dravix-agent 0.1.0

package/dist/cache.js

@@ -0,0 +1,146 @@
+/**
+ * LMDB-backed cache for engine results and other per-project state.
+ *
+ * Keys are namespaced strings; values are JSON.
+ * Falls back to in-memory Map if LMDB fails to load (e.g. native binding
+ * missing on a host) — the gate degrades to "no cache" but still works.
+ */
+import { mkdirSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { getLogger } from "./util/logger.js";
+const log = getLogger("aegis.cache");
+class MemoryBackend {
+    store = new Map();
+    get(key) {
+        const e = this.store.get(key);
+        if (!e)
+            return undefined;
+        if (e.exp !== 0 && e.exp < Date.now()) {
+            this.store.delete(key);
+            return undefined;
+        }
+        return e.v;
+    }
+    put(key, value, ttlMs) {
+        this.store.set(key, { v: value, exp: ttlMs ? Date.now() + ttlMs : 0 });
+    }
+    delete(key) {
+        this.store.delete(key);
+    }
+    async close() {
+        this.store.clear();
+    }
+}
+class LmdbBackend {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    get(key) {
+        try {
+            const raw = this.db.get(key);
+            if (!raw)
+                return undefined;
+            if (raw.exp !== 0 && raw.exp < Date.now()) {
+                void this.db.remove(key);
+                return undefined;
+            }
+            return raw.v;
+        }
+        catch (err) {
+            log.debug("lmdb get failed", { key, err: String(err) });
+            return undefined;
+        }
+    }
+    async put(key, value, ttlMs) {
+        try {
+            // AWAIT the underlying promise. lmdb-js batches writes; without await,
+            // a subsequent get from the same process may not see the value in time
+            // (manifests as ``undefined`` reads immediately after writes).
+            await this.db.put(key, { v: value, exp: ttlMs ? Date.now() + ttlMs : 0 });
+        }
+        catch (err) {
+            log.debug("lmdb put failed", { key, err: String(err) });
+        }
+    }
+    async delete(key) {
+        try {
+            await this.db.remove(key);
+        }
+        catch (err) {
+            log.debug("lmdb remove failed", { key, err: String(err) });
+        }
+    }
+    async close() {
+        try {
+            await this.db.close();
+        }
+        catch {
+            // best-effort
+        }
+    }
+}
+let _backend = null;
+let _initAttempted = false;
+async function getBackend(_projectRoot) {
+    if (_backend)
+        return _backend;
+    if (_initAttempted) {
+        _backend = new MemoryBackend();
+        return _backend;
+    }
+    _initAttempted = true;
+    // Use a SINGLE cache shared by all projects (keys are project-hashed via
+    // rootKey() upstream), located under the user's home dir or
+    // ``AEGIS_HOME``. Per-cwd caches led to misses when ``aegis index`` and
+    // ``aegis scan`` were invoked from different working directories.
+    try {
+        const lmdbMod = (await import("lmdb"));
+        const home = process.env.AEGIS_HOME ?? resolve(process.env.HOME ?? process.env.USERPROFILE ?? ".", ".aegis");
+        const dir = resolve(home, "cache");
+        mkdirSync(dir, { recursive: true });
+        const db = lmdbMod.open({
+            path: join(dir, "aegis-cache.mdb"),
+            compression: true,
+        });
+        _backend = new LmdbBackend(db);
+        log.info("cache backend: lmdb (shared)", { path: dir });
+    }
+    catch (err) {
+        log.warn("lmdb unavailable; falling back to in-memory cache", { err: String(err) });
+        _backend = new MemoryBackend();
+    }
+    return _backend;
+}
+export class Cache {
+    projectRoot;
+    constructor(projectRoot) {
+        this.projectRoot = projectRoot;
+    }
+    async get(key) {
+        const b = await getBackend(this.projectRoot);
+        return b.get(key);
+    }
+    async put(key, value, ttlMs) {
+        const b = await getBackend(this.projectRoot);
+        await b.put(key, value, ttlMs);
+    }
+    async delete(key) {
+        const b = await getBackend(this.projectRoot);
+        await b.delete(key);
+    }
+}
+/** Cache key for an engine result on a specific (engine, lang, content_hash). */
+import { createHash } from "node:crypto";
+export function cacheKeyForEngine(engine, lang, content) {
+    const h = createHash("sha256")
+        .update(engine)
+        .update("\0")
+        .update(lang)
+        .update("\0")
+        .update(content)
+        .digest("hex")
+        .slice(0, 32);
+    return `eng:${engine}:${lang}:${h}`;
+}
+//# sourceMappingURL=cache.js.map

package/dist/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,GAAG,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;AAcrC,MAAM,aAAa;IACT,KAAK,GAAG,IAAI,GAAG,EAAiB,CAAC;IACzC,GAAG,CAAC,GAAW;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzB,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,CAAC,CAAC,CAAC;IACb,CAAC;IACD,GAAG,CAAC,GAAW,EAAE,KAAc,EAAE,KAAc;QAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;CACF;AAWD,MAAM,WAAW;IACc;IAA7B,YAA6B,EAA+B;QAA/B,OAAE,GAAF,EAAE,CAA6B;IAAG,CAAC;IAChE,GAAG,CAAC,GAAW;QACb,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAsB,CAAC;YAClD,IAAI,CAAC,GAAG;gBAAE,OAAO,SAAS,CAAC;YAC3B,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC1C,KAAK,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACzB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,GAAG,CAAC,CAAC,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxD,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAc,EAAE,KAAc;QACnD,IAAI,CAAC;YACH,uEAAuE;YACvE,uEAAuE;YACvE,+DAA+D;YAC/D,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,KAAK,CAAC,KAAK;QACT,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;CACF;AAED,IAAI,QAAQ,GAAmB,IAAI,CAAC;AACpC,IAAI,cAAc,GAAG,KAAK,CAAC;AAE3B,KAAK,UAAU,UAAU,CAAC,YAAqB;IAC7C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,cAAc,EAAE,CAAC;QACnB,QAAQ,GAAG,IAAI,aAAa,EAAE,CAAC;QAC/B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,cAAc,GAAG,IAAI,CAAC;IACtB,yEAAyE;IACzE,4DAA4D;IAC5D,wEAAwE;IACxE,kEAAkE;IAClE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAuB,CAAC;QAC7D,MAAM,IAAI,GACR,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,EAAE,QAAQ,CAAC,CAAC;QAClG,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;YACtB,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC;YAClC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,QAAQ,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,mDAAmD,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpF,QAAQ,GAAG,IAAI,aAAa,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,KAAK;IACa;IAA7B,YAA6B,WAAoB;QAApB,gBAAW,GAAX,WAAW,CAAS;IAAG,CAAC;IAErD,KAAK,CAAC,GAAG,CAAI,GAAW;QACtB,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7C,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,CAAkB,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,GAAW,EAAE,KAAQ,EAAE,KAAc;QAChD,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7C,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7C,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;CACF;AAED,iFAAiF;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,IAAY,EAAE,OAAe;IAC7E,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC3B,MAAM,CAAC,MAAM,CAAC;SACd,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,OAAO,MAAM,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;AACtC,CAAC"}

package/dist/engines/ai-sinks.d.ts

@@ -0,0 +1,52 @@
+/**
+ * AI / LLM-specific dangerous-sinks scanner — multi-language (Python + JS/TS).
+ *
+ * Targets the prompt-injection and LLM-misuse patterns from OWASP Top 10 for
+ * LLM Applications 2025 + the corpus of real-world LLM-app CVEs. These have
+ * no signal in classical SAST and Vul-RAG misses them too because the KB is
+ * pre-LLM-era.
+ *
+ *   AI-01 Direct prompt injection: untrusted text concatenated into prompt
+ *         without delimiters / tag-marking (CWE-1427)
+ *   AI-02 System-role contamination: f"...{user_input}..." used as the
+ *         system message (CWE-1427)
+ *   AI-03 Indirect prompt injection: tool output / web-search result fed
+ *         back into the next prompt without quoting (CWE-1426)
+ *   AI-04 Hardcoded LLM API key: sk-..., claude-..., AIza... literal in source
+ *         (CWE-798) — broader catch than the generic secret-scan
+ *   AI-05 Missing rate limit on chat.completions in a route handler (CWE-770)
+ *   AI-06 Template-based prompt builder where the SOURCE template comes from
+ *         user input (CWE-1427)
+ *
+ * All patterns are language-aware: Python ones use Python idioms (f-string,
+ * messages=[{...}], anthropic.messages.create); JS ones use template
+ * literals + openai.chat.completions.create.
+ */
+import { Engine, EngineRunInput, EngineRunResult } from "./types.js";
+import { Lang } from "../lang.js";
+interface SinkRule {
+    id: string;
+    cwe: string;
+    severity: "high" | "critical";
+    what: string;
+    pattern: RegExp;
+    isDangerous: (firstArg: string, allArgs: string, fullContent?: string) => boolean;
+    fileGate?: (fullContent: string) => boolean;
+    remediation: string;
+    langs: ReadonlyArray<Lang>;
+}
+declare function isLlmFile(c: string): boolean;
+declare function tainted(s: string): boolean;
+export declare class AiSinksEngine implements Engine {
+    readonly name: "ai-sinks";
+    readonly languages: ReadonlyArray<Lang>;
+    available(): Promise<boolean>;
+    run(input: EngineRunInput): Promise<EngineRunResult>;
+}
+export declare const _testing: {
+    RULES: readonly SinkRule[];
+    isLlmFile: typeof isLlmFile;
+    tainted: typeof tainted;
+};
+export {};
+//# sourceMappingURL=ai-sinks.d.ts.map

package/dist/engines/ai-sinks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-sinks.d.ts","sourceRoot":"","sources":["../../src/engines/ai-sinks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAGlC,UAAU,QAAQ;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IAClF,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;CAC5B;AAGD,iBAAS,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAIrC;AAOD,iBAAS,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAEnC;AA4ID,qBAAa,aAAc,YAAW,MAAM;IAC1C,QAAQ,CAAC,IAAI,EAAG,UAAU,CAAU;IACpC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,CAA0C;IAE3E,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAI7B,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;CA6D3D;AAED,eAAO,MAAM,QAAQ;;;;CAAgC,CAAC"}

package/dist/engines/ai-sinks.js

@@ -0,0 +1,204 @@
+import { makeFindingId } from "../findings.js";
+import { isLineSuppressed, isTestOrFixturePath } from "./pragma.js";
+// Files that look like they wire an LLM call.
+function isLlmFile(c) {
+    return /\b(?:openai|anthropic|google\.generativeai|cohere|together|groq|ollama|@anthropic-ai\/sdk|claude(?:-3|-4|_sdk))\b/i.test(c);
+}
+// Common taint sources across both languages — anything that smells like
+// untrusted user / network input.
+const TAINT_SOURCE_RE = /\b(?:request\.(?:args|form|json|values|cookies|files|data)\b|req\.(?:body|params|query|cookies)\b|input\s*\(\s*\)|sys\.argv\b|process\.argv\b|process\.env\b(?!\.NODE_ENV\b)|tool_result\b|search_result\b|scraped_content\b|raw_email\b|webhook_body\b)/;
+function tainted(s) {
+    return TAINT_SOURCE_RE.test(s);
+}
+/** Check if an f-string capture (e.g. just the variable name "q") is
+ * tainted — directly OR via assignment somewhere else in the file.
+ *
+ *   prompt = f"... {q}"                      <- capture is "q"
+ *   q = request.args.get('q','')             <- assignment elsewhere
+ *
+ * We escape the capture as a regex literal and look for
+ *   <name> = <anything-with-a-taint-source>
+ * Returns true on direct match OR transitive assignment. */
+function captureIsTainted(capture, fullContent) {
+    if (TAINT_SOURCE_RE.test(capture))
+        return true;
+    if (!fullContent)
+        return false;
+    const name = capture.trim().split(/[\s,.\[]/, 1)[0];
+    if (!name || name.length === 0 || /\W/.test(name))
+        return false;
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    // Match: <name> = <expression involving a taint source>
+    // (the expression can span the rest of the line)
+    const assignRe = new RegExp(`\\b${escaped}\\s*=\\s*[^=\\n]*?(?:${TAINT_SOURCE_RE.source})`);
+    return assignRe.test(fullContent);
+}
+const RULES = [
+    {
+        id: "prompt-injection-fstring",
+        cwe: "CWE-1427",
+        severity: "high",
+        what: "Python f-string prompt with untrusted interpolation — direct prompt injection (attacker steers the model)",
+        // Looks for: prompt = f"...{tainted}..." OR content = f"...{request.x}..."
+        // Direct assignment OR dict-value form. Simpler than the previous
+        // monster regex — matches: `prompt = f"...{x}..."` and
+        // `{"content": f"...{x}..."}`.
+        pattern: /(?:\b(?:prompt|message|content|system|user_message|system_prompt|systemPrompt)\s*=\s*|['"]content['"]\s*:\s*)[rR]?[fF]['"][^'"]*\{([^{}]+)\}/g,
+        isDangerous: (capture, _all, content) => captureIsTainted(capture, content),
+        fileGate: (c) => isLlmFile(c),
+        remediation: "Wrap untrusted text in clearly marked delimiters and instruct the model in the SYSTEM prompt " +
+            "that anything inside the delimiter is data, never instructions:\n" +
+            "  user_msg = f'Answer the user. Their message is delimited by <user_input>...</user_input>.'\n" +
+            "  user_msg += f'\\n<user_input>{untrusted}</user_input>'\n" +
+            "Plus: refuse-on-instruction-conflict + tag-only-mode in tool schemas.",
+        langs: ["python"],
+    },
+    {
+        id: "prompt-injection-template-literal",
+        cwe: "CWE-1427",
+        severity: "high",
+        what: "JS template-literal prompt with untrusted interpolation — direct prompt injection",
+        pattern: /(?:\b(?:prompt|message|content|system|userMessage|systemPrompt)\s*=\s*|['"]content['"]\s*:\s*)`[^`]*\$\{([^{}]+)\}/g,
+        isDangerous: (capture, _all, content) => captureIsTainted(capture, content),
+        fileGate: (c) => isLlmFile(c),
+        remediation: "Wrap untrusted text in clearly marked delimiters in the user message and instruct the SYSTEM " +
+            "prompt that delimited content is data:\n" +
+            "  const userMsg = `User input is in <user_input> tags.\\n<user_input>${untrusted}</user_input>`;\n" +
+            "Plus: structured output (JSON schema) + refuse-on-instruction-conflict.",
+        langs: ["javascript", "typescript"],
+    },
+    {
+        id: "llm-tool-result-fed-back-raw",
+        cwe: "CWE-1426",
+        severity: "high",
+        what: "Raw tool/search/scrape output appended back to the prompt without delimiters — indirect prompt injection",
+        // Patterns like: messages.append({"role":"user","content": tool_result})
+        // OR prompt += search_result OR messages.push({content: scraped})
+        pattern: /(?:messages\.(?:append|push)\s*\(|(?:prompt|message|context)\s*[+]?=)[^;\n]*\b(tool_result|search_result|scraped_content|webhook_body|raw_email|tool_output)\b/g,
+        isDangerous: () => true,
+        fileGate: (c) => isLlmFile(c),
+        remediation: "Treat ALL tool / network / web-scraped output as untrusted. Wrap it: " +
+            "f'<tool_output>{result}</tool_output>' AND set a system instruction that anything inside such " +
+            "tags is data. Better: have the tool return STRUCTURED output (JSON), parse it server-side, and " +
+            "expose only the fields you need to the next prompt.",
+        langs: ["python", "javascript", "typescript"],
+    },
+    {
+        id: "llm-hardcoded-api-key",
+        cwe: "CWE-798",
+        severity: "critical",
+        what: "Hardcoded LLM provider API key in source",
+        // Match common prefixes for OpenAI / Anthropic / Google / Cohere / Mistral.
+        pattern: /['"`](sk-(?:proj-|ant-|live-)?[A-Za-z0-9_-]{20,}|claude-[A-Za-z0-9_-]{20,}|AIza[A-Za-z0-9_-]{30,}|co\.[A-Za-z0-9]{20,}|mst-[A-Za-z0-9]{20,})['"`]/g,
+        isDangerous: (capture) => {
+            // Exclude obvious template placeholders.
+            const v = capture.replace(/['"`]/g, "");
+            if (/EXAMPLE|YOUR[_-]?KEY|PLACEHOLDER|xxxx|\.\.\.|<.*>/i.test(v))
+                return false;
+            return true;
+        },
+        remediation: "Load from env: api_key=os.environ['ANTHROPIC_API_KEY']. Hardcoded LLM keys end up in git history " +
+            "and on PyPI / npm / GitHub — automated scanners harvest them within minutes and bill them out. " +
+            "Rotate the exposed key NOW at the provider console.",
+        langs: ["python", "javascript", "typescript"],
+    },
+    {
+        id: "llm-system-prompt-interpolates-user",
+        cwe: "CWE-1427",
+        severity: "high",
+        what: "System prompt contains f-string / template interpolation of untrusted input — attacker can rewrite role",
+        // Match: system_prompt = f"...{tainted}..." OR system_prompt = `...${tainted}...`
+        pattern: /\b(?:system_prompt|systemPrompt|SYSTEM_PROMPT)\s*=\s*(?:[rR]?[fF]['"][^'"]*\{([^{}]+)\}|`[^`]*\$\{([^{}]+)\})/g,
+        isDangerous: (_first, all, content) => TAINT_SOURCE_RE.test(all) || captureIsTainted(all, content),
+        fileGate: (c) => isLlmFile(c),
+        remediation: "Keep the system prompt 100% STATIC. Move all user-controlled values to the user-role message " +
+            "with explicit delimiters. A system prompt that interpolates user input gives the attacker the " +
+            "ability to insert role-overriding instructions that the model is trained to obey.",
+        langs: ["python", "javascript", "typescript"],
+    },
+    {
+        id: "llm-jinja-from-string-render",
+        cwe: "CWE-1427",
+        severity: "critical",
+        what: "Jinja Template / from_string(user_input).render(...) used to build an LLM prompt — template-injection-via-LLM",
+        // Any .from_string(...) call counts when we're in an LLM file.
+        pattern: /\.from_string\s*\(([^()]*(?:\([^()]*\)[^()]*)*)\)/g,
+        isDangerous: (first) => TAINT_SOURCE_RE.test(first),
+        fileGate: (c) => isLlmFile(c),
+        remediation: "Never build a prompt via runtime template-source from user input. Use parameter substitution " +
+            "into a static template (Jinja2.Template(STATIC).render(user=untrusted)). The render itself is safe; " +
+            "the SOURCE-as-data is the bug.",
+        langs: ["python"],
+    },
+];
+export class AiSinksEngine {
+    name = "ai-sinks";
+    languages = ["python", "javascript", "typescript"];
+    async available() {
+        return true;
+    }
+    async run(input) {
+        const t0 = Date.now();
+        const findings = [];
+        if (input.lang !== "python" &&
+            input.lang !== "javascript" &&
+            input.lang !== "typescript") {
+            return { engine: this.name, findings: [], unavailable: false, durationMs: 0 };
+        }
+        if (isTestOrFixturePath(input.filePath)) {
+            return { engine: this.name, findings: [], unavailable: false, durationMs: 0 };
+        }
+        const content = input.content;
+        const lines = content.split(/\r?\n/);
+        const seen = new Set();
+        for (const rule of RULES) {
+            if (!rule.langs.includes(input.lang))
+                continue;
+            if (rule.fileGate && !rule.fileGate(content))
+                continue;
+            rule.pattern.lastIndex = 0;
+            let m;
+            while ((m = rule.pattern.exec(content)) !== null) {
+                const allArgs = m[1] ?? "";
+                if (!rule.isDangerous(allArgs, allArgs, content))
+                    continue;
+                const upTo = content.slice(0, m.index);
+                const line = upTo.split(/\r?\n/).length;
+                const snippet = (lines[line - 1] ?? "").slice(0, 400);
+                if (isLineSuppressed(snippet, rule.id))
+                    continue;
+                const id = makeFindingId({
+                    engine: this.name,
+                    file: input.filePath,
+                    line,
+                    rule_id: rule.id,
+                });
+                if (seen.has(id))
+                    continue;
+                seen.add(id);
+                findings.push({
+                    id,
+                    engine: "ai-sinks",
+                    file: input.filePath,
+                    line,
+                    rule_id: rule.id,
+                    cwe: rule.cwe,
+                    severity: rule.severity,
+                    message: `${rule.what}. Likely ${rule.cwe} — review and remediate before merging.`,
+                    evidence: { snippet },
+                    confidence: 0.75,
+                    source: "pattern",
+                    remediation: rule.remediation,
+                });
+            }
+        }
+        return {
+            engine: this.name,
+            findings,
+            unavailable: false,
+            durationMs: Date.now() - t0,
+        };
+    }
+}
+export const _testing = { RULES, isLlmFile, tainted };
+//# sourceMappingURL=ai-sinks.js.map

package/dist/engines/ai-sinks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-sinks.js","sourceRoot":"","sources":["../../src/engines/ai-sinks.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAW,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAcpE,8CAA8C;AAC9C,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,oHAAoH,CAAC,IAAI,CAC9H,CAAC,CACF,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,kCAAkC;AAClC,MAAM,eAAe,GACnB,0PAA0P,CAAC;AAE7P,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;4DAQ4D;AAC5D,SAAS,gBAAgB,CAAC,OAAe,EAAE,WAAoB;IAC7D,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC5D,wDAAwD;IACxD,iDAAiD;IACjD,MAAM,QAAQ,GAAG,IAAI,MAAM,CACzB,MAAM,OAAO,wBAAwB,eAAe,CAAC,MAAM,GAAG,CAC/D,CAAC;IACF,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,KAAK,GAA4B;IACrC;QACE,EAAE,EAAE,0BAA0B;QAC9B,GAAG,EAAE,UAAU;QACf,QAAQ,EAAE,MAAM;QAChB,IAAI,EACF,2GAA2G;QAC7G,2EAA2E;QAC3E,kEAAkE;QAClE,uDAAuD;QACvD,+BAA+B;QAC/B,OAAO,EACL,+IAA+I;QACjJ,WAAW,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC;QAC3E,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7B,WAAW,EACT,+FAA+F;YAC/F,mEAAmE;YACnE,gGAAgG;YAChG,4DAA4D;YAC5D,uEAAuE;QACzE,KAAK,EAAE,CAAC,QAAQ,CAAC;KAClB;IACD;QACE,EAAE,EAAE,mCAAmC;QACvC,GAAG,EAAE,UAAU;QACf,QAAQ,EAAE,MAAM;QAChB,IAAI,EACF,mFAAmF;QACrF,OAAO,EACL,qHAAqH;QACvH,WAAW,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC;QAC3E,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7B,WAAW,EACT,+FAA+F;YAC/F,0CAA0C;YAC1C,oGAAoG;YACpG,yEAAyE;QAC3E,KAAK,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;KACpC;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,GAAG,EAAE,UAAU;QACf,QAAQ,EAAE,MAAM;QAChB,IAAI,EACF,0GAA0G;QAC5G,yEAAyE;QACzE,kEAAkE;QAClE,OAAO,EACL,iKAAiK;QACnK,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI;QACvB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7B,WAAW,EACT,uEAAuE;YACvE,gGAAgG;YAChG,iGAAiG;YACjG,qDAAqD;QACvD,KAAK,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAC;KAC9C;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,0CAA0C;QAChD,4EAA4E;QAC5E,OAAO,EACL,oJAAoJ;QACtJ,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE;YACvB,yCAAyC;YACzC,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACxC,IAAI,oDAAoD,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC/E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,WAAW,EACT,mGAAmG;YACnG,iGAAiG;YACjG,qDAAqD;QACvD,KAAK,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAC;KAC9C;IACD;QACE,EAAE,EAAE,qCAAqC;QACzC,GAAG,EAAE,UAAU;QACf,QAAQ,EAAE,MAAM;QAChB,IAAI,EACF,yGAAyG;QAC3G,kFAAkF;QAClF,OAAO,EACL,gHAAgH;QAClH,WAAW,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC;QAClG,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7B,WAAW,EACT,+FAA+F;YAC/F,gGAAgG;YAChG,mFAAmF;QACrF,KAAK,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAC;KAC9C;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,GAAG,EAAE,UAAU;QACf,QAAQ,EAAE,UAAU;QACpB,IAAI,EACF,+GAA+G;QACjH,+DAA+D;QAC/D,OAAO,EACL,oDAAoD;QACtD,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QACnD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7B,WAAW,EACT,+FAA+F;YAC/F,sGAAsG;YACtG,gCAAgC;QAClC,KAAK,EAAE,CAAC,QAAQ,CAAC;KAClB;CACF,CAAC;AAEF,MAAM,OAAO,aAAa;IACf,IAAI,GAAG,UAAmB,CAAC;IAC3B,SAAS,GAAwB,CAAC,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IAEjF,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAqB;QAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,IACE,KAAK,CAAC,IAAI,KAAK,QAAQ;YACvB,KAAK,CAAC,IAAI,KAAK,YAAY;YAC3B,KAAK,CAAC,IAAI,KAAK,YAAY,EAC3B,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/C,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS;YACvD,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAyB,CAAC;YAC9B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACjD,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;oBAAE,SAAS;gBAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;gBACxC,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACtD,IAAI,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;oBAAE,SAAS;gBACjD,MAAM,EAAE,GAAG,aAAa,CAAC;oBACvB,MAAM,EAAE,IAAI,CAAC,IAAI;oBACjB,IAAI,EAAE,KAAK,CAAC,QAAQ;oBACpB,IAAI;oBACJ,OAAO,EAAE,IAAI,CAAC,EAAE;iBACjB,CAAC,CAAC;gBACH,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,SAAS;gBAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE;oBACF,MAAM,EAAE,UAAU;oBAClB,IAAI,EAAE,KAAK,CAAC,QAAQ;oBACpB,IAAI;oBACJ,OAAO,EAAE,IAAI,CAAC,EAAE;oBAChB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,GAAG,yCAAyC;oBAClF,QAAQ,EAAE,EAAE,OAAO,EAAE;oBACrB,UAAU,EAAE,IAAI;oBAChB,MAAM,EAAE,SAAS;oBACjB,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,IAAI;YACjB,QAAQ;YACR,WAAW,EAAE,KAAK;YAClB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;SAC5B,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC"}

package/dist/engines/eslint.d.ts

@@ -0,0 +1,9 @@
+import { Engine, EngineRunInput, EngineRunResult } from "./types.js";
+import { Lang } from "../lang.js";
+export declare class ESLintEngine implements Engine {
+    readonly name = "eslint";
+    readonly languages: readonly Lang[];
+    available(): Promise<boolean>;
+    run(input: EngineRunInput): Promise<EngineRunResult>;
+}
+//# sourceMappingURL=eslint.d.ts.map

package/dist/engines/eslint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eslint.d.ts","sourceRoot":"","sources":["../../src/engines/eslint.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AA2JlC,qBAAa,YAAa,YAAW,MAAM;IACzC,QAAQ,CAAC,IAAI,YAAY;IACzB,QAAQ,CAAC,SAAS,kBAAa;IAEzB,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAK7B,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;CAwG3D"}