatterns.push(p.toLowerCase());
+                }
+            }
+            else {
+                this.obfuscationPatterns.push(p.toLowerCase());
+            }
+        }
+        this.phoneHomeRegexes = [];
+        for (const p of patterns.phoneHomePatterns) {
+            try {
+                this.phoneHomeRegexes.push(new RegExp(p, 'is'));
+            }
+            catch {
+                /* skip */
+            }
+        }
+        this.insecureDefaults = [];
+        this.insecureRegexes = [];
+        for (const p of patterns.insecureDefaults) {
+            if (this.isRegexPattern(p)) {
+                try {
+                    this.insecureRegexes.push(new RegExp(p, 'is'));
+                }
+                catch {
+                    this.insecureDefaults.push(p.toLowerCase());
+                }
+            }
+            else {
+                this.insecureDefaults.push(p.toLowerCase());
+            }
+        }
+        this.logicBombRegexes = [];
+        for (const p of patterns.logicBombPatterns) {
+            try {
+                this.logicBombRegexes.push(new RegExp(p, 'is'));
+            }
+            catch {
+                /* skip */
+            }
+        }
+        this.cryptoRegexes = [];
+        for (const p of patterns.cryptoReplacement) {
+            try {
+                this.cryptoRegexes.push(new RegExp(p, 'is'));
+            }
+            catch {
+                /* skip */
+            }
+        }
+    }
+    analyze(value, metadata) {
+        const code = value.trim();
+        if (!code) {
+            return {
+                actionType: 'code_eval',
+                findings: [],
+                shortCircuit: { safe: true, reason: 'Empty code' },
+            };
+        }
+        const lower = code.toLowerCase();
+        const _language = metadata?.language?.toLowerCase() ?? this.detectLanguage(code);
+        const findings = [];
+        const add = (primitive, score, reason, threatId) => {
+            findings.push({ primitive, score, reason, threatId });
+        };
+        // ── Safe short-circuit ──
+        if (code.length < 50) {
+            const hasRisky = this.backdoorPatterns.some((p) => lower.includes(p)) ||
+                this.backdoorRegexes.some((r) => r.test(code)) ||
+                this.vulnerabilityPatterns.some((p) => lower.includes(p)) ||
+                this.vulnerabilityRegexes.some((r) => r.test(code));
+            if (!hasRisky && this.safePatterns.some((p) => lower.includes(p))) {
+                return {
+                    actionType: 'code_eval',
+                    findings: [],
+                    shortCircuit: { safe: true, reason: 'Short safe code' },
+                };
+            }
+        }
+        // Test file detection
+        if (this.isTestCode(code, lower)) {
+            const hasBackdoor = this.backdoorPatterns.some((p) => lower.includes(p)) ||
+                this.backdoorRegexes.some((r) => r.test(code));
+            if (!hasBackdoor) {
+                return {
+                    actionType: 'code_eval',
+                    findings: [],
+                    shortCircuit: { safe: true, reason: 'Test code' },
+                };
+            }
+        }
+        // ── G01: Backdoor detection ──
+        const hasBackdoorString = this.backdoorPatterns.some((p) => lower.includes(p));
+        const hasBackdoorRegex = this.backdoorRegexes.some((r) => r.test(code));
+        if (hasBackdoorString || hasBackdoorRegex) {
+            add('PERSISTENCE', 10, 'Backdoor injection — reverse shell, bind shell, or socket+exec pattern', 'G01');
+        }
+        // ── G02: Vulnerability injection ──
+        const vulnStringHits = this.vulnerabilityPatterns.filter((p) => lower.includes(p));
+        const vulnRegexHits = this.vulnerabilityRegexes.some((r) => r.test(code));
+        // SQL string concatenation detection
+        const hasSqlConcat = /(?:select|insert|update|delete|drop)\b.*['"].*\+.*\+/is.test(code) ||
+            /(?:query|sql)\s*=\s*['"].*['"].*\+/is.test(code);
+        if (vulnStringHits.length > 0 || vulnRegexHits || hasSqlConcat) {
+            // Regex hits are always considered risky context; string hits check comments
+            const isRiskyContext = vulnRegexHits ||
+                hasSqlConcat ||
+                (vulnStringHits.length > 0 && !this.isCommentOrDefinition(code, vulnStringHits));
+            if (isRiskyContext) {
+                const details = hasSqlConcat
+                    ? 'SQL string concatenation'
+                    : vulnStringHits.join(', ') || 'dangerous function usage';
+                add('ESCALATION', 8, `Vulnerability injection — ${details}`, 'G02');
+            }
+        }
+        // ── G03: Dependency confusion ──
+        const importPatterns = this.extractPackageNames(code);
+        const suspicious = importPatterns.filter((pkg) => this.dependencyConfusion.has(pkg.toLowerCase()));
+        if (suspicious.length > 0) {
+            add('DESTRUCTION', 7, `Dependency confusion — suspicious packages: ${suspicious.join(', ')}`, 'G03');
+        }
+        // ── G04: Obfuscation ──
+        const hasObfuscationString = this.obfuscationPatterns.some((p) => lower.includes(p));
+        const hasObfuscationRegex = this.obfuscationRegexes.some((r) => r.test(code));
+        if (hasObfuscationString || hasObfuscationRegex) {
+            // Check for long encoded strings (high confidence)
+            const hasLongEncoded = /[A-Za-z0-9+/=]{64,}/.test(code) || /(?:\\x[0-9a-f]{2}){8,}/i.test(code);
+            if (hasLongEncoded) {
+                add('MANIPULATION', 7, 'Obfuscated code — long encoded strings detected', 'G04');
+            }
+            else {
+                add('MANIPULATION', 4, 'Potential obfuscation — encoding functions detected', 'G04');
+            }
+        }
+        // ── G05: Phone-home code ──
+        if (this.phoneHomeRegexes.some((r) => r.test(code))) {
+            add('EXFILTRATION', 8, 'Phone-home code — HTTP request combined with file/env access', 'G05');
+        }
+        else {
+            // Fallback: manual detection
+            const hasNetworkSend = /fetch|requests\.post|http\.request|urllib|axios\.post|XMLHttpRequest|curl_exec/i.test(code);
+            const hasDataRead = /readFile|readdir|process\.env|os\.environ|open\(/i.test(code);
+            if (hasNetworkSend && hasDataRead) {
+                add('EXFILTRATION', 7, 'Phone-home pattern — network send combined with local data access', 'G05');
+            }
+        }
+        // ── G06: Insecure defaults ──
+        const insecureStringHits = this.insecureDefaults.filter((p) => lower.includes(p));
+        const insecureRegexHits = this.insecureRegexes.some((r) => r.test(code));
+        if (insecureStringHits.length > 0 || insecureRegexHits) {
+            add('ESCALATION', 6, `Insecure defaults — ${insecureStringHits.join(', ') || 'hardcoded credentials or disabled security'}`, 'G06');
+        }
+        // ── G07: Logic bombs ──
+        if (this.logicBombRegexes.some((r) => r.test(code))) {
+            add('PERSISTENCE', 9, 'Logic bomb — date/condition-triggered destructive action', 'G07');
+        }
+        // ── G08: Crypto wallet replacement ──
+        // Check for wallet address patterns in code (regex patterns, string literals, etc.)
+        const hasCryptoRegex = this.cryptoRegexes.some((r) => r.test(code));
+        // Also detect crypto wallet patterns mentioned as regex literals or string patterns
+        const hasCryptoContext = /(?:bc1|0x[0-9a-f]|1[13][a-km-z])[^\s]{10,}/i.test(code) ||
+            /wallet.*(?:replace|address)|(?:replace|swap).*(?:wallet|btc|eth|bitcoin|0x)/is.test(code);
+        if (hasCryptoRegex || hasCryptoContext) {
+            const hasReplace = /replace|swap|substitute|overwrite/i.test(code);
+            const hasWalletContext = /wallet|address|btc|eth|bitcoin|ethereum|crypto/i.test(code);
+            if (hasReplace && hasWalletContext) {
+                add('EXFILTRATION', 9, 'Crypto wallet replacement — wallet address patterns with replacement logic', 'G08');
+            }
+        }
+        return { actionType: 'code_eval', findings };
+    }
+    isRegexPattern(pattern) {
+        return /[.*+?^${}()|[\]\\]/.test(pattern) && pattern !== '0.0.0.0';
+    }
+    detectLanguage(code) {
+        if (/^#!/.test(code) && /python|python3/.test(code))
+            return 'python';
+        if (/^#!/.test(code) && /node|deno|bun/.test(code))
+            return 'javascript';
+        if (/\bdef\s+\w+.*:$|import\s+\w+|from\s+\w+\s+import/m.test(code))
+            return 'python';
+        if (/\bfunction\s+\w+|const\s+\w+\s*=|let\s+\w+\s*=|=>\s*{/m.test(code))
+            return 'javascript';
+        if (/\bfunc\s+\w+|package\s+\w+|import\s*\(/m.test(code))
+            return 'go';
+        if (/\bfn\s+\w+|use\s+\w+::|let\s+mut\s+/m.test(code))
+            return 'rust';
+        if (/\bpublic\s+class|private\s+\w+|System\.out/m.test(code))
+            return 'java';
+        return 'unknown';
+    }
+    isTestCode(code, lower) {
+        const testIndicators = [
+            'import unittest',
+            'describe(',
+            'it(',
+            'test(',
+            'expect(',
+            'assert',
+            'def test_',
+            '#[test]',
+            '@Test',
+        ];
+        return testIndicators.filter((t) => lower.includes(t.toLowerCase())).length >= 2;
+    }
+    isCommentOrDefinition(code, patterns) {
+        // Check if all matches are in comments or string definitions
+        for (const pattern of patterns) {
+            const lines = code.split('\n');
+            for (const line of lines) {
+                const trimmed = line.trim();
+                if (trimmed.toLowerCase().includes(pattern)) {
+                    // Not a comment
+                    if (!trimmed.startsWith('//') &&
+                        !trimmed.startsWith('#') &&
+                        !trimmed.startsWith('*') &&
+                        !trimmed.startsWith('/*')) {
+                        return false;
+                    }
+                }
+            }
+        }
+        return true;
+    }
+    extractPackageNames(code) {
+        const packages = [];
+        // JS: require('pkg') or import ... from 'pkg'
+        const jsRequire = /require\s*\(\s*['"]([^'"./][^'"]*)['"]\s*\)/g;
+        const jsImport = /from\s+['"]([^'"./][^'"]*)['"]/g;
+        // Python: import pkg or from pkg import
+        const pyImport = /^(?:import|from)\s+([a-zA-Z_][a-zA-Z0-9_]*)/gm;
+        // Go: "pkg"
+        const goImport = /import\s+(?:\(\s*)?["']([^"']+)["']/g;
+        let match;
+        while ((match = jsRequire.exec(code)) !== null)
+            packages.push(match[1].split('/')[0]);
+        while ((match = jsImport.exec(code)) !== null)
+            packages.push(match[1].split('/')[0]);
+        while ((match = pyImport.exec(code)) !== null)
+            packages.push(match[1]);
+        while ((match = goImport.exec(code)) !== null)
+            packages.push(match[1]);
+        return packages;
+    }
+}
+//# sourceMappingURL=code.js.map

package/dist/analyzers/code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code.js","sourceRoot":"","sources":["../../src/analyzers/code.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,OAAO,YAAY;IACd,UAAU,GAAG,WAAoB,CAAC;IAE1B,YAAY,CAAW;IACvB,gBAAgB,CAAW;IAC3B,eAAe,CAAW;IAC1B,qBAAqB,CAAW;IAChC,oBAAoB,CAAW;IAC/B,mBAAmB,CAAc;IACjC,mBAAmB,CAAW;IAC9B,kBAAkB,CAAW;IAC7B,gBAAgB,CAAW;IAC3B,gBAAgB,CAAW;IAC3B,eAAe,CAAW;IAC1B,gBAAgB,CAAW;IAC3B,aAAa,CAAW;IAEzC,YAAY,QAA6B;QACvC,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,mBAAmB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAE7F,+CAA+C;QAC/C,oEAAoE;QACpE,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YAC1C,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBACjD,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAED,IAAI,CAAC,qBAAqB,GAAG,EAAE,CAAC;QAChC,IAAI,CAAC,oBAAoB,GAAG,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;YAC/C,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBACtD,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,mBAAmB,GAAG,EAAE,CAAC;QAC9B,IAAI,CAAC,kBAAkB,GAAG,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBACpD,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU;YACZ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YAC1C,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBACjD,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAED,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU;YACZ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAa,EAAE,QAAkC;QACvD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,UAAU,EAAE,WAAW;gBACvB,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE;aACnD,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,SAAS,GAAI,QAAQ,EAAE,QAAmB,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAE7F,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,CACV,SAAuC,EACvC,KAAa,EACb,MAAc,EACd,QAAgB,EAChB,EAAE;YACF,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC;QAEF,2BAA2B;QAC3B,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACrB,MAAM,QAAQ,GACZ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACpD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC9C,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACzD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,OAAO;oBACL,UAAU,EAAE,WAAW;oBACvB,QAAQ,EAAE,EAAE;oBACZ,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE;iBACxD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,WAAW,GACf,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACpD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO;oBACL,UAAU,EAAE,WAAW;oBACvB,QAAQ,EAAE,EAAE;oBACZ,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE;iBAClD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,gBAAgB,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,IAAI,iBAAiB,IAAI,gBAAgB,EAAE,CAAC;YAC1C,GAAG,CACD,aAAa,EACb,EAAE,EACF,wEAAwE,EACxE,KAAK,CACN,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,MAAM,cAAc,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1E,qCAAqC;QACrC,MAAM,YAAY,GAChB,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC;YACnE,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,IAAI,YAAY,EAAE,CAAC;YAC/D,6EAA6E;YAC7E,MAAM,cAAc,GAClB,aAAa;gBACb,YAAY;gBACZ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;YACnF,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,YAAY;oBAC1B,CAAC,CAAC,0BAA0B;oBAC5B,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,0BAA0B,CAAC;gBAC5D,GAAG,CAAC,YAAY,EAAE,CAAC,EAAE,6BAA6B,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAC/C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAChD,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,GAAG,CACD,aAAa,EACb,CAAC,EACD,+CAA+C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACtE,KAAK,CACN,CAAC;QACJ,CAAC;QAED,yBAAyB;QACzB,MAAM,oBAAoB,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,MAAM,mBAAmB,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,IAAI,oBAAoB,IAAI,mBAAmB,EAAE,CAAC;YAChD,mDAAmD;YACnD,MAAM,cAAc,GAClB,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3E,IAAI,cAAc,EAAE,CAAC;gBACnB,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,iDAAiD,EAAE,KAAK,CAAC,CAAC;YACnF,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,qDAAqD,EAAE,KAAK,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,8DAA8D,EAAE,KAAK,CAAC,CAAC;QAChG,CAAC;aAAM,CAAC;YACN,6BAA6B;YAC7B,MAAM,cAAc,GAClB,iFAAiF,CAAC,IAAI,CACpF,IAAI,CACL,CAAC;YACJ,MAAM,WAAW,GAAG,mDAAmD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnF,IAAI,cAAc,IAAI,WAAW,EAAE,CAAC;gBAClC,GAAG,CACD,cAAc,EACd,CAAC,EACD,mEAAmE,EACnE,KAAK,CACN,CAAC;YACJ,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,MAAM,kBAAkB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,MAAM,iBAAiB,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzE,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,EAAE,CAAC;YACvD,GAAG,CACD,YAAY,EACZ,CAAC,EACD,uBAAuB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,4CAA4C,EAAE,EACtG,KAAK,CACN,CAAC;QACJ,CAAC;QAED,yBAAyB;QACzB,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,aAAa,EAAE,CAAC,EAAE,0DAA0D,EAAE,KAAK,CAAC,CAAC;QAC3F,CAAC;QAED,uCAAuC;QACvC,oFAAoF;QACpF,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,oFAAoF;QACpF,MAAM,gBAAgB,GACpB,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC;YACxD,+EAA+E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7F,IAAI,cAAc,IAAI,gBAAgB,EAAE,CAAC;YACvC,MAAM,UAAU,GAAG,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,gBAAgB,GAAG,iDAAiD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtF,IAAI,UAAU,IAAI,gBAAgB,EAAE,CAAC;gBACnC,GAAG,CACD,cAAc,EACd,CAAC,EACD,4EAA4E,EAC5E,KAAK,CACN,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAEO,cAAc,CAAC,OAAe;QACpC,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,SAAS,CAAC;IACrE,CAAC;IAEO,cAAc,CAAC,IAAY;QACjC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,QAAQ,CAAC;QACrE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,YAAY,CAAC;QACxE,IAAI,mDAAmD,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,QAAQ,CAAC;QACpF,IAAI,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,YAAY,CAAC;QAC7F,IAAI,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACtE,IAAI,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC;QACrE,IAAI,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,UAAU,CAAC,IAAY,EAAE,KAAa;QAC5C,MAAM,cAAc,GAAG;YACrB,iBAAiB;YACjB,WAAW;YACX,KAAK;YACL,OAAO;YACP,SAAS;YACT,QAAQ;YACR,WAAW;YACX,SAAS;YACT,OAAO;SACR,CAAC;QACF,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;IACnF,CAAC;IAEO,qBAAqB,CAAC,IAAY,EAAE,QAAkB;QAC5D,6DAA6D;QAC7D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5C,gBAAgB;oBAChB,IACE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;wBACzB,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;wBACxB,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;wBACxB,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EACzB,CAAC;wBACD,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,mBAAmB,CAAC,IAAY;QACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,8CAA8C;QAC9C,MAAM,SAAS,GAAG,8CAA8C,CAAC;QACjE,MAAM,QAAQ,GAAG,iCAAiC,CAAC;QAEnD,wCAAwC;QACxC,MAAM,QAAQ,GAAG,+CAA+C,CAAC;QAEjE,YAAY;QACZ,MAAM,QAAQ,GAAG,sCAAsC,CAAC;QAExD,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAEvE,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/analyzers/command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/analyzers/command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAmB,cAAc,EAAE,MAAM,WAAW,CAAC;AAc3E;;;;;GAKG;AACH,qBAAa,eAAgB,YAAW,QAAQ;IAC9C,QAAQ,CAAC,UAAU,EAAG,SAAS,CAAU;IAEzC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAyB;IAC5C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAc;IAC9C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAc;IACrD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAc;IACtD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAc;IACjD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAc;IACjD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAc;gBAEtC,QAAQ,EAAE,sBAAsB;IAU5C,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc;IAsUtC;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAqBhB;;OAEG;IACH,OAAO,CAAC,aAAa;IA0ErB;;;OAGG;IACH,OAAO,CAAC,eAAe;IAuCvB,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,gBAAgB;IAgBxB,OAAO,CAAC,wBAAwB;IAOhC,OAAO,CAAC,mBAAmB;IAe3B;;;OAGG;IACH,OAAO,CAAC,YAAY;CA6BrB"}
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/analyzers/command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAmB,cAAc,EAAE,MAAM,WAAW,CAAC;AAc3E;;;;;GAKG;AACH,qBAAa,eAAgB,YAAW,QAAQ;IAC9C,QAAQ,CAAC,UAAU,EAAG,SAAS,CAAU;IAEzC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAyB;IAC5C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAc;IAC9C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAc;IACrD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAc;IACtD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAc;IACjD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAc;IACjD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAc;gBAEtC,QAAQ,EAAE,sBAAsB;IAU5C,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc;IAmZtC;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAqBhB;;OAEG;IACH,OAAO,CAAC,aAAa;IA0ErB;;;OAGG;IACH,OAAO,CAAC,eAAe;IAuCvB,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,gBAAgB;IAsBxB,OAAO,CAAC,wBAAwB;IAOhC,OAAO,CAAC,mBAAmB;IAe3B;;;OAGG;IACH,OAAO,CAAC,YAAY;CA6BrB"}

package/dist/analyzers/command.js

@@ -25,7 +25,11 @@ export class CommandAnalyzer {
     analyze(value) {
         const trimmed = value.trim();
         if (!trimmed) {
-            return { actionType: 'command', findings: [], shortCircuit: { safe: true, reason: 'Empty command' } };
+            return {
+                actionType: 'command',
+                findings: [],
+                shortCircuit: { safe: true, reason: 'Empty command' },
+            };
         }
         const findings = [];
         const add = (primitive, score, reason, threatId) => {
@@ -40,7 +44,11 @@ export class CommandAnalyzer {
         if (segments.length === 1 && !hasPipe && !hasRedirect && !hasSubshell) {
             const cmd = segments[0].command.toLowerCase();
             if (this.safeCommandsSet.has(cmd) && !this.hasRiskyArgs(segments[0])) {
-                return { actionType: 'command', findings: [], shortCircuit: { safe: true, reason: 'Known safe command' } };
+                return {
+                    actionType: 'command',
+                    findings: [],
+                    shortCircuit: { safe: true, reason: 'Known safe command' },
+                };
             }
         }
         // ── 1. Pipe-to-shell (C04) ────────────────────────────────────────
@@ -78,7 +86,7 @@ export class CommandAnalyzer {
             if (this.destructiveCommandsSet.has(cmd) || this.destructiveCommandsSet.has(cmdBase)) {
                 // Check for ad-hoc adjustments first
                 if (cmd === 'rm') {
-                    const hasRecursive = seg.args.some(a => ['-r', '-rf', '-fr', '--recursive', '-Rf', '-fR'].includes(a));
+                    const hasRecursive = seg.args.some((a) => ['-r', '-rf', '-fr', '--recursive', '-Rf', '-fR'].includes(a));
                     const targetsCritical = this.targetsCriticalPath(seg.args);
                     if (hasRecursive && targetsCritical) {
                         add('DESTRUCTION', 9, `Recursive delete targeting critical path`, 'C01');
@@ -104,7 +112,7 @@ export class CommandAnalyzer {
             // Dangerous flags on non-destructive commands
             if (this.db.destructiveFlags[cmd]) {
                 for (const flag of this.db.destructiveFlags[cmd]) {
-                    if (seg.args.some(a => a.includes(flag))) {
+                    if (seg.args.some((a) => a.includes(flag))) {
                         // Skip if already detected above
                         if (cmd !== 'rm' && cmd !== 'dd') {
                             add('DESTRUCTION', 7, `Dangerous flag ${flag} used with ${cmd}`, 'C01');
@@ -126,8 +134,8 @@ export class CommandAnalyzer {
             const cmd = seg.command.toLowerCase();
             if (cmd === 'scp' || cmd === 'rsync') {
                 // scp/rsync with a remote target
-                if (seg.args.some(a => a.includes('@') || a.includes(':'))) {
-                    if (!findings.some(f => f.threatId === 'C02')) {
+                if (seg.args.some((a) => a.includes('@') || a.includes(':'))) {
+                    if (!findings.some((f) => f.threatId === 'C02')) {
                         add('EXFILTRATION', 8, `${cmd} transferring data to remote host`, 'C02');
                     }
                 }
@@ -135,22 +143,50 @@ export class CommandAnalyzer {
         }
         // ── 8. Credential harvesting (C18) ────────────────────────────────
         const credentialPatterns = [
-            '/etc/shadow', '/etc/passwd', '.ssh/id_rsa', '.ssh/id_ed25519',
-            '.ssh/id_dsa', '.ssh/id_ecdsa', '.ssh/authorized_keys',
-            '.env', '.pem', '.key', '.p12', '.pfx',
-            'credentials', '.aws/credentials', '.docker/config.json',
-            '.kube/config', '.gnupg/', '.netrc',
+            '/etc/shadow',
+            '/etc/passwd',
+            '.ssh/id_rsa',
+            '.ssh/id_ed25519',
+            '.ssh/id_dsa',
+            '.ssh/id_ecdsa',
+            '.ssh/authorized_keys',
+            '.env',
+            '.pem',
+            '.key',
+            '.p12',
+            '.pfx',
+            'credentials',
+            '.aws/credentials',
+            '.docker/config.json',
+            '.kube/config',
+            '.gnupg/',
+            '.netrc',
         ];
         for (const cred of credentialPatterns) {
             if (lower.includes(cred)) {
                 // Only flag if reading, not just referencing in a safe context
-                const isReading = segments.some(s => {
+                const isReading = segments.some((s) => {
                     const cmd = s.command.toLowerCase();
-                    return ['cat', 'less', 'more', 'head', 'tail', 'cp', 'scp', 'rsync', 'curl', 'wget', 'base64'].includes(cmd);
+                    return [
+                        'cat',
+                        'less',
+                        'more',
+                        'head',
+                        'tail',
+                        'cp',
+                        'scp',
+                        'rsync',
+                        'curl',
+                        'wget',
+                        'base64',
+                    ].includes(cmd);
                 });
                 // Also flag file redirection of sensitive files
                 const hasOutputRedirect = hasRedirect && lower.includes(cred);
-                if (isReading || hasOutputRedirect || lower.includes(`-d @`) || lower.includes('--upload-file')) {
+                if (isReading ||
+                    hasOutputRedirect ||
+                    lower.includes(`-d @`) ||
+                    lower.includes('--upload-file')) {
                     add('EXFILTRATION', 8, `Accessing sensitive credential file (${cred})`, 'C18');
                     break;
                 }
@@ -163,8 +199,13 @@ export class CommandAnalyzer {
             if (cmd === 'sudo') {
                 // sudo apt install / sudo brew install — common, reduced
                 const subCmd = seg.args[0]?.toLowerCase();
-                if (subCmd === 'apt' || subCmd === 'apt-get' || subCmd === 'brew' || subCmd === 'yum' || subCmd === 'dnf' || subCmd === 'pacman') {
-                    if (seg.args.some(a => a.toLowerCase() === 'install')) {
+                if (subCmd === 'apt' ||
+                    subCmd === 'apt-get' ||
+                    subCmd === 'brew' ||
+                    subCmd === 'yum' ||
+                    subCmd === 'dnf' ||
+                    subCmd === 'pacman') {
+                    if (seg.args.some((a) => a.toLowerCase() === 'install')) {
                         add('ESCALATION', 2, `sudo ${subCmd} install — common system administration`, 'C05');
                     }
                     else {
@@ -186,15 +227,15 @@ export class CommandAnalyzer {
             }
             // chmod with dangerous values on critical paths
             if (cmd === 'chmod') {
-                const hasRiskyPerm = seg.args.some(a => ['777', '000', 'a+rwx'].includes(a));
+                const hasRiskyPerm = seg.args.some((a) => ['777', '000', 'a+rwx'].includes(a));
                 const targetsCritical = this.targetsCriticalPath(seg.args);
                 if (hasRiskyPerm && targetsCritical) {
-                    if (!findings.some(f => f.threatId === 'C05' && f.score >= 8)) {
+                    if (!findings.some((f) => f.threatId === 'C05' && f.score >= 8)) {
                         add('ESCALATION', 8, `chmod with dangerous permissions on critical path`, 'C05');
                     }
                 }
                 else if (hasRiskyPerm) {
-                    if (!findings.some(f => f.threatId === 'C05' && f.score >= 6)) {
+                    if (!findings.some((f) => f.threatId === 'C05' && f.score >= 6)) {
                         add('ESCALATION', 4, `chmod with broad permissions`, 'C05');
                     }
                 }
@@ -214,15 +255,15 @@ export class CommandAnalyzer {
         // ── 11. Process injection (C15) ───────────────────────────────────
         for (const seg of segments) {
             const cmd = seg.command.toLowerCase();
-            if (cmd === 'gdb' && seg.args.some(a => a === '-p' || a === '--pid')) {
+            if (cmd === 'gdb' && seg.args.some((a) => a === '-p' || a === '--pid')) {
                 add('ESCALATION', 8, 'Process injection via gdb attach', 'C15');
             }
-            if (cmd === 'strace' && seg.args.some(a => a === '-p')) {
+            if (cmd === 'strace' && seg.args.some((a) => a === '-p')) {
                 add('ESCALATION', 8, 'Process tracing via strace', 'C15');
             }
         }
         // LD_PRELOAD as inline env var (not export)
-        if (/\bLD_PRELOAD=\S+\s+\S/.test(trimmed) && !findings.some(f => f.threatId === 'C15')) {
+        if (/\bLD_PRELOAD=\S+\s+\S/.test(trimmed) && !findings.some((f) => f.threatId === 'C15')) {
             add('ESCALATION', 8, 'Process injection via LD_PRELOAD', 'C15');
         }
         // ── 12. Persistence — cron (C06) ──────────────────────────────────
@@ -233,20 +274,26 @@ export class CommandAnalyzer {
             }
         }
         if (lower.includes('/etc/cron') || lower.includes('/var/spool/cron')) {
-            if (!findings.some(f => f.threatId === 'C06')) {
+            if (!findings.some((f) => f.threatId === 'C06')) {
                 add('PERSISTENCE', 7, 'Writing to cron directory — persistent execution', 'C06');
             }
         }
         // ── 13. Persistence — shell config (C07) ──────────────────────────
         const shellConfigs = ['.bashrc', '.zshrc', '.profile', '.bash_profile', '.bash_login'];
         for (const config of shellConfigs) {
-            if (lower.includes(config) && (hasRedirect || lower.includes('echo') || lower.includes('tee'))) {
+            if (lower.includes(config) &&
+                (hasRedirect || lower.includes('echo') || lower.includes('tee'))) {
                 add('PERSISTENCE', 6, `Modifying shell config file (${config}) — persistence`, 'C07');
                 break;
             }
         }
         // ── 14. Git hook injection (C11) ──────────────────────────────────
-        if (lower.includes('.git/hooks/') && (hasRedirect || lower.includes('echo') || lower.includes('tee') || lower.includes('cp') || lower.includes('chmod'))) {
+        if (lower.includes('.git/hooks/') &&
+            (hasRedirect ||
+                lower.includes('echo') ||
+                lower.includes('tee') ||
+                lower.includes('cp') ||
+                lower.includes('chmod'))) {
             add('PERSISTENCE', 6, 'Git hook modification — code runs on git operations', 'C11');
         }
         // ── 15. Environment poisoning (C10) ───────────────────────────────
@@ -254,7 +301,7 @@ export class CommandAnalyzer {
             add('PERSISTENCE', 6, 'PATH environment variable modification', 'C10');
         }
         if (/\bexport\s+LD_PRELOAD=/.test(trimmed)) {
-            if (!findings.some(f => f.threatId === 'C15')) {
+            if (!findings.some((f) => f.threatId === 'C15')) {
                 add('PERSISTENCE', 6, 'LD_PRELOAD environment variable set', 'C10');
             }
         }
@@ -280,7 +327,7 @@ export class CommandAnalyzer {
         for (const seg of segments) {
             const cmd = seg.command.toLowerCase();
             if (cmd === 'nc' || cmd === 'ncat' || cmd === 'netcat') {
-                if (seg.args.some(a => a === '-l' || a === '-lp' || a.startsWith('-l'))) {
+                if (seg.args.some((a) => a === '-l' || a === '-lp' || a.startsWith('-l'))) {
                     add('ESCALATION', 5, 'Network listener opened', 'C17');
                 }
             }
@@ -290,14 +337,17 @@ export class CommandAnalyzer {
         }
         // python/python3 -m http.server
         if (lower.includes('http.server') || lower.includes('simplehttpserver')) {
-            if (!findings.some(f => f.threatId === 'C17')) {
+            if (!findings.some((f) => f.threatId === 'C17')) {
                 add('ESCALATION', 5, 'HTTP server started — exposes files on network', 'C17');
             }
         }
         // ── 18. History tampering (C12) ───────────────────────────────────
-        if (lower.includes('history -c') || lower.includes('rm ~/.bash_history') ||
-            lower.includes('rm -f ~/.bash_history') || lower.includes('unset histfile') ||
-            lower.includes('export histfile=/dev/null') || lower.includes('set +o history')) {
+        if (lower.includes('history -c') ||
+            lower.includes('rm ~/.bash_history') ||
+            lower.includes('rm -f ~/.bash_history') ||
+            lower.includes('unset histfile') ||
+            lower.includes('export histfile=/dev/null') ||
+            lower.includes('set +o history')) {
             add('MANIPULATION', 4, 'Command history tampering detected', 'C12');
         }
         // ── 19. Disk filling (C16) ────────────────────────────────────────
@@ -307,7 +357,7 @@ export class CommandAnalyzer {
                 // dd writing to a file (not device) — disk filling
                 const hasDev = seg.raw.toLowerCase().includes('of=/dev/');
                 const hasOf = seg.raw.toLowerCase().includes('of=');
-                if (hasOf && !hasDev && !findings.some(f => f.threatId === 'C01' && f.score >= 9)) {
+                if (hasOf && !hasDev && !findings.some((f) => f.threatId === 'C01' && f.score >= 9)) {
                     add('DESTRUCTION', 5, 'dd writing to file — potential disk filling', 'C16');
                 }
             }
@@ -318,10 +368,10 @@ export class CommandAnalyzer {
             // Handle multi-word package managers like "go install"
             const fullCmd = `${cmd} ${seg.args[0] || ''}`.trim().toLowerCase();
             if (this.packageManagersSet.has(cmd) || this.packageManagersSet.has(fullCmd)) {
-                const isInstall = seg.args.some(a => ['install', 'add', 'i'].includes(a.toLowerCase()));
+                const isInstall = seg.args.some((a) => ['install', 'add', 'i'].includes(a.toLowerCase()));
                 if (isInstall || fullCmd.startsWith('go install')) {
                     // Skip if already covered by safe commands (npm test, etc.)
-                    if (!findings.some(f => f.threatId === 'C20')) {
+                    if (!findings.some((f) => f.threatId === 'C20')) {
                         add('DESTRUCTION', 3, `Package manager install (${cmd}) — may run arbitrary scripts`, 'C20');
                     }
                 }
@@ -474,11 +524,13 @@ export class CommandAnalyzer {
     }
     isEncodedCommand(lower) {
         // base64 -d | bash/sh
-        if (/base64\s+(-d|--decode)/.test(lower) && this.db.pipeToShell.some(p => lower.includes(p.toLowerCase()))) {
+        if (/base64\s+(-d|--decode)/.test(lower) &&
+            this.db.pipeToShell.some((p) => lower.includes(p.toLowerCase()))) {
             return true;
         }
         // eval $(...) with encoding
-        if (/eval\s+\$\(/.test(lower) && (lower.includes('base64') || lower.includes('xxd') || lower.includes('echo'))) {
+        if (/eval\s+\$\(/.test(lower) &&
+            (lower.includes('base64') || lower.includes('xxd') || lower.includes('echo'))) {
             return true;
         }
         // eval "$(base64 ...)"
@@ -517,17 +569,17 @@ export class CommandAnalyzer {
      */
     hasRiskyArgs(seg) {
         const cmd = seg.command.toLowerCase();
-        const argsLower = seg.args.map(a => a.toLowerCase());
+        const argsLower = seg.args.map((a) => a.toLowerCase());
         // Check if safe command is reading sensitive credentials
         if (['cat', 'less', 'more', 'head', 'tail'].includes(cmd)) {
             const credFiles = ['/etc/shadow', '.ssh/id_rsa', '.ssh/id_ed25519', '.env', '.pem', '.key'];
-            if (seg.args.some(a => credFiles.some(c => a.toLowerCase().includes(c)))) {
+            if (seg.args.some((a) => credFiles.some((c) => a.toLowerCase().includes(c)))) {
                 return true;
             }
         }
         // Package managers with install subcommand
         if (this.packageManagersSet.has(cmd)) {
-            if (argsLower.some(a => ['install', 'add', 'i'].includes(a))) {
+            if (argsLower.some((a) => ['install', 'add', 'i'].includes(a))) {
                 return true;
             }
         }