chainwall 0.1.0

package/dist/scanner/filesystem-scanner.js

@@ -0,0 +1,369 @@
+import { opendir, lstat, open, readFile } from 'node:fs/promises';
+import { join, basename } from 'node:path';
+export const SKIP_DIRS = new Set([
+    'node_modules',
+    '.git',
+    'vendor',
+    'dist',
+    'build',
+    '__pycache__',
+    '.llm-av',
+    '.next',
+    '.nuxt',
+    'coverage',
+    '.venv',
+    '.cache',
+    '.idea',
+    '.vscode',
+    // Blockchain data dirs (millions of state files, never contain secrets)
+    'chaindata',
+    'lightchaindata',
+    'blocks',
+    'ancient',
+    'ethash',
+    'triecache',
+    'rocksdb',
+    'leveldb',
+    // macOS system dirs (huge, never contain user secrets)
+    'Library',
+    '.Trash',
+    'Pictures',
+    'Music',
+    'Movies',
+    'Applications',
+    // Package manager caches
+    '.npm',
+    '.yarn',
+    '.pnpm-store',
+    '.cargo',
+    '.rustup',
+    '.local',
+    // Container/VM dirs
+    '.docker',
+    '.colima',
+    '.lima',
+    '.vagrant',
+    'Parallels',
+    'VirtualBox VMs',
+    // Mobile/IDE build dirs
+    '.android',
+    'Xcode',
+    'DerivedData',
+    // Cloud sync dirs
+    'Google Drive',
+    'OneDrive',
+    'Dropbox',
+    'iCloud Drive',
+    // AI tool caches (conversation logs full of code examples = false positives)
+    '.claude',
+    '.kimi',
+    '.gemini',
+    '.antigravity',
+    '.copilot',
+    '.codeium',
+    '.continue',
+    '.cursor-tutor',
+    '.tabby',
+    // Runtime caches
+    '.bun',
+    '.codex',
+    // macOS index/temp
+    '.Spotlight-V100',
+    '.fseventsd',
+    '.TemporaryItems',
+    // Test directories (contain intentional fake credentials)
+    'test',
+    'tests',
+    '__tests__',
+    '__mocks__',
+    '__fixtures__',
+    'spec',
+    'specs',
+    'fixtures',
+    'e2e',
+    'cypress',
+    'playwright',
+]);
+export const TEST_DIRS = new Set([
+    'test', 'tests', '__tests__', '__mocks__', '__fixtures__',
+    'spec', 'specs', 'fixtures', 'e2e', 'cypress', 'playwright',
+]);
+export const SKIP_EXTENSIONS = new Set([
+    '.png', '.jpg', '.jpeg', '.gif', '.ico', '.svg', '.webp', '.bmp',
+    '.woff', '.woff2', '.ttf', '.eot', '.otf',
+    '.zip', '.tar', '.gz', '.bz2', '.xz', '.7z', '.rar',
+    '.wasm', '.pyc', '.pyo', '.class', '.o', '.so', '.dylib', '.dll',
+    '.pdf', '.doc', '.docx', '.xls', '.xlsx',
+    '.mp3', '.mp4', '.wav', '.avi', '.mov',
+    '.lock',
+]);
+export const MAX_FILE_SIZE = 1_048_576; // 1MB
+const DEFAULT_MAX_DEPTH = 50;
+const HOME_MAX_DEPTH = 10;
+const DEFAULT_MAX_FILES = 50_000;
+// Known text extensions — skip isBinary() check for these
+const KNOWN_TEXT_EXTENSIONS = new Set([
+    '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs',
+    '.json', '.yaml', '.yml', '.toml', '.ini', '.cfg', '.conf',
+    '.env', '.envrc', '.env.local', '.env.development', '.env.production',
+    '.md', '.txt', '.rst', '.csv',
+    '.sh', '.bash', '.zsh', '.fish', '.bat', '.cmd', '.ps1',
+    '.py', '.rb', '.go', '.rs', '.java', '.kt', '.scala', '.c', '.cpp', '.h',
+    '.xml', '.html', '.htm', '.css', '.scss', '.less',
+    '.sql', '.graphql', '.gql',
+    '.tf', '.hcl', '.dockerfile',
+    '.pem', '.key', '.crt', '.cer', '.pub',
+    '.properties', '.gradle', '.plist',
+    '.gitignore', '.dockerignore', '.npmrc', '.npmignore',
+]);
+export function shouldSkipExtension(name) {
+    const dot = name.lastIndexOf('.');
+    if (dot === -1)
+        return false;
+    return SKIP_EXTENSIONS.has(name.slice(dot).toLowerCase());
+}
+export function isKnownText(name) {
+    const dot = name.lastIndexOf('.');
+    if (dot === -1)
+        return false;
+    return KNOWN_TEXT_EXTENSIONS.has(name.slice(dot).toLowerCase());
+}
+export async function isBinary(filePath) {
+    let fh;
+    try {
+        fh = await open(filePath, 'r');
+        const buf = Buffer.alloc(512);
+        const { bytesRead } = await fh.read(buf, 0, 512, 0);
+        for (let i = 0; i < bytesRead; i++) {
+            if (buf[i] === 0x00)
+                return true;
+        }
+        return false;
+    }
+    catch {
+        return true;
+    }
+    finally {
+        await fh?.close();
+    }
+}
+export function buildSkipSet(options) {
+    if (!options?.includeTests && !options?.extraSkipDirs?.length)
+        return SKIP_DIRS;
+    const set = new Set(SKIP_DIRS);
+    if (options.includeTests) {
+        for (const d of TEST_DIRS)
+            set.delete(d);
+    }
+    if (options.extraSkipDirs) {
+        for (const d of options.extraSkipDirs)
+            set.add(d);
+    }
+    return set;
+}
+async function* streamWalk(rootDir, maxDepth = DEFAULT_MAX_DEPTH, skipSet = SKIP_DIRS) {
+    const stack = [{ path: rootDir, depth: 0 }];
+    while (stack.length > 0) {
+        const { path: dirPath, depth } = stack.pop();
+        let dir;
+        try {
+            dir = await opendir(dirPath);
+        }
+        catch {
+            continue;
+        }
+        try {
+            for await (const dirent of dir) {
+                if (dirent.isDirectory()) {
+                    if (skipSet.has(dirent.name))
+                        continue;
+                    if (depth + 1 <= maxDepth) {
+                        stack.push({ path: join(dirPath, dirent.name), depth: depth + 1 });
+                    }
+                }
+                else if (dirent.isFile()) {
+                    yield join(dirPath, dirent.name);
+                }
+            }
+        }
+        catch {
+            // Permission denied or dir removed mid-walk
+        }
+    }
+}
+export async function* walkFiles(rootDir, stats, signal, options) {
+    if (signal?.aborted)
+        return;
+    const maxDepth = options?.maxDepth ?? DEFAULT_MAX_DEPTH;
+    const maxFiles = options?.maxFiles ?? DEFAULT_MAX_FILES;
+    const skipSet = buildSkipSet(options);
+    let count = 0;
+    let yielded = 0;
+    for await (const fullPath of streamWalk(rootDir, maxDepth, skipSet)) {
+        if (++count % 50 === 0 && signal?.aborted)
+            return;
+        if (yielded >= maxFiles)
+            return;
+        const name = basename(fullPath);
+        if (shouldSkipExtension(name)) {
+            if (stats)
+                stats.filesSkipped++;
+            continue;
+        }
+        let fileStat;
+        try {
+            fileStat = await lstat(fullPath);
+        }
+        catch {
+            continue;
+        }
+        if (!fileStat.isFile())
+            continue;
+        if (fileStat.size > MAX_FILE_SIZE) {
+            if (stats)
+                stats.filesSkipped++;
+            continue;
+        }
+        if (fileStat.size === 0) {
+            if (stats)
+                stats.filesSkipped++;
+            continue;
+        }
+        // Skip isBinary check for known text extensions
+        if (!isKnownText(name) && await isBinary(fullPath)) {
+            if (stats)
+                stats.filesSkipped++;
+            continue;
+        }
+        let content;
+        try {
+            content = await readFile(fullPath, 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        if (stats)
+            stats.filesScanned++;
+        yielded++;
+        yield { path: fullPath, content };
+    }
+}
+const SYSTEM_MAX_FILE_SIZE = 10_485_760; // 10MB for system targets (shell history can be large)
+export async function* walkSystemTargets(targets, stats, signal) {
+    let count = 0;
+    for (const target of targets) {
+        if (signal?.aborted)
+            return;
+        let targetStat;
+        try {
+            targetStat = await lstat(target.path);
+        }
+        catch {
+            continue; // target doesn't exist, skip
+        }
+        if (targetStat.isFile()) {
+            // Single file target
+            if (target.fileFilter && !target.fileFilter.test(basename(target.path))) {
+                continue;
+            }
+            yield* readSingleFile(target.path, stats);
+            continue;
+        }
+        if (!targetStat.isDirectory())
+            continue;
+        // Directory target — use opendir() for single-level listing
+        let dir;
+        try {
+            dir = await opendir(target.path);
+        }
+        catch {
+            continue;
+        }
+        try {
+            for await (const dirent of dir) {
+                if (++count % 50 === 0 && signal?.aborted)
+                    return;
+                if (!dirent.isFile())
+                    continue;
+                const fullPath = join(target.path, dirent.name);
+                const name = dirent.name;
+                if (target.fileFilter && !target.fileFilter.test(name)) {
+                    continue;
+                }
+                if (shouldSkipExtension(name)) {
+                    if (stats)
+                        stats.filesSkipped++;
+                    continue;
+                }
+                let fileStat;
+                try {
+                    fileStat = await lstat(fullPath);
+                }
+                catch {
+                    continue;
+                }
+                if (!fileStat.isFile())
+                    continue;
+                if (fileStat.size > SYSTEM_MAX_FILE_SIZE) {
+                    if (stats)
+                        stats.filesSkipped++;
+                    continue;
+                }
+                if (fileStat.size === 0)
+                    continue;
+                if (await isBinary(fullPath)) {
+                    if (stats)
+                        stats.filesSkipped++;
+                    continue;
+                }
+                let content;
+                try {
+                    content = await readFile(fullPath, 'utf-8');
+                }
+                catch {
+                    continue;
+                }
+                if (stats)
+                    stats.filesScanned++;
+                yield { path: fullPath, content };
+            }
+        }
+        catch {
+            // Permission denied or dir removed mid-walk
+        }
+    }
+}
+async function* readSingleFile(filePath, stats) {
+    let fileStat;
+    try {
+        fileStat = await lstat(filePath);
+    }
+    catch {
+        return;
+    }
+    if (!fileStat.isFile())
+        return;
+    if (fileStat.size > SYSTEM_MAX_FILE_SIZE) {
+        if (stats)
+            stats.filesSkipped++;
+        return;
+    }
+    if (fileStat.size === 0)
+        return;
+    if (await isBinary(filePath)) {
+        if (stats)
+            stats.filesSkipped++;
+        return;
+    }
+    let content;
+    try {
+        content = await readFile(filePath, 'utf-8');
+    }
+    catch {
+        return;
+    }
+    if (stats)
+        stats.filesScanned++;
+    yield { path: filePath, content };
+}
+//# sourceMappingURL=filesystem-scanner.js.map

package/dist/scanner/filesystem-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-scanner.js","sourceRoot":"","sources":["../../src/scanner/filesystem-scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG3C,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IAC/B,cAAc;IACd,MAAM;IACN,QAAQ;IACR,MAAM;IACN,OAAO;IACP,aAAa;IACb,SAAS;IACT,OAAO;IACP,OAAO;IACP,UAAU;IACV,OAAO;IACP,QAAQ;IACR,OAAO;IACP,SAAS;IACT,wEAAwE;IACxE,WAAW;IACX,gBAAgB;IAChB,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,WAAW;IACX,SAAS;IACT,SAAS;IACT,uDAAuD;IACvD,SAAS;IACT,QAAQ;IACR,UAAU;IACV,OAAO;IACP,QAAQ;IACR,cAAc;IACd,yBAAyB;IACzB,MAAM;IACN,OAAO;IACP,aAAa;IACb,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,oBAAoB;IACpB,SAAS;IACT,SAAS;IACT,OAAO;IACP,UAAU;IACV,WAAW;IACX,gBAAgB;IAChB,wBAAwB;IACxB,UAAU;IACV,OAAO;IACP,aAAa;IACb,kBAAkB;IAClB,cAAc;IACd,UAAU;IACV,SAAS;IACT,cAAc;IACd,6EAA6E;IAC7E,SAAS;IACT,OAAO;IACP,SAAS;IACT,cAAc;IACd,UAAU;IACV,UAAU;IACV,WAAW;IACX,eAAe;IACf,QAAQ;IACR,iBAAiB;IACjB,MAAM;IACN,QAAQ;IACR,mBAAmB;IACnB,iBAAiB;IACjB,YAAY;IACZ,iBAAiB;IACjB,0DAA0D;IAC1D,MAAM;IACN,OAAO;IACP,WAAW;IACX,WAAW;IACX,cAAc;IACd,MAAM;IACN,OAAO;IACP,UAAU;IACV,KAAK;IACL,SAAS;IACT,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc;IACzD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY;CAC5D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IACrC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACzC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;IACnD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;IAChE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO;IACxC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACtC,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,MAAM;AAC9C,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,0DAA0D;AAC1D,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;IAC1D,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB;IACrE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC7B,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACvD,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI;IACxE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;IACjD,MAAM,EAAE,UAAU,EAAE,MAAM;IAC1B,KAAK,EAAE,MAAM,EAAE,aAAa;IAC5B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACtC,aAAa,EAAE,SAAS,EAAE,QAAQ;IAClC,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,YAAY;CACtD,CAAC,CAAC;AAEH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAgB;IAC7C,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;QACnC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC;IACpB,CAAC;AACH,CAAC;AAiBD,MAAM,UAAU,YAAY,CAAC,OAAqB;IAChD,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM;QAAE,OAAO,SAAS,CAAC;IAChF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,aAAa;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,UAAU,CACxB,OAAe,EACf,WAAmB,iBAAiB,EACpC,UAAuB,SAAS;IAEhC,MAAM,KAAK,GAAgB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAEzD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QAE9C,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC/B,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;oBACzB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;wBAAE,SAAS;oBACvC,IAAI,KAAK,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;wBAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;oBACrE,CAAC;gBACH,CAAC;qBAAM,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;oBAC3B,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;AACH,CAAC;AASD,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,SAAS,CAC9B,OAAe,EACf,KAAiB,EACjB,MAAoB,EACpB,OAAqB;IAErB,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO;IAC5B,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,iBAAiB,CAAC;IACxD,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,iBAAiB,CAAC;IACxD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,KAAK,EAAE,MAAM,QAAQ,IAAI,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QACpE,IAAI,EAAE,KAAK,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO;QAClD,IAAI,OAAO,IAAI,QAAQ;YAAE,OAAO;QAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEhC,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,IAAI,KAAK;gBAAE,KAAK,CAAC,YAAY,EAAE,CAAC;YAChC,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,SAAS;QAEjC,IAAI,QAAQ,CAAC,IAAI,GAAG,aAAa,EAAE,CAAC;YAClC,IAAI,KAAK;gBAAE,KAAK,CAAC,YAAY,EAAE,CAAC;YAChC,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACxB,IAAI,KAAK;gBAAE,KAAK,CAAC,YAAY,EAAE,CAAC;YAChC,SAAS;QACX,CAAC;QAED,gDAAgD;QAChD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,IAAI,KAAK;gBAAE,KAAK,CAAC,YAAY,EAAE,CAAC;YAChC,SAAS;QACX,CAAC;QAED,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,IAAI,KAAK;YAAE,KAAK,CAAC,YAAY,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;AACH,CAAC;AAED,MAAM,oBAAoB,GAAG,UAAU,CAAC,CAAC,uDAAuD;AAEhG,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,iBAAiB,CACtC,OAAqB,EACrB,KAAiB,EACjB,MAAoB;IAEpB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO;QAC5B,IAAI,UAAU,CAAC;QACf,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,6BAA6B;QACzC,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACxB,qBAAqB;YACrB,IAAI,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACxE,SAAS;YACX,CAAC;YACD,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;YAAE,SAAS;QAExC,4DAA4D;QAC5D,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC/B,IAAI,EAAE,KAAK,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,OAAO;oBAAE,OAAO;gBAClD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;oBAAE,SAAS;gBAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBAEzB,IAAI,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvD,SAAS;gBACX,CAAC;gBAED,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9B,IAAI,KAAK;wBAAE,KAAK,CAAC,YAAY,EAAE,CAAC;oBAChC,SAAS;gBACX,CAAC;gBAED,IAAI,QAAQ,CAAC;gBACb,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACnC,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBAED,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;oBAAE,SAAS;gBAEjC,IAAI,QAAQ,CAAC,IAAI,GAAG,oBAAoB,EAAE,CAAC;oBACzC,IAAI,KAAK;wBAAE,KAAK,CAAC,YAAY,EAAE,CAAC;oBAChC,SAAS;gBACX,CAAC;gBACD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;oBAAE,SAAS;gBAElC,IAAI,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC7B,IAAI,KAAK;wBAAE,KAAK,CAAC,YAAY,EAAE,CAAC;oBAChC,SAAS;gBACX,CAAC;gBAED,IAAI,OAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC9C,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBAED,IAAI,KAAK;oBAAE,KAAK,CAAC,YAAY,EAAE,CAAC;gBAChC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YACpC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,cAAc,CAC5B,QAAgB,EAChB,KAAiB;IAEjB,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;QAAE,OAAO;IAC/B,IAAI,QAAQ,CAAC,IAAI,GAAG,oBAAoB,EAAE,CAAC;QACzC,IAAI,KAAK;YAAE,KAAK,CAAC,YAAY,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAEhC,IAAI,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,IAAI,KAAK;YAAE,KAAK,CAAC,YAAY,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IAED,IAAI,KAAK;QAAE,KAAK,CAAC,YAAY,EAAE,CAAC;IAChC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC"}

package/dist/scanner/injection-scanner.d.ts

@@ -0,0 +1,12 @@
+import type { ScanFinding } from '../rules/types.js';
+/**
+ * Scan a single file for prompt injection if it's an instruction file.
+ * Returns findings or empty array if not an instruction file.
+ */
+export declare function scanFileForInjection(filePath: string, content: string): ScanFinding[];
+/**
+ * Scan common instruction file locations across the home directory.
+ * Yields findings from each discovered instruction file.
+ */
+export declare function scanInstructionFiles(signal?: AbortSignal): AsyncGenerator<ScanFinding>;
+//# sourceMappingURL=injection-scanner.d.ts.map

package/dist/scanner/injection-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection-scanner.d.ts","sourceRoot":"","sources":["../../src/scanner/injection-scanner.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAc,MAAM,mBAAmB,CAAC;AAkEjE;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE,CAGrF;AAED;;;GAGG;AACH,wBAAuB,oBAAoB,CACzC,MAAM,CAAC,EAAE,WAAW,GACnB,cAAc,CAAC,WAAW,CAAC,CA+D7B"}

package/dist/scanner/injection-scanner.js

@@ -0,0 +1,136 @@
+import { readFile, lstat } from 'node:fs/promises';
+import { join, basename } from 'node:path';
+import { homedir } from 'node:os';
+import { promptInjectionRules } from '../rules/injection-rules.js';
+/** Files specifically targeted for prompt injection scanning */
+const INSTRUCTION_FILE_PATTERNS = [
+    // AI agent instruction files
+    'AGENTS.md', 'CLAUDE.md', '.cursorrules', '.windsurfrules', '.clinerules',
+    '.continuerules', 'GEMINI.md', 'copilot-instructions.md',
+    // Common config/instruction filenames
+    '.github/copilot-instructions.md',
+    '.cursor/rules/security.mdc',
+    '.gemini/styleguide.md',
+    '.roo/rules/security.md',
+    '.trae/rules/security.md',
+    '.kiro/rules/security.md',
+];
+const INSTRUCTION_EXTENSIONS = new Set(['.md', '.mdc', '.txt', '.yaml', '.yml', '.json']);
+function isInstructionFile(filePath) {
+    const name = basename(filePath);
+    // Direct match against known instruction files
+    if (INSTRUCTION_FILE_PATTERNS.some(p => filePath.endsWith(p) || name === p)) {
+        return true;
+    }
+    // Check extension
+    const dot = name.lastIndexOf('.');
+    if (dot !== -1 && INSTRUCTION_EXTENSIONS.has(name.slice(dot).toLowerCase())) {
+        return true;
+    }
+    return false;
+}
+function scanContentForInjection(filePath, content) {
+    const findings = [];
+    const seen = new Set();
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const rule of promptInjectionRules) {
+            rule.regex.lastIndex = 0;
+            const match = rule.regex.exec(line);
+            if (!match)
+                continue;
+            if (rule.validate && !rule.validate(match, line))
+                continue;
+            const key = `${rule.id}:${filePath}:${i + 1}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            findings.push({
+                ruleId: rule.id,
+                ruleName: rule.name,
+                severity: rule.severity,
+                category: rule.category,
+                description: rule.description,
+                filePath,
+                line: i + 1,
+                matchedText: match[0].length > 80 ? match[0].slice(0, 80) + '...' : match[0],
+                action: (rule.action ?? 'block'),
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Scan a single file for prompt injection if it's an instruction file.
+ * Returns findings or empty array if not an instruction file.
+ */
+export function scanFileForInjection(filePath, content) {
+    if (!isInstructionFile(filePath))
+        return [];
+    return scanContentForInjection(filePath, content);
+}
+/**
+ * Scan common instruction file locations across the home directory.
+ * Yields findings from each discovered instruction file.
+ */
+export async function* scanInstructionFiles(signal) {
+    const home = homedir();
+    // Known instruction file locations relative to home
+    const knownPaths = [
+        '.claude/CLAUDE.md',
+        '.cursorrules',
+        '.windsurfrules',
+        '.clinerules',
+        '.continuerules',
+        'GEMINI.md',
+        '.gemini/styleguide.md',
+    ];
+    // Also search common project-level paths in current working directory
+    const cwdPaths = [
+        'AGENTS.md',
+        'CLAUDE.md',
+        '.cursorrules',
+        '.windsurfrules',
+        '.clinerules',
+        '.continuerules',
+        'GEMINI.md',
+        '.github/copilot-instructions.md',
+        '.cursor/rules/security.mdc',
+        '.gemini/styleguide.md',
+        '.roo/rules/security.md',
+        '.trae/rules/security.md',
+        '.kiro/rules/security.md',
+    ];
+    const allPaths = [
+        ...knownPaths.map(p => join(home, p)),
+        ...cwdPaths.map(p => join(process.cwd(), p)),
+    ];
+    // Deduplicate
+    const uniquePaths = [...new Set(allPaths)];
+    for (const filePath of uniquePaths) {
+        if (signal?.aborted)
+            return;
+        let stat;
+        try {
+            stat = await lstat(filePath);
+        }
+        catch {
+            continue; // File doesn't exist
+        }
+        if (!stat.isFile() || stat.size === 0 || stat.size > 1_048_576)
+            continue;
+        let content;
+        try {
+            content = await readFile(filePath, 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        const findings = scanContentForInjection(filePath, content);
+        for (const f of findings) {
+            yield f;
+        }
+    }
+}
+//# sourceMappingURL=injection-scanner.js.map

package/dist/scanner/injection-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection-scanner.js","sourceRoot":"","sources":["../../src/scanner/injection-scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE,gEAAgE;AAChE,MAAM,yBAAyB,GAAG;IAChC,6BAA6B;IAC7B,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa;IACzE,gBAAgB,EAAE,WAAW,EAAE,yBAAyB;IACxD,sCAAsC;IACtC,iCAAiC;IACjC,4BAA4B;IAC5B,uBAAuB;IACvB,wBAAwB;IACxB,yBAAyB;IACzB,yBAAyB;CAC1B,CAAC;AAEF,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAE1F,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChC,+CAA+C;IAC/C,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,kBAAkB;IAClB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB,EAAE,OAAe;IAChE,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;YACxC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;gBAAE,SAAS;YAE3D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,QAAQ,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAEd,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,QAAQ;gBACR,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC5E,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAe;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,OAAe;IACpE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,OAAO,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,oBAAoB,CACzC,MAAoB;IAEpB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,oDAAoD;IACpD,MAAM,UAAU,GAAG;QACjB,mBAAmB;QACnB,cAAc;QACd,gBAAgB;QAChB,aAAa;QACb,gBAAgB;QAChB,WAAW;QACX,uBAAuB;KACxB,CAAC;IAEF,sEAAsE;IACtE,MAAM,QAAQ,GAAG;QACf,WAAW;QACX,WAAW;QACX,cAAc;QACd,gBAAgB;QAChB,aAAa;QACb,gBAAgB;QAChB,WAAW;QACX,iCAAiC;QACjC,4BAA4B;QAC5B,uBAAuB;QACvB,wBAAwB;QACxB,yBAAyB;QACzB,yBAAyB;KAC1B,CAAC;IAEF,MAAM,QAAQ,GAAG;QACf,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACrC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;KAC7C,CAAC;IAEF,cAAc;IACd,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE3C,KAAK,MAAM,QAAQ,IAAI,WAAW,EAAE,CAAC;QACnC,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO;QAE5B,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,qBAAqB;QACjC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,SAAS;YAAE,SAAS;QAEzE,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5D,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/scanner/permission-checker.d.ts

@@ -0,0 +1,4 @@
+import type { ScanFinding } from '../rules/types.js';
+import type { PermissionTarget } from './system-targets.js';
+export declare function checkPermissions(targets: PermissionTarget[]): Promise<ScanFinding[]>;
+//# sourceMappingURL=permission-checker.d.ts.map

package/dist/scanner/permission-checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-checker.d.ts","sourceRoot":"","sources":["../../src/scanner/permission-checker.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAM5D,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAiC1F"}

package/dist/scanner/permission-checker.js

@@ -0,0 +1,37 @@
+import { stat } from 'node:fs/promises';
+import { platform } from 'node:os';
+function formatMode(mode) {
+    return '0' + (mode & 0o777).toString(8);
+}
+export async function checkPermissions(targets) {
+    if (platform() === 'win32')
+        return [];
+    const findings = [];
+    for (const target of targets) {
+        let fileStat;
+        try {
+            fileStat = await stat(target.path);
+        }
+        catch {
+            continue; // file doesn't exist, skip
+        }
+        const mode = fileStat.mode & 0o777;
+        const excess = mode & ~target.maxMode;
+        if (excess !== 0) {
+            findings.push({
+                ruleId: target.ruleId,
+                ruleName: `Insecure permissions on ${target.path.split('/').pop()}`,
+                severity: target.severity,
+                category: 'permission',
+                description: `File permissions are too open — other users may be able to read this file`,
+                filePath: target.path,
+                line: 0,
+                matchedText: `mode: ${formatMode(mode)}`,
+                action: 'warn',
+                detail: `mode: ${formatMode(mode)}, expected: ${formatMode(target.expectedMode)}, max: ${formatMode(target.maxMode)}`,
+            });
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=permission-checker.js.map

package/dist/scanner/permission-checker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-checker.js","sourceRoot":"","sources":["../../src/scanner/permission-checker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAInC,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,GAAG,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAA2B;IAChE,IAAI,QAAQ,EAAE,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,2BAA2B;QACvC,CAAC;QAED,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;QAEtC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,2BAA2B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBACnE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ,EAAE,YAAY;gBACtB,WAAW,EAAE,2EAA2E;gBACxF,QAAQ,EAAE,MAAM,CAAC,IAAI;gBACrB,IAAI,EAAE,CAAC;gBACP,WAAW,EAAE,SAAS,UAAU,CAAC,IAAI,CAAC,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,SAAS,UAAU,CAAC,IAAI,CAAC,eAAe,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;aACtH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/scanner/redact.d.ts

@@ -0,0 +1,3 @@
+import type { Category } from '../rules/types.js';
+export declare function redactMatch(text: string, category: Category | string): string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/scanner/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/scanner/redact.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AASlD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAO7E"}

package/dist/scanner/redact.js

@@ -0,0 +1,17 @@
+const REDACT_CATEGORIES = new Set([
+    'credential',
+    'private_key',
+    'pii',
+    'crypto',
+]);
+export function redactMatch(text, category) {
+    if (!REDACT_CATEGORIES.has(category))
+        return text;
+    if (text.length <= 8)
+        return '*'.repeat(text.length);
+    const showPrefix = Math.min(4, Math.floor(text.length * 0.2));
+    const showSuffix = Math.min(4, Math.floor(text.length * 0.2));
+    const masked = text.length - showPrefix - showSuffix;
+    return text.slice(0, showPrefix) + '*'.repeat(masked) + text.slice(text.length - showSuffix);
+}
+//# sourceMappingURL=redact.js.map

package/dist/scanner/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/scanner/redact.ts"],"names":[],"mappings":"AAEA,MAAM,iBAAiB,GAAkB,IAAI,GAAG,CAAC;IAC/C,YAAY;IACZ,aAAa;IACb,KAAK;IACL,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,QAA2B;IACnE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAoB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC;IACrD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC;AAC/F,CAAC"}

package/dist/scanner/rule-engine.d.ts

@@ -0,0 +1,9 @@
+import type { Rule, ScanFinding, Config } from '../rules/types.js';
+export interface RuleEngineOptions {
+    rules: Rule[];
+    config: Config;
+}
+export declare function createRuleEngine({ rules, config }: RuleEngineOptions): {
+    scanFile: (filePath: string, content: string) => ScanFinding[];
+};
+//# sourceMappingURL=rule-engine.d.ts.map

package/dist/scanner/rule-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-engine.d.ts","sourceRoot":"","sources":["../../src/scanner/rule-engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAInE,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAeD,wBAAgB,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,iBAAiB;yBAiDvC,MAAM,WAAW,MAAM,KAAG,WAAW,EAAE;EAmEpE"}