audit-tools 0.30.36 → 0.30.38

package/dist/audit/extractors/analyzers/acquisitionEngine.d.ts

@@ -1,5 +1,6 @@
 import { type AnalyzerSetting, type RunTrackedResult } from "audit-tools/shared";
 import type { ExternalAnalyzerResults, ExternalAnalyzerToolStatus } from "../../types/externalAnalyzer.js";
+import { type BinarySpec, type BinaryResolveOptions } from "./binaryAcquisition.js";
 /**
  * F5 — external analyzer acquisition engine.
  *
@@ -21,18 +22,26 @@ import type { ExternalAnalyzerResults, ExternalAnalyzerToolStatus } from "../../
  *    its `AnalyzerSetting` (auto|ephemeral|permanent) — even a `permanent`,
  *    pre-installed tool cannot spawn without consent (CE-005). The small
  *    value-curated DEFAULT set runs without prompting.
- *  - **Own-vs-acquire boundary.** git-history / secret-scan are OWNED by F6 and
- *    are rejected at registration — never acquired here.
+ *  - **Own-vs-acquire boundary.** git-history is OWNED by F6 and is rejected at
+ *    registration — never acquired here. Secret scanning is ACQUIRED (gitleaks).
  *  - **Run-safety gate written once** (`runSafetyGate`): capability-probe, pin
  *    version, read-only/sandboxed argv, degrade-to-empty.
  *  - **Degrade-to-empty + report-skipped-never-silently.** Every candidate
  *    yields exactly one {@link ExternalAnalyzerToolStatus}; a failure never
  *    throws and never silently drops the candidate.
  */
-/** Tool ids OWNED by F6 (git-history mining / secret scanning). Never acquired. */
+/**
+ * Tool ids OWNED by F6 and never acquired. Only git-history mining is OWNED — it
+ * is a truly-agnostic signal with no ecosystem tool. Secret scanning is ACQUIRED
+ * (gitleaks), not owned, so it is deliberately NOT listed here.
+ */
 export declare const OWNED_TOOL_IDS: Set<string>;
-/** Ecosystem runners F5 knows how to drive. */
-export type EcosystemRunner = "npx" | "pipx" | "cargo" | "bundle";
+/**
+ * Ecosystem runners F5 knows how to drive. `npx`/`pipx`/`cargo`/`bundle` acquire
+ * + run a pinned package ephemerally; `binary` runs a standalone release binary
+ * resolved (and downloaded-if-absent) by the binary-acquisition seam.
+ */
+export type EcosystemRunner = "npx" | "pipx" | "cargo" | "bundle" | "binary";
 /**
  * One acquirable external analyzer. `defaultRun: true` marks a member of the
  * small value-curated set that may run without a consent token; everything else
@@ -67,10 +76,24 @@ export interface ExternalAnalyzerCandidate {
         from?: unknown;
         to?: unknown;
     }>;
+    /**
+     * For tools that ONLY report to a file (e.g. gitleaks) rather than stdout: the
+     * report path the tool was told to write (must match `buildArgv`). When set, the
+     * engine reads this file (degrade-to-"" if absent) and passes its contents to
+     * `parse` instead of stdout, then best-effort removes it. Omit for stdout tools.
+     */
+    reportFile?(root: string): string;
     /** Whether this ecosystem is present (marker file detection). */
     detect(root: string): boolean;
     /** Member of the value-curated DEFAULT set (runs without prompting). */
     defaultRun: boolean;
+    /**
+     * Acquisition spec for a `runner: "binary"` candidate — how to probe PATH and,
+     * if absent, download + SHA256-verify the pinned release binary. Resolved ahead
+     * of the (synchronous) engine by `resolveBinaryCandidates`; ignored for the
+     * package-manager runners.
+     */
+    binary?: BinarySpec;
 }
 export declare function detectNodeEcosystem(root: string): boolean;
 export declare function detectPythonEcosystem(root: string): boolean;
@@ -92,6 +115,12 @@ export interface AcquisitionEngineOptions {
     run?: AcquisitionRunner;
     /** Injectable logger; defaults to a no-op (degrade quietly to status records). */
     log?: (...args: unknown[]) => void;
+    /**
+     * Resolved executable path per `runner: "binary"` candidate id, produced by
+     * `resolveBinaryCandidates`. A binary candidate with no entry here is reported
+     * `not_resolved` (acquisition failed / was skipped) and never spawned.
+     */
+    resolvedBinaries?: Record<string, string>;
 }
 /**
  * Single subprocess-SPAWN admission chokepoint. Returns the reason a spawn is
@@ -127,6 +156,20 @@ export declare function runExternalAnalyzer(candidate: ExternalAnalyzerCandidate
  * boundary is enforced HERE so an owned tool can never enter the engine.
  */
 export declare function registerExternalAnalyzers(candidates: ExternalAnalyzerCandidate[]): ExternalAnalyzerCandidate[];
+export interface ResolvedBinaries {
+    /** id → resolved executable path/name, for candidates that resolved. */
+    resolvedBinaries: Record<string, string>;
+    /** One status per `binary` candidate that did NOT resolve (skipped/unavailable). */
+    unresolvedStatuses: ExternalAnalyzerToolStatus[];
+}
+/**
+ * Resolve (acquiring if absent) the executable for every `runner: "binary"`
+ * candidate, ahead of the synchronous engine. This is where the async network
+ * I/O + checksum gate lives. Owned tools and non-binary candidates are skipped.
+ * Never throws; an unresolved binary yields a `not_resolved`/`skipped` status so
+ * the caller can record the coverage gap (never silently dropped).
+ */
+export declare function resolveBinaryCandidates(candidates: ExternalAnalyzerCandidate[], root: string, options?: AcquisitionEngineOptions & BinaryResolveOptions): Promise<ResolvedBinaries>;
 export interface RunAllOutcome {
     results: ExternalAnalyzerResults[];
     statuses: ExternalAnalyzerToolStatus[];

package/dist/audit/extractors/analyzers/acquisitionEngine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acquisitionEngine.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/acquisitionEngine.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EACV,uBAAuB,EACvB,0BAA0B,EAC3B,MAAM,iCAAiC,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,mFAAmF;AACnF,eAAO,MAAM,cAAc,aAMzB,CAAC;AAEH,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAElE;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,+DAA+D;IAC/D,EAAE,EAAE,MAAM,CAAC;IACX,4DAA4D;IAC5D,MAAM,EAAE,eAAe,CAAC;IACxB,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1D;;;OAGG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;QAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,OAAO,CAAC;QACd,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,EAAE,CAAC,EAAE,OAAO,CAAC;KACd,CAAC,CAAC;IACH,iEAAiE;IACjE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,wEAAwE;IACxE,UAAU,EAAE,OAAO,CAAC;CACrB;AAOD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AA0BD,MAAM,WAAW,iBAAiB;IAChC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAC;CACjD;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C,oEAAoE;IACpE,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB,kFAAkF;IAClF,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACpC;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,SAAS,EAAE,yBAAyB,EACpC,OAAO,EAAE,eAAe,EACxB,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,MAAM,GAAG,SAAS,CAKpB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,yBAAyB,EACpC,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAgB9C;AAaD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,uBAAuB,CAAC;IACjC,MAAM,EAAE,0BAA0B,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,yBAAyB,EACpC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,wBAA6B,GACrC,kBAAkB,CA6GpB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,yBAAyB,EAAE,GACtC,yBAAyB,EAAE,CAO7B;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACnC,QAAQ,EAAE,0BAA0B,EAAE,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,yBAAyB,EAAE,EACvC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,wBAA6B,GACrC,aAAa,CAYf"}
+{"version":3,"file":"acquisitionEngine.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/acquisitionEngine.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EACV,uBAAuB,EACvB,0BAA0B,EAC3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,oBAAoB,EAC1B,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc,aAGzB,CAAC;AAEH;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE7E;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,+DAA+D;IAC/D,EAAE,EAAE,MAAM,CAAC;IACX,4DAA4D;IAC5D,MAAM,EAAE,eAAe,CAAC;IACxB,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1D;;;OAGG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;QAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,OAAO,CAAC;QACd,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,EAAE,CAAC,EAAE,OAAO,CAAC;KACd,CAAC,CAAC;IACH;;;;;OAKG;IACH,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC,iEAAiE;IACjE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,wEAAwE;IACxE,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAOD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AA+BD,MAAM,WAAW,iBAAiB;IAChC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAC;CACjD;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C,oEAAoE;IACpE,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB,kFAAkF;IAClF,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACnC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,SAAS,EAAE,yBAAyB,EACpC,OAAO,EAAE,eAAe,EACxB,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,MAAM,GAAG,SAAS,CAKpB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,yBAAyB,EACpC,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAgB9C;AAaD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,uBAAuB,CAAC;IACjC,MAAM,EAAE,0BAA0B,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,yBAAyB,EACpC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,wBAA6B,GACrC,kBAAkB,CAoJpB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,yBAAyB,EAAE,GACtC,yBAAyB,EAAE,CAO7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,oFAAoF;IACpF,kBAAkB,EAAE,0BAA0B,EAAE,CAAC;CAClD;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,yBAAyB,EAAE,EACvC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,wBAAwB,GAAG,oBAAyB,GAC5D,OAAO,CAAC,gBAAgB,CAAC,CAuC3B;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACnC,QAAQ,EAAE,0BAA0B,EAAE,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,yBAAyB,EAAE,EACvC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,wBAA6B,GACrC,aAAa,CAYf"}

package/dist/audit/extractors/analyzers/acquisitionEngine.js

@@ -1,7 +1,8 @@
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { runTracked, } from "audit-tools/shared";
 import { normalizeGenericExternalResults, normalizeGenericExternalEdges, } from "../../adapters/normalizeExternal.js";
+import { resolveBinary, } from "./binaryAcquisition.js";
 /**
  * F5 — external analyzer acquisition engine.
  *
@@ -23,21 +24,22 @@ import { normalizeGenericExternalResults, normalizeGenericExternalEdges, } from
  *    its `AnalyzerSetting` (auto|ephemeral|permanent) — even a `permanent`,
  *    pre-installed tool cannot spawn without consent (CE-005). The small
  *    value-curated DEFAULT set runs without prompting.
- *  - **Own-vs-acquire boundary.** git-history / secret-scan are OWNED by F6 and
- *    are rejected at registration — never acquired here.
+ *  - **Own-vs-acquire boundary.** git-history is OWNED by F6 and is rejected at
+ *    registration — never acquired here. Secret scanning is ACQUIRED (gitleaks).
  *  - **Run-safety gate written once** (`runSafetyGate`): capability-probe, pin
  *    version, read-only/sandboxed argv, degrade-to-empty.
  *  - **Degrade-to-empty + report-skipped-never-silently.** Every candidate
  *    yields exactly one {@link ExternalAnalyzerToolStatus}; a failure never
  *    throws and never silently drops the candidate.
  */
-/** Tool ids OWNED by F6 (git-history mining / secret scanning). Never acquired. */
+/**
+ * Tool ids OWNED by F6 and never acquired. Only git-history mining is OWNED — it
+ * is a truly-agnostic signal with no ecosystem tool. Secret scanning is ACQUIRED
+ * (gitleaks), not owned, so it is deliberately NOT listed here.
+ */
 export const OWNED_TOOL_IDS = new Set([
     "git-history",
     "git-history-mining",
-    "secret-scan",
-    "secret-scanner",
-    "secrets",
 ]);
 /** Marker-file ecosystem detection — deterministic, no language→tool table. */
 function hasAnyMarker(root, markers) {
@@ -66,6 +68,8 @@ function runnerProbeArgv(runner) {
         case "pipx": return ["pipx", "--version"];
         case "cargo": return ["cargo", "--version"];
         case "bundle": return ["bundle", "--version"];
+        // `binary` is resolved (+ checksum-gated) ahead of the engine — no runner probe.
+        case "binary": return [];
     }
 }
 function runnerPrefix(runner, spec) {
@@ -75,6 +79,9 @@ function runnerPrefix(runner, spec) {
         case "pipx": return ["pipx", "run", "--spec", spec];
         case "cargo": return ["cargo", spec];
         case "bundle": return ["bundle", "exec", spec];
+        // For `binary` the resolved executable path is supplied via
+        // options.resolvedBinaries and used directly — this is never called.
+        case "binary": return [];
     }
 }
 /**
@@ -154,16 +161,39 @@ export function runExternalAnalyzer(candidate, root, options = {}) {
             status: { tool: candidate.id, resolved: false, status: "skipped", error: denied },
         };
     }
-    // Run-safety gate: capability-probe the runner before the real spawn.
-    const gate = runSafetyGate(candidate, run, root);
-    if (!gate.ok) {
-        log("[f5] %s safety gate failed: %s", candidate.id, gate.reason);
-        return {
-            results: emptyResults(candidate.id),
-            status: { tool: candidate.id, resolved: false, status: "not_resolved", error: gate.reason },
-        };
+    // Resolve the argv prefix. A `binary` candidate is gated by binary-acquisition
+    // (PATH probe / checksum-verified download) AHEAD of the engine, so it skips the
+    // runner probe and uses its resolved executable path; everything else passes the
+    // capability-probe run-safety gate before its first real spawn.
+    let prefix;
+    if (candidate.runner === "binary") {
+        const resolved = options.resolvedBinaries?.[candidate.id];
+        if (!resolved) {
+            log("[f5] %s binary not acquired", candidate.id);
+            return {
+                results: emptyResults(candidate.id),
+                status: {
+                    tool: candidate.id,
+                    resolved: false,
+                    status: "not_resolved",
+                    error: "binary not acquired (PATH probe failed and download unavailable)",
+                },
+            };
+        }
+        prefix = [resolved];
+    }
+    else {
+        const gate = runSafetyGate(candidate, run, root);
+        if (!gate.ok) {
+            log("[f5] %s safety gate failed: %s", candidate.id, gate.reason);
+            return {
+                results: emptyResults(candidate.id),
+                status: { tool: candidate.id, resolved: false, status: "not_resolved", error: gate.reason },
+            };
+        }
+        prefix = runnerPrefix(candidate.runner, candidate.spec);
     }
-    const argv = candidate.buildArgv(runnerPrefix(candidate.runner, candidate.spec), root);
+    const argv = candidate.buildArgv(prefix, root);
     const command = argv.join(" ");
     let result;
     try {
@@ -194,9 +224,28 @@ export function runExternalAnalyzer(candidate, root, options = {}) {
             },
         };
     }
+    // Tools that report to a file (gitleaks) are read from there; stdout tools use
+    // stdout. The report file is best-effort removed after parsing.
+    let parseInput = result.stdout;
+    if (candidate.reportFile) {
+        const reportPath = candidate.reportFile(root);
+        try {
+            parseInput = existsSync(reportPath) ? readFileSync(reportPath, "utf8") : "";
+        }
+        catch {
+            parseInput = "";
+        }
+        try {
+            if (existsSync(reportPath))
+                rmSync(reportPath, { force: true });
+        }
+        catch {
+            /* best-effort */
+        }
+    }
     let items;
     try {
-        items = candidate.parse(result.stdout);
+        items = candidate.parse(parseInput);
     }
     catch (error) {
         return {
@@ -241,6 +290,56 @@ export function registerExternalAnalyzers(candidates) {
     }
     return accepted;
 }
+/**
+ * Resolve (acquiring if absent) the executable for every `runner: "binary"`
+ * candidate, ahead of the synchronous engine. This is where the async network
+ * I/O + checksum gate lives. Owned tools and non-binary candidates are skipped.
+ * Never throws; an unresolved binary yields a `not_resolved`/`skipped` status so
+ * the caller can record the coverage gap (never silently dropped).
+ */
+export async function resolveBinaryCandidates(candidates, root, options = {}) {
+    const resolvedBinaries = {};
+    const unresolvedStatuses = [];
+    for (const candidate of candidates) {
+        if (candidate.runner !== "binary" || !candidate.binary)
+            continue;
+        if (OWNED_TOOL_IDS.has(candidate.id))
+            continue;
+        if (!candidate.detect(root)) {
+            unresolvedStatuses.push({
+                tool: candidate.id,
+                resolved: false,
+                status: "skipped",
+                error: "ecosystem not detected",
+            });
+            continue;
+        }
+        const setting = settingFor(options.analyzers, candidate.id);
+        const denied = admitSpawn(candidate, setting, options.consentToken);
+        if (denied) {
+            unresolvedStatuses.push({
+                tool: candidate.id,
+                resolved: false,
+                status: "skipped",
+                error: denied,
+            });
+            continue;
+        }
+        const resolution = await resolveBinary(candidate.binary, options);
+        if (resolution.command) {
+            resolvedBinaries[candidate.id] = resolution.command;
+        }
+        else {
+            unresolvedStatuses.push({
+                tool: candidate.id,
+                resolved: false,
+                status: "not_resolved",
+                error: resolution.note ?? "binary unavailable",
+            });
+        }
+    }
+    return { resolvedBinaries, unresolvedStatuses };
+}
 /**
  * Drive the whole registered candidate set through the engine for one repo,
  * collecting one status per candidate. Owned tools are rejected at registration;

package/dist/audit/extractors/analyzers/acquisitionEngine.js.map

@@ -1 +1 @@
-{"version":3,"file":"acquisitionEngine.js","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/acquisitionEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,UAAU,GAGX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,qCAAqC,CAAC;AAM7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IAC5C,aAAa;IACb,oBAAoB;IACpB,aAAa;IACb,gBAAgB;IAChB,SAAS;CACV,CAAC,CAAC;AA6CH,+EAA+E;AAC/E,SAAS,YAAY,CAAC,IAAY,EAAE,OAAiB;IACnD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,MAAuB;IAC9C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC1C,KAAK,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC5C,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAuB,EAAE,IAAY;IACzD,QAAQ,MAAM,EAAE,CAAC;QACf,qEAAqE;QACrE,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpD,KAAK,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrC,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAqBD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,SAAoC,EACpC,OAAwB,EACxB,YAAgC;IAEhC,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,cAAc,CAAC;IAC9C,IAAI,SAAS,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,YAAY,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO,iDAAiD,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAoC,EACpC,GAAsB,EACtB,IAAY;IAEZ,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,8BAA8B,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW,SAAS,CAAC,MAAM,oBACjC,KAAK,CAAC,KAAK,EAAE,OAAO,IAAI,QAAQ,KAAK,CAAC,MAAM,EAC9C,EAAE;SACH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CACjB,SAAsD,EACtD,EAAU;IAEV,OAAO,SAAS,EAAE,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC;AACnC,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAoC,EACpC,IAAY,EACZ,UAAoC,EAAE;IAEtC,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;QACrC,yDAAyD;QACzD,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,uDAAuD;aAC/D;SACF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAE5D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,wBAAwB,EAAE;SACpG,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACpE,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,gCAAgC,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5D,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE;SAClF,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,GAAG,CAAC,gCAAgC,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACjE,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;SAC5F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,OAAO;gBACP,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,aAAa;gBACrB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D;SACF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,OAAO;gBACP,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,aAAa;gBACrB,SAAS,EAAE,MAAM,CAAC,MAAM;gBACxB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;aAC5B;SACF,CAAC;IACJ,CAAC;IAED,IAAI,KAAqD,CAAC;IAC1D,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,OAAO;gBACP,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,aAAa;gBACrB,SAAS,EAAE,MAAM,CAAC,MAAM;gBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aAC5C;SACF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,+BAA+B,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,UAAU,CAAC,WAAW,GAAG,KAAK,CAAC;IAErD,OAAO;QACL,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE;YACN,IAAI,EAAE,SAAS,CAAC,EAAE;YAClB,OAAO;YACP,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YAC9D,SAAS,EAAE,MAAM,CAAC,MAAM;SACzB;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAuC;IAEvC,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,SAAS;QAC/C,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAuC,EACvC,IAAY,EACZ,UAAoC,EAAE;IAEtC,MAAM,UAAU,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAiC,EAAE,CAAC;IAClD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9D,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;YAC9E,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"acquisitionEngine.js","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/acquisitionEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,UAAU,GAGX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,qCAAqC,CAAC;AAK7C,OAAO,EACL,aAAa,GAGd,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IAC5C,aAAa;IACb,oBAAoB;CACrB,CAAC,CAAC;AA+DH,+EAA+E;AAC/E,SAAS,YAAY,CAAC,IAAY,EAAE,OAAiB;IACnD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,MAAuB;IAC9C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC1C,KAAK,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC5C,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC9C,iFAAiF;QACjF,KAAK,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAuB,EAAE,IAAY;IACzD,QAAQ,MAAM,EAAE,CAAC;QACf,qEAAqE;QACrE,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpD,KAAK,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrC,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/C,4DAA4D;QAC5D,qEAAqE;QACrE,KAAK,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AA2BD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,SAAoC,EACpC,OAAwB,EACxB,YAAgC;IAEhC,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,cAAc,CAAC;IAC9C,IAAI,SAAS,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,YAAY,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO,iDAAiD,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAoC,EACpC,GAAsB,EACtB,IAAY;IAEZ,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,8BAA8B,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW,SAAS,CAAC,MAAM,oBACjC,KAAK,CAAC,KAAK,EAAE,OAAO,IAAI,QAAQ,KAAK,CAAC,MAAM,EAC9C,EAAE;SACH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CACjB,SAAsD,EACtD,EAAU;IAEV,OAAO,SAAS,EAAE,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC;AACnC,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAoC,EACpC,IAAY,EACZ,UAAoC,EAAE;IAEtC,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;QACrC,yDAAyD;QACzD,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,uDAAuD;aAC/D;SACF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAE5D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,wBAAwB,EAAE;SACpG,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACpE,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,gCAAgC,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5D,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE;SAClF,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,iFAAiF;IACjF,iFAAiF;IACjF,gEAAgE;IAChE,IAAI,MAAgB,CAAC;IACrB,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,6BAA6B,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;YACjD,OAAO;gBACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnC,MAAM,EAAE;oBACN,IAAI,EAAE,SAAS,CAAC,EAAE;oBAClB,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,cAAc;oBACtB,KAAK,EAAE,kEAAkE;iBAC1E;aACF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,GAAG,CAAC,gCAAgC,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;aAC5F,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,OAAO;gBACP,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,aAAa;gBACrB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D;SACF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,OAAO;gBACP,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,aAAa;gBACrB,SAAS,EAAE,MAAM,CAAC,MAAM;gBACxB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;aAC5B;SACF,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,gEAAgE;IAChE,IAAI,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,EAAE,CAAC;QAClB,CAAC;QACD,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,UAAU,CAAC;gBAAE,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IAED,IAAI,KAAqD,CAAC;IAC1D,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,OAAO;gBACP,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,aAAa;gBACrB,SAAS,EAAE,MAAM,CAAC,MAAM;gBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aAC5C;SACF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,+BAA+B,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,UAAU,CAAC,WAAW,GAAG,KAAK,CAAC;IAErD,OAAO;QACL,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE;YACN,IAAI,EAAE,SAAS,CAAC,EAAE;YAClB,OAAO;YACP,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YAC9D,SAAS,EAAE,MAAM,CAAC,MAAM;SACzB;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAuC;IAEvC,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,SAAS;QAC/C,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAAuC,EACvC,IAAY,EACZ,UAA2D,EAAE;IAE7D,MAAM,gBAAgB,GAA2B,EAAE,CAAC;IACpD,MAAM,kBAAkB,GAAiC,EAAE,CAAC;IAC5D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,MAAM;YAAE,SAAS;QACjE,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,SAAS;QAC/C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,kBAAkB,CAAC,IAAI,CAAC;gBACtB,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,wBAAwB;aAChC,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACpE,IAAI,MAAM,EAAE,CAAC;YACX,kBAAkB,CAAC,IAAI,CAAC;gBACtB,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClE,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,kBAAkB,CAAC,IAAI,CAAC;gBACtB,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,cAAc;gBACtB,KAAK,EAAE,UAAU,CAAC,IAAI,IAAI,oBAAoB;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;AAClD,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAuC,EACvC,IAAY,EACZ,UAAoC,EAAE;IAEtC,MAAM,UAAU,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAiC,EAAE,CAAC;IAClD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9D,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;YAC9E,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC"}

package/dist/audit/extractors/analyzers/binaryAcquisition.d.ts

@@ -0,0 +1,65 @@
+import { type RunTrackedResult } from "audit-tools/shared";
+/**
+ * Generic acquisition of a standalone mature analyzer BINARY (gitleaks,
+ * trufflehog, …) that has no language package-manager runner. The own-vs-acquire
+ * policy's "acquire the mature tool" half for tools shipped as release binaries.
+ *
+ * Resolution order (all degrade-to-unavailable, never throw):
+ *   1. PATH        — the tool is already installed (`<tool> version` probes 0).
+ *   2. cache       — a previously-downloaded pinned binary is present + executable.
+ *   3. download    — fetch the pinned GitHub-release asset for THIS os/arch over
+ *                    HTTPS, fetch that release's `checksums.txt`, SHA256-verify the
+ *                    asset against it, extract via the system `tar`, cache, return.
+ *
+ * Security invariants: version is PINNED (reproducibility); the downloaded asset
+ * is SHA256-verified against the official release checksums BEFORE it is extracted
+ * or executed; the fetcher is injected so the engine is testable without network
+ * and an absent network degrades cleanly. A checksum mismatch is fatal-to-this-tool
+ * (returns `unavailable`), never executed.
+ */
+/** Injected network fetch: returns the URL's bytes, or `null` when unavailable. */
+export interface BinaryFetcher {
+    (url: string): Promise<Uint8Array | null>;
+}
+/** Injected command runner (probe PATH, run `tar`); defaults to the shared runTracked. */
+export interface BinaryCommandRunner {
+    (argv: string[], cwd: string): RunTrackedResult;
+}
+/** Pinned, os/arch-aware description of one acquirable release binary. */
+export interface BinarySpec {
+    /** Executable name on PATH / inside the archive (e.g. "gitleaks"). */
+    binaryName: string;
+    /** Pinned release version, no leading `v` (e.g. "8.18.4"). */
+    version: string;
+    /** Probe argv proving an on-PATH install (e.g. ["gitleaks","version"]). */
+    versionProbeArgs: string[];
+    /** Asset filename for a platform/arch, or null when unsupported. */
+    assetFor(platform: NodeJS.Platform, arch: string): string | null;
+    /** Checksums-file asset name (lists `<sha256>  <asset>` lines). */
+    checksumsAsset: string;
+    /** `${releaseUrlBase}/${assetName}` is the download URL (asset + checksums). */
+    releaseUrlForAsset(assetName: string): string;
+}
+export interface BinaryResolveOptions {
+    fetch?: BinaryFetcher;
+    run?: BinaryCommandRunner;
+    /** Root cache dir for downloaded binaries; default `<tmpdir>/audit-tools-bincache`. */
+    cacheDir?: string;
+    platform?: NodeJS.Platform;
+    arch?: string;
+}
+export interface BinaryResolution {
+    status: "path" | "cached" | "downloaded" | "unavailable";
+    /** Resolved executable (PATH name or absolute cached path); null when unavailable. */
+    command: string | null;
+    note?: string;
+}
+/** Parse a `<sha256>␠␠<asset>` checksums file for one asset's expected digest. */
+export declare function expectedSha256For(checksumsText: string, assetName: string): string | null;
+/**
+ * Resolve an executable for `spec`, acquiring it if necessary. Async (download is
+ * network I/O); never throws. The result's `command` is what the engine spawns,
+ * or null when the tool could not be made available.
+ */
+export declare function resolveBinary(spec: BinarySpec, options?: BinaryResolveOptions): Promise<BinaryResolution>;
+//# sourceMappingURL=binaryAcquisition.d.ts.map

package/dist/audit/extractors/analyzers/binaryAcquisition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binaryAcquisition.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/binaryAcquisition.ts"],"names":[],"mappings":"AAYA,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEvE;;;;;;;;;;;;;;;;;GAiBG;AAEH,mFAAmF;AACnF,MAAM,WAAW,aAAa;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CAC3C;AAED,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAClC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAC;CACjD;AAED,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACjE,mEAAmE;IACnE,cAAc,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;CAC/C;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,GAAG,CAAC,EAAE,mBAAmB,CAAC;IAC1B,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,YAAY,GAAG,aAAa,CAAC;IACzD,sFAAsF;IACtF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAUD,kFAAkF;AAClF,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAMf;AAMD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,UAAU,EAChB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,gBAAgB,CAAC,CAqG3B"}

package/dist/audit/extractors/analyzers/binaryAcquisition.js

@@ -0,0 +1,153 @@
+import { createHash } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readdirSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { runTracked } from "audit-tools/shared";
+function defaultCacheDir() {
+    return join(tmpdir(), "audit-tools-bincache");
+}
+function exeName(binaryName, platform) {
+    return platform === "win32" ? `${binaryName}.exe` : binaryName;
+}
+/** Parse a `<sha256>␠␠<asset>` checksums file for one asset's expected digest. */
+export function expectedSha256For(checksumsText, assetName) {
+    for (const line of checksumsText.split(/\r?\n/)) {
+        const match = line.trim().match(/^([0-9a-fA-F]{64})\s+\*?(.+)$/);
+        if (match && match[2].trim() === assetName)
+            return match[1].toLowerCase();
+    }
+    return null;
+}
+function sha256(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+/**
+ * Resolve an executable for `spec`, acquiring it if necessary. Async (download is
+ * network I/O); never throws. The result's `command` is what the engine spawns,
+ * or null when the tool could not be made available.
+ */
+export async function resolveBinary(spec, options = {}) {
+    const platform = options.platform ?? process.platform;
+    const arch = options.arch ?? process.arch;
+    const run = options.run ?? ((argv, cwd) => runTracked(argv, { cwd }));
+    const cacheDir = options.cacheDir ?? defaultCacheDir();
+    // 1. PATH — already installed.
+    const probe = run(spec.versionProbeArgs, process.cwd());
+    if (!probe.error && probe.status === 0) {
+        return { status: "path", command: spec.binaryName };
+    }
+    // 2. cache — a previously-downloaded pinned binary.
+    const versionDir = join(cacheDir, `${spec.binaryName}-${spec.version}`);
+    const cachedPath = join(versionDir, exeName(spec.binaryName, platform));
+    if (existsSync(cachedPath)) {
+        return { status: "cached", command: cachedPath };
+    }
+    // 3. download — pinned release asset, SHA256-verified, then extracted.
+    const fetch = options.fetch;
+    if (!fetch) {
+        return { status: "unavailable", command: null, note: "no fetcher configured (offline)" };
+    }
+    const assetName = spec.assetFor(platform, arch);
+    if (!assetName) {
+        return {
+            status: "unavailable",
+            command: null,
+            note: `no release asset for ${platform}/${arch}`,
+        };
+    }
+    let assetBytes;
+    let checksumsBytes;
+    try {
+        checksumsBytes = await fetch(spec.releaseUrlForAsset(spec.checksumsAsset));
+        assetBytes = await fetch(spec.releaseUrlForAsset(assetName));
+    }
+    catch (error) {
+        return {
+            status: "unavailable",
+            command: null,
+            note: `download failed: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    if (!checksumsBytes || !assetBytes) {
+        return { status: "unavailable", command: null, note: "download returned no bytes" };
+    }
+    const expected = expectedSha256For(Buffer.from(checksumsBytes).toString("utf8"), assetName);
+    if (!expected) {
+        return { status: "unavailable", command: null, note: `no checksum for ${assetName}` };
+    }
+    const actual = sha256(assetBytes);
+    if (actual !== expected) {
+        return {
+            status: "unavailable",
+            command: null,
+            note: `checksum mismatch for ${assetName} (expected ${expected}, got ${actual})`,
+        };
+    }
+    // Verified — write the archive and extract it with the system `tar` (bsdtar
+    // ships on win32 / darwin / linux and reads both .tar.gz and .zip).
+    try {
+        mkdirSync(versionDir, { recursive: true });
+        const archivePath = join(versionDir, assetName);
+        writeFileSync(archivePath, assetBytes);
+        const extract = run(["tar", "-xf", archivePath, "-C", versionDir], versionDir);
+        rmSync(archivePath, { force: true });
+        if (extract.error || extract.status !== 0) {
+            return {
+                status: "unavailable",
+                command: null,
+                note: `extract failed: ${extract.error?.message ?? `tar exit ${extract.status}`}`,
+            };
+        }
+    }
+    catch (error) {
+        return {
+            status: "unavailable",
+            command: null,
+            note: `extract error: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    // Locate the executable (archives may nest it); chmod +x on POSIX.
+    const resolved = findExecutable(versionDir, exeName(spec.binaryName, platform));
+    if (!resolved) {
+        return { status: "unavailable", command: null, note: "binary not found in archive" };
+    }
+    if (platform !== "win32") {
+        try {
+            chmodSync(resolved, 0o755);
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+    return { status: "downloaded", command: resolved };
+}
+/** Shallow-then-recursive search for `name` under `dir`. */
+function findExecutable(dir, name) {
+    const direct = join(dir, name);
+    if (existsSync(direct))
+        return direct;
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return null;
+    }
+    for (const entry of entries) {
+        const full = join(dir, entry);
+        let isDir = false;
+        try {
+            isDir = statSync(full).isDirectory();
+        }
+        catch {
+            continue;
+        }
+        if (isDir) {
+            const nested = findExecutable(full, name);
+            if (nested)
+                return nested;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=binaryAcquisition.js.map

package/dist/audit/extractors/analyzers/binaryAcquisition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binaryAcquisition.js","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/binaryAcquisition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,WAAW,EACX,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAyB,MAAM,oBAAoB,CAAC;AA+DvE,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,OAAO,CAAC,UAAkB,EAAE,QAAyB;IAC5D,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,UAAU,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;AACjE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAC/B,aAAqB,EACrB,SAAiB;IAEjB,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACjE,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAgB,EAChB,UAAgC,EAAE;IAElC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC;IAEvD,+BAA+B;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACtD,CAAC;IAED,oDAAoD;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,uEAAuE;IACvE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,wBAAwB,QAAQ,IAAI,IAAI,EAAE;SACjD,CAAC;IACJ,CAAC;IAED,IAAI,UAA6B,CAAC;IAClC,IAAI,cAAiC,CAAC;IACtC,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;QAC3E,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACnF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAChC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC5C,SAAS,CACV,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,SAAS,EAAE,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,yBAAyB,SAAS,cAAc,QAAQ,SAAS,MAAM,GAAG;SACjF,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,CAAC;QACH,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAChD,aAAa,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;QAC/E,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,mBAAmB,OAAO,CAAC,KAAK,EAAE,OAAO,IAAI,YAAY,OAAO,CAAC,MAAM,EAAE,EAAE;aAClF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,kBAAkB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACjF,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACrD,CAAC;AAED,4DAA4D;AAC5D,SAAS,cAAc,CAAC,GAAW,EAAE,IAAY;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/B,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1C,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/audit/extractors/analyzers/candidates.d.ts

@@ -0,0 +1,23 @@
+import type { ExternalAnalyzerCandidate } from "./acquisitionEngine.js";
+/**
+ * The value-curated EXTERNAL analyzer candidate registry. This is the only place
+ * concrete tools are named; the engine is tool-agnostic. gitleaks is the DEFAULT
+ * member (high-value, low-overhead secret scanning, agnostic to the repo's
+ * ecosystem); semgrep + eslint are registered but CONSENT-GATED (defaultRun:
+ * false) — they pull rule sets / need repo config and so only run when the
+ * operator supplies a per-run consent token.
+ */
+declare const GITLEAKS_VERSION = "8.21.2";
+/**
+ * Parse gitleaks' default JSON report (array of findings, PascalCase fields) into
+ * the engine's generic item shape. The raw secret value is NEVER carried through
+ * (Secret/Match are dropped) so the persisted artifact cannot leak a credential.
+ */
+declare function parseGitleaks(report: string): ReturnType<ExternalAnalyzerCandidate["parse"]>;
+declare const gitleaksCandidate: ExternalAnalyzerCandidate;
+declare const semgrepCandidate: ExternalAnalyzerCandidate;
+declare const eslintCandidate: ExternalAnalyzerCandidate;
+/** The curated external analyzer candidate set. gitleaks is the default member. */
+export declare const EXTERNAL_ANALYZER_CANDIDATES: ExternalAnalyzerCandidate[];
+export { gitleaksCandidate, semgrepCandidate, eslintCandidate, parseGitleaks, GITLEAKS_VERSION, };
+//# sourceMappingURL=candidates.d.ts.map

package/dist/audit/extractors/analyzers/candidates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"candidates.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/candidates.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAOxE;;;;;;;GAOG;AAKH,QAAA,MAAM,gBAAgB,WAAW,CAAC;AA2ClC;;;;GAIG;AACH,iBAAS,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAqCrF;AAED,QAAA,MAAM,iBAAiB,EAAE,yBAsBxB,CAAC;AAiCF,QAAA,MAAM,gBAAgB,EAAE,yBASvB,CAAC;AAqCF,QAAA,MAAM,eAAe,EAAE,yBAStB,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,4BAA4B,EAAE,yBAAyB,EAInE,CAAC;AAEF,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,gBAAgB,GACjB,CAAC"}