coverme-scanner 1.5.0 → 1.5.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli/index.js +1 -0
- package/dist/cli/index.js.map +1 -1
- package/dist/cli/init.d.ts +1 -0
- package/dist/cli/init.d.ts.map +1 -1
- package/dist/cli/init.js +15 -2
- package/dist/cli/init.js.map +1 -1
- package/dist/prompts/coverme-command.md +1021 -0
- package/package.json +1 -1
package/dist/cli/index.js
CHANGED
|
@@ -17,6 +17,7 @@ program
|
|
|
17
17
|
.command('init')
|
|
18
18
|
.description('Install vibecode slash commands into .claude/commands/')
|
|
19
19
|
.option('-g, --global', 'Install globally to ~/.claude/commands/')
|
|
20
|
+
.option('-f, --force', 'Force overwrite existing coverme.md')
|
|
20
21
|
.action(init_js_1.init);
|
|
21
22
|
program
|
|
22
23
|
.command('scan')
|
package/dist/cli/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";;;AAEA,yCAAoC;AACpC,uCAAiC;AACjC,uCAAiC;AACjC,iDAAoD;AACpD,2BAAsF;AACtF,+BAA4B;AAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3F,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,uEAAuE,CAAC;KACpF,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,wDAAwD,CAAC;KACrE,MAAM,CAAC,cAAc,EAAE,yCAAyC,CAAC;KACjE,MAAM,CAAC,cAAI,CAAC,CAAC;AAEhB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,gDAAgD,CAAC;KAC7D,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,CAAC;KACvC,MAAM,CAAC,uBAAuB,EAAE,oCAAoC,EAAE,KAAK,CAAC;KAC5E,MAAM,CAAC,0BAA0B,EAAE,kBAAkB,CAAC;KACtD,MAAM,CAAC,yBAAyB,EAAE,qDAAqD,EAAE,KAAK,CAAC;KAC/F,MAAM,CAAC,wBAAwB,EAAE,iDAAiD,EAAE,KAAK,CAAC;KAC1F,MAAM,CAAC,eAAe,EAAE,gBAAgB,CAAC;KACzC,MAAM,CAAC,sBAAsB,EAAE,2BAA2B,EAAE,GAAG,CAAC;KAChE,MAAM,CAAC,cAAI,CAAC,CAAC;AAEhB,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,yCAAyC,CAAC;KACtD,QAAQ,CAAC,aAAa,EAAE,+DAA+D,CAAC;KACxF,MAAM,CAAC,qBAAqB,EAAE,kBAAkB,CAAC;KACjD,MAAM,CAAC,uBAAuB,EAAE,0BAA0B,EAAE,KAAK,CAAC;KAClE,MAAM,CAAC,KAAK,EAAE,QAA4B,EAAE,OAAqD,EAAE,EAAE;IACpG,IAAI,UAAU,GAAG,QAAQ,CAAC;IAE1B,wCAAwC;IACxC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;QAEnD,sBAAsB;QACtB,MAAM,WAAW,GAAG,IAAA,WAAI,EAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAClD,IAAI,IAAA,eAAU,EAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,UAAU,GAAG,WAAW,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,kBAAkB,UAAU,EAAE,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,wCAAwC;YACxC,IAAI,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;gBAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC;qBAChD,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;qBACnE,IAAI,EAAE;qBACN,OAAO,EAAE,CAAC;gBAEb,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,UAAU,GAAG,IAAA,WAAI,EAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;oBACxC,OAAO,CAAC,GAAG,CAAC,kBAAkB,UAAU,EAAE,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;YACxC,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC7D,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,MAAM,IAAA,yBAAc,EAAC,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEL,4BAA4B;AAC5B,MAAM,QAAQ,GAAG,OAAO;KACrB,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,sBAAsB,CAAC,CAAC;AAEvC,QAAQ;KACL,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,wBAAwB,CAAC;KACrC,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC;KAC/C,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;KAC9C,MAAM,CAAC,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE;IACrC,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAEnD,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,IAAA,cAAS,EAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,MAAM,GAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACjC,IAAI,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,IAAA,kBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEL,QAAQ;KACL,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,wBAAwB,CAAC;KACrC,MAAM,CAAC,GAAG,EAAE;IACX,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IAClE,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC;QACvG,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC;QACvG,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAU,EAAE,CAAS,EAAE,EAAE;QAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,QAAQ;KACL,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,uBAAuB,CAAC;KACpC,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;KAC1C,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;IACvB,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IAClE,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7F,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,IAAA,kBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,kBAAkB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC;AAEL,gCAAgC;AAChC,MAAM,SAAS,GAAG,OAAO;KACtB,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,sDAAsD,CAAC,CAAC;AAEvE,SAAS;KACN,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,+CAA+C,CAAC;KAC5D,MAAM,CAAC,mBAAmB,EAAE,kCAAkC,CAAC;KAC/D,MAAM,CAAC,mBAAmB,EAAE,UAAU,EAAE,IAAI,CAAC;KAC7C,MAAM,CAAC,kBAAkB,EAAE,yBAAyB,CAAC;KACrD,MAAM,CAAC,mBAAmB,EAAE,8CAA8C,CAAC;KAC3E,MAAM,CAAC,CAAC,OAAsE,EAAE,EAAE;IACjF,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAEpD,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,IAAA,cAAS,EAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,MAAM,GAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IACvC,IAAI,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,MAAM,CAAC,YAAY,GAAG,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,+FAA+F,CAAC,CAAC;QAC7G,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;QAE9D,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;YACxC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,GAAQ,EAAE,CAAS,EAAE,EAAE;gBAClD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IAEvF,iCAAiC;IACjC,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IAEjF,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC;QACvB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;QACpC,OAAO,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI;QAC5B,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAClC,CAAC,CAAC;IAEH,IAAA,kBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,GAAG,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,UAAU,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,8BAA8B,CAAC;KAC3C,MAAM,CAAC,GAAG,EAAE;IACX,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IAEnE,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;QAClF,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAE7D,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC5C,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,GAAQ,EAAE,CAAS,EAAE,EAAE;QAClD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,GAAG,CAAC,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,uBAAuB,CAAC;KACpC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;KACtC,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;IACvB,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IAEnE,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAEnG,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,aAAa,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAA,kBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,EAAE,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";;;AAEA,yCAAoC;AACpC,uCAAiC;AACjC,uCAAiC;AACjC,iDAAoD;AACpD,2BAAsF;AACtF,+BAA4B;AAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3F,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,uEAAuE,CAAC;KACpF,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,wDAAwD,CAAC;KACrE,MAAM,CAAC,cAAc,EAAE,yCAAyC,CAAC;KACjE,MAAM,CAAC,aAAa,EAAE,qCAAqC,CAAC;KAC5D,MAAM,CAAC,cAAI,CAAC,CAAC;AAEhB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,gDAAgD,CAAC;KAC7D,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,CAAC;KACvC,MAAM,CAAC,uBAAuB,EAAE,oCAAoC,EAAE,KAAK,CAAC;KAC5E,MAAM,CAAC,0BAA0B,EAAE,kBAAkB,CAAC;KACtD,MAAM,CAAC,yBAAyB,EAAE,qDAAqD,EAAE,KAAK,CAAC;KAC/F,MAAM,CAAC,wBAAwB,EAAE,iDAAiD,EAAE,KAAK,CAAC;KAC1F,MAAM,CAAC,eAAe,EAAE,gBAAgB,CAAC;KACzC,MAAM,CAAC,sBAAsB,EAAE,2BAA2B,EAAE,GAAG,CAAC;KAChE,MAAM,CAAC,cAAI,CAAC,CAAC;AAEhB,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,yCAAyC,CAAC;KACtD,QAAQ,CAAC,aAAa,EAAE,+DAA+D,CAAC;KACxF,MAAM,CAAC,qBAAqB,EAAE,kBAAkB,CAAC;KACjD,MAAM,CAAC,uBAAuB,EAAE,0BAA0B,EAAE,KAAK,CAAC;KAClE,MAAM,CAAC,KAAK,EAAE,QAA4B,EAAE,OAAqD,EAAE,EAAE;IACpG,IAAI,UAAU,GAAG,QAAQ,CAAC;IAE1B,wCAAwC;IACxC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;QAEnD,sBAAsB;QACtB,MAAM,WAAW,GAAG,IAAA,WAAI,EAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAClD,IAAI,IAAA,eAAU,EAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,UAAU,GAAG,WAAW,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,kBAAkB,UAAU,EAAE,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,wCAAwC;YACxC,IAAI,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;gBAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC;qBAChD,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;qBACnE,IAAI,EAAE;qBACN,OAAO,EAAE,CAAC;gBAEb,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,UAAU,GAAG,IAAA,WAAI,EAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;oBACxC,OAAO,CAAC,GAAG,CAAC,kBAAkB,UAAU,EAAE,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;YACxC,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC7D,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,MAAM,IAAA,yBAAc,EAAC,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEL,4BAA4B;AAC5B,MAAM,QAAQ,GAAG,OAAO;KACrB,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,sBAAsB,CAAC,CAAC;AAEvC,QAAQ;KACL,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,wBAAwB,CAAC;KACrC,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC;KAC/C,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;KAC9C,MAAM,CAAC,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE;IACrC,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAEnD,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,IAAA,cAAS,EAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,MAAM,GAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACjC,IAAI,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,IAAA,kBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEL,QAAQ;KACL,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,wBAAwB,CAAC;KACrC,MAAM,CAAC,GAAG,EAAE;IACX,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IAClE,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC;QACvG,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC;QACvG,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAU,EAAE,CAAS,EAAE,EAAE;QAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,QAAQ;KACL,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,uBAAuB,CAAC;KACpC,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;KAC1C,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;IACvB,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IAClE,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7F,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,IAAA,kBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,kBAAkB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC;AAEL,gCAAgC;AAChC,MAAM,SAAS,GAAG,OAAO;KACtB,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,sDAAsD,CAAC,CAAC;AAEvE,SAAS;KACN,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,+CAA+C,CAAC;KAC5D,MAAM,CAAC,mBAAmB,EAAE,kCAAkC,CAAC;KAC/D,MAAM,CAAC,mBAAmB,EAAE,UAAU,EAAE,IAAI,CAAC;KAC7C,MAAM,CAAC,kBAAkB,EAAE,yBAAyB,CAAC;KACrD,MAAM,CAAC,mBAAmB,EAAE,8CAA8C,CAAC;KAC3E,MAAM,CAAC,CAAC,OAAsE,EAAE,EAAE;IACjF,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAEpD,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,IAAA,cAAS,EAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,MAAM,GAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IACvC,IAAI,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,MAAM,CAAC,YAAY,GAAG,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,+FAA+F,CAAC,CAAC;QAC7G,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;QAE9D,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;YACxC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,GAAQ,EAAE,CAAS,EAAE,EAAE;gBAClD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IAEvF,iCAAiC;IACjC,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IAEjF,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC;QACvB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;QACpC,OAAO,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI;QAC5B,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAClC,CAAC,CAAC;IAEH,IAAA,kBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,GAAG,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,UAAU,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,8BAA8B,CAAC;KAC3C,MAAM,CAAC,GAAG,EAAE;IACX,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IAEnE,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;QAClF,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAE7D,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC5C,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,GAAQ,EAAE,CAAS,EAAE,EAAE;QAClD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,GAAG,CAAC,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,uBAAuB,CAAC;KACpC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;KACtC,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;IACvB,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IAEnE,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAEnG,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,aAAa,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAA,kBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,EAAE,CAAC"}
|
package/dist/cli/init.d.ts
CHANGED
package/dist/cli/init.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/cli/init.ts"],"names":[],"mappings":"AAIA,UAAU,WAAW;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;
|
|
1
|
+
{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/cli/init.ts"],"names":[],"mappings":"AAIA,UAAU,WAAW;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAihBD,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA6J9D"}
|
package/dist/cli/init.js
CHANGED
|
@@ -575,8 +575,21 @@ async function init(options) {
|
|
|
575
575
|
}
|
|
576
576
|
// Write the slash command
|
|
577
577
|
const commandPath = path.join(targetDir, 'coverme.md');
|
|
578
|
-
|
|
579
|
-
|
|
578
|
+
// Check if file exists and force flag is not set
|
|
579
|
+
if (fs.existsSync(commandPath) && !options.force) {
|
|
580
|
+
console.log(`File already exists: ${commandPath}`);
|
|
581
|
+
console.log(`Use --force to overwrite.`);
|
|
582
|
+
}
|
|
583
|
+
else {
|
|
584
|
+
// Try to read from package's distributed file first
|
|
585
|
+
const distCommandPath = path.join(__dirname, '..', 'prompts', 'coverme-command.md');
|
|
586
|
+
let commandContent = SLASH_COMMAND;
|
|
587
|
+
if (fs.existsSync(distCommandPath)) {
|
|
588
|
+
commandContent = fs.readFileSync(distCommandPath, 'utf-8');
|
|
589
|
+
}
|
|
590
|
+
fs.writeFileSync(commandPath, commandContent);
|
|
591
|
+
console.log(`${options.force ? 'Updated' : 'Created'}: ${commandPath}`);
|
|
592
|
+
}
|
|
580
593
|
// Create .coverme directory for reports
|
|
581
594
|
const covermeDir = path.join(process.cwd(), '.coverme');
|
|
582
595
|
if (!fs.existsSync(covermeDir)) {
|
package/dist/cli/init.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/cli/init.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
|
1
|
+
{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/cli/init.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwhBA,oBA6JC;AArrBD,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AAOzB,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6gBrB,CAAC;AAEK,KAAK,UAAU,IAAI,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM;QAC9B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC;QAChD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAEpD,OAAO,CAAC,GAAG,CAAC,oCAAoC,SAAS,EAAE,CAAC,CAAC;IAE7D,6BAA6B;IAC7B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,0BAA0B;IAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAEvD,iDAAiD;IACjD,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,wBAAwB,WAAW,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,oDAAoD;QACpD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;QACpF,IAAI,cAAc,GAAG,aAAa,CAAC;QAEnC,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACnC,cAAc,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC7D,CAAC;QAED,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,wCAAwC;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;IACxD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,YAAY,UAAU,GAAG,CAAC,CAAC;IACzC,CAAC;IAED,4BAA4B;IAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG;YACnB,WAAW,EAAE,EAAE;YACf,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,EAAE;YACZ,oBAAoB,EAAE,EAAE;YACxB,YAAY,EAAE,CAAC;YACf,UAAU,EAAE,CAAC;SACd,CAAC;QACF,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,YAAY,YAAY,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,kDAAkD;IAClD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,uCAAuC,CAAC;IAE9D,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,MAAM,gBAAgB,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACjE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3C,EAAE,CAAC,cAAc,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;IACnD,CAAC;IAED,kEAAkE;IAClE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;IACnE,MAAM,kBAAkB,GAAG;QACzB,WAAW,EAAE;YACX,KAAK,EAAE;gBACL,eAAe;gBACf,YAAY;gBACZ,aAAa;gBACb,YAAY;gBACZ,cAAc;gBACd,sBAAsB;gBACtB,8BAA8B;gBAC9B,cAAc;gBACd,sBAAsB;gBACtB,iBAAiB;gBACjB,cAAc;gBACd,aAAa;gBACb,kBAAkB;gBAClB,mBAAmB;gBACnB,kBAAkB;aACnB;SACF;KACF,CAAC;IAEF,0CAA0C;IAC1C,IAAI,gBAAgB,GAAQ,EAAE,CAAC;IAC/B,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,sCAAsC;QACxC,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,MAAM,cAAc,GAAG;QACrB,GAAG,gBAAgB;QACnB,WAAW,EAAE;YACX,GAAG,gBAAgB,CAAC,WAAW;YAC/B,KAAK,EAAE;gBACL,GAAG,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC9C,GAAG,kBAAkB,CAAC,WAAW,CAAC,KAAK;aACxC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SACpD;KACF,CAAC;IAEF,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,oBAAoB,YAAY,2BAA2B,CAAC,CAAC;IAEzE,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCb,CAAC,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,1021 @@
|
|
|
1
|
+
# CoverMe - Ultimate AI Security Scanner
|
|
2
|
+
|
|
3
|
+
The most comprehensive AI-powered code scanner. 22 specialized agents + validators + deep analysis.
|
|
4
|
+
|
|
5
|
+
$ARGUMENTS
|
|
6
|
+
|
|
7
|
+
## CRITICAL INSTRUCTIONS - READ FIRST!
|
|
8
|
+
|
|
9
|
+
1. **DO NOT ASK ANY QUESTIONS** - Run the entire scan autonomously from start to finish
|
|
10
|
+
2. **DO NOT STOP FOR CONFIRMATION** - Just keep going through all phases
|
|
11
|
+
3. **DO NOT ASK ABOUT FILE CHANGES** - Automatically update/overwrite scan.json
|
|
12
|
+
4. **DO NOT ASK TO OPEN REPORT** - Just open it automatically at the end
|
|
13
|
+
5. **COMPLETE EVERYTHING IN ONE GO** - All phases without interruption
|
|
14
|
+
6. **RUN AGENTS IN BACKGROUND** - Use `run_in_background: true` for all Task tool calls
|
|
15
|
+
7. **RUN BASH IN BACKGROUND** - Use `run_in_background: true` for long Bash commands
|
|
16
|
+
|
|
17
|
+
Execute ALL phases automatically. Do NOT stop until the HTML report is open.
|
|
18
|
+
|
|
19
|
+
---
|
|
20
|
+
|
|
21
|
+
## Phase 0: Project Discovery & Statistics
|
|
22
|
+
|
|
23
|
+
### Step 1: Gather Project Statistics
|
|
24
|
+
|
|
25
|
+
```bash
|
|
26
|
+
# Count files and lines of code
|
|
27
|
+
find . -type f \( -name "*.ts" -o -name "*.js" -o -name "*.tsx" -o -name "*.jsx" -o -name "*.py" -o -name "*.go" -o -name "*.java" -o -name "*.rb" -o -name "*.php" -o -name "*.cs" -o -name "*.swift" -o -name "*.kt" \) -not -path "*/node_modules/*" -not -path "*/.git/*" -not -path "*/dist/*" -not -path "*/build/*" -not -path "*/__pycache__/*" | wc -l
|
|
28
|
+
|
|
29
|
+
# Count lines of code (approximate)
|
|
30
|
+
find . -type f \( -name "*.ts" -o -name "*.js" -o -name "*.tsx" -o -name "*.jsx" -o -name "*.py" -o -name "*.go" \) -not -path "*/node_modules/*" -not -path "*/.git/*" -not -path "*/dist/*" 2>/dev/null | head -100 | xargs wc -l 2>/dev/null | tail -1
|
|
31
|
+
|
|
32
|
+
# Generate project tree (max 3 levels deep, exclude node_modules etc)
|
|
33
|
+
find . -maxdepth 3 -type d -not -path "*/node_modules/*" -not -path "*/.git/*" -not -path "*/dist/*" -not -path "*/__pycache__/*" | head -30 | sort
|
|
34
|
+
```
|
|
35
|
+
|
|
36
|
+
### Step 2: Read Project Info
|
|
37
|
+
|
|
38
|
+
```bash
|
|
39
|
+
cat package.json 2>/dev/null | head -30
|
|
40
|
+
cat README.md 2>/dev/null | head -100
|
|
41
|
+
ls -la
|
|
42
|
+
ls src/ 2>/dev/null || ls app/ 2>/dev/null || ls lib/ 2>/dev/null
|
|
43
|
+
```
|
|
44
|
+
|
|
45
|
+
### Step 3: Load Custom Agents (if exists)
|
|
46
|
+
|
|
47
|
+
```bash
|
|
48
|
+
cat .coverme/agents.json 2>/dev/null || echo "NO_CUSTOM_AGENTS"
|
|
49
|
+
```
|
|
50
|
+
|
|
51
|
+
### Step 4: Check for Runtime Verification (SSH)
|
|
52
|
+
|
|
53
|
+
```bash
|
|
54
|
+
cat .coverme/runtime.json 2>/dev/null || echo "NO_RUNTIME_CONFIG"
|
|
55
|
+
```
|
|
56
|
+
|
|
57
|
+
---
|
|
58
|
+
|
|
59
|
+
## Phase 1: Discovery (22 parallel agents)
|
|
60
|
+
|
|
61
|
+
Launch ALL agents IN PARALLEL using the Task tool with `run_in_background: true`.
|
|
62
|
+
|
|
63
|
+
### Agent 1: Security Core Scanner (SEC)
|
|
64
|
+
```
|
|
65
|
+
Scan for OWASP Top 10 and common vulnerabilities:
|
|
66
|
+
|
|
67
|
+
INJECTION:
|
|
68
|
+
- SQL injection (string concatenation in queries, raw queries)
|
|
69
|
+
- NoSQL injection (MongoDB $where, $regex with user input)
|
|
70
|
+
- Command injection (exec, spawn, system with user input)
|
|
71
|
+
- LDAP injection, XPath injection
|
|
72
|
+
- Template injection (SSTI in Jinja2, EJS, Handlebars)
|
|
73
|
+
- Header injection (CRLF in headers)
|
|
74
|
+
- Log injection (unescaped user input in logs)
|
|
75
|
+
|
|
76
|
+
XSS:
|
|
77
|
+
- Reflected XSS (user input in response without encoding)
|
|
78
|
+
- Stored XSS (database content rendered without escaping)
|
|
79
|
+
- DOM XSS (innerHTML, document.write, eval with user data)
|
|
80
|
+
- dangerouslySetInnerHTML in React without sanitization
|
|
81
|
+
|
|
82
|
+
AUTHENTICATION:
|
|
83
|
+
- Hardcoded credentials (check git ls-files first!)
|
|
84
|
+
- Weak password policies (no complexity, short length)
|
|
85
|
+
- Missing rate limiting on login/register
|
|
86
|
+
- Session fixation (session ID not rotated after login)
|
|
87
|
+
- JWT issues (none algorithm, weak secret, no expiry)
|
|
88
|
+
- Missing MFA on sensitive operations
|
|
89
|
+
|
|
90
|
+
AUTHORIZATION:
|
|
91
|
+
- IDOR (direct object references without ownership check)
|
|
92
|
+
- Missing authorization checks on endpoints
|
|
93
|
+
- Privilege escalation paths
|
|
94
|
+
- Horizontal access (user A accessing user B's data)
|
|
95
|
+
- Vertical access (user accessing admin functions)
|
|
96
|
+
|
|
97
|
+
CRYPTOGRAPHY:
|
|
98
|
+
- MD5/SHA1 for passwords (use bcrypt/argon2)
|
|
99
|
+
- Math.random() for security (use crypto.randomBytes)
|
|
100
|
+
- Hardcoded encryption keys/IVs
|
|
101
|
+
- ECB mode usage
|
|
102
|
+
- Missing HTTPS enforcement
|
|
103
|
+
|
|
104
|
+
DATABASE-SPECIFIC DANGEROUS FUNCTIONS:
|
|
105
|
+
- DuckDB: read_text(), read_blob(), read_csv_auto(), read_parquet(), glob(), getenv(), httpfs
|
|
106
|
+
- SQLite: load_extension(), readfile(), writefile()
|
|
107
|
+
- PostgreSQL: pg_read_file(), pg_ls_dir(), COPY TO/FROM
|
|
108
|
+
- MySQL: LOAD_FILE(), INTO OUTFILE, INTO DUMPFILE
|
|
109
|
+
- MongoDB: $where with user input, mapReduce with user functions
|
|
110
|
+
- Redis: EVAL/EVALSHA with user input, CONFIG, DEBUG commands
|
|
111
|
+
|
|
112
|
+
Output JSON: [{id: "SEC-XXX", title, severity, category, file, line, code, description, impact, recommendation, cwe, confidence, fixOwner, fixType, dread: {damage, reproducibility, exploitability, affectedUsers, discoverability, score}}]
|
|
113
|
+
```
|
|
114
|
+
|
|
115
|
+
### Agent 2: Auth & Session Scanner (AUTH)
|
|
116
|
+
```
|
|
117
|
+
Deep dive into authentication and session management:
|
|
118
|
+
|
|
119
|
+
FIRST: Detect which auth method(s) this project uses:
|
|
120
|
+
| Auth Type | Detection Pattern |
|
|
121
|
+
|-----------|-------------------|
|
|
122
|
+
| OAuth/OIDC | oauth, oidc, authorization_code, client_id, redirect_uri |
|
|
123
|
+
| JWT | jsonwebtoken, jwt, Bearer, accessToken, refreshToken |
|
|
124
|
+
| Session-based | express-session, cookie-session, session.save, req.session |
|
|
125
|
+
| API Keys | x-api-key, apiKey, api_key, API_SECRET |
|
|
126
|
+
| Clerk | @clerk, useAuth, clerkMiddleware |
|
|
127
|
+
| Auth0 | @auth0, auth0-js, auth0-react |
|
|
128
|
+
| Firebase Auth | firebase/auth, signInWith, onAuthStateChanged |
|
|
129
|
+
| Passport.js | passport, passport-local, passport-jwt |
|
|
130
|
+
| Supabase Auth | @supabase/auth, supabase.auth |
|
|
131
|
+
| NextAuth | next-auth, NextAuth, getServerSession |
|
|
132
|
+
|
|
133
|
+
FOR EACH AUTH TYPE DETECTED, check specific vulnerabilities:
|
|
134
|
+
|
|
135
|
+
OAuth/OIDC:
|
|
136
|
+
- Open redirect in return_url/redirect_uri (CRITICAL!)
|
|
137
|
+
- State parameter missing or predictable
|
|
138
|
+
- PKCE not implemented for public clients
|
|
139
|
+
- Token stored in localStorage (XSS vulnerable)
|
|
140
|
+
|
|
141
|
+
JWT:
|
|
142
|
+
- alg: none accepted (signature bypass)
|
|
143
|
+
- Weak secret (< 256 bits)
|
|
144
|
+
- No expiry (exp claim missing)
|
|
145
|
+
- Token not invalidated on logout
|
|
146
|
+
|
|
147
|
+
Session-based:
|
|
148
|
+
- Session ID in URL (referer leak)
|
|
149
|
+
- Session not invalidated on logout
|
|
150
|
+
- Session fixation
|
|
151
|
+
- Missing secure, httpOnly, sameSite on cookies
|
|
152
|
+
|
|
153
|
+
TIMING ATTACKS:
|
|
154
|
+
- Non-constant-time string comparison for tokens/secrets
|
|
155
|
+
- Early return on auth failure leaking valid usernames
|
|
156
|
+
|
|
157
|
+
Output JSON: [{id: "AUTH-XXX", ...full format with DREAD}]
|
|
158
|
+
```
|
|
159
|
+
|
|
160
|
+
### Agent 3: API Security Scanner (API)
|
|
161
|
+
```
|
|
162
|
+
Scan API endpoints for security issues:
|
|
163
|
+
|
|
164
|
+
INPUT VALIDATION:
|
|
165
|
+
- Missing input validation on request body
|
|
166
|
+
- Type coercion attacks (string vs number)
|
|
167
|
+
- Array/object pollution
|
|
168
|
+
- Prototype pollution
|
|
169
|
+
- Mass assignment vulnerabilities
|
|
170
|
+
- GraphQL introspection enabled in production
|
|
171
|
+
- GraphQL depth/complexity limits missing
|
|
172
|
+
|
|
173
|
+
RATE LIMITING:
|
|
174
|
+
- No rate limiting on expensive operations
|
|
175
|
+
- Rate limit bypass via headers (X-Forwarded-For)
|
|
176
|
+
- Non-atomic INCR+EXPIRE in Redis
|
|
177
|
+
|
|
178
|
+
CORS MISCONFIGURATION:
|
|
179
|
+
- res.header('Access-Control-Allow-Origin', req.headers.origin)
|
|
180
|
+
- res.header('Access-Control-Allow-Origin', '*')
|
|
181
|
+
- app.use(cors({ origin: true }))
|
|
182
|
+
|
|
183
|
+
FAIL-OPEN vs FAIL-CLOSED PATTERNS (CRITICAL):
|
|
184
|
+
- IP whitelist empty/missing = allow all
|
|
185
|
+
- Auth middleware errors = request passes through
|
|
186
|
+
- Rate limiter Redis down = no limiting
|
|
187
|
+
- Config missing = insecure defaults
|
|
188
|
+
|
|
189
|
+
WEBHOOKS:
|
|
190
|
+
- Webhook signature not verified
|
|
191
|
+
- SSRF via webhook URLs
|
|
192
|
+
- No webhook replay protection
|
|
193
|
+
|
|
194
|
+
Output JSON: [{id: "API-XXX", ...full format with DREAD}]
|
|
195
|
+
```
|
|
196
|
+
|
|
197
|
+
### Agent 4: Infrastructure Scanner (INFRA)
|
|
198
|
+
```
|
|
199
|
+
Scan infrastructure and deployment configs:
|
|
200
|
+
|
|
201
|
+
DOCKER:
|
|
202
|
+
- Running as root user
|
|
203
|
+
- Secrets in Dockerfile or build args
|
|
204
|
+
- Latest tag usage (unpinned versions)
|
|
205
|
+
- Sensitive ports exposed
|
|
206
|
+
- Missing health checks
|
|
207
|
+
- No resource limits
|
|
208
|
+
- Privileged mode enabled
|
|
209
|
+
|
|
210
|
+
KUBERNETES/HELM:
|
|
211
|
+
- No resource limits/requests
|
|
212
|
+
- Running as root
|
|
213
|
+
- Privileged containers
|
|
214
|
+
- Host network/PID enabled
|
|
215
|
+
- Missing network policies
|
|
216
|
+
- Secrets not encrypted at rest
|
|
217
|
+
- Service account auto-mount enabled
|
|
218
|
+
|
|
219
|
+
CI/CD:
|
|
220
|
+
- Secrets in CI config files
|
|
221
|
+
- Missing SAST/DAST in pipeline
|
|
222
|
+
- No branch protection
|
|
223
|
+
|
|
224
|
+
SECRETS IN GIT HISTORY (CRITICAL CHECK!):
|
|
225
|
+
Run: git log --all --full-history -- "**/secrets*" "**/credentials*" "**/*.env"
|
|
226
|
+
If secrets appear in history, they are EXPOSED even if now gitignored!
|
|
227
|
+
|
|
228
|
+
DEPENDENCY SECURITY (HIGH if missing):
|
|
229
|
+
- npm audit or yarn audit in CI pipeline
|
|
230
|
+
- Dependabot/Renovate configuration
|
|
231
|
+
- SBOM generation
|
|
232
|
+
|
|
233
|
+
Output JSON: [{id: "INFRA-XXX", ...full format with DREAD}]
|
|
234
|
+
```
|
|
235
|
+
|
|
236
|
+
### Agent 5: Data & Privacy Scanner (DATA)
|
|
237
|
+
```
|
|
238
|
+
Scan for data protection and privacy issues:
|
|
239
|
+
|
|
240
|
+
PII HANDLING:
|
|
241
|
+
- PII logged (emails, IPs, names, phone numbers)
|
|
242
|
+
- PII in URLs/query strings
|
|
243
|
+
- PII in error messages
|
|
244
|
+
- PII not encrypted at rest
|
|
245
|
+
- PII not masked in UI/logs
|
|
246
|
+
|
|
247
|
+
GDPR/PRIVACY:
|
|
248
|
+
- Missing data retention policy implementation
|
|
249
|
+
- No data deletion mechanism (right to erasure)
|
|
250
|
+
- No data export mechanism (data portability)
|
|
251
|
+
- Consent not tracked properly
|
|
252
|
+
- Third-party data sharing without consent
|
|
253
|
+
|
|
254
|
+
DATABASE:
|
|
255
|
+
- Sensitive data not encrypted (column-level)
|
|
256
|
+
- No audit logging for sensitive operations
|
|
257
|
+
- Connection strings with credentials in code
|
|
258
|
+
|
|
259
|
+
SECRETS:
|
|
260
|
+
- API keys in code (check git ls-files!)
|
|
261
|
+
- Secrets in environment files committed
|
|
262
|
+
- .env files not in .gitignore
|
|
263
|
+
|
|
264
|
+
Output JSON: [{id: "DATA-XXX", ...full format with DREAD}]
|
|
265
|
+
```
|
|
266
|
+
|
|
267
|
+
### Agent 6: AI/LLM Security Scanner (AI)
|
|
268
|
+
```
|
|
269
|
+
CONDITIONAL: First detect if this project uses AI/LLM:
|
|
270
|
+
grep -r -l "openai\|anthropic\|langchain\|ollama\|huggingface\|llama\|gpt-\|claude\|gemini\|bedrock\|vertex" --include="*.ts" --include="*.js" --include="*.py" --include="*.json" .
|
|
271
|
+
|
|
272
|
+
IF NO AI CODE FOUND: Output: {"skipped": true, "reason": "No AI/LLM code detected", "findings": []}
|
|
273
|
+
|
|
274
|
+
IF AI CODE FOUND:
|
|
275
|
+
PROMPT INJECTION:
|
|
276
|
+
- User input directly in prompts without sanitization
|
|
277
|
+
- System prompts exposed to users
|
|
278
|
+
- No input length limits on prompts
|
|
279
|
+
- Missing output validation from LLM
|
|
280
|
+
- Jailbreak vulnerabilities
|
|
281
|
+
|
|
282
|
+
LLM OUTPUT → CODE EXECUTION CHAINS:
|
|
283
|
+
- LLM generates SQL that gets executed
|
|
284
|
+
- LLM generates code that gets eval'd
|
|
285
|
+
- LLM generates shell commands that get executed
|
|
286
|
+
- LLM output used in template rendering (SSTI)
|
|
287
|
+
|
|
288
|
+
SUPPLY CHAIN:
|
|
289
|
+
- CDN imports without Subresource Integrity (SRI)
|
|
290
|
+
- Unpinned AI model versions
|
|
291
|
+
|
|
292
|
+
Output JSON: [{id: "AI-XXX", ...full format with DREAD}]
|
|
293
|
+
```
|
|
294
|
+
|
|
295
|
+
### Agent 7: Performance & DoS Scanner (PERF)
|
|
296
|
+
```
|
|
297
|
+
Scan for performance and denial-of-service issues:
|
|
298
|
+
|
|
299
|
+
DATABASE:
|
|
300
|
+
- N+1 query patterns
|
|
301
|
+
- Missing indexes on filtered/sorted columns
|
|
302
|
+
- Full table scans
|
|
303
|
+
- Unbounded queries (no LIMIT)
|
|
304
|
+
|
|
305
|
+
MEMORY:
|
|
306
|
+
- Memory leaks (event listeners not removed)
|
|
307
|
+
- Unbounded caches
|
|
308
|
+
- Stream not properly closed
|
|
309
|
+
- SSE/WebSocket buffer accumulation
|
|
310
|
+
|
|
311
|
+
CPU:
|
|
312
|
+
- ReDoS (Regular Expression DoS)
|
|
313
|
+
- Algorithmic complexity attacks
|
|
314
|
+
- Synchronous crypto operations
|
|
315
|
+
- JSON parsing of large payloads
|
|
316
|
+
|
|
317
|
+
DANGEROUS DATABASE OPERATIONS IN HOT PATHS:
|
|
318
|
+
- Redis KEYS command (blocks entire server, O(n) scan)
|
|
319
|
+
- MongoDB find() without limit
|
|
320
|
+
- SQL SELECT without LIMIT
|
|
321
|
+
|
|
322
|
+
Output JSON: [{id: "PERF-XXX", ...full format with DREAD}]
|
|
323
|
+
```
|
|
324
|
+
|
|
325
|
+
### Agent 8: Business Logic Scanner (BIZ)
|
|
326
|
+
```
|
|
327
|
+
Scan for business logic vulnerabilities:
|
|
328
|
+
|
|
329
|
+
RACE CONDITIONS:
|
|
330
|
+
- TOCTOU (time-of-check-time-of-use)
|
|
331
|
+
- Double-spend in transactions
|
|
332
|
+
- Inventory overselling
|
|
333
|
+
- Non-atomic read-modify-write
|
|
334
|
+
|
|
335
|
+
WORKFLOW:
|
|
336
|
+
- Step skipping in multi-step processes
|
|
337
|
+
- State manipulation attacks
|
|
338
|
+
- Workflow replay attacks
|
|
339
|
+
|
|
340
|
+
FINANCIAL:
|
|
341
|
+
- Rounding errors in calculations
|
|
342
|
+
- Currency handling issues
|
|
343
|
+
- Negative amount bypass
|
|
344
|
+
- Discount stacking exploits
|
|
345
|
+
|
|
346
|
+
Output JSON: [{id: "BIZ-XXX", ...full format with DREAD}]
|
|
347
|
+
```
|
|
348
|
+
|
|
349
|
+
### Agent 9: Code Quality Scanner (QUAL)
|
|
350
|
+
```
|
|
351
|
+
Scan for code quality issues that affect security/reliability:
|
|
352
|
+
|
|
353
|
+
COMPLEXITY:
|
|
354
|
+
- Cyclomatic complexity > 10
|
|
355
|
+
- Functions > 50 lines
|
|
356
|
+
- Files > 500 lines
|
|
357
|
+
- Deep nesting (> 4 levels)
|
|
358
|
+
|
|
359
|
+
ANTI-PATTERNS:
|
|
360
|
+
- God objects/classes
|
|
361
|
+
- Callback hell
|
|
362
|
+
- Magic numbers/strings
|
|
363
|
+
- Dead code
|
|
364
|
+
- Console.log in production
|
|
365
|
+
- TODO/FIXME comments about security issues
|
|
366
|
+
|
|
367
|
+
ERROR HANDLING:
|
|
368
|
+
- Empty catch blocks
|
|
369
|
+
- Generic error swallowing
|
|
370
|
+
- Missing error boundaries (React)
|
|
371
|
+
- Unhandled promise rejections
|
|
372
|
+
|
|
373
|
+
DEAD CODE WITH SECURITY IMPLICATIONS:
|
|
374
|
+
- Old/commented code that has BETTER security than current code
|
|
375
|
+
- Deprecated functions with security controls not ported
|
|
376
|
+
|
|
377
|
+
Output JSON: [{id: "QUAL-XXX", ...full format with DREAD}]
|
|
378
|
+
```
|
|
379
|
+
|
|
380
|
+
### Agent 10: Testing & Reliability Scanner (TEST)
|
|
381
|
+
```
|
|
382
|
+
Scan for testing gaps and reliability issues:
|
|
383
|
+
|
|
384
|
+
TEST COVERAGE:
|
|
385
|
+
- Critical paths without tests (auth, payments, data access)
|
|
386
|
+
- Error handlers not tested
|
|
387
|
+
- No integration tests
|
|
388
|
+
- No E2E tests for main flows
|
|
389
|
+
|
|
390
|
+
TEST QUALITY:
|
|
391
|
+
- Tests without assertions
|
|
392
|
+
- Mocked security checks (dangerous!)
|
|
393
|
+
- Flaky tests (time-dependent)
|
|
394
|
+
|
|
395
|
+
RELIABILITY:
|
|
396
|
+
- Missing health checks
|
|
397
|
+
- No graceful shutdown
|
|
398
|
+
- Missing readiness/liveness probes
|
|
399
|
+
- No circuit breakers for external calls
|
|
400
|
+
- Missing retry logic with backoff
|
|
401
|
+
|
|
402
|
+
Output JSON: [{id: "TEST-XXX", ...full format with DREAD}]
|
|
403
|
+
```
|
|
404
|
+
|
|
405
|
+
### Agent 11: Redis & Cache Security Scanner (REDIS)
|
|
406
|
+
```
|
|
407
|
+
CONDITIONAL: First detect if this project uses Redis/Cache:
|
|
408
|
+
grep -r -l "redis\|ioredis\|memcached\|node-cache\|lru-cache\|cache-manager" --include="*.ts" --include="*.js" --include="*.json" --include="*.yaml" .
|
|
409
|
+
|
|
410
|
+
IF NO CACHE CODE FOUND: Output: {"skipped": true, "reason": "No Redis/Cache code detected", "findings": []}
|
|
411
|
+
|
|
412
|
+
IF CACHE CODE FOUND:
|
|
413
|
+
DANGEROUS COMMANDS:
|
|
414
|
+
- KEYS * in production code (blocks entire server, use SCAN instead)
|
|
415
|
+
- FLUSHALL, FLUSHDB accessible without protection
|
|
416
|
+
- DEBUG, CONFIG commands enabled in production
|
|
417
|
+
- EVAL/EVALSHA with user-controlled scripts (Lua injection)
|
|
418
|
+
|
|
419
|
+
AUTHENTICATION & ACCESS:
|
|
420
|
+
- Redis without AUTH (requirepass not set)
|
|
421
|
+
- Redis exposed on 0.0.0.0 instead of 127.0.0.1
|
|
422
|
+
- Missing TLS for Redis connections
|
|
423
|
+
- Connection strings with passwords in code/logs
|
|
424
|
+
|
|
425
|
+
DATA SECURITY:
|
|
426
|
+
- Sensitive data stored without encryption
|
|
427
|
+
- PII in Redis without TTL
|
|
428
|
+
- Cache keys predictable/enumerable
|
|
429
|
+
- No key prefix separation between tenants (multi-tenant leak)
|
|
430
|
+
|
|
431
|
+
RACE CONDITIONS:
|
|
432
|
+
- Non-atomic read-modify-write patterns
|
|
433
|
+
- Missing WATCH/MULTI/EXEC for transactions
|
|
434
|
+
- INCR + EXPIRE not atomic
|
|
435
|
+
|
|
436
|
+
Output JSON: [{id: "REDIS-XXX", ...full format with DREAD}]
|
|
437
|
+
```
|
|
438
|
+
|
|
439
|
+
### Agent 12: Resilience & Fallback Scanner (RESIL)
|
|
440
|
+
```
|
|
441
|
+
Scan for resilience patterns and fallback mechanisms:
|
|
442
|
+
|
|
443
|
+
CIRCUIT BREAKERS:
|
|
444
|
+
- External service calls without circuit breaker
|
|
445
|
+
- Circuit breaker without proper thresholds
|
|
446
|
+
- No fallback when circuit is open
|
|
447
|
+
|
|
448
|
+
RETRY PATTERNS:
|
|
449
|
+
- Retries without exponential backoff
|
|
450
|
+
- Retries without jitter (thundering herd)
|
|
451
|
+
- Retries without max attempts limit
|
|
452
|
+
- Retrying non-idempotent operations
|
|
453
|
+
|
|
454
|
+
TIMEOUTS:
|
|
455
|
+
- HTTP calls without timeout
|
|
456
|
+
- Database queries without timeout
|
|
457
|
+
- External API calls without timeout
|
|
458
|
+
|
|
459
|
+
FALLBACKS:
|
|
460
|
+
- No fallback for critical external dependencies
|
|
461
|
+
- Missing cached fallback data
|
|
462
|
+
- No degraded mode implementation
|
|
463
|
+
|
|
464
|
+
HEALTH CHECKS:
|
|
465
|
+
- Health check that calls external dependencies
|
|
466
|
+
- No distinction between liveness and readiness
|
|
467
|
+
|
|
468
|
+
Output JSON: [{id: "RESIL-XXX", ...full format with DREAD}]
|
|
469
|
+
```
|
|
470
|
+
|
|
471
|
+
### Agent 13: PII & Sensitive Data Scanner (PII)
|
|
472
|
+
```
|
|
473
|
+
Scan for PII exposure and sensitive data handling issues:
|
|
474
|
+
|
|
475
|
+
PII IN LOGS:
|
|
476
|
+
- Email addresses logged
|
|
477
|
+
- Phone numbers logged
|
|
478
|
+
- IP addresses logged without justification
|
|
479
|
+
- Names/addresses in logs
|
|
480
|
+
- Request/response bodies logged without redaction
|
|
481
|
+
|
|
482
|
+
PII IN URLS:
|
|
483
|
+
- PII in URL path (e.g., /user/john@email.com)
|
|
484
|
+
- PII in query parameters
|
|
485
|
+
- Session tokens in URLs (referer leak)
|
|
486
|
+
|
|
487
|
+
PII IN STORAGE:
|
|
488
|
+
- PII stored without encryption at rest
|
|
489
|
+
- PII in local storage/session storage (browser)
|
|
490
|
+
- PII in cookies without encryption
|
|
491
|
+
|
|
492
|
+
GDPR/CCPA COMPLIANCE:
|
|
493
|
+
- No data export functionality
|
|
494
|
+
- No data deletion on request
|
|
495
|
+
- Missing consent tracking
|
|
496
|
+
|
|
497
|
+
SENSITIVE DATA TYPES TO FIND:
|
|
498
|
+
- SSN, passport numbers, national IDs
|
|
499
|
+
- Credit card numbers (even partial)
|
|
500
|
+
- Bank account numbers
|
|
501
|
+
- Health/medical information
|
|
502
|
+
- Authentication credentials
|
|
503
|
+
|
|
504
|
+
Output JSON: [{id: "PII-XXX", ...full format with DREAD}]
|
|
505
|
+
```
|
|
506
|
+
|
|
507
|
+
### Agent 14: Dead Code & Unused Scanner (DEAD)
|
|
508
|
+
```
|
|
509
|
+
Scan for dead code, unused dependencies, and technical debt:
|
|
510
|
+
|
|
511
|
+
UNUSED CODE:
|
|
512
|
+
- Functions never called
|
|
513
|
+
- Classes never instantiated
|
|
514
|
+
- Variables assigned but never read
|
|
515
|
+
- API endpoints not used by any client
|
|
516
|
+
|
|
517
|
+
COMMENTED CODE:
|
|
518
|
+
- Large blocks of commented-out code
|
|
519
|
+
- TODO/FIXME comments older than 6 months
|
|
520
|
+
- Console.log/print statements
|
|
521
|
+
|
|
522
|
+
UNUSED DEPENDENCIES:
|
|
523
|
+
- npm/pip packages installed but never imported
|
|
524
|
+
- Devdependencies in production bundle
|
|
525
|
+
- Duplicate dependencies (different versions)
|
|
526
|
+
|
|
527
|
+
SECURITY IMPLICATIONS:
|
|
528
|
+
- Commented security checks (why removed?)
|
|
529
|
+
- Unused auth middleware (was security removed?)
|
|
530
|
+
- Dead validation code (security regression?)
|
|
531
|
+
|
|
532
|
+
Output JSON: [{id: "DEAD-XXX", ...full format with DREAD}]
|
|
533
|
+
```
|
|
534
|
+
|
|
535
|
+
### Agent 15: Database Security Scanner (DB)
|
|
536
|
+
```
|
|
537
|
+
AUTO-DETECT DATABASE TYPE(S):
|
|
538
|
+
| Database | Detection Pattern |
|
|
539
|
+
|----------|-------------------|
|
|
540
|
+
| PostgreSQL | pg, postgres, @prisma, typeorm, knex |
|
|
541
|
+
| MySQL | mysql, mysql2, mariadb |
|
|
542
|
+
| SQLite | sqlite, better-sqlite3, sql.js |
|
|
543
|
+
| MongoDB | mongoose, mongodb |
|
|
544
|
+
| DuckDB | duckdb, @duckdb |
|
|
545
|
+
| Supabase | @supabase/supabase-js |
|
|
546
|
+
|
|
547
|
+
IF NO DATABASE FOUND: Output: {"skipped": true, "reason": "No database code detected", "findings": []}
|
|
548
|
+
|
|
549
|
+
SQL INJECTION:
|
|
550
|
+
- String concatenation in queries
|
|
551
|
+
- Template literals with user input in SQL
|
|
552
|
+
- Raw queries without parameterization
|
|
553
|
+
- Dynamic table/column names from user input
|
|
554
|
+
|
|
555
|
+
NOSQL INJECTION:
|
|
556
|
+
- MongoDB: $where with user input
|
|
557
|
+
- MongoDB: operator injection ({$gt: ""})
|
|
558
|
+
|
|
559
|
+
ACCESS CONTROL:
|
|
560
|
+
- Database user with excessive privileges (GRANT ALL)
|
|
561
|
+
- Application using root/admin database user
|
|
562
|
+
- No row-level security (RLS) for multi-tenant
|
|
563
|
+
|
|
564
|
+
CONNECTION SECURITY:
|
|
565
|
+
- Database connection without TLS/SSL
|
|
566
|
+
- Connection strings with credentials in code
|
|
567
|
+
- Database exposed on public IP
|
|
568
|
+
|
|
569
|
+
ORM SPECIFIC:
|
|
570
|
+
- Prisma.$queryRawUnsafe() - VULNERABLE
|
|
571
|
+
- Sequelize.query() with user input - VULNERABLE
|
|
572
|
+
- TypeORM repository.query() with string concat - VULNERABLE
|
|
573
|
+
- Mongoose User.find({ username: req.body.username }) - operator injection
|
|
574
|
+
|
|
575
|
+
Output JSON: [{id: "DB-XXX", ...full format with DREAD}]
|
|
576
|
+
```
|
|
577
|
+
|
|
578
|
+
### Agent 16: Network & Architecture Scanner (ARCH)
|
|
579
|
+
```
|
|
580
|
+
Scan for network architecture and service boundary issues:
|
|
581
|
+
|
|
582
|
+
SERVICE BOUNDARIES:
|
|
583
|
+
- Internal endpoints exposed externally
|
|
584
|
+
- Missing network segmentation between services
|
|
585
|
+
- Service-to-service communication without mTLS
|
|
586
|
+
- Admin/debug ports accessible from outside
|
|
587
|
+
|
|
588
|
+
For EACH FINDING, determine fixOwner:
|
|
589
|
+
- Fixable by code? → fixOwner: "developer"
|
|
590
|
+
- Fixable by NetworkPolicy/firewall/K8s config? → fixOwner: "devops"
|
|
591
|
+
- Needs architecture redesign? → fixOwner: "architect"
|
|
592
|
+
|
|
593
|
+
KUBERNETES/INFRASTRUCTURE:
|
|
594
|
+
- Missing NetworkPolicies for namespace isolation
|
|
595
|
+
- Services using ClusterIP that should be internal
|
|
596
|
+
- LoadBalancer exposing internal services
|
|
597
|
+
- Pod-to-pod communication without restrictions
|
|
598
|
+
|
|
599
|
+
Output JSON: [{id: "ARCH-XXX", ...full format with notCodeFix: true if devops/architect}]
|
|
600
|
+
```
|
|
601
|
+
|
|
602
|
+
### Agent 17: Design Decision Detector (DESIGN)
|
|
603
|
+
```
|
|
604
|
+
Scan for intentional design decisions that might look like bugs.
|
|
605
|
+
|
|
606
|
+
GOAL: Prevent false positives by identifying documented/intentional patterns
|
|
607
|
+
|
|
608
|
+
DOCUMENTED DECISIONS:
|
|
609
|
+
- Comments explaining WHY something is done a certain way
|
|
610
|
+
- README/docs explaining architecture choices
|
|
611
|
+
- ADR (Architecture Decision Records) files
|
|
612
|
+
|
|
613
|
+
CODE PATTERNS THAT ARE NOT BUGS:
|
|
614
|
+
- // Intentional: .... or // Design decision: ...
|
|
615
|
+
- // SECURITY: This is safe because...
|
|
616
|
+
- Feature flags controlling security features with documentation
|
|
617
|
+
|
|
618
|
+
FOR EACH PATTERN FOUND, output:
|
|
619
|
+
{
|
|
620
|
+
"id": "DESIGN-001",
|
|
621
|
+
"type": "documented_decision",
|
|
622
|
+
"title": "Content filtering disabled",
|
|
623
|
+
"file": "src/ai/chat.ts",
|
|
624
|
+
"line": 45,
|
|
625
|
+
"reason": "Documented in code comment",
|
|
626
|
+
"relatedFindings": ["AI-001"],
|
|
627
|
+
"recommendation": "Not a bug - document as accepted risk"
|
|
628
|
+
}
|
|
629
|
+
|
|
630
|
+
These findings will be EXCLUDED from main report and moved to "Design Decisions" section.
|
|
631
|
+
```
|
|
632
|
+
|
|
633
|
+
### Agent 18: Context-Aware Validator (CTX)
|
|
634
|
+
```
|
|
635
|
+
Scan to understand the CONTEXT of each potential finding.
|
|
636
|
+
|
|
637
|
+
GOAL: Reduce false positives by understanding deployment context
|
|
638
|
+
|
|
639
|
+
FOR EACH FINDING FROM OTHER AGENTS, determine:
|
|
640
|
+
|
|
641
|
+
DEPLOYMENT CONTEXT:
|
|
642
|
+
- Is this code running in a container with network isolation?
|
|
643
|
+
- Is this behind an API gateway that handles auth?
|
|
644
|
+
- Is this internal-only service behind VPN?
|
|
645
|
+
|
|
646
|
+
RUNTIME CONTEXT:
|
|
647
|
+
- Is this code path actually reachable in production?
|
|
648
|
+
- Is this only used in development/testing?
|
|
649
|
+
- Is this protected by feature flag that's disabled?
|
|
650
|
+
|
|
651
|
+
DATA FLOW CONTEXT:
|
|
652
|
+
- Is the input already validated upstream?
|
|
653
|
+
- Is there middleware that applies to this route?
|
|
654
|
+
|
|
655
|
+
OUTPUT:
|
|
656
|
+
{
|
|
657
|
+
"findingId": "SEC-001",
|
|
658
|
+
"contextAnalysis": {
|
|
659
|
+
"deploymentContext": "Runs in K8s with NetworkPolicy",
|
|
660
|
+
"runtimeContext": "Only reachable from internal services",
|
|
661
|
+
"verdict": "false_positive|confirmed|needs_review",
|
|
662
|
+
"reason": "Protected by network policy"
|
|
663
|
+
}
|
|
664
|
+
}
|
|
665
|
+
```
|
|
666
|
+
|
|
667
|
+
### Agent 19: Enclave & Trusted Compute Scanner (ENC)
|
|
668
|
+
```
|
|
669
|
+
CONDITIONAL: First detect if this project uses enclaves/TEE:
|
|
670
|
+
grep -r -l "enclave\|nitro\|sgx\|tee\|attestation\|trusted.compute\|confidential.computing\|vsock" --include="*.ts" --include="*.js" --include="*.py" --include="*.yaml" --include="*.yml" .
|
|
671
|
+
|
|
672
|
+
IF NO ENCLAVE CODE FOUND: Output: {"skipped": true, "reason": "No enclave/TEE code detected", "findings": []}
|
|
673
|
+
|
|
674
|
+
ENCLAVE REGISTRATION:
|
|
675
|
+
- Enclave-to-backend registration without attestation
|
|
676
|
+
- IP-based trust without cryptographic verification
|
|
677
|
+
- Enclave secrets transmitted without encryption
|
|
678
|
+
|
|
679
|
+
Output JSON: [{id: "ENC-XXX", ...full format with DREAD}]
|
|
680
|
+
```
|
|
681
|
+
|
|
682
|
+
### Agent 20: Executive Summary Generator (EXEC)
|
|
683
|
+
```
|
|
684
|
+
After all other agents complete, generate an executive summary.
|
|
685
|
+
|
|
686
|
+
OUTPUT FORMAT:
|
|
687
|
+
{
|
|
688
|
+
"executiveSummary": {
|
|
689
|
+
"headline": "3 Critical + 5 High findings require immediate attention",
|
|
690
|
+
"riskLevel": "HIGH",
|
|
691
|
+
"topRisks": [
|
|
692
|
+
"SQL injection in user search allows database access",
|
|
693
|
+
"Missing rate limiting enables brute force attacks"
|
|
694
|
+
],
|
|
695
|
+
"positives": [
|
|
696
|
+
"Authentication flow is well-implemented",
|
|
697
|
+
"Good use of parameterized queries in core modules"
|
|
698
|
+
],
|
|
699
|
+
"recommendedActions": [
|
|
700
|
+
{
|
|
701
|
+
"priority": 1,
|
|
702
|
+
"action": "Fix SQL injection in src/search.ts",
|
|
703
|
+
"owner": "developer",
|
|
704
|
+
"effort": "1-2 hours"
|
|
705
|
+
}
|
|
706
|
+
],
|
|
707
|
+
"byOwner": {
|
|
708
|
+
"developer": 5,
|
|
709
|
+
"devops": 3,
|
|
710
|
+
"architect": 1
|
|
711
|
+
}
|
|
712
|
+
}
|
|
713
|
+
}
|
|
714
|
+
```
|
|
715
|
+
|
|
716
|
+
### Agent 21: Duplicate & Existing Solutions Scanner (DUP)
|
|
717
|
+
```
|
|
718
|
+
CRITICAL: Before recommending ANY fix, check if a solution ALREADY EXISTS.
|
|
719
|
+
|
|
720
|
+
For EVERY finding from Phase 1, search the codebase for:
|
|
721
|
+
|
|
722
|
+
1. Existing utilities/helpers:
|
|
723
|
+
- Search for similar function names (sanitize, validate, escape)
|
|
724
|
+
- Check utils/, helpers/, lib/, common/ folders
|
|
725
|
+
|
|
726
|
+
2. Existing patterns:
|
|
727
|
+
- How do OTHER files handle the same issue?
|
|
728
|
+
- Is there a project-wide convention?
|
|
729
|
+
|
|
730
|
+
3. Duplicate findings:
|
|
731
|
+
- Is this the same issue reported multiple times?
|
|
732
|
+
- Are multiple findings actually ONE root cause?
|
|
733
|
+
|
|
734
|
+
For EACH finding, add:
|
|
735
|
+
- "EXISTING: Found sanitizeHtml() in src/utils/security.ts - use this"
|
|
736
|
+
- "PATTERN: Other files use zod.string().email() - follow same pattern"
|
|
737
|
+
- "DUPLICATE: Same root cause as SEC-003, fix once in middleware"
|
|
738
|
+
|
|
739
|
+
Output:
|
|
740
|
+
{
|
|
741
|
+
"findingId": "SEC-001",
|
|
742
|
+
"existingSolution": "Found: src/utils/sanitize.ts exports sanitizeUserInput()",
|
|
743
|
+
"duplicateOf": null,
|
|
744
|
+
"suggestedApproach": "Import and use existing function"
|
|
745
|
+
}
|
|
746
|
+
```
|
|
747
|
+
|
|
748
|
+
### Agent 22: Runtime Verification Scanner (RUNTIME)
|
|
749
|
+
```
|
|
750
|
+
CONDITIONAL: Only runs if SSH is configured in Phase 0 runtime.json.
|
|
751
|
+
|
|
752
|
+
IF NO runtime.json → Skip this agent entirely
|
|
753
|
+
|
|
754
|
+
PURPOSE: Find dangerous mismatches between code configuration and actual runtime.
|
|
755
|
+
|
|
756
|
+
STEP 1: Gather Code Expectations
|
|
757
|
+
grep -E "^USER|^EXPOSE|^ENV" Dockerfile 2>/dev/null
|
|
758
|
+
grep -E "runAsUser|runAsNonRoot|readOnlyRootFilesystem" k8s/*.yaml 2>/dev/null
|
|
759
|
+
|
|
760
|
+
STEP 2: SSH and Check Actual Runtime
|
|
761
|
+
ssh user@server "docker ps -q | head -1 | xargs -I {} docker exec {} id"
|
|
762
|
+
ssh user@server "kubectl get pods -o name | head -1 | xargs -I {} kubectl exec {} -- id"
|
|
763
|
+
|
|
764
|
+
STEP 3: Compare and Generate Findings
|
|
765
|
+
|
|
766
|
+
| Mismatch | Severity |
|
|
767
|
+
|----------|----------|
|
|
768
|
+
| Code says non-root, runs as root | CRITICAL |
|
|
769
|
+
| Dockerfile USER ignored | CRITICAL |
|
|
770
|
+
| ReadOnlyRootFilesystem not enforced | HIGH |
|
|
771
|
+
| Unexpected ports exposed | MEDIUM |
|
|
772
|
+
|
|
773
|
+
Output JSON: [{id: "RUNTIME-XXX", expected: {...}, actual: {...}, ...full format}]
|
|
774
|
+
```
|
|
775
|
+
|
|
776
|
+
---
|
|
777
|
+
|
|
778
|
+
## Phase 2: Mitigation Validation (CRITICAL)
|
|
779
|
+
|
|
780
|
+
Wait for all Phase 1 background agents to complete using `AgentOutputTool`.
|
|
781
|
+
|
|
782
|
+
### Validator M: Mitigation Hunter
|
|
783
|
+
|
|
784
|
+
For EVERY finding, search the codebase for mitigations:
|
|
785
|
+
|
|
786
|
+
1. **Input Validation** - Is input sanitized before reaching the vulnerable sink?
|
|
787
|
+
2. **Middleware Protection** - Is there middleware that protects this route?
|
|
788
|
+
3. **Framework Auto-Protection** - Does the framework handle this automatically?
|
|
789
|
+
4. **Route Protection** - Is the endpoint protected by auth/authorization?
|
|
790
|
+
|
|
791
|
+
Output Per Finding:
|
|
792
|
+
```json
|
|
793
|
+
{
|
|
794
|
+
"findingId": "SEC-001",
|
|
795
|
+
"verdict": "mitigated|partial|confirmed|false_positive",
|
|
796
|
+
"mitigationType": "input_validation|middleware|framework|config|none",
|
|
797
|
+
"evidence": ["Found Zod validation at src/routes/user.ts:23"],
|
|
798
|
+
"adjustedSeverity": "low"
|
|
799
|
+
}
|
|
800
|
+
```
|
|
801
|
+
|
|
802
|
+
---
|
|
803
|
+
|
|
804
|
+
## Phase 3: Cross-Validation (3 parallel validators)
|
|
805
|
+
|
|
806
|
+
Launch 3 validators IN PARALLEL with `run_in_background: true`:
|
|
807
|
+
|
|
808
|
+
### Validator A: False Positive Hunter
|
|
809
|
+
Review ALL findings. For each finding:
|
|
810
|
+
1. Read the actual code file
|
|
811
|
+
2. Check if there are mitigating controls elsewhere
|
|
812
|
+
3. For secrets: run "git ls-files <file>" - if not tracked, mark FALSE POSITIVE
|
|
813
|
+
4. Check if code is actually reachable in production
|
|
814
|
+
|
|
815
|
+
Output: { confirmed: ["SEC-001",...], falsePositives: [{id, reason},...] }
|
|
816
|
+
|
|
817
|
+
### Validator B: Evidence Challenger
|
|
818
|
+
Challenge every HIGH and CRITICAL finding:
|
|
819
|
+
1. Read the actual code with 20 lines of context
|
|
820
|
+
2. Trace data flow from source to sink
|
|
821
|
+
3. Check for sanitization/validation in between
|
|
822
|
+
4. Verify the exploit scenario is realistic
|
|
823
|
+
|
|
824
|
+
Output: { confirmed: ["SEC-001",...], falsePositives: [{id, reason},...] }
|
|
825
|
+
|
|
826
|
+
### Validator C: Missing Issues Hunter
|
|
827
|
+
Look for issues that Phase 1 agents MISSED:
|
|
828
|
+
- Race conditions in critical operations
|
|
829
|
+
- Business logic flaws specific to this application
|
|
830
|
+
- Combination attacks (multiple low issues = high)
|
|
831
|
+
|
|
832
|
+
Output: { missedIssues: [{full finding object},...] }
|
|
833
|
+
|
|
834
|
+
---
|
|
835
|
+
|
|
836
|
+
## Phase 4: Build Consensus
|
|
837
|
+
|
|
838
|
+
Wait for all Phase 3 background validators to complete using `AgentOutputTool`.
|
|
839
|
+
|
|
840
|
+
Combine all results:
|
|
841
|
+
1. Calculate confidence: (confirmations / validators) * 100
|
|
842
|
+
2. Remove findings with confidence < 50%
|
|
843
|
+
3. Add missed issues from Validator C
|
|
844
|
+
4. Remove mitigated and false positive findings
|
|
845
|
+
5. Identify positive observations (good patterns found)
|
|
846
|
+
|
|
847
|
+
---
|
|
848
|
+
|
|
849
|
+
## Phase 5: Generate Report
|
|
850
|
+
|
|
851
|
+
**DO NOT ASK - JUST OVERWRITE THE FILE!**
|
|
852
|
+
|
|
853
|
+
Update `.coverme/scan.json` with the full scan results including:
|
|
854
|
+
|
|
855
|
+
### Required Fields:
|
|
856
|
+
- **projectName**: from package.json or folder name
|
|
857
|
+
- **scanDate**: today's date
|
|
858
|
+
- **filesScanned**: count of source files analyzed
|
|
859
|
+
- **linesOfCode**: total lines in source files
|
|
860
|
+
- **projectTree**: ASCII tree of main directories
|
|
861
|
+
|
|
862
|
+
### projectOverview:
|
|
863
|
+
```json
|
|
864
|
+
{
|
|
865
|
+
"name": "project-name",
|
|
866
|
+
"type": "Backend API | Frontend SPA | Full-stack | CLI | Library",
|
|
867
|
+
"stack": ["Node.js", "TypeScript", "React", "PostgreSQL"],
|
|
868
|
+
"purpose": "Brief description of what this project does",
|
|
869
|
+
"architecture": "Monolith | Microservices | Serverless",
|
|
870
|
+
"keyComponents": ["auth service", "payment processing", "AI chat"]
|
|
871
|
+
}
|
|
872
|
+
```
|
|
873
|
+
|
|
874
|
+
### architectureOverview:
|
|
875
|
+
```json
|
|
876
|
+
{
|
|
877
|
+
"components": [
|
|
878
|
+
{"name": "API Server", "type": "service", "description": "Express.js REST API", "trustLevel": "semi-trusted"},
|
|
879
|
+
{"name": "PostgreSQL", "type": "database", "description": "Primary data store", "trustLevel": "trusted"}
|
|
880
|
+
],
|
|
881
|
+
"trustBoundaries": [
|
|
882
|
+
{"name": "Client to API", "from": "Browser", "to": "API Server", "protocol": "HTTPS"}
|
|
883
|
+
],
|
|
884
|
+
"criticalAssets": [
|
|
885
|
+
{"name": "User Credentials", "type": "credential", "location": "PostgreSQL", "protection": "bcrypt hashed"}
|
|
886
|
+
],
|
|
887
|
+
"dataFlows": ["User Authentication Flow", "Payment Processing Flow"]
|
|
888
|
+
}
|
|
889
|
+
```
|
|
890
|
+
|
|
891
|
+
### executiveSummary:
|
|
892
|
+
```json
|
|
893
|
+
{
|
|
894
|
+
"headline": "3 Critical + 5 High findings require immediate attention",
|
|
895
|
+
"riskLevel": "CRITICAL | HIGH | MEDIUM | LOW",
|
|
896
|
+
"topRisks": ["SQL injection in user search", "Missing rate limiting"],
|
|
897
|
+
"positives": ["Good authentication flow", "Proper input validation"],
|
|
898
|
+
"recommendedActions": [
|
|
899
|
+
{"priority": 1, "action": "Fix SQL injection", "owner": "developer", "effort": "1-2 hours"}
|
|
900
|
+
],
|
|
901
|
+
"byOwner": {"developer": 5, "devops": 3, "architect": 1}
|
|
902
|
+
}
|
|
903
|
+
```
|
|
904
|
+
|
|
905
|
+
### threatModel:
|
|
906
|
+
```json
|
|
907
|
+
[
|
|
908
|
+
{
|
|
909
|
+
"id": "T-001",
|
|
910
|
+
"threat": "SQL Injection via user input",
|
|
911
|
+
"category": "STRIDE",
|
|
912
|
+
"strideType": "T",
|
|
913
|
+
"status": "open | partial | mitigated",
|
|
914
|
+
"relatedFindings": ["SEC-001", "DB-002"],
|
|
915
|
+
"mitigation": "Use parameterized queries",
|
|
916
|
+
"dreadScore": 8.5
|
|
917
|
+
}
|
|
918
|
+
]
|
|
919
|
+
```
|
|
920
|
+
|
|
921
|
+
### qualityReview:
|
|
922
|
+
```json
|
|
923
|
+
{
|
|
924
|
+
"deleteItems": [
|
|
925
|
+
{"type": "delete", "file": "src/utils/oldHelpers.ts", "lines": 250, "description": "Dead code", "reason": "No imports found"}
|
|
926
|
+
],
|
|
927
|
+
"mergeItems": [
|
|
928
|
+
{"type": "merge", "file": "src/utils/validate.ts, src/helpers/validation.ts", "description": "Overlapping functions", "reason": "DRY violation"}
|
|
929
|
+
],
|
|
930
|
+
"simplifyItems": [
|
|
931
|
+
{"type": "simplify", "file": "src/services/payment.ts", "lines": 450, "description": "Overly complex", "reason": "Can be reduced"}
|
|
932
|
+
],
|
|
933
|
+
"totalLinesRemovable": 680,
|
|
934
|
+
"percentageOfCodebase": 4.2
|
|
935
|
+
}
|
|
936
|
+
```
|
|
937
|
+
|
|
938
|
+
### actionItems:
|
|
939
|
+
```json
|
|
940
|
+
[
|
|
941
|
+
{
|
|
942
|
+
"id": "A-001",
|
|
943
|
+
"title": "Fix SQL injection in user search",
|
|
944
|
+
"priority": "immediate | high | medium | long-term",
|
|
945
|
+
"relatedFindings": ["SEC-001"],
|
|
946
|
+
"effort": "low | medium | high",
|
|
947
|
+
"description": "Replace string concatenation with parameterized query"
|
|
948
|
+
}
|
|
949
|
+
]
|
|
950
|
+
```
|
|
951
|
+
|
|
952
|
+
### findings:
|
|
953
|
+
Each finding MUST include ALL these fields:
|
|
954
|
+
```json
|
|
955
|
+
{
|
|
956
|
+
"id": "SEC-001",
|
|
957
|
+
"title": "SQL Injection in User Search",
|
|
958
|
+
"severity": "critical | high | medium | low | info",
|
|
959
|
+
"category": "security | auth | api | infra | data | ai | performance | business-logic | quality | testing",
|
|
960
|
+
"file": "src/routes/users.ts",
|
|
961
|
+
"line": 45,
|
|
962
|
+
"code": "db.query(`SELECT * FROM users WHERE name LIKE '%${searchTerm}%'`)",
|
|
963
|
+
"description": "User search parameter directly concatenated into SQL query",
|
|
964
|
+
"impact": "Attacker can extract entire database contents",
|
|
965
|
+
"attackChain": [
|
|
966
|
+
{"step": 1, "action": "Send malicious search term", "result": "Query returns all users"},
|
|
967
|
+
{"step": 2, "action": "Use UNION SELECT", "result": "Database schema exposed"}
|
|
968
|
+
],
|
|
969
|
+
"recommendation": "Use parameterized queries",
|
|
970
|
+
"cwe": "CWE-89",
|
|
971
|
+
"owasp": "A03:2021",
|
|
972
|
+
"dread": {
|
|
973
|
+
"damage": 10,
|
|
974
|
+
"reproducibility": 10,
|
|
975
|
+
"exploitability": 9,
|
|
976
|
+
"affectedUsers": 10,
|
|
977
|
+
"discoverability": 8,
|
|
978
|
+
"total": 9.4
|
|
979
|
+
},
|
|
980
|
+
"status": "open",
|
|
981
|
+
"confidence": 95,
|
|
982
|
+
"fixOwner": "developer | devops | architect",
|
|
983
|
+
"fixType": "code | config | infrastructure | design"
|
|
984
|
+
}
|
|
985
|
+
```
|
|
986
|
+
|
|
987
|
+
### Other sections:
|
|
988
|
+
- **designDecisions**: Intentional patterns that look like bugs
|
|
989
|
+
- **mitigatedFindings**: Findings with existing protection
|
|
990
|
+
- **falsePositives**: Findings that are not actually vulnerabilities
|
|
991
|
+
- **positiveObservations**: Good practices found
|
|
992
|
+
- **validationSummary**: Stats on mitigation validation
|
|
993
|
+
- **summary**: Total counts by severity
|
|
994
|
+
- **agentsUsed**: List of agents that ran
|
|
995
|
+
- **scanDuration**: Time taken in ms
|
|
996
|
+
|
|
997
|
+
Use the Write tool to overwrite `.coverme/scan.json` with the results.
|
|
998
|
+
|
|
999
|
+
---
|
|
1000
|
+
|
|
1001
|
+
## Phase 6: Generate HTML Report
|
|
1002
|
+
|
|
1003
|
+
**DO NOT ASK - JUST RUN THE COMMANDS!**
|
|
1004
|
+
|
|
1005
|
+
Generate the HTML report and open it automatically:
|
|
1006
|
+
```bash
|
|
1007
|
+
TIMESTAMP=$(date +%Y-%m-%d_%H-%M-%S)
|
|
1008
|
+
npx coverme-scanner report .coverme/scan.json -f html -o ".coverme/report_$TIMESTAMP.html"
|
|
1009
|
+
cp .coverme/scan.json ".coverme/scan_$TIMESTAMP.json"
|
|
1010
|
+
open ".coverme/report_$TIMESTAMP.html"
|
|
1011
|
+
```
|
|
1012
|
+
|
|
1013
|
+
Run these commands without asking for permission.
|
|
1014
|
+
|
|
1015
|
+
---
|
|
1016
|
+
|
|
1017
|
+
## DONE
|
|
1018
|
+
|
|
1019
|
+
Tell the user: "Scan complete! Report saved to .coverme/ and opened in browser."
|
|
1020
|
+
|
|
1021
|
+
**REMINDER: You should have completed all 6 phases without asking ANY questions or stopping for confirmation.**
|