codehere 0.2.2 → 0.3.0-rc.10

package/dist/infrastructure/security/file-collection.js

@@ -0,0 +1,115 @@
+/**
+ * Canonical file-collection rules for the trust scanner.
+ *
+ * Historic bug: IGNORE_DIRS and the test-file filter lived in three places
+ * (trust-command, mcp-helpers, report-command) and drifted. The v0.3.0-alpha
+ * shipreadiness fix patched two of them; report-command kept the old rules
+ * and produced different finding counts than `trust` for the same directory.
+ *
+ * Single source of truth now — every scanner entry point imports from here.
+ */
+import { readdirSync, statSync } from 'fs';
+import { join, extname } from 'path';
+export const CODE_EXTENSIONS = new Set([
+    '.ts',
+    '.tsx',
+    '.js',
+    '.jsx',
+    '.mjs',
+    '.cjs',
+    '.py',
+    '.rb',
+    '.go',
+    '.java',
+    '.cs',
+    '.php',
+    '.sh',
+    '.bash',
+    '.zsh',
+    '.sql',
+    '.html',
+    '.vue',
+    '.svelte',
+]);
+export const IGNORE_DIRS = new Set([
+    // JS/TS
+    'node_modules',
+    'dist',
+    'build',
+    '.next',
+    '.nuxt',
+    '.svelte-kit',
+    '.turbo',
+    '.parcel-cache',
+    // Python
+    'venv',
+    '__pycache__',
+    '.pytest_cache',
+    '.ruff_cache',
+    '.mypy_cache',
+    '.tox',
+    '__pypackages__',
+    // Rust / Go / PHP / Java / .NET
+    'target',
+    'vendor',
+    '.gradle',
+    'obj',
+    // VCS / tooling / coverage / codehere
+    '.git',
+    '.hg',
+    '.svn',
+    'coverage',
+    '.cache',
+    '.codehere',
+    '.codehere-cache',
+    // Test fixtures / mocks (intentionally-vulnerable code used as scanner inputs)
+    'fixtures',
+    'test-fixtures',
+    '__fixtures__',
+    '__mocks__',
+]);
+// Test files contain deliberate vulnerability patterns as scanner inputs —
+// SQL injection strings, hardcoded "credentials" etc. — that inflate the
+// finding count without being real production risks. Skip by default.
+export const TEST_FILE_RE = /\.(test|spec)\.[cm]?[jt]sx?$/;
+export function shouldIgnoreDir(name) {
+    if (IGNORE_DIRS.has(name))
+        return true;
+    // Python virtualenv variants — .venv, .venv311, .venv-py3, venv3.11, env-py3
+    if (name.startsWith('.venv') || name.startsWith('venv'))
+        return true;
+    return false;
+}
+export function shouldIgnoreFile(name) {
+    return TEST_FILE_RE.test(name);
+}
+export function isCodeFile(name) {
+    return CODE_EXTENSIONS.has(extname(name)) && !shouldIgnoreFile(name);
+}
+/**
+ * Walk a directory and return paths of code files worth scanning.
+ * If `target` is a single file, it is returned as-is (explicit targets
+ * are never excluded — user pointed at it on purpose).
+ */
+export function collectCodeFiles(target) {
+    const stat = statSync(target);
+    if (stat.isFile())
+        return [target];
+    const files = [];
+    function walk(dir) {
+        for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            if (shouldIgnoreDir(entry.name))
+                continue;
+            const full = join(dir, entry.name);
+            if (entry.isDirectory()) {
+                walk(full);
+            }
+            else if (isCodeFile(entry.name)) {
+                files.push(full);
+            }
+        }
+    }
+    walk(target);
+    return files;
+}
+//# sourceMappingURL=file-collection.js.map

package/dist/infrastructure/security/trust-scorer.js

@@ -9,60 +9,283 @@
  *
  * All passes run locally, zero API calls.
  */
-import { scanPayload } from '../hooks/claude-sdk-hook.js';
 export const CODE_PATTERNS = [
     // Secrets (scan with strings visible — must see inside string literals)
-    { regex: /(?:password|passwd|pass|pwd|secret|api_?key|auth_?token)\s*[:=]\s*['"`][^'"`\s]{4,}['"`]/gi, severity: 'high', category: 'Secrets', description: 'Hardcoded credential', cwe: 'CWE-798', scanRaw: true },
-    { regex: /(?:password|passwd|secret|api.?key|auth.?token)[^\n]*\|\|\s*['"`][^'"`\s]{3,}['"`]/gi, severity: 'high', category: 'Secrets', description: 'Hardcoded fallback credential (env var || literal)', cwe: 'CWE-798', scanRaw: true },
-    { regex: /sk-[a-zA-Z0-9]{32,}|xoxb-[a-zA-Z0-9-]+|ghp_[a-zA-Z0-9]{36,}/i, severity: 'critical', category: 'Secrets', description: 'API key pattern (OpenAI/Slack/GitHub)', cwe: 'CWE-798', scanRaw: true },
+    {
+        regex: /(?:password|passwd|pass|pwd|secret|api_?key|auth_?token)\s*[:=]\s*['"`][^'"`\s]{4,}['"`]/gi,
+        severity: 'high',
+        category: 'Secrets',
+        description: 'Hardcoded credential',
+        cwe: 'CWE-798',
+        scanRaw: true,
+    },
+    {
+        regex: /(?:password|passwd|secret|api.?key|auth.?token)[^\n]*\|\|\s*['"`][^'"`\s]{3,}['"`]/gi,
+        severity: 'high',
+        category: 'Secrets',
+        description: 'Hardcoded fallback credential (env var || literal)',
+        cwe: 'CWE-798',
+        scanRaw: true,
+    },
+    {
+        regex: /sk-[a-zA-Z0-9]{32,}|xoxb-[a-zA-Z0-9-]+|ghp_[a-zA-Z0-9]{36,}/i,
+        severity: 'critical',
+        category: 'Secrets',
+        description: 'API key pattern (OpenAI/Slack/GitHub)',
+        cwe: 'CWE-798',
+        scanRaw: true,
+    },
     // SQL Injection (scan with strings visible — SQL lives inside string literals)
     // Per-quote-type to allow inner quotes: "SELECT...WHERE name='" + user
-    { regex: /"[^"]*SELECT[^"]*FROM[^"]*WHERE[^"]*"\s*\+/gi, severity: 'critical', category: 'SQL Injection', description: 'SQL query built with string concatenation (double-quoted)', cwe: 'CWE-89', scanRaw: true },
-    { regex: /'[^']*SELECT[^']*FROM[^']*WHERE[^']*'\s*\+/gi, severity: 'critical', category: 'SQL Injection', description: 'SQL query built with string concatenation (single-quoted)', cwe: 'CWE-89', scanRaw: true },
-    { regex: /query\s*\(\s*['"`][^'"`]*\$\{|execute\s*\([`'"]\s*SELECT.*\$\{/gi, severity: 'critical', category: 'SQL Injection', description: 'String interpolation in SQL query', cwe: 'CWE-89', scanRaw: true },
-    { regex: /pool\.query\s*\([^,)]*\+[^,)]*\)/g, severity: 'high', category: 'SQL Injection', description: 'String concatenation in SQL query call', cwe: 'CWE-89' },
+    {
+        regex: /"[^"]*SELECT[^"]*FROM[^"]*WHERE[^"]*"\s*\+/gi,
+        severity: 'critical',
+        category: 'SQL Injection',
+        description: 'SQL query built with string concatenation (double-quoted)',
+        cwe: 'CWE-89',
+        scanRaw: true,
+    },
+    {
+        regex: /'[^']*SELECT[^']*FROM[^']*WHERE[^']*'\s*\+/gi,
+        severity: 'critical',
+        category: 'SQL Injection',
+        description: 'SQL query built with string concatenation (single-quoted)',
+        cwe: 'CWE-89',
+        scanRaw: true,
+    },
+    // Require a SQL keyword inside the interpolated string — otherwise this
+    // matches any `query("prompt with ${x}")` (handleQuery, graphql.query, etc.)
+    {
+        regex: /query\s*\(\s*['"`][^'"`]*\b(?:SELECT|INSERT|UPDATE|DELETE|WHERE|FROM)\b[^'"`]*\$\{|execute\s*\([`'"]\s*SELECT.*\$\{/gi,
+        severity: 'critical',
+        category: 'SQL Injection',
+        description: 'String interpolation in SQL query',
+        cwe: 'CWE-89',
+        scanRaw: true,
+    },
+    {
+        regex: /pool\.query\s*\([^,)]*\+[^,)]*\)/g,
+        severity: 'high',
+        category: 'SQL Injection',
+        description: 'String concatenation in SQL query call',
+        cwe: 'CWE-89',
+    },
     // Command injection with user input (scan with strings visible)
     // Catches require('child_process').execSync(req.body.cmd) — child_process is in a string
     // but the method call and req. reference are in plain code
-    { regex: /\.exec(?:Sync)?\s*\(\s*req\./gi, severity: 'critical', category: 'Command Injection', description: 'exec/execSync called directly with request input', cwe: 'CWE-78', scanRaw: true },
+    {
+        regex: /\.exec(?:Sync)?\s*\(\s*req\./gi,
+        severity: 'critical',
+        category: 'Command Injection',
+        description: 'exec/execSync called directly with request input',
+        cwe: 'CWE-78',
+        scanRaw: true,
+    },
     // Injection (scan fully stripped — structural, must not trigger on pattern defs or comments)
-    { regex: /\beval\s*\(/g, severity: 'critical', category: 'Code Injection', description: 'eval() allows arbitrary code execution', cwe: 'CWE-95' },
-    { regex: /new\s+Function\s*\(/g, severity: 'critical', category: 'Code Injection', description: 'Function() constructor execution', cwe: 'CWE-95' },
-    { regex: /child_process\.exec(?:Sync)?\s*\(\s*[^,)'"]*(?:req\.|body\.|params\.|query\.)/g, severity: 'critical', category: 'Command Injection', description: 'execSync/exec with user-controlled input', cwe: 'CWE-78' },
-    { regex: /child_process\.exec\s*\(\s*[^,)]*\+/g, severity: 'critical', category: 'Command Injection', description: 'Command injection via string concat', cwe: 'CWE-78' },
+    {
+        regex: /\beval\s*\(/g,
+        severity: 'critical',
+        category: 'Code Injection',
+        description: 'eval() allows arbitrary code execution',
+        cwe: 'CWE-95',
+    },
+    {
+        regex: /new\s+Function\s*\(/g,
+        severity: 'critical',
+        category: 'Code Injection',
+        description: 'Function() constructor execution',
+        cwe: 'CWE-95',
+    },
+    {
+        regex: /child_process\.exec(?:Sync)?\s*\(\s*[^,)'"]*(?:req\.|body\.|params\.|query\.)/g,
+        severity: 'critical',
+        category: 'Command Injection',
+        description: 'execSync/exec with user-controlled input',
+        cwe: 'CWE-78',
+    },
+    {
+        regex: /child_process\.exec\s*\(\s*[^,)]*\+/g,
+        severity: 'critical',
+        category: 'Command Injection',
+        description: 'Command injection via string concat',
+        cwe: 'CWE-78',
+    },
     // Destructured exec/execSync with string concat containing user input
-    { regex: /\bexec(?:Sync)?\s*\([^)]*\+\s*req\./g, severity: 'critical', category: 'Command Injection', description: 'exec() with string concatenation of user input', cwe: 'CWE-78', scanRaw: true },
-    { regex: /\.innerHTML\s*=\s*[^=]/g, severity: 'high', category: 'XSS', description: 'innerHTML assignment (potential XSS)', cwe: 'CWE-79' },
-    { regex: /document\.write\s*\(/g, severity: 'high', category: 'XSS', description: 'document.write can lead to XSS', cwe: 'CWE-79' },
+    {
+        regex: /\bexec(?:Sync)?\s*\([^)]*\+\s*req\./g,
+        severity: 'critical',
+        category: 'Command Injection',
+        description: 'exec() with string concatenation of user input',
+        cwe: 'CWE-78',
+        scanRaw: true,
+    },
+    {
+        regex: /\.innerHTML\s*=\s*[^=]/g,
+        severity: 'high',
+        category: 'XSS',
+        description: 'innerHTML assignment (potential XSS)',
+        cwe: 'CWE-79',
+    },
+    {
+        regex: /document\.write\s*\(/g,
+        severity: 'high',
+        category: 'XSS',
+        description: 'document.write can lead to XSS',
+        cwe: 'CWE-79',
+    },
     // Insecure deserialization
-    { regex: /JSON\.parse\s*\([^)]*req\.|JSON\.parse\s*\([^)]*input/gi, severity: 'medium', category: 'Insecure Input', description: 'JSON.parse on unvalidated user input', cwe: 'CWE-502' },
-    { regex: /yaml\.load\s*\([^)]*\)/g, severity: 'high', category: 'Insecure Deserialization', description: 'yaml.load without safeLoad', cwe: 'CWE-502' },
-    { regex: /pickle\.loads\s*\(/g, severity: 'critical', category: 'Insecure Deserialization', description: 'pickle.loads on arbitrary data', cwe: 'CWE-502' },
+    {
+        regex: /JSON\.parse\s*\([^)]*req\.|JSON\.parse\s*\([^)]*input/gi,
+        severity: 'medium',
+        category: 'Insecure Input',
+        description: 'JSON.parse on unvalidated user input',
+        cwe: 'CWE-502',
+    },
+    {
+        regex: /yaml\.load\s*\([^)]*\)/g,
+        severity: 'high',
+        category: 'Insecure Deserialization',
+        description: 'yaml.load without safeLoad',
+        cwe: 'CWE-502',
+    },
+    {
+        regex: /pickle\.loads\s*\(/g,
+        severity: 'critical',
+        category: 'Insecure Deserialization',
+        description: 'pickle.loads on arbitrary data',
+        cwe: 'CWE-502',
+    },
     // Auth issues
-    { regex: /jwt\.verify\s*\([^,)]+,\s*[^,)]+,\s*\{\s*algorithms\s*:\s*\[\s*['"`]none['"`]/i, severity: 'critical', category: 'Auth Bypass', description: 'JWT algorithm:none vulnerability', cwe: 'CWE-347' },
-    { regex: /password\s*===?\s*['"`]|password\s*==\s*req\./gi, severity: 'high', category: 'Auth Bypass', description: 'Plaintext password comparison', cwe: 'CWE-256' },
+    {
+        regex: /jwt\.verify\s*\([^,)]+,\s*[^,)]+,\s*\{\s*algorithms\s*:\s*\[\s*['"`]none['"`]/i,
+        severity: 'critical',
+        category: 'Auth Bypass',
+        description: 'JWT algorithm:none vulnerability',
+        cwe: 'CWE-347',
+    },
+    {
+        regex: /password\s*===?\s*['"`]|password\s*==\s*req\./gi,
+        severity: 'high',
+        category: 'Auth Bypass',
+        description: 'Plaintext password comparison',
+        cwe: 'CWE-256',
+    },
     // Weak crypto
-    { regex: /Math\.random\s*\(\s*\).*(?:token|key|secret|password|nonce|salt)/gi, severity: 'high', category: 'Weak Crypto', description: 'Math.random() for security-sensitive value', cwe: 'CWE-338' },
-    { regex: /createCipheriv\s*\([^,]*['"`](?:des|rc4|md5)[^'"]*['"`]/gi, severity: 'high', category: 'Weak Crypto', description: 'Weak/deprecated cipher algorithm', cwe: 'CWE-327' },
+    {
+        regex: /Math\.random\s*\(\s*\).*(?:token|key|secret|password|nonce|salt)/gi,
+        severity: 'high',
+        category: 'Weak Crypto',
+        description: 'Math.random() for security-sensitive value',
+        cwe: 'CWE-338',
+    },
+    {
+        regex: /createCipheriv\s*\([^,]*['"`](?:des|rc4|md5)[^'"]*['"`]/gi,
+        severity: 'high',
+        category: 'Weak Crypto',
+        description: 'Weak/deprecated cipher algorithm',
+        cwe: 'CWE-327',
+    },
     // Path traversal
-    { regex: /readFile\s*\([^)]*req\.|readFileSync\s*\([^)]*user/gi, severity: 'high', category: 'Path Traversal', description: 'File read with user-controlled path', cwe: 'CWE-22' },
-    { regex: /__dirname\s*\+\s*['"`/]*\s*\+?\s*req\.(params|query|body)/gi, severity: 'high', category: 'Path Traversal', description: 'Path built from user input without sanitization', cwe: 'CWE-22' },
-    { regex: /sendFile\s*\([^)]*req\.(params|query|body)/gi, severity: 'high', category: 'Path Traversal', description: 'sendFile with user-controlled path', cwe: 'CWE-22' },
+    {
+        regex: /readFile\s*\([^)]*req\.|readFileSync\s*\([^)]*user/gi,
+        severity: 'high',
+        category: 'Path Traversal',
+        description: 'File read with user-controlled path',
+        cwe: 'CWE-22',
+    },
+    {
+        regex: /__dirname\s*\+\s*['"`/]*\s*\+?\s*req\.(params|query|body)/gi,
+        severity: 'high',
+        category: 'Path Traversal',
+        description: 'Path built from user input without sanitization',
+        cwe: 'CWE-22',
+    },
+    {
+        regex: /sendFile\s*\([^)]*req\.(params|query|body)/gi,
+        severity: 'high',
+        category: 'Path Traversal',
+        description: 'sendFile with user-controlled path',
+        cwe: 'CWE-22',
+    },
     // Open redirect
-    { regex: /res\.redirect\s*\([^)]*req\.(query|body|params)/gi, severity: 'medium', category: 'Open Redirect', description: 'Redirect to user-controlled URL', cwe: 'CWE-601' },
+    {
+        regex: /res\.redirect\s*\([^)]*req\.(query|body|params)/gi,
+        severity: 'medium',
+        category: 'Open Redirect',
+        description: 'Redirect to user-controlled URL',
+        cwe: 'CWE-601',
+    },
     // Server-side XSS (template injection in response)
-    { regex: /res\.send\s*\(\s*`[^`]*\$\{[^}]*req\.(query|body|params)/gi, severity: 'high', category: 'XSS', description: 'User input interpolated directly into response HTML', cwe: 'CWE-79', scanRaw: true },
-    { regex: /res\.send\s*\([^)]*\+\s*req\.(query|body|params)/gi, severity: 'high', category: 'XSS', description: 'User input concatenated into response', cwe: 'CWE-79', scanRaw: true },
-    // Command injection via variable indirection (exec with non-literal arg)
-    { regex: /\.exec\s*\(\s*(?!['"`])(\w+)\s*[,)]/g, severity: 'high', category: 'Command Injection', description: 'exec() called with variable argument — verify input is not user-controlled', cwe: 'CWE-78' },
+    {
+        regex: /res\.send\s*\(\s*`[^`]*\$\{[^}]*req\.(query|body|params)/gi,
+        severity: 'high',
+        category: 'XSS',
+        description: 'User input interpolated directly into response HTML',
+        cwe: 'CWE-79',
+        scanRaw: true,
+    },
+    {
+        regex: /res\.send\s*\([^)]*\+\s*req\.(query|body|params)/gi,
+        severity: 'high',
+        category: 'XSS',
+        description: 'User input concatenated into response',
+        cwe: 'CWE-79',
+        scanRaw: true,
+    },
+    // Command injection via variable indirection (exec with non-literal arg).
+    // Gated: only fires if file references child_process — otherwise regex.exec(str)
+    // lights up every bundled highlight.js / parser in the ecosystem.
+    // requiresContext must match an actual import, not the literal string
+    // child_process (which this scanner file itself contains as pattern data).
+    {
+        regex: /\.exec\s*\(\s*(?!['"`])(\w+)\s*[,)]/g,
+        severity: 'high',
+        category: 'Command Injection',
+        description: 'exec() called with variable argument — verify input is not user-controlled',
+        cwe: 'CWE-78',
+        requiresContext: /(?:from|require\()\s*['"](?:node:)?child_process['"]/,
+    },
     // SSRF
-    { regex: /fetch\s*\(\s*req\.(body|query|params)/gi, severity: 'high', category: 'SSRF', description: 'Server-side request to user-controlled URL', cwe: 'CWE-918' },
-    { regex: /axios\s*\.\s*(?:get|post|put|delete)\s*\(\s*req\.(body|query|params)/gi, severity: 'high', category: 'SSRF', description: 'HTTP request to user-controlled URL', cwe: 'CWE-918' },
+    {
+        regex: /fetch\s*\(\s*req\.(body|query|params)/gi,
+        severity: 'high',
+        category: 'SSRF',
+        description: 'Server-side request to user-controlled URL',
+        cwe: 'CWE-918',
+    },
+    {
+        regex: /axios\s*\.\s*(?:get|post|put|delete)\s*\(\s*req\.(body|query|params)/gi,
+        severity: 'high',
+        category: 'SSRF',
+        description: 'HTTP request to user-controlled URL',
+        cwe: 'CWE-918',
+    },
     // Weak crypto (MD5, SHA1 for passwords)
-    { regex: /createHash\s*\(\s*['"`]md5['"`]\s*\)/gi, severity: 'high', category: 'Weak Crypto', description: 'MD5 hash is cryptographically broken — use bcrypt/argon2 for passwords', cwe: 'CWE-328', scanRaw: true },
-    { regex: /createHash\s*\(\s*['"`]sha1['"`]\s*\)/gi, severity: 'medium', category: 'Weak Crypto', description: 'SHA1 is deprecated for security use — use SHA-256+ or bcrypt', cwe: 'CWE-328', scanRaw: true },
+    {
+        regex: /createHash\s*\(\s*['"`]md5['"`]\s*\)/gi,
+        severity: 'high',
+        category: 'Weak Crypto',
+        description: 'MD5 hash is cryptographically broken — use bcrypt/argon2 for passwords',
+        cwe: 'CWE-328',
+        scanRaw: true,
+    },
+    {
+        regex: /createHash\s*\(\s*['"`]sha1['"`]\s*\)/gi,
+        severity: 'medium',
+        category: 'Weak Crypto',
+        description: 'SHA1 is deprecated for security use — use SHA-256+ or bcrypt',
+        cwe: 'CWE-328',
+        scanRaw: true,
+    },
     // JWT algorithm:none (both sign and verify — scan raw to catch string content)
-    { regex: /jwt\.(?:sign|verify)\s*\([^)]*algorithm\s*:\s*['"`]none['"`]/gi, severity: 'critical', category: 'Auth Bypass', description: 'JWT with algorithm "none" disables signature verification', cwe: 'CWE-347', scanRaw: true },
+    {
+        regex: /jwt\.(?:sign|verify)\s*\([^)]*algorithm\s*:\s*['"`]none['"`]/gi,
+        severity: 'critical',
+        category: 'Auth Bypass',
+        description: 'JWT with algorithm "none" disables signature verification',
+        cwe: 'CWE-347',
+        scanRaw: true,
+    },
 ];
 export function measureComplexity(code) {
     const lines = code.split('\n').length;
@@ -100,8 +323,8 @@ function isRegexStart(code, pos) {
     if (j < 0)
         return true;
     const prev = code[j];
-    return '=([{,;!&|?:~^%+->'.includes(prev) ||
-        /\b(return|typeof|instanceof|in|new|delete|void|throw|case)\s*$/.test(code.slice(0, pos).trimEnd());
+    return ('=([{,;!&|?:~^%+->'.includes(prev) ||
+        /\b(return|typeof|instanceof|in|new|delete|void|throw|case)\s*$/.test(code.slice(0, pos).trimEnd()));
 }
 /**
  * Strip ONLY comments and regex literals — string literals remain visible.
@@ -254,14 +477,36 @@ function stripLiterals(code) {
     }
     return out.join('');
 }
+/**
+ * Public-by-design credential patterns — not secrets, should not flag.
+ * Firebase web API keys: Google documents these as safe to expose (security is via Firebase Rules).
+ * Stripe publishable keys: meant to be used in client code (pk_test_, pk_live_).
+ * Supabase anon keys: public by design when used with row-level security.
+ */
+const PUBLIC_KEY_SIGNATURES = [
+    /AIzaSy[A-Za-z0-9_-]{33}/, // Firebase / Google Cloud web API key
+    /pk_(?:test|live)_[A-Za-z0-9]{20,}/, // Stripe publishable key
+];
+function isKnownPublicKey(matched) {
+    if (!matched)
+        return false;
+    return PUBLIC_KEY_SIGNATURES.some((re) => re.test(matched));
+}
 export function scoreFile(filepath, code) {
     const allFindings = [];
     // Pass 1: Comments+regex stripped but strings visible — catches secrets/SQL inside literals
     const rawForSecrets = stripCommentsAndRegex(code);
-    for (const pattern of CODE_PATTERNS.filter(p => p.scanRaw)) {
+    for (const pattern of CODE_PATTERNS.filter((p) => p.scanRaw)) {
         let match;
         const re = new RegExp(pattern.regex.source, pattern.regex.flags);
         while ((match = re.exec(rawForSecrets)) !== null) {
+            const matched = match[0].substring(0, 80);
+            // Skip known public-by-design keys (Firebase, Stripe publishable, etc.)
+            if (pattern.category === 'Secrets' && isKnownPublicKey(matched)) {
+                if (!re.global)
+                    break;
+                continue;
+            }
             const line = code.substring(0, match.index).split('\n').length;
             allFindings.push({
                 severity: pattern.severity,
@@ -269,7 +514,7 @@ export function scoreFile(filepath, code) {
                 description: pattern.description,
                 line,
                 cwe: pattern.cwe,
-                matched: match[0].substring(0, 80),
+                matched,
             });
             if (!re.global)
                 break;
@@ -277,7 +522,16 @@ export function scoreFile(filepath, code) {
     }
     // Pass 2: Fully stripped code — structural patterns (no false positives from literals)
     const scannable = stripLiterals(code);
-    for (const pattern of CODE_PATTERNS.filter(p => !p.scanRaw)) {
+    // Context gate test: use comment-stripped source so `// require('child_process')`
+    // in a comment doesn't count as real usage. Strings still visible so actual
+    // imports like `from 'child_process'` still match.
+    const contextTarget = rawForSecrets;
+    for (const pattern of CODE_PATTERNS.filter((p) => !p.scanRaw)) {
+        // Context gate: skip pattern if the file doesn't have the required context
+        // (e.g., .exec(var) only fires if the file uses child_process).
+        if (pattern.requiresContext && !pattern.requiresContext.test(contextTarget)) {
+            continue;
+        }
         let match;
         const re = new RegExp(pattern.regex.source, pattern.regex.flags);
         while ((match = re.exec(scannable)) !== null) {
@@ -293,19 +547,10 @@ export function scoreFile(filepath, code) {
                 break;
         }
     }
-    // Pass 3: Hook-layer instruction patterns on fully stripped code
-    const instructionFindings = scanPayload(scannable);
-    for (const f of instructionFindings) {
-        const isDupe = allFindings.some(af => af.category === f.category && af.description === f.description);
-        if (!isDupe) {
-            allFindings.push({
-                severity: f.severity,
-                category: f.category,
-                description: f.description,
-                matched: f.matched,
-            });
-        }
-    }
+    // Pass 3 (removed): hook-layer instruction patterns are designed for runtime
+    // tool_input JSON, not source code. Firing them on source lit up every docstring
+    // containing phrases like "act as a flag". The hook handler still uses scanPayload
+    // directly; source scanning stays with Pass 1 + Pass 2 only.
     const complexity = measureComplexity(code);
     let penalty = 0;
     for (const f of allFindings)
@@ -320,8 +565,8 @@ export function scoreFile(filepath, code) {
         penalty += 3;
     const score = Math.max(0, Math.min(100, 100 - penalty));
     const grade = score >= 90 ? 'A' : score >= 75 ? 'B' : score >= 60 ? 'C' : score >= 40 ? 'D' : 'F';
-    const critical = allFindings.filter(f => f.severity === 'critical').length;
-    const high = allFindings.filter(f => f.severity === 'high').length;
+    const critical = allFindings.filter((f) => f.severity === 'critical').length;
+    const high = allFindings.filter((f) => f.severity === 'high').length;
     const summary = critical > 0
         ? `${critical} critical issue${critical > 1 ? 's' : ''} require immediate attention`
         : high > 0

package/dist/infrastructure/storage/task-repository.js

@@ -58,7 +58,10 @@ export class JsonlTaskRepository {
         }
         try {
             const content = readFileSync(this.tasksPath, 'utf-8');
-            const lines = content.trim().split('\n').filter(line => line.trim());
+            const lines = content
+                .trim()
+                .split('\n')
+                .filter((line) => line.trim());
             // Load all tasks, then keep only the latest version of each ID
             const allTasks = [];
             for (const line of lines) {
@@ -120,7 +123,7 @@ export class JsonlTaskRepository {
         this.loadTasks();
         // Load all tasks and find the latest version of this ID
         const allTasks = Array.from(this.tasksCache.values());
-        const tasksWithId = allTasks.filter(task => task.id === id);
+        const tasksWithId = allTasks.filter((task) => task.id === id);
         if (tasksWithId.length === 0) {
             return null;
         }
@@ -135,7 +138,7 @@ export class JsonlTaskRepository {
     async getByStatus(status) {
         this.loadTasks();
         const tasks = Array.from(this.tasksCache.values());
-        return tasks.filter(task => task.status === status);
+        return tasks.filter((task) => task.status === status);
     }
     /**
      * Get tasks by mode
@@ -143,7 +146,7 @@ export class JsonlTaskRepository {
     async getByMode(mode) {
         this.loadTasks();
         const tasks = Array.from(this.tasksCache.values());
-        return tasks.filter(task => task.mode === mode);
+        return tasks.filter((task) => task.mode === mode);
     }
     /**
      * Get recent tasks (latest updated first)
@@ -151,9 +154,7 @@ export class JsonlTaskRepository {
     async getRecent(limit = 10) {
         this.loadTasks();
         const tasks = Array.from(this.tasksCache.values());
-        return tasks
-            .sort((a, b) => b.updatedAt - a.updatedAt)
-            .slice(0, limit);
+        return tasks.sort((a, b) => b.updatedAt - a.updatedAt).slice(0, limit);
     }
     /**
      * Get all tasks (latest version of each)