easyvibegate 0.4.4 → 0.6.2

package/dist/engine/util/code-lex.js

@@ -0,0 +1,260 @@
+/**
+ * A small per-language lexer for source code, chosen by file extension.
+ *
+ * Why this exists: the old masker scanned characters with no notion of which
+ * language it was reading. `//` inside a URL string became a line comment and
+ * erased the real code after it; a JS `#private` field or a Python `4 // 2`
+ * was taken for a comment; a quoted string was not atomic, so anything inside
+ * it could open a "comment" that swallowed the rest of the line. Every such
+ * corner was a silently missed finding — a clean PASS on dangerous code.
+ *
+ * Lexing once, per language, makes that family of bugs impossible by
+ * construction: a string is one token whatever it contains, a comment is one
+ * token, and the rules for what starts either come from the language, not
+ * from a guess. Same approach as sql-lex.ts, which SQL already relies on.
+ *
+ * Coverage is deliberately small: comments, strings, template literals and
+ * regex literals. Everything else is `word` or `punct`. The grammars are
+ * approximations for languages we only *mask* (Go/Java/Rust share the C-family
+ * rules; shell/YAML/TOML share `#` rules), documented in `langForFile`.
+ */
+import { lexSql } from './sql-lex.js';
+const NONE = { slash: false, hash: false, html: false, quotes: true, triple: false, template: false, regex: false, privateName: false };
+const JS = { ...NONE, slash: true, template: true, regex: true, privateName: true };
+const PROFILES = {
+    js: JS,
+    html: { ...JS, html: true },
+    python: { ...NONE, hash: true, triple: true },
+    hash: { ...NONE, hash: true },
+    markup: { ...NONE, html: true, quotes: false },
+    mixed: { ...NONE, slash: true, hash: true },
+    none: NONE,
+};
+const EXT_LANG = {
+    '.js': 'js', '.jsx': 'js', '.ts': 'js', '.tsx': 'js', '.mjs': 'js', '.cjs': 'js', '.mts': 'js', '.cts': 'js',
+    // C-family languages share the comment/string shapes we care about.
+    '.go': 'js', '.java': 'js', '.kt': 'js', '.kts': 'js', '.rs': 'js', '.cs': 'js', '.swift': 'js', '.dart': 'js',
+    '.scala': 'js', '.groovy': 'js', '.gradle': 'js', '.php': 'js', '.c': 'js', '.h': 'js', '.cc': 'js', '.cpp': 'js',
+    '.hpp': 'js', '.css': 'js', '.scss': 'js', '.less': 'js', '.jsonc': 'js', '.json5': 'js',
+    '.vue': 'html', '.svelte': 'html', '.astro': 'html', '.html': 'html', '.htm': 'html',
+    '.py': 'python', '.pyi': 'python', '.pyw': 'python',
+    '.rb': 'hash', '.sh': 'hash', '.bash': 'hash', '.zsh': 'hash', '.fish': 'hash', '.yml': 'hash', '.yaml': 'hash',
+    '.toml': 'hash', '.ini': 'hash', '.cfg': 'hash', '.conf': 'hash', '.env': 'hash', '.properties': 'hash',
+    '.pl': 'hash', '.pm': 'hash', '.r': 'hash', '.ex': 'hash', '.exs': 'hash', '.nix': 'hash', '.tfvars': 'hash',
+    '.sql': 'sql', '.psql': 'sql', '.pgsql': 'sql',
+    '.xml': 'markup', '.plist': 'markup', '.svg': 'markup',
+    // Prose keeps the legacy rules so `// easyvibegate-ignore` in a README still counts as a comment.
+    '.md': 'mixed', '.mdx': 'mixed', '.txt': 'mixed',
+    '.json': 'none', '.ipynb': 'none', '.csv': 'none', '.lock': 'none',
+    '.pem': 'none', '.key': 'none', '.crt': 'none', '.cert': 'none', '.pkcs8': 'none',
+};
+const HASH_NAMES = new Set(['Dockerfile', 'Makefile', 'Gemfile', 'Procfile', '.gitignore', '.dockerignore', '.npmrc', '.yarnrc']);
+/** Pick the lexing rules for a path. Unknown extensions get the legacy `mixed` rules. */
+export function langForFile(rel) {
+    const base = rel.slice(Math.max(rel.lastIndexOf('/'), rel.lastIndexOf('\\')) + 1);
+    if (base.startsWith('.env') || base.startsWith('docker-compose') || HASH_NAMES.has(base))
+        return 'hash';
+    const dot = base.lastIndexOf('.');
+    const ext = dot <= 0 ? '' : base.slice(dot).toLowerCase();
+    return EXT_LANG[ext] ?? 'mixed';
+}
+const isIdentStart = (c) => /[A-Za-z_$€-￿]/.test(c);
+const isIdentPart = (c) => /[A-Za-z0-9_$€-￿]/.test(c);
+const isSpace = (c) => c === ' ' || c === '\t' || c === '\n' || c === '\r' || c === '\f' || c === '\v';
+/** After these words a `/` starts a regex literal, not a division. */
+const REGEX_AFTER_WORD = new Set([
+    'return', 'typeof', 'instanceof', 'in', 'of', 'new', 'delete', 'void', 'throw', 'case', 'do', 'else', 'yield', 'await',
+]);
+/** Tokenize `src` with the rules of `lang`. Offsets are absolute into `src`. */
+export function lexCode(src, lang = 'mixed') {
+    if (lang === 'sql') {
+        // SQL already has a real lexer; only the token vocabulary differs.
+        return lexSql(src).map((t) => ({
+            type: t.type === 'comment' ? 'comment' : t.type === 'word' || t.type === 'punct' ? t.type : 'string',
+            value: src.slice(t.start, t.end),
+            start: t.start,
+            end: t.end,
+        }));
+    }
+    const out = [];
+    lexInto(src, 0, PROFILES[lang], out, false);
+    return out;
+}
+/**
+ * Lex from `from` to the end, or — inside a template `${…}` — up to the `}`
+ * that closes it, whose index is returned. Nested braces, strings, comments
+ * and templates inside the expression are all handled by the same loop.
+ */
+function lexInto(src, from, p, out, inTemplateExpr) {
+    const n = src.length;
+    const push = (type, start, end) => out.push({ type, value: src.slice(start, end), start, end });
+    let depth = 0;
+    let i = from;
+    while (i < n) {
+        const ch = src[i];
+        const next = src[i + 1];
+        if (isSpace(ch)) {
+            i++;
+            continue;
+        }
+        if (inTemplateExpr) {
+            if (ch === '{')
+                depth++;
+            else if (ch === '}') {
+                if (depth === 0)
+                    return i;
+                depth--;
+            }
+        }
+        if (p.slash && ch === '/' && next === '/') {
+            let j = i;
+            while (j < n && src[j] !== '\n')
+                j++;
+            push('comment', i, j);
+            i = j;
+            continue;
+        }
+        if (p.slash && ch === '/' && next === '*') {
+            const c = src.indexOf('*/', i + 2);
+            const end = c === -1 ? n : c + 2;
+            push('comment', i, end);
+            i = end;
+            continue;
+        }
+        if (p.hash && ch === '#' && src[i - 1] !== '$') {
+            let j = i;
+            while (j < n && src[j] !== '\n')
+                j++;
+            push('comment', i, j);
+            i = j;
+            continue;
+        }
+        if (p.html && ch === '<' && src.startsWith('<!--', i)) {
+            const c = src.indexOf('-->', i + 4);
+            const end = c === -1 ? n : c + 3;
+            push('comment', i, end);
+            i = end;
+            continue;
+        }
+        if (p.quotes && (ch === '"' || ch === "'")) {
+            if (p.triple && next === ch && src[i + 2] === ch) {
+                // '''…''' spans lines; a backslash still escapes the next character.
+                const q = ch + ch + ch;
+                let j = i + 3;
+                while (j < n && !src.startsWith(q, j))
+                    j += src[j] === '\\' ? 2 : 1;
+                const end = Math.min(j + 3, n);
+                push('string', i, end);
+                i = end;
+                continue;
+            }
+            // One-line string. An unterminated one ends at the newline so damage from
+            // a stray quote (JSX text, prose) never spreads past its own line.
+            let j = i + 1;
+            while (j < n && src[j] !== ch && src[j] !== '\n')
+                j += src[j] === '\\' ? 2 : 1;
+            const end = Math.min(src[j] === ch ? j + 1 : j, n);
+            push('string', i, end);
+            i = end;
+            continue;
+        }
+        if (p.template && ch === '`') {
+            let chunk = i;
+            let j = i + 1;
+            while (j < n) {
+                const c = src[j];
+                if (c === '\\') {
+                    j += 2;
+                    continue;
+                }
+                if (c === '`') {
+                    j++;
+                    break;
+                }
+                if (c === '$' && src[j + 1] === '{') {
+                    push('template', chunk, j + 2);
+                    // The expression is code again: lex it in place, resume after its `}`.
+                    const close = lexInto(src, j + 2, p, out, true);
+                    chunk = close;
+                    j = close + 1;
+                    continue;
+                }
+                j++;
+            }
+            const end = Math.min(j, n);
+            if (end > chunk)
+                push('template', chunk, end);
+            i = end;
+            continue;
+        }
+        if (p.regex && ch === '/' && regexAllowed(out)) {
+            const end = scanRegex(src, i);
+            if (end !== -1) {
+                push('regex', i, end);
+                i = end;
+                continue;
+            }
+        }
+        if (isIdentStart(ch) || (p.privateName && ch === '#' && next !== undefined && isIdentStart(next))) {
+            let j = i + 1;
+            while (j < n && isIdentPart(src[j]))
+                j++;
+            push('word', i, j);
+            i = j;
+            continue;
+        }
+        if (ch >= '0' && ch <= '9') {
+            let j = i + 1;
+            while (j < n && /[A-Za-z0-9_.]/.test(src[j]))
+                j++;
+            push('word', i, j);
+            i = j;
+            continue;
+        }
+        push('punct', i, i + 1);
+        i++;
+    }
+    return n;
+}
+/** A `/` after a value (identifier, number, `)`, `]`, `}`) divides; elsewhere it opens a regex. */
+function regexAllowed(out) {
+    let k = out.length - 1;
+    while (k >= 0 && out[k]?.type === 'comment')
+        k--;
+    const prev = out[k];
+    if (!prev)
+        return true;
+    if (prev.type === 'punct')
+        return !')]}'.includes(prev.value);
+    if (prev.type === 'word')
+        return REGEX_AFTER_WORD.has(prev.value);
+    return false;
+}
+/** End offset of a regex literal starting at `i`, or -1 if the line ends first (so it was a division). */
+function scanRegex(src, i) {
+    let j = i + 1;
+    let inClass = false;
+    while (j < src.length) {
+        const c = src[j];
+        if (c === '\n')
+            return -1;
+        if (c === '\\') {
+            j += 2;
+            continue;
+        }
+        if (inClass) {
+            if (c === ']')
+                inClass = false;
+        }
+        else if (c === '[')
+            inClass = true;
+        else if (c === '/') {
+            j++;
+            while (j < src.length && /[a-z]/i.test(src[j]))
+                j++;
+            return j;
+        }
+        j++;
+    }
+    return -1;
+}

package/dist/engine/util/git-exposure.js

@@ -0,0 +1,33 @@
+import { execFileSync } from 'node:child_process';
+function git(root, args) {
+    try {
+        return execFileSync('git', ['-C', root, ...args], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 });
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Build a per-root resolver. Tracked files are listed once; ignore checks run
+ * lazily and are cached, so a project with many findings still costs a few
+ * git calls, not one per finding.
+ */
+export function createExposure(root) {
+    const isRepo = git(root, ['rev-parse', '--git-dir']) !== null;
+    if (!isRepo)
+        return () => 'no-git';
+    const tracked = new Set((git(root, ['ls-files', '-z']) ?? '').split('\0').filter(Boolean));
+    const cache = new Map();
+    return (rel) => {
+        const hit = cache.get(rel);
+        if (hit)
+            return hit;
+        let ex;
+        if (tracked.has(rel))
+            ex = 'committed';
+        else
+            ex = git(root, ['check-ignore', '-q', '--', rel]) !== null ? 'ignored' : 'untracked';
+        cache.set(rel, ex);
+        return ex;
+    };
+}

package/dist/engine/util/mask.js

@@ -2,8 +2,21 @@
  * Blank out comments (and, optionally, quoted strings) while preserving length
  * and newlines, so match offsets and line numbers stay correct. Used so that a
  * comment like `// never use eval()` is not reported as a finding.
+ *
+ * What counts as a comment or a string depends on the language, so pass the
+ * file name (or a `lang`) — see code-lex.ts. Without either, the legacy
+ * `mixed` rules apply: both `//` and `#` comments, strings atomic.
  */
+import { lexCode, langForFile } from './code-lex.js';
 export function maskCode(src, opts = {}) {
+    const lang = opts.lang ?? (opts.file ? langForFile(opts.file) : 'mixed');
+    return maskTokens(src, lexCode(src, lang), opts);
+}
+/**
+ * Same as maskCode but over tokens lexed once — a checker that needs both the
+ * "no comments" and the "no strings" view of a file pays for lexing only once.
+ */
+export function maskTokens(src, tokens, opts = {}) {
     const out = src.split('');
     const n = src.length;
     const blank = (from, to) => {
@@ -11,54 +24,29 @@ export function maskCode(src, opts = {}) {
             if (out[k] !== '\n')
                 out[k] = ' ';
     };
-    let i = 0;
-    while (i < n) {
-        const ch = src[i];
-        const next = src[i + 1];
-        if (ch === '/' && next === '/') {
-            let j = i;
-            while (j < n && src[j] !== '\n')
-                j++;
-            blank(i, j);
-            i = j;
-            continue;
-        }
-        if (ch === '#' && src[i - 1] !== '$') {
-            let j = i;
-            while (j < n && src[j] !== '\n')
-                j++;
-            blank(i, j);
-            i = j;
-            continue;
-        }
-        if (ch === '/' && next === '*') {
-            const c = src.indexOf('*/', i + 2);
-            const end = c === -1 ? n : c + 2;
-            blank(i, end);
-            i = end;
-            continue;
-        }
-        if (opts.strings && (ch === '"' || ch === "'")) {
-            let j = i + 1;
-            while (j < n && src[j] !== ch) {
-                if (src[j] === '\\')
-                    j++;
-                if (src[j] === '\n')
-                    break;
-                j++;
-            }
-            const end = Math.min(j + 1, n);
-            blank(i, end);
-            i = end;
-            continue;
-        }
-        i++;
+    for (const t of tokens) {
+        if (t.type === 'comment')
+            blank(t.start, t.end);
+        else if (opts.strings && (t.type === 'string' || t.type === 'template' || t.type === 'regex'))
+            blank(t.start, t.end);
     }
     return out.join('');
 }
-/** Minified/bundled output is not source a human wrote — reviewing it is noise. */
+/**
+ * Paths that hold generated output, not source a human wrote: `.min.js`,
+ * `dist/`, `build/`, `vendor/`, `bundle/`. A checker that skips these must
+ * say so (CheckerResult.partial) — skipped is not clean.
+ */
+export function looksBundledPath(rel) {
+    return /\.min\.(js|css|mjs|cjs)$/i.test(rel) || /(^|\/)(dist|build|vendor|bundle)\//.test(rel);
+}
+/**
+ * Minified/bundled output is not source a human wrote — reviewing it is noise.
+ * The long-line heuristic is only a guess: one long data line in a real source
+ * file also trips it, so callers must never use it to skip a file silently.
+ */
 export function looksMinified(rel, content) {
-    if (/\.min\.(js|css|mjs|cjs)$/i.test(rel) || /(^|\/)(dist|build|vendor|bundle)\//.test(rel))
+    if (looksBundledPath(rel))
         return true;
     const lines = content.split('\n');
     const longest = lines.reduce((m, l) => Math.max(m, l.length), 0);

package/dist/engine/util/sql-lex.js

@@ -0,0 +1,172 @@
+/**
+ * A small SQL lexer.
+ *
+ * Why this exists: the RLS checker used to look for statements with regexes run
+ * over a "masked" copy of the file, where comments and strings had been blanked
+ * out by a second, separate scanner. Every syntax corner that the masker got
+ * wrong became a silently missed (or invented) statement — `E'it\'s'`, nested
+ * block comments, `$tag$` bodies, a column alias in double quotes that happens
+ * to contain SQL keywords. Approximating a real grammar with regexes has no end.
+ *
+ * Lexing once, here, makes that whole family of bugs impossible by construction:
+ * a string is a token, a comment is a token, a quoted identifier is a token, and
+ * none of them can ever be read as executable keywords.
+ */
+const isIdentStart = (c) => /[A-Za-z_€-￿]/.test(c);
+const isIdentPart = (c) => /[A-Za-z0-9_$€-￿]/.test(c);
+/** Read a `$tag$` opener at `i`, or null if this `$` is not a dollar-quote. */
+function dollarTagAt(sql, i) {
+    if (sql[i] !== '$')
+        return null;
+    let j = i + 1;
+    while (j < sql.length && sql[j] !== '$') {
+        const c = sql[j];
+        // A tag is an identifier; `$1` (a bind parameter) is not a dollar-quote.
+        if (!(j === i + 1 ? isIdentStart(c) : isIdentPart(c)))
+            return null;
+        j++;
+    }
+    return j < sql.length ? sql.slice(i, j + 1) : null;
+}
+/** Tokenize `sql`. Offsets are absolute; add `offset` when lexing a fragment. */
+export function lexSql(sql, offset = 0) {
+    const out = [];
+    const n = sql.length;
+    let i = 0;
+    while (i < n) {
+        const ch = sql[i];
+        if (/\s/.test(ch)) {
+            i++;
+            continue;
+        }
+        // -- line comment
+        if (ch === '-' && sql[i + 1] === '-') {
+            let j = i;
+            while (j < n && sql[j] !== '\n')
+                j++;
+            out.push({ type: 'comment', value: sql.slice(i, j), start: offset + i, end: offset + j });
+            i = j;
+            continue;
+        }
+        // /* block comment */ — PostgreSQL nests these.
+        if (ch === '/' && sql[i + 1] === '*') {
+            let depth = 0;
+            let j = i;
+            while (j < n) {
+                if (sql[j] === '/' && sql[j + 1] === '*') {
+                    depth++;
+                    j += 2;
+                    continue;
+                }
+                if (sql[j] === '*' && sql[j + 1] === '/') {
+                    depth--;
+                    j += 2;
+                    if (depth === 0)
+                        break;
+                    continue;
+                }
+                j++;
+            }
+            const end = depth === 0 ? j : n;
+            out.push({ type: 'comment', value: sql.slice(i, end), start: offset + i, end: offset + end });
+            i = end;
+            continue;
+        }
+        // '...' string. Doubling ('') always escapes; a backslash escapes only in an
+        // E'' string, where PostgreSQL enables C-style escapes.
+        if (ch === "'") {
+            const prev = out[out.length - 1];
+            const eString = !!prev && prev.type === 'word' && /^e$/i.test(prev.value) && prev.end === offset + i;
+            let j = i + 1;
+            while (j < n) {
+                if (eString && sql[j] === '\\') {
+                    j += 2;
+                    continue;
+                }
+                if (sql[j] === "'") {
+                    if (sql[j + 1] === "'") {
+                        j += 2;
+                        continue;
+                    }
+                    break;
+                }
+                j++;
+            }
+            const end = Math.min(j + 1, n);
+            out.push({
+                type: 'string',
+                value: sql.slice(i + 1, Math.max(i + 1, j)),
+                start: offset + i,
+                end: offset + end,
+                bodyStart: offset + i + 1,
+            });
+            i = end;
+            continue;
+        }
+        // "..." quoted identifier. Its contents are a NAME, never statements.
+        if (ch === '"') {
+            let j = i + 1;
+            while (j < n) {
+                if (sql[j] === '"') {
+                    if (sql[j + 1] === '"') {
+                        j += 2;
+                        continue;
+                    }
+                    break;
+                }
+                j++;
+            }
+            const end = Math.min(j + 1, n);
+            out.push({
+                type: 'quotedIdent',
+                value: sql.slice(i + 1, Math.max(i + 1, j)).replace(/""/g, '"'),
+                start: offset + i,
+                end: offset + end,
+            });
+            i = end;
+            continue;
+        }
+        // $tag$ ... $tag$
+        const tag = dollarTagAt(sql, i);
+        if (tag) {
+            const bodyStart = i + tag.length;
+            const close = sql.indexOf(tag, bodyStart);
+            const bodyEnd = close === -1 ? n : close;
+            const end = close === -1 ? n : close + tag.length;
+            out.push({
+                type: 'dollarString',
+                value: sql.slice(bodyStart, bodyEnd),
+                start: offset + i,
+                end: offset + end,
+                bodyStart: offset + bodyStart,
+            });
+            i = end;
+            continue;
+        }
+        // word / unquoted identifier
+        if (isIdentStart(ch)) {
+            let j = i + 1;
+            while (j < n && isIdentPart(sql[j]))
+                j++;
+            out.push({ type: 'word', value: sql.slice(i, j), start: offset + i, end: offset + j });
+            i = j;
+            continue;
+        }
+        // number — lexed as a word so it can never be mistaken for a keyword
+        if (/[0-9]/.test(ch)) {
+            let j = i + 1;
+            while (j < n && /[0-9.]/.test(sql[j]))
+                j++;
+            out.push({ type: 'word', value: sql.slice(i, j), start: offset + i, end: offset + j });
+            i = j;
+            continue;
+        }
+        out.push({ type: 'punct', value: ch, start: offset + i, end: offset + i + 1 });
+        i++;
+    }
+    return out;
+}
+/** Tokens that carry executable SQL: comments and literals are dropped. */
+export function codeTokens(tokens) {
+    return tokens.filter((t) => t.type !== 'comment');
+}

package/dist/engine/util/text.js

@@ -48,3 +48,15 @@ export function decodeJwtPayload(token) {
         return null;
     }
 }
+/**
+ * A DNS label, bounded to its real maximum (RFC 1035, 63 octets) — never `+`.
+ * Used right before a literal host suffix (`.firebaseapp.com`, `.supabase.co`)
+ * in a regex run against raw, unbounded file content. An open `[a-z0-9-]+` in
+ * that position is a classic quadratic-time regex: at every position inside a
+ * long run of matching characters (a minified bundle, a base64 blob, a lockfile
+ * hash) the engine greedily consumes to the end and backtracks one character at
+ * a time looking for a literal that never comes. Measured: a 500KB matching run
+ * took over two minutes unbounded; bounded, the same file scans in single-digit
+ * milliseconds — and no real hostname label is longer than this anyway.
+ */
+export const DNS_LABEL = '[a-z0-9-]{1,63}';

package/dist/engine/walk.js

@@ -1,10 +1,32 @@
 import { readdirSync, statSync, readFileSync } from 'node:fs';
-import { join, relative, extname, sep } from 'node:path';
+import { join, relative, extname, sep, resolve } from 'node:path';
 const SKIP_DIRS = new Set([
     '.git', 'node_modules', '.next', 'dist', 'build', 'out', '.venv', 'venv',
     '__pycache__', 'coverage', '.turbo', '.cache', 'vendor', '.svelte-kit',
     '.nuxt', '.output', 'target', '.idea', '.vscode', 'easyvibegate-report',
+    // Installed third-party code, not the user's own. Matching only the venv
+    // folder names above misses a venv called anything else (tools/ytenv/...),
+    // and then every key inside a vendored library is reported as the user's leak.
+    'site-packages', '__pypackages__', 'bower_components', 'Pods',
+    // Yarn Berry vendors its own release script and zips dependencies here —
+    // tool-managed, not the user's code (and often full of high-entropy blobs
+    // that would otherwise read as secrets).
+    '.yarn',
 ]);
+/**
+ * Names ambiguous enough that they are sometimes real source (a module named
+ * "cache", a package called "tmp") and sometimes pure data. Skipped only when
+ * `relDir` (the ambiguous directory's own path, relative to the project root,
+ * e.g. "cache" or "data/cache") has at most 2 path segments — i.e. the
+ * directory IS the root's own child, or is nested exactly one level below it.
+ * The real-world evidence for this was `data/cache/*.json` full of API
+ * pagination tokens, 559 of 569 "generic secrets" in one real project. Deeper
+ * nesting (`apps/api/src/lib/cache/`, 4 segments) is ordinary source and stays
+ * scanned; blanket name-matching at any depth once made a source directory
+ * invisible to every check with no visible coverage gap.
+ */
+const AMBIGUOUS_DATA_DIRS = new Set(['cache', 'caches', 'tmp', 'temp', '.tmp']);
+const isShallowDataDir = (name, relDir) => AMBIGUOUS_DATA_DIRS.has(name) && relDir.split('/').length <= 2;
 const TEXT_EXT = new Set([
     '.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.vue', '.svelte',
     '.py', '.rb', '.php', '.go', '.rs', '.java', '.kt', '.cs',
@@ -27,11 +49,13 @@ function isScannable(name) {
         return true;
     return TEXT_EXT.has(extname(name).toLowerCase());
 }
-/** Recursively collect scannable text files under `root`, skipping noise. */
-export function walk(root) {
+export function walk(root, opts = {}) {
+    const excluded = new Set((opts.excludeAbs ?? []).map((d) => resolve(d)));
     const out = [];
     let skippedOversized = 0;
     let skippedUnreadable = 0;
+    let skippedDirs = 0;
+    let skippedSymlinks = 0;
     const stack = [root];
     while (stack.length > 0) {
         const dir = stack.pop();
@@ -40,14 +64,35 @@ export function walk(root) {
             entries = readdirSync(dir, { withFileTypes: true });
         }
         catch {
+            // A directory we cannot list is an unchecked subtree, not an empty one.
+            // Swallowing this silently let a project with an unreadable folder report
+            // full coverage and a clean PASS.
+            skippedDirs++;
             continue;
         }
         for (const ent of entries) {
-            if (ent.isSymbolicLink())
-                continue;
             const full = join(dir, ent.name);
+            if (ent.isSymbolicLink()) {
+                // Never followed: a link can loop or escape the project root. But a
+                // link to a directory or a scannable file is unchecked content, and
+                // silently dropping it let a project whose `migrations` was a symlink
+                // PASS with full coverage. Count it so the walk is reported partial.
+                const relLink = relative(root, full).split(sep).join('/');
+                if (SKIP_DIRS.has(ent.name) || isShallowDataDir(ent.name, relLink))
+                    continue;
+                try {
+                    const target = statSync(full); // follows the link
+                    if (target.isDirectory() || (target.isFile() && isScannable(ent.name)))
+                        skippedSymlinks++;
+                }
+                catch {
+                    /* dangling link — nothing behind it to scan */
+                }
+                continue;
+            }
             if (ent.isDirectory()) {
-                if (!SKIP_DIRS.has(ent.name))
+                const relDir = relative(root, full).split(sep).join('/');
+                if (!SKIP_DIRS.has(ent.name) && !isShallowDataDir(ent.name, relDir) && !excluded.has(resolve(full)))
                     stack.push(full);
                 continue;
             }
@@ -82,5 +127,5 @@ export function walk(root) {
             });
         }
     }
-    return { files: out, skippedOversized, skippedUnreadable };
+    return { files: out, skippedOversized, skippedUnreadable, skippedDirs, skippedSymlinks };
 }