fchek 1.0.0

package/lib/dom.js

@@ -0,0 +1,226 @@
+'use strict';
+
+const fs = require('fs');
+const http = require('http');
+const https = require('https');
+const { URL } = require('url');
+const { output, ok, fail } = require('./output');
+
+const HELP = `
+fchek dom <url_or_file> <selector> [--attr=<attr>]
+
+Query DOM elements from local HTML files or remote websites.
+Supports basic selectors like tag names (e.g., div, a), classes (e.g., .btn), and IDs (e.g., #header).
+Use --attr to extract a specific attribute value instead of inner text/HTML.
+`.trim();
+
+// Lightweight HTML Parser
+function parseHTML(html) {
+  const nodes = [];
+  const tagRegex = /<(\/?)([a-zA-Z0-9\-]+)([^>]*)>/g;
+  let match;
+  let lastIndex = 0;
+  const stack = [];
+
+  const root = { tag: 'root', attrs: {}, children: [], text: '', html: html };
+  let current = root;
+
+  function parseAttributes(attrStr) {
+    const attrs = {};
+    const attrRegex = /([a-zA-Z0-9\-]+)(?:=(?:"([^"]*)"|'([^']*)'|([^\s>]+)))?/g;
+    let attrMatch;
+    while ((attrMatch = attrRegex.exec(attrStr)) !== null) {
+      const name = attrMatch[1];
+      const val = attrMatch[2] || attrMatch[3] || attrMatch[4] || '';
+      attrs[name] = val;
+    }
+    return attrs;
+  }
+
+  while ((match = tagRegex.exec(html)) !== null) {
+    const [fullTag, isClosing, tagName, attrStr] = match;
+    const startIndex = match.index;
+
+    // Save text node before this tag
+    const textVal = html.substring(lastIndex, startIndex).trim();
+    if (textVal && current) {
+      current.children.push({
+        tag: 'text',
+        text: textVal,
+        html: textVal,
+        attrs: {},
+        children: []
+      });
+    }
+
+    if (isClosing) {
+      // Find matching tag in stack
+      if (stack.length > 0) {
+        const popped = stack.pop();
+        if (popped.tag === tagName.toLowerCase()) {
+          popped.html = html.substring(popped.startIndex, startIndex + fullTag.length);
+          // Recalculate text for this node
+          popped.text = popped.children.map(c => c.text || '').join(' ').trim();
+          current = stack[stack.length - 1] || root;
+        } else {
+          // Mismatch, push back
+          stack.push(popped);
+        }
+      }
+    } else {
+      // Self-closing tags check
+      const isSelfClosing = attrStr.endsWith('/') || ['img', 'br', 'hr', 'input', 'meta', 'link'].includes(tagName.toLowerCase());
+      const node = {
+        tag: tagName.toLowerCase(),
+        attrs: parseAttributes(attrStr),
+        children: [],
+        text: '',
+        html: '',
+        startIndex
+      };
+
+      current.children.push(node);
+
+      if (!isSelfClosing) {
+        stack.push(node);
+        current = node;
+      } else {
+        node.html = fullTag;
+      }
+    }
+
+    lastIndex = tagRegex.lastIndex;
+  }
+
+  const remainingText = html.substring(lastIndex).trim();
+  if (remainingText) {
+    root.children.push({
+      tag: 'text',
+      text: remainingText,
+      html: remainingText,
+      attrs: {},
+      children: []
+    });
+  }
+
+  return root.children;
+}
+
+function findNodes(nodes, selector) {
+  const matches = [];
+  const target = selector.toLowerCase().trim();
+
+  function traverse(node) {
+    let isMatch = false;
+
+    if (target.startsWith('.')) {
+      const cls = target.slice(1);
+      if (node.attrs.class && node.attrs.class.toLowerCase().split(/\s+/).includes(cls)) {
+        isMatch = true;
+      }
+    } else if (target.startsWith('#')) {
+      const id = target.slice(1);
+      if (node.attrs.id && node.attrs.id.toLowerCase() === id) {
+        isMatch = true;
+      }
+    } else {
+      if (node.tag === target) {
+        isMatch = true;
+      }
+    }
+
+    if (isMatch) {
+      matches.push(node);
+    }
+
+    for (const child of node.children) {
+      traverse(child);
+    }
+  }
+
+  for (const node of nodes) {
+    traverse(node);
+  }
+
+  return matches;
+}
+
+function fetchUrl(urlStr) {
+  return new Promise((resolve, reject) => {
+    const parsed = new URL(urlStr);
+    const protocol = parsed.protocol === 'https:' ? https : http;
+    protocol.get(urlStr, { timeout: 10000 }, (res) => {
+      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+        // Handle redirect
+        resolve(fetchUrl(new URL(res.headers.location, urlStr).toString()));
+        return;
+      }
+      if (res.statusCode !== 200) {
+        reject(new Error(`Server returned status code ${res.statusCode}`));
+        return;
+      }
+      let data = '';
+      res.setEncoding('utf8');
+      res.on('data', chunk => data += chunk);
+      res.on('end', () => resolve(data));
+    }).on('error', reject);
+  });
+}
+
+async function run(args) {
+  if (args.includes('--help') || args.includes('-h')) {
+    console.log(HELP);
+    return;
+  }
+
+  const source = args.find(a => !a.startsWith('-'));
+  const selector = args.find(a => a !== source && !a.startsWith('-'));
+
+  if (!source || !selector) {
+    output(fail('Please specify both an HTML source (file/URL) and a selector', 'dom'));
+    return;
+  }
+
+  let attrName = null;
+  for (const arg of args) {
+    if (arg.startsWith('--attr=')) {
+      attrName = arg.split('=')[1];
+    }
+  }
+
+  try {
+    let html = '';
+    if (source.startsWith('http://') || source.startsWith('https://')) {
+      html = await fetchUrl(source);
+    } else {
+      if (!fs.existsSync(source)) {
+        output(fail(`HTML file does not exist: ${source}`, 'dom'));
+        return;
+      }
+      html = fs.readFileSync(source, 'utf8');
+    }
+
+    const parsedTree = parseHTML(html);
+    const nodes = findNodes(parsedTree, selector);
+
+    const formattedMatches = nodes.map(n => {
+      const res = {
+        tag: n.tag,
+        attributes: n.attrs,
+      };
+      if (attrName) {
+        res.attribute_value = n.attrs[attrName] || null;
+      } else {
+        res.text = n.text;
+        res.html = n.html;
+      }
+      return res;
+    });
+
+    output(ok({ source, selector, count: formattedMatches.length, matches: formattedMatches }, 'dom'));
+  } catch (err) {
+    output(fail(`DOM query failed: ${err.message}`, 'dom'));
+  }
+}
+
+module.exports = { run };

package/lib/fuzz.js

@@ -0,0 +1,470 @@
+'use strict';
+
+/**
+ * fuzz.js — fuzzing on minimal setup
+ *
+ * C/C++  → AFL++ (afl-fuzz)  — Linux/macOS
+ * Rust   → cargo-fuzz (libFuzzer)
+ * Python → Atheris (Google's libFuzzer-based Python fuzzer)
+ * Go     → go-fuzz or native go test -fuzz
+ *
+ * Fuzzing finds inputs that crash/hang/trigger unexpected behavior.
+ * Run for a limited time (default: 60s) and report findings.
+ */
+
+const { spawnSync, spawn, execSync } = require('child_process');
+const path   = require('path');
+const fs     = require('fs');
+const os     = require('os');
+const { output, ok, fail } = require('./output');
+
+const HELP = `
+fchek fuzz <file> [--duration=60] [--target=<fuzz_target>] [--corpus=<dir>]
+
+Run a fuzzer on your code and report crashes / interesting inputs found.
+Finds edge cases you'd never write by hand.
+
+Supported:
+  .c / .cpp    → AFL++  (apt install afl++)
+  .rs / Cargo  → cargo-fuzz  (cargo install cargo-fuzz)
+  .py          → Atheris  (pip install atheris)
+  .go          → native go test -fuzz  (Go 1.18+)
+
+Options:
+  --duration=60      Run fuzzer for N seconds (default: 60)
+  --target=<name>    Fuzzing target name (Rust/Go: fuzz target function)
+  --corpus=<dir>     Seed corpus directory (initial inputs)
+  --no-compile       Skip compilation step (use existing binary)
+
+Examples:
+  fchek fuzz parse_input.c --duration=120
+  fchek fuzz . --target=fuzz_parse --duration=60       (Rust)
+  fchek fuzz fuzz_target.py --duration=30               (Python)
+  fchek fuzz . --target=FuzzParseInput --duration=60    (Go)
+
+IMPORTANT: Fuzzing is CPU-intensive. Start with --duration=30 to test setup.
+`.trim();
+
+const DEFAULT_DURATION = 60;
+
+function commandExists(cmd) {
+  try {
+    execSync(process.platform === 'win32' ? `where ${cmd}` : `which ${cmd}`, { stdio: 'ignore' });
+    return true;
+  } catch { return false; }
+}
+
+// ─── C/C++ via AFL++ ─────────────────────────────────────────────────────────
+
+function fuzzC(file, duration, corpus, timeoutMs) {
+  if (process.platform === 'win32') {
+    return output(fail('AFL++ is not supported on Windows. Use WSL.'));
+  }
+
+  const aflCompiler = commandExists('afl-clang-fast++') ? 'afl-clang-fast++'
+    : commandExists('afl-g++-fast')                     ? 'afl-g++-fast'
+    : commandExists('afl-clang++')                      ? 'afl-clang++'
+    : null;
+
+  if (!aflCompiler) {
+    return output(fail(
+      'AFL++ compiler not found.\n' +
+      'Install: apt install afl++  OR  brew install afl++'
+    ));
+  }
+
+  const ext    = path.extname(file).toLowerCase();
+  const outBin = path.join(os.tmpdir(), `fchek_fuzz_${path.basename(file, ext)}`);
+
+  // Compile with AFL++ instrumentation
+  const compile = spawnSync(
+    aflCompiler,
+    ['-o', outBin, '-fsanitize=address', file],
+    { encoding: 'utf8', env: { ...process.env, AFL_USE_ASAN: '1' } }
+  );
+
+  if (compile.status !== 0) {
+    return output(fail(`AFL++ compilation failed:\n${compile.stderr}`));
+  }
+
+  // Setup corpus
+  const corpusDir = corpus || path.join(os.tmpdir(), 'fchek_corpus');
+  const outputDir = path.join(os.tmpdir(), 'fchek_findings');
+  fs.mkdirSync(corpusDir,  { recursive: true });
+  fs.mkdirSync(outputDir,  { recursive: true });
+
+  // Seed: create a minimal input if corpus is empty
+  if (fs.readdirSync(corpusDir).length === 0) {
+    fs.writeFileSync(path.join(corpusDir, 'seed0'), 'hello\n');
+    fs.writeFileSync(path.join(corpusDir, 'seed1'), '0\n');
+    fs.writeFileSync(path.join(corpusDir, 'seed2'), '\x00\xff\xfe');
+  }
+
+  // Run AFL++ with time limit
+  const aflRes = spawnSync(
+    'afl-fuzz',
+    ['-i', corpusDir, '-o', outputDir, '-V', String(duration), '--', outBin, '@@'],
+    {
+      encoding: 'utf8',
+      timeout: (duration + 30) * 1000, // buffer of 30s for startup
+      env: {
+        ...process.env,
+        AFL_NO_UI: '1',      // no terminal UI, just text
+        AFL_SKIP_CPUFREQ: '1',
+      },
+    }
+  );
+
+  // Parse AFL++ results
+  const crashes  = countAflFindings(path.join(outputDir, 'default', 'crashes'));
+  const hangs    = countAflFindings(path.join(outputDir, 'default', 'hangs'));
+  const queueLen = countAflFindings(path.join(outputDir, 'default', 'queue'));
+
+  try { fs.unlinkSync(outBin); } catch {}
+
+  output(ok({
+    file: path.resolve(file),
+    lang: 'c',
+    tool: 'AFL++',
+    duration_s: duration,
+    crashes_found:   crashes,
+    hangs_found:     hangs,
+    queue_entries:   queueLen,
+    verdict:         crashes > 0 ? 'crashes_found' : hangs > 0 ? 'hangs_found' : 'clean',
+    findings_dir:    outputDir,
+    afl_output:      (aflRes.stderr || '').slice(0, 2000),
+  }));
+}
+
+function countAflFindings(dir) {
+  try {
+    const files = fs.readdirSync(dir).filter(f => !f.startsWith('README'));
+    return files.length;
+  } catch { return 0; }
+}
+
+// ─── Rust via cargo-fuzz ─────────────────────────────────────────────────────
+
+function fuzzRust(target, duration, fuzzTarget, timeoutMs) {
+  if (!commandExists('cargo')) {
+    return output(fail('cargo not found. Install Rust: https://rustup.rs'));
+  }
+
+  const cwd = path.resolve(target === '.' ? process.cwd() : target);
+
+  // Check if cargo-fuzz is installed
+  const versionRes = spawnSync('cargo', ['fuzz', '--version'], { encoding: 'utf8', timeout: 5000 });
+  if (versionRes.status !== 0) {
+    return output(fail(
+      'cargo-fuzz not found.\n' +
+      'Install: cargo install cargo-fuzz\n' +
+      'Note: requires nightly Rust: rustup default nightly'
+    ));
+  }
+
+  // List available fuzz targets if none specified
+  if (!fuzzTarget) {
+    const listRes = spawnSync('cargo', ['fuzz', 'list'], { encoding: 'utf8', cwd, timeout: 10_000 });
+    const targets = (listRes.stdout || '').trim().split('\n').filter(Boolean);
+
+    if (targets.length === 0) {
+      return output(fail(
+        'No fuzz targets found. Create one:\n' +
+        '  cargo fuzz add fuzz_target_1\n' +
+        'Then add your fuzzing logic in fuzz/fuzz_targets/fuzz_target_1.rs'
+      ));
+    }
+
+    if (targets.length === 1) {
+      fuzzTarget = targets[0];
+    } else {
+      // Use first target but report all available
+      return output(fail(
+        `Multiple fuzz targets found. Specify one with --target=<name>.\n` +
+        `Available: ${targets.join(', ')}`
+      ));
+    }
+  }
+
+  // Run fuzzing for duration seconds
+  const runRes = spawnSync(
+    'cargo',
+    ['fuzz', 'run', fuzzTarget, '--', `-max_total_time=${duration}`],
+    {
+      encoding: 'utf8',
+      cwd,
+      timeout: (duration + 60) * 1000,
+      env: { ...process.env, RUSTFLAGS: '-C opt-level=0' },
+    }
+  );
+
+  const raw = (runRes.stdout || '') + (runRes.stderr || '');
+
+  // Parse libFuzzer output
+  const crashMatch  = raw.match(/SUMMARY: AddressSanitizer: (.+)/);
+  const execsMatch  = raw.match(/exec\/s:\s+(\d+)/);
+  const covMatch    = raw.match(/cov:\s+(\d+)/);
+
+  const crashed = crashMatch !== null || raw.includes('CRASHED') || raw.includes('AddressSanitizer');
+
+  output(ok({
+    target: cwd,
+    lang:   'rust',
+    tool:   'cargo-fuzz (libFuzzer)',
+    fuzz_target:  fuzzTarget,
+    duration_s:   duration,
+    crashed:      crashed,
+    crash_reason: crashMatch?.[1] ?? null,
+    execs_per_sec: execsMatch ? parseInt(execsMatch[1]) : null,
+    coverage_points: covMatch ? parseInt(covMatch[1]) : null,
+    verdict:    crashed ? 'crash_found' : 'clean',
+    raw_output: raw.slice(-2000), // last 2000 chars most relevant
+  }));
+}
+
+// ─── Python via Atheris ───────────────────────────────────────────────────────
+
+function fuzzPython(file, duration, timeoutMs) {
+  const py = ['python3', 'python'].find(p => {
+    const r = spawnSync(p, ['--version'], { stdio: 'ignore', timeout: 3000 });
+    return r && r.status === 0;
+  });
+  if (!py) return output(fail('Python not found. Install: https://python.org'));
+
+  // Check atheris
+  const atherisCheck = spawnSync(py, ['-c', 'import atheris'], { encoding: 'utf8', timeout: 5000 });
+  if (atherisCheck.status !== 0) {
+    return output(fail(
+      'atheris not found. Install: pip install atheris\n' +
+      'Note: atheris uses libFuzzer — requires Linux or macOS with clang.'
+    ));
+  }
+
+  // Wrap the target file in an atheris harness if it doesn't have one
+  const content = fs.readFileSync(file, 'utf8');
+  const hasAtheris = content.includes('atheris') || content.includes('FuzzedDataProvider');
+
+  let runFile = file;
+  let autoHarnessWarning = null;
+
+  if (!hasAtheris) {
+    // Try to find entry points in the module
+    const content = fs.readFileSync(file, 'utf8');
+    const hasParse   = /\bdef\s+parse\s*\(/.test(content);
+    const hasProcess = /\bdef\s+process\s*\(/.test(content);
+    const hasDecode  = /\bdef\s+decode\s*\(/.test(content);
+    const hasLoad    = /\bdef\s+load\s*\(/.test(content);
+
+    if (!hasParse && !hasProcess && !hasDecode && !hasLoad) {
+      // No known entry point found — harness will fuzz a no-op
+      autoHarnessWarning =
+        'WARNING: auto-harness did not find a known entry point (parse/process/decode/load). ' +
+        'The fuzzer will run but test nothing meaningful. ' +
+        'Write a manual harness with FuzzedDataProvider for accurate results. ' +
+        'See: https://github.com/google/atheris#using-atheris';
+    }
+
+    // Generate a minimal harness that tries all detected functions
+    const entryPoints = [];
+    if (hasParse)   entryPoints.push(`if hasattr(mod, 'parse'):   mod.parse(fdp.ConsumeUnicodeNoSurrogates(128))`);
+    if (hasProcess) entryPoints.push(`if hasattr(mod, 'process'): mod.process(fdp.ConsumeBytes(256))`);
+    if (hasDecode)  entryPoints.push(`if hasattr(mod, 'decode'):  mod.decode(fdp.ConsumeBytes(256))`);
+    if (hasLoad)    entryPoints.push(`if hasattr(mod, 'load'):    mod.load(fdp.ConsumeUnicodeNoSurrogates(256))`);
+
+    if (entryPoints.length === 0) {
+      // Last resort: fuzz every callable that takes one argument
+      entryPoints.push(
+        `for name in dir(mod):\n` +
+        `        fn = getattr(mod, name)\n` +
+        `        if callable(fn) and not name.startswith('_'):\n` +
+        `            try: fn(fdp.ConsumeUnicodeNoSurrogates(64))\n` +
+        `            except: pass`
+      );
+    }
+
+    // Write harness to tmpfile — avoids any -c / sys.argv issues
+    const harnessPath = path.join(os.tmpdir(), 'fchek_atheris_' + Date.now() + '.py');
+    const entryPointsCode = entryPoints.join('\n        ');
+    const absFilePath = path.resolve(file).replace(/\\/g, '/');
+    const harness = [
+      'import atheris',
+      'import sys',
+      'import importlib.util',
+      '',
+      'spec = importlib.util.spec_from_file_location("target", ' + JSON.stringify(path.resolve(file)) + ')',
+      'mod = importlib.util.module_from_spec(spec)',
+      'try:',
+      '    spec.loader.exec_module(mod)',
+      'except Exception:',
+      '    pass',
+      '',
+      '@atheris.instrument_func',
+      'def TestOneInput(data):',
+      '    fdp = atheris.FuzzedDataProvider(data)',
+      '    try:',
+      '        ' + entryPointsCode,
+      '    except (ValueError, TypeError, KeyError, IndexError, UnicodeDecodeError, OverflowError):',
+      '        pass',
+      '',
+      'atheris.Setup(sys.argv, TestOneInput)',
+      'atheris.Fuzz()',
+    ].join('\n');
+    fs.writeFileSync(harnessPath, harness, 'utf8');
+    runFile = harnessPath;
+  }
+
+  const res = spawnSync(
+    py,
+    [runFile, '-max_total_time=' + String(duration)],
+    {
+      encoding: 'utf8',
+      timeout: (duration + 30) * 1000,
+      env: { ...process.env, PYTHONDONTWRITEBYTECODE: '1' },
+    }
+  );
+
+  const raw     = (res.stdout || '') + (res.stderr || '');
+  const crashed = raw.includes('CRASH') || raw.includes('Traceback') && raw.includes('SUMMARY');
+  const execsM  = raw.match(/exec\/s:\s+(\d+)/);
+  const covM    = raw.match(/cov:\s+(\d+)/);
+
+  if (runFile !== file) try { fs.unlinkSync(runFile); } catch {}
+
+  output(ok({
+    file:    path.resolve(file),
+    lang:    'python',
+    tool:    'atheris (libFuzzer)',
+    duration_s: duration,
+    auto_harness: !hasAtheris,
+    auto_harness_warning: autoHarnessWarning,
+    crashed,
+    execs_per_sec:   execsM ? parseInt(execsM[1]) : null,
+    coverage_points: covM   ? parseInt(covM[1])   : null,
+    verdict: crashed ? 'crash_found' : 'clean',
+    raw_output: raw.slice(-2000),
+  }));
+}
+
+// ─── Go — native go test -fuzz ────────────────────────────────────────────────
+
+function fuzzGo(target, duration, fuzzTarget, timeoutMs) {
+  if (!commandExists('go')) {
+    return output(fail('go not found. Install: https://go.dev'));
+  }
+
+  const cwd = path.resolve(target === '.' ? process.cwd() : target);
+
+  // Check Go version >= 1.18
+  const verRes = spawnSync('go', ['version'], { encoding: 'utf8', timeout: 5000 });
+  const verMatch = (verRes.stdout || '').match(/go(\d+)\.(\d+)/);
+  if (!verMatch || parseInt(verMatch[1]) < 1 || (parseInt(verMatch[1]) === 1 && parseInt(verMatch[2]) < 18)) {
+    return output(fail('go test -fuzz requires Go 1.18+. Update Go: https://go.dev'));
+  }
+
+  if (!fuzzTarget) {
+    // Try to auto-detect fuzz functions from test files
+    const testFiles = findGoTestFiles(cwd);
+    const targets = [];
+    for (const tf of testFiles) {
+      const content = fs.readFileSync(tf, 'utf8');
+      const matches = [...content.matchAll(/func (Fuzz\w+)/g)];
+      targets.push(...matches.map(m => m[1]));
+    }
+
+    if (targets.length === 0) {
+      return output(fail(
+        'No Fuzz* functions found in _test.go files.\n' +
+        'Create one:\n' +
+        '  func FuzzParseInput(f *testing.F) {\n' +
+        '      f.Add("initial_seed")\n' +
+        '      f.Fuzz(func(t *testing.T, s string) { ParseInput(s) })\n' +
+        '  }'
+      ));
+    }
+
+    if (targets.length > 1) {
+      return output(fail(
+        `Multiple Fuzz targets found. Specify with --target=<name>.\n` +
+        `Available: ${targets.join(', ')}`
+      ));
+    }
+
+    fuzzTarget = targets[0];
+  }
+
+  const res = spawnSync(
+    'go',
+    ['test', '-fuzz', fuzzTarget, `-fuzztime=${duration}s`, './...'],
+    { encoding: 'utf8', cwd, timeout: (duration + 30) * 1000 }
+  );
+
+  const raw     = (res.stdout || '') + (res.stderr || '');
+  const crashed = res.status !== 0 || raw.includes('FAIL') && raw.includes('panic:');
+  const failingInput = raw.match(/Failing input written to testdata\/fuzz\/.+/)?.[0] ?? null;
+
+  output(ok({
+    target:    cwd,
+    lang:      'go',
+    tool:      'go test -fuzz',
+    fuzz_target: fuzzTarget,
+    duration_s:  duration,
+    crashed,
+    failing_input: failingInput,
+    verdict:  crashed ? 'crash_found' : 'clean',
+    raw_output: raw.slice(-2000),
+  }));
+}
+
+function findGoTestFiles(dir) {
+  const results = [];
+  try {
+    for (const name of fs.readdirSync(dir)) {
+      if (name.endsWith('_test.go')) results.push(path.join(dir, name));
+    }
+  } catch {}
+  return results;
+}
+
+// ─── Entry point ─────────────────────────────────────────────────────────────
+
+async function run(args) {
+  if (args.length === 0 || args[0] === '--help') {
+    console.log(HELP);
+    return;
+  }
+
+  const target   = args[0];
+  const duration = parseInt(
+    (args.find(a => a.startsWith('--duration=')) ?? `--duration=${DEFAULT_DURATION}`).replace('--duration=', ''),
+    10
+  );
+  const fuzzTarget = (args.find(a => a.startsWith('--target=')) ?? '').replace('--target=', '') || null;
+  const corpus     = (args.find(a => a.startsWith('--corpus='))  ?? '').replace('--corpus=', '')  || null;
+
+  if (!fs.existsSync(target)) {
+    return output(fail(`Not found: ${target}`));
+  }
+
+  const ext  = path.extname(target).toLowerCase();
+  const isDir = fs.statSync(target).isDirectory();
+
+  if (['.c', '.cpp', '.cc'].includes(ext)) return fuzzC(target, duration, corpus, (duration + 60) * 1000);
+  if (ext === '.py')                        return fuzzPython(target, duration, (duration + 60) * 1000);
+  if (ext === '.rs' || (isDir && fs.existsSync(path.join(path.resolve(target), 'Cargo.toml')))) {
+    return fuzzRust(target, duration, fuzzTarget, (duration + 120) * 1000);
+  }
+  if (ext === '.go' || (isDir && fs.existsSync(path.join(path.resolve(target), 'go.mod')))) {
+    return fuzzGo(target, duration, fuzzTarget, (duration + 60) * 1000);
+  }
+
+  // Fallback "." — detect by project markers
+  if (isDir) {
+    const cwd = path.resolve(target);
+    if (fs.existsSync(path.join(cwd, 'Cargo.toml'))) return fuzzRust(target, duration, fuzzTarget, (duration + 120) * 1000);
+    if (fs.existsSync(path.join(cwd, 'go.mod')))     return fuzzGo(target, duration, fuzzTarget, (duration + 60) * 1000);
+  }
+
+  output(fail(`Cannot detect language for: ${target}. Supported: .c .cpp .rs .py .go`));
+}
+
+module.exports = { run };