ferret-scan 2.2.0 → 2.3.0

package/dist/__tests__/capabilityMapping.test.js

@@ -0,0 +1,49 @@
+/**
+ * Capability Mapping Tests
+ */
+import { detectAgentType } from '../features/capabilityMapping.js';
+describe('detectAgentType', () => {
+    it('detects claude-code from .claude path', () => {
+        expect(detectAgentType('/home/user/.claude/agents/test.md')).toBe('claude-code');
+    });
+    it('detects claude-code from CLAUDE.md', () => {
+        expect(detectAgentType('/project/CLAUDE.md')).toBe('claude-code');
+    });
+    it('detects claude-code from claude.json', () => {
+        expect(detectAgentType('/project/claude.json')).toBe('claude-code');
+    });
+    it('detects cursor from .cursorrules', () => {
+        expect(detectAgentType('/project/.cursorrules')).toBe('cursor');
+    });
+    it('detects cursor from .cursor directory', () => {
+        expect(detectAgentType('/project/.cursor/settings.json')).toBe('cursor');
+    });
+    it('detects windsurf from .windsurfrules', () => {
+        expect(detectAgentType('/project/.windsurfrules')).toBe('windsurf');
+    });
+    it('detects continue from .continuerc', () => {
+        expect(detectAgentType('/project/.continuerc')).toBe('continue');
+    });
+    it('detects continue from .continuerc path', () => {
+        expect(detectAgentType('/project/.continuerc')).toBe('continue');
+    });
+    it('detects aider from .aider.conf.yml', () => {
+        expect(detectAgentType('/project/.aider.conf.yml')).toBe('aider');
+    });
+    it('detects cline from .clinerules', () => {
+        expect(detectAgentType('/project/.clinerules')).toBe('cline');
+    });
+    it('detects mcp from .mcp.json', () => {
+        expect(detectAgentType('/project/.mcp.json')).toBe('mcp');
+    });
+    it('detects mcp from mcp.json', () => {
+        expect(detectAgentType('/project/mcp.json')).toBe('mcp');
+    });
+    it('returns null for unknown file', () => {
+        expect(detectAgentType('/project/some-random-file.txt')).toBeNull();
+    });
+    it('returns null for generic config file', () => {
+        expect(detectAgentType('/project/config.yaml')).toBeNull();
+    });
+});
+//# sourceMappingURL=capabilityMapping.test.js.map

package/dist/__tests__/capabilityMappingExtra.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Additional Capability Mapping Tests
+ */
+export {};
+//# sourceMappingURL=capabilityMappingExtra.test.d.ts.map

package/dist/__tests__/capabilityMappingExtra.test.js

@@ -0,0 +1,200 @@
+/**
+ * Additional Capability Mapping Tests
+ */
+import { analyzeCapabilities, analyzeCapabilitiesContent, capabilityProfileToFindings, } from '../features/capabilityMapping.js';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+describe('analyzeCapabilities', () => {
+    let tmpDir;
+    beforeEach(() => {
+        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'ferret-cap-'));
+    });
+    afterEach(() => {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    });
+    it('returns null for non-existent file', () => {
+        const result = analyzeCapabilities('/nonexistent/config.json');
+        expect(result).toBeNull();
+    });
+    it('returns null for unknown agent type', () => {
+        const filePath = path.join(tmpDir, 'random-file.txt');
+        fs.writeFileSync(filePath, 'some content');
+        const result = analyzeCapabilities(filePath);
+        expect(result).toBeNull();
+    });
+    it('analyzes a claude settings.json', () => {
+        const claudeDir = path.join(tmpDir, '.claude');
+        fs.mkdirSync(claudeDir);
+        const filePath = path.join(claudeDir, 'settings.json');
+        fs.writeFileSync(filePath, JSON.stringify({
+            allowedTools: ['Bash', 'Read', 'Write'],
+        }));
+        const result = analyzeCapabilities(filePath);
+        expect(result).not.toBeNull();
+        expect(result?.agentType).toContain('Claude');
+    });
+    it('analyzes a .mcp.json file', () => {
+        const filePath = path.join(tmpDir, '.mcp.json');
+        fs.writeFileSync(filePath, JSON.stringify({
+            mcpServers: {
+                'my-server': {
+                    command: 'npx',
+                    args: ['my-server@1.0.0'],
+                },
+            },
+        }));
+        const result = analyzeCapabilities(filePath);
+        expect(result).not.toBeNull();
+    });
+});
+describe('analyzeCapabilitiesContent', () => {
+    it('returns null for unknown agent type', () => {
+        const result = analyzeCapabilitiesContent('/project/random.txt', '{}');
+        expect(result).toBeNull();
+    });
+    it('analyzes claude settings content', () => {
+        const content = JSON.stringify({
+            allowedTools: ['Bash', 'Read', 'Write'],
+        });
+        const result = analyzeCapabilitiesContent('/project/.claude/settings.json', content);
+        expect(result).not.toBeNull();
+        expect(result?.agentType).toContain('Claude');
+    });
+    it('parses JSON config with mcpServers', () => {
+        const content = JSON.stringify({
+            mcpServers: {
+                'fs-server': {
+                    command: 'npx',
+                    args: ['@modelcontextprotocol/server-filesystem@1.0.0'],
+                },
+                'url-server': {
+                    url: 'https://api.example.com/mcp',
+                },
+            },
+        });
+        const result = analyzeCapabilitiesContent('/project/.claude/settings.json', content);
+        expect(result).not.toBeNull();
+        expect(result?.capabilities.some(c => c.type === 'code_execution')).toBe(true);
+        expect(result?.capabilities.some(c => c.type === 'network_access')).toBe(true);
+    });
+    it('parses YAML-like config for aider', () => {
+        const content = `
+auto-commits: true
+edit-format: diff
+lint-cmd: npm run lint
+`;
+        const result = analyzeCapabilitiesContent('/project/.aider.conf.yml', content);
+        expect(result).not.toBeNull();
+        expect(result?.capabilities.length).toBeGreaterThan(0);
+    });
+    it('handles invalid JSON gracefully (falls back to YAML parsing)', () => {
+        const content = `terminalAccess: true\nfileAccess: false\n`;
+        const result = analyzeCapabilitiesContent('/project/cursor.json', content);
+        // May return null or a result depending on parsing
+        expect(result === null || typeof result === 'object').toBe(true);
+    });
+    it('computes correct overall risk for critical capabilities', () => {
+        const content = JSON.stringify({
+            allowedTools: ['Bash', 'task'],
+        });
+        const result = analyzeCapabilitiesContent('/project/.claude/settings.json', content);
+        expect(result).not.toBeNull();
+        if (result) {
+            const hasCritical = result.capabilities.some(c => c.riskLevel === 'critical' && c.permission === 'allowed');
+            if (hasCritical) {
+                expect(result.overallRisk).toBe('critical');
+            }
+        }
+    });
+    it('generates recommendations for network access', () => {
+        const content = JSON.stringify({
+            allowedTools: ['webfetch'],
+        });
+        const result = analyzeCapabilitiesContent('/project/.claude/settings.json', content);
+        if (result && result.capabilities.some(c => c.type === 'network_access' && c.permission === 'allowed')) {
+            expect(result.recommendations.some(r => r.toLowerCase().includes('network'))).toBe(true);
+        }
+    });
+});
+describe('capabilityProfileToFindings', () => {
+    it('returns empty array for profile with no allowed high-risk capabilities', () => {
+        const profile = {
+            agentType: 'Claude Code',
+            configFile: '/project/.claude/settings.json',
+            capabilities: [
+                {
+                    type: 'file_read',
+                    permission: 'allowed',
+                    riskLevel: 'low',
+                    description: 'Can read files',
+                    source: 'read',
+                },
+            ],
+            overallRisk: 'low',
+            recommendations: [],
+        };
+        const findings = capabilityProfileToFindings(profile);
+        expect(findings).toHaveLength(0);
+    });
+    it('returns findings for critical capabilities', () => {
+        const profile = {
+            agentType: 'Claude Code',
+            configFile: '/project/.claude/settings.json',
+            capabilities: [
+                {
+                    type: 'shell_access',
+                    permission: 'allowed',
+                    riskLevel: 'critical',
+                    description: 'Can execute shell commands',
+                    source: 'bash',
+                },
+            ],
+            overallRisk: 'critical',
+            recommendations: ['Review shell access'],
+        };
+        const findings = capabilityProfileToFindings(profile);
+        expect(findings.length).toBeGreaterThan(0);
+        expect(findings[0]?.severity).toBe('HIGH'); // critical risk -> HIGH severity
+    });
+    it('returns findings for high-risk capabilities', () => {
+        const profile = {
+            agentType: 'Claude Code',
+            configFile: '/project/.claude/settings.json',
+            capabilities: [
+                {
+                    type: 'network_access',
+                    permission: 'allowed',
+                    riskLevel: 'high',
+                    description: 'Can make network requests',
+                    source: 'webfetch',
+                },
+            ],
+            overallRisk: 'high',
+            recommendations: [],
+        };
+        const findings = capabilityProfileToFindings(profile);
+        expect(findings.length).toBeGreaterThan(0);
+        expect(findings[0]?.severity).toBe('MEDIUM'); // high risk -> MEDIUM severity
+    });
+    it('skips denied capabilities', () => {
+        const profile = {
+            agentType: 'Claude Code',
+            configFile: '/project/.claude/settings.json',
+            capabilities: [
+                {
+                    type: 'shell_access',
+                    permission: 'denied',
+                    riskLevel: 'critical',
+                    description: 'Shell access is denied',
+                    source: 'bash',
+                },
+            ],
+            overallRisk: 'low',
+            recommendations: [],
+        };
+        const findings = capabilityProfileToFindings(profile);
+        expect(findings).toHaveLength(0);
+    });
+});
+//# sourceMappingURL=capabilityMappingExtra.test.js.map

package/dist/__tests__/complianceExtra.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Additional Compliance Mapper Tests
+ * Tests for getControlRecommendations with credentials/exfiltration findings
+ */
+export {};
+//# sourceMappingURL=complianceExtra.test.d.ts.map

package/dist/__tests__/complianceExtra.test.js

@@ -0,0 +1,121 @@
+/**
+ * Additional Compliance Mapper Tests
+ * Tests for getControlRecommendations with credentials/exfiltration findings
+ */
+import { ComplianceMapper } from '../compliance/ComplianceMapper.js';
+function makeFinding(overrides = {}) {
+    return {
+        ruleId: 'TEST-001',
+        ruleName: 'Test',
+        severity: 'HIGH',
+        category: 'injection',
+        file: '/project/test.md',
+        relativePath: 'test.md',
+        line: 1,
+        match: 'test',
+        context: [],
+        remediation: 'fix',
+        timestamp: new Date(),
+        riskScore: 75,
+        ...overrides,
+    };
+}
+function makeScanResult(findings = []) {
+    return {
+        success: true,
+        startTime: new Date(),
+        endTime: new Date(),
+        duration: 100,
+        scannedPaths: ['/project'],
+        totalFiles: 5,
+        analyzedFiles: 5,
+        skippedFiles: 0,
+        findings,
+        findingsBySeverity: {
+            CRITICAL: findings.filter(f => f.severity === 'CRITICAL'),
+            HIGH: findings.filter(f => f.severity === 'HIGH'),
+            MEDIUM: findings.filter(f => f.severity === 'MEDIUM'),
+            LOW: findings.filter(f => f.severity === 'LOW'),
+            INFO: [],
+        },
+        findingsByCategory: {},
+        overallRiskScore: 0,
+        summary: {
+            critical: findings.filter(f => f.severity === 'CRITICAL').length,
+            high: findings.filter(f => f.severity === 'HIGH').length,
+            medium: 0, low: 0, info: 0,
+            total: findings.length,
+        },
+        errors: [],
+    };
+}
+describe('ComplianceMapper - credential recommendations', () => {
+    let mapper;
+    beforeEach(() => {
+        mapper = new ComplianceMapper();
+    });
+    it('generates credentials recommendations in SOC2 when credentials findings exist', async () => {
+        const findings = [
+            makeFinding({ category: 'credentials', severity: 'CRITICAL' }),
+        ];
+        const result = makeScanResult(findings);
+        const assessment = await mapper.assessSOC2(result);
+        expect(assessment.framework).toBe('SOC2');
+        // Check if any control assessments have recommendations about credentials
+        const allRecs = assessment.controlAssessments.flatMap(a => a.recommendations);
+        expect(allRecs.length).toBeGreaterThanOrEqual(0); // Just check it runs
+    });
+    it('generates exfiltration recommendations in SOC2 when exfiltration findings exist', async () => {
+        const findings = [
+            makeFinding({ category: 'exfiltration', severity: 'CRITICAL' }),
+        ];
+        const result = makeScanResult(findings);
+        const assessment = await mapper.assessSOC2(result);
+        const allRecs = assessment.controlAssessments.flatMap(a => a.recommendations);
+        expect(allRecs.length).toBeGreaterThanOrEqual(0);
+    });
+    it('generates non-compliant recommendations when SOC2 fails', async () => {
+        const findings = [
+            makeFinding({ category: 'credentials', severity: 'CRITICAL' }),
+            makeFinding({ category: 'injection', severity: 'HIGH' }),
+        ];
+        const result = makeScanResult(findings);
+        const assessment = await mapper.assessSOC2(result);
+        expect(assessment.nonCompliantControls.length).toBeGreaterThanOrEqual(0);
+    });
+    it('assesses ISO27001 with credentials findings', async () => {
+        const findings = [
+            makeFinding({ category: 'credentials', severity: 'HIGH' }),
+        ];
+        const result = makeScanResult(findings);
+        const assessment = await mapper.assessISO27001(result);
+        expect(assessment.framework).toBe('ISO27001');
+        expect(assessment.overallScore).toBeGreaterThanOrEqual(0);
+        expect(assessment.overallScore).toBeLessThanOrEqual(100);
+    });
+    it('assesses GDPR with credentials findings', async () => {
+        const findings = [
+            makeFinding({ category: 'credentials', severity: 'HIGH' }),
+            makeFinding({ category: 'exfiltration', severity: 'CRITICAL' }),
+        ];
+        const result = makeScanResult(findings);
+        const assessment = await mapper.assessGDPR(result);
+        expect(assessment.framework).toBe('GDPR');
+        expect(typeof assessment.overallScore).toBe('number');
+    });
+    it('generates no non-compliant when no findings', async () => {
+        const result = makeScanResult([]);
+        const assessment = await mapper.assessSOC2(result);
+        expect(assessment.nonCompliantControls.length).toBe(0);
+        expect(assessment.overallScore).toBe(100);
+    });
+    it('assessments have required fields', async () => {
+        const result = makeScanResult();
+        const assessment = await mapper.assessSOC2(result);
+        expect(assessment.framework).toBeDefined();
+        expect(assessment.assessmentDate).toBeInstanceOf(Date);
+        expect(Array.isArray(assessment.controlAssessments)).toBe(true);
+        expect(Array.isArray(assessment.recommendations)).toBe(true);
+    });
+});
+//# sourceMappingURL=complianceExtra.test.js.map

package/dist/__tests__/config.test.js

@@ -95,7 +95,7 @@ describe('loadConfig defaults', () => {
         expect(config.watch).toBe(false);
         expect(config.configOnly).toBe(false);
         expect(config.docDampening).toBe(true);
-        expect(config.redact).toBe(false);
+        expect(config.redact).toBe(true);
         expect(config.ignoreComments).toBe(true);
         expect(config.mitreAtlas).toBe(true);
     });

package/dist/__tests__/configLoader.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Config Loader Tests
+ * Tests for loadConfig and getAIConfigPaths in utils/config.ts
+ */
+export {};
+//# sourceMappingURL=configLoader.test.d.ts.map

package/dist/__tests__/configLoader.test.js

@@ -0,0 +1,225 @@
+/**
+ * Config Loader Tests
+ * Tests for loadConfig and getAIConfigPaths in utils/config.ts
+ */
+import { loadConfig, getAIConfigPaths, getClaudeConfigPaths } from '../utils/config.js';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+function makeCliOptions(overrides = {}) {
+    return {
+        ...overrides,
+    };
+}
+describe('loadConfig', () => {
+    it('returns default config when no options provided', () => {
+        const config = loadConfig(makeCliOptions());
+        expect(config).toBeDefined();
+        expect(config.severities).toBeDefined();
+        expect(Array.isArray(config.severities)).toBe(true);
+        expect(config.categories).toBeDefined();
+    });
+    it('applies path from CLI options', () => {
+        const config = loadConfig(makeCliOptions({ path: '/my/project' }));
+        expect(config.paths).toContain(path.resolve('/my/project'));
+    });
+    it('applies severity filter', () => {
+        const config = loadConfig(makeCliOptions({ severity: 'CRITICAL,HIGH' }));
+        expect(config.severities).toContain('CRITICAL');
+        expect(config.severities).toContain('HIGH');
+        expect(config.severities).not.toContain('LOW');
+    });
+    it('ignores invalid severity values', () => {
+        const config = loadConfig(makeCliOptions({ severity: 'INVALID,CRITICAL' }));
+        expect(config.severities).toContain('CRITICAL');
+        expect(config.severities).not.toContain('INVALID');
+    });
+    it('applies categories filter', () => {
+        const config = loadConfig(makeCliOptions({ categories: 'injection,credentials' }));
+        expect(config.categories).toContain('injection');
+        expect(config.categories).toContain('credentials');
+    });
+    it('ignores invalid category values', () => {
+        const config = loadConfig(makeCliOptions({ categories: 'invalid-cat,injection' }));
+        expect(config.categories).toContain('injection');
+        expect(config.categories).not.toContain('invalid-cat');
+    });
+    it('applies failOn from CLI options', () => {
+        const config = loadConfig(makeCliOptions({ failOn: 'critical' }));
+        expect(config.failOn).toBe('CRITICAL');
+    });
+    it('applies format from CLI options', () => {
+        const config = loadConfig(makeCliOptions({ format: 'json' }));
+        expect(config.format).toBe('json');
+    });
+    it('applies output file from CLI options', () => {
+        const config = loadConfig(makeCliOptions({ output: '/tmp/report.json' }));
+        expect(config.outputFile).toBe('/tmp/report.json');
+    });
+    it('applies watch mode', () => {
+        const config = loadConfig(makeCliOptions({ watch: true }));
+        expect(config.watch).toBe(true);
+    });
+    it('applies ci mode', () => {
+        const config = loadConfig(makeCliOptions({ ci: true }));
+        expect(config.ci).toBe(true);
+    });
+    it('applies verbose mode', () => {
+        const config = loadConfig(makeCliOptions({ verbose: true }));
+        expect(config.verbose).toBe(true);
+    });
+    it('applies configOnly', () => {
+        const config = loadConfig(makeCliOptions({ configOnly: true }));
+        expect(config.configOnly).toBe(true);
+    });
+    it('applies marketplace mode (valid)', () => {
+        const config = loadConfig(makeCliOptions({ marketplace: 'all' }));
+        expect(config.marketplaceMode).toBe('all');
+    });
+    it('ignores invalid marketplace mode', () => {
+        // Should warn and not change from default
+        const config1 = loadConfig(makeCliOptions());
+        const config2 = loadConfig(makeCliOptions({ marketplace: 'invalid-mode' }));
+        expect(config2.marketplaceMode).toBe(config1.marketplaceMode);
+    });
+    it('applies redact option', () => {
+        const config = loadConfig(makeCliOptions({ redact: true }));
+        expect(config.redact).toBe(true);
+    });
+    it('applies docDampening option', () => {
+        const config = loadConfig(makeCliOptions({ docDampening: false }));
+        expect(config.docDampening).toBe(false);
+    });
+    it('applies threatIntel option', () => {
+        const config = loadConfig(makeCliOptions({ threatIntel: true }));
+        expect(config.threatIntel).toBe(true);
+    });
+    it('applies semanticAnalysis option', () => {
+        const config = loadConfig(makeCliOptions({ semanticAnalysis: false }));
+        expect(config.semanticAnalysis).toBe(false);
+    });
+    it('applies correlationAnalysis option', () => {
+        const config = loadConfig(makeCliOptions({ correlationAnalysis: false }));
+        expect(config.correlationAnalysis).toBe(false);
+    });
+    it('applies entropyAnalysis option', () => {
+        const config = loadConfig(makeCliOptions({ entropyAnalysis: true }));
+        expect(config.entropyAnalysis).toBe(true);
+    });
+    it('applies mcpValidation option', () => {
+        const config = loadConfig(makeCliOptions({ mcpValidation: false }));
+        expect(config.mcpValidation).toBe(false);
+    });
+    it('applies dependencyAnalysis option', () => {
+        const config = loadConfig(makeCliOptions({ dependencyAnalysis: true }));
+        expect(config.dependencyAnalysis).toBe(true);
+    });
+    it('applies capabilityMapping option', () => {
+        const config = loadConfig(makeCliOptions({ capabilityMapping: true }));
+        expect(config.capabilityMapping).toBe(true);
+    });
+    it('applies ignoreComments option', () => {
+        const config = loadConfig(makeCliOptions({ ignoreComments: false }));
+        expect(config.ignoreComments).toBe(false);
+    });
+    it('applies mitreAtlas option', () => {
+        const config = loadConfig(makeCliOptions({ mitreAtlas: true }));
+        expect(config.mitreAtlas).toBe(true);
+    });
+    it('applies llmAnalysis option', () => {
+        const config = loadConfig(makeCliOptions({ llmAnalysis: true }));
+        expect(config.llmAnalysis).toBe(true);
+    });
+    it('applies thorough profile', () => {
+        const config = loadConfig(makeCliOptions({ thorough: true }));
+        expect(config.threatIntel).toBe(true);
+        expect(config.semanticAnalysis).toBe(true);
+        expect(config.correlationAnalysis).toBe(true);
+        expect(config.entropyAnalysis).toBe(true);
+        expect(config.mcpValidation).toBe(true);
+        expect(config.dependencyAnalysis).toBe(true);
+        expect(config.capabilityMapping).toBe(true);
+        expect(config.ignoreComments).toBe(true);
+        expect(config.mitreAtlas).toBe(true);
+    });
+    it('applies mitreAtlasCatalog option', () => {
+        const config = loadConfig(makeCliOptions({ mitreAtlasCatalog: true }));
+        expect(config.mitreAtlasCatalog.enabled).toBe(true);
+    });
+    it('applies mitreAtlasCatalogForceRefresh and enables catalog', () => {
+        const config = loadConfig(makeCliOptions({ mitreAtlasCatalogForceRefresh: true }));
+        expect(config.mitreAtlasCatalog.forceRefresh).toBe(true);
+        expect(config.mitreAtlasCatalog.enabled).toBe(true);
+    });
+    it('applies LLM provider options', () => {
+        const config = loadConfig(makeCliOptions({
+            llmProvider: 'openai-compatible',
+            llmModel: 'gpt-4o',
+            llmBaseUrl: 'https://api.openai.com/v1/chat/completions',
+            llmApiKeyEnv: 'OPENAI_API_KEY',
+            llmTimeoutMs: 30000,
+        }));
+        expect(config.llm.provider).toBe('openai-compatible');
+        expect(config.llm.model).toBe('gpt-4o');
+        expect(config.llm.baseUrl).toBe('https://api.openai.com/v1/chat/completions');
+        expect(config.llm.apiKeyEnv).toBe('OPENAI_API_KEY');
+        expect(config.llm.timeoutMs).toBe(30000);
+    });
+    it('loads config from file when path is specified', () => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'ferret-config-test-'));
+        const configPath = path.join(tmpDir, '.ferretrc.json');
+        fs.writeFileSync(configPath, JSON.stringify({
+            severity: ['CRITICAL', 'HIGH'],
+            ignore: ['node_modules/**'],
+        }));
+        const config = loadConfig(makeCliOptions({ config: configPath }));
+        expect(config.severities).toContain('CRITICAL');
+        expect(config.ignore).toContain('node_modules/**');
+        fs.rmSync(tmpDir, { recursive: true });
+    });
+    it('handles config file with features section', () => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'ferret-config-test-'));
+        const configPath = path.join(tmpDir, '.ferretrc.json');
+        fs.writeFileSync(configPath, JSON.stringify({
+            features: {
+                entropyAnalysis: false,
+                mcpValidation: true,
+                dependencyAnalysis: false,
+                ignoreComments: true,
+            },
+        }));
+        const config = loadConfig(makeCliOptions({ config: configPath }));
+        expect(config.entropyAnalysis).toBe(false);
+        expect(config.mcpValidation).toBe(true);
+        expect(config.dependencyAnalysis).toBe(false);
+        expect(config.ignoreComments).toBe(true);
+        fs.rmSync(tmpDir, { recursive: true });
+    });
+    it('handles invalid config file gracefully', () => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'ferret-config-test-'));
+        const configPath = path.join(tmpDir, '.ferretrc.json');
+        fs.writeFileSync(configPath, 'invalid json {{{');
+        // Should not throw, just use defaults
+        expect(() => loadConfig(makeCliOptions({ config: configPath }))).not.toThrow();
+        fs.rmSync(tmpDir, { recursive: true });
+    });
+});
+describe('getAIConfigPaths', () => {
+    it('returns an array', () => {
+        const paths = getAIConfigPaths();
+        expect(Array.isArray(paths)).toBe(true);
+    });
+    it('returns unique paths', () => {
+        const paths = getAIConfigPaths();
+        const unique = [...new Set(paths)];
+        expect(paths.length).toBe(unique.length);
+    });
+});
+describe('getClaudeConfigPaths', () => {
+    it('returns same as getAIConfigPaths', () => {
+        const ai = getAIConfigPaths();
+        const claude = getClaudeConfigPaths();
+        expect(ai).toEqual(claude);
+    });
+});
+//# sourceMappingURL=configLoader.test.js.map

package/dist/__tests__/configLoaderExtra.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Additional Config Loader Tests
+ * Tests for loadConfig with LLM and mitreAtlas config file settings
+ */
+export {};
+//# sourceMappingURL=configLoaderExtra.test.d.ts.map