flecto 3.0.1 → 3.1.0

package/src/config.js

@@ -1,14 +1,43 @@
-import { existsSync, readFileSync, readdirSync, writeFileSync } from 'fs';
-import { resolve, sep } from 'path';
+import {
+  existsSync,
+  lstatSync,
+  readFileSync,
+  readdirSync,
+  readlinkSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from 'fs';
+import { basename, dirname, join, relative, resolve, sep } from 'path';
 import fg from 'fast-glob';
 import yaml from 'js-yaml';
-import { isEnvFilename } from './parser.js';
+import { isEnvFilename, parseContent } from './parser.js';
+import { encryptionState } from './encrypted.js';
 
 const RC_CANDIDATES = ['.flectorc', '.flectorc.json', '.flectorc.yaml', '.flectorc.yml'];
 const COMPOSE_FILENAMES = ['docker-compose.yml', 'docker-compose.yaml', 'compose.yml', 'compose.yaml'];
 const CONFIG_DIR_PATTERN = 'config/**/*.{yaml,yml,json,toml,ini}';
 const ENV_FILE_PATTERNS = ['.env', '.env.*', '*.env'];
 const GENERIC_FILE_PATTERNS = [CONFIG_DIR_PATTERN, ...ENV_FILE_PATTERNS];
+const GITHUB_ACTIONS_WORKFLOW_PATTERN = '.github/workflows/**/*.{yaml,yml}';
+
+// Conventional places a Kubernetes/SOPS repo keeps manifests, searched in
+// addition to the repo root. Detection is content-based (see sniffManifestDirs),
+// so these only bound *where* Flecto looks — a manifest named deploy.yaml still
+// has to actually carry `apiVersion` + `kind` to count.
+const MANIFEST_DIRS = ['k8s', 'kubernetes', 'manifests', 'deploy'];
+
+// Cost guards. `flecto init` must not read a large repo exhaustively: the issue
+// (#123) is explicit that reading every YAML file is the wrong trade. Sniffing
+// stops after this many files, and a single file larger than the byte cap is
+// skipped rather than read — a hand-written manifest is never megabytes, and a
+// generated blob that large is not what we want to gate on anyway.
+const MAX_SNIFF_FILES = 50;
+const MAX_SNIFF_BYTES = 256 * 1024;
+const SNIFF_EXTENSIONS = ['.yaml', '.yml', '.json'];
+
+const K8S_ROOT_PATTERN = '*.{yaml,yml}';
+const K8S_DIR_PATTERN = '**/*.{yaml,yml}';
 
 /**
  * @typedef {{
@@ -89,6 +118,264 @@ function rcPluginsAllowed() {
   return raw === '1' || String(raw).toLowerCase() === 'true';
 }
 
+/**
+ * Has the operator explicitly opted in to targets that leave the project through
+ * a symlink?
+ * @returns {boolean}
+ */
+function symlinkTargetsAllowed() {
+  const raw = process.env.FLECTO_ALLOW_SYMLINK_TARGETS;
+  return raw === '1' || String(raw).toLowerCase() === 'true';
+}
+
+/**
+ * Resolve symlinks where possible, falling back to the input for a path that
+ * does not exist yet.
+ *
+ * `realpathSync.native` first because on Windows it asks the OS for the final
+ * path, resolving 8.3 short names and normalizing case — two spellings of one
+ * directory would otherwise compare as different and make a contained path look
+ * like an escape.
+ * @param {string} path
+ * @returns {string}
+ */
+function canonical(path) {
+  try {
+    return realpathSync.native(path);
+  } catch {
+    // Falls through for a path that does not exist yet.
+  }
+  try {
+    return realpathSync(path);
+  } catch {
+    return resolve(path);
+  }
+}
+
+/**
+ * @param {string} candidate
+ * @param {string} root both already canonical
+ * @returns {boolean}
+ */
+function isInside(candidate, root) {
+  return candidate === root || candidate.startsWith(root + sep);
+}
+
+/**
+ * Refuse a path that lives inside the project but reads from outside it through
+ * a symlink.
+ *
+ * On an untrusted pull request the file *names* are attacker-controlled, and so
+ * is what they point at. A pull request adding `config/app.ini` as a symlink to
+ * `~/.aws/credentials` gets that file parsed and its contents emitted — into the
+ * job log, the JSON envelope, and, with `--format pr-comment --pr-comment-post`,
+ * into a comment on the pull request itself. The attacker never controls the
+ * linked-to file, which is exactly what makes it worth reading.
+ *
+ * The rule is deliberately narrow, and it is about *escape*, not about location:
+ *
+ * - A path given from outside the project is operator intent — `flecto compare
+ *   /etc/a.yaml /etc/b.yaml` is a real thing to do — and is untouched.
+ * - A path inside the project that resolves to somewhere inside it is fine, so
+ *   symlinks within a repository keep working.
+ * - A path inside the project that resolves *out* of it is refused, because that
+ *   is the one shape an untrusted pull request can author to reach a file it
+ *   could not otherwise commit.
+ *
+ * `FLECTO_ALLOW_SYMLINK_TARGETS=1` opts out, for a checkout that genuinely links
+ * config in from a sibling directory. Refusing loudly rather than skipping is
+ * deliberate, for the reason rc-declared plugins are: a target that stops being
+ * scanned without saying so weakens a gate the operator believes is in place.
+ * @param {string} file absolute path as Flecto was given it
+ * @param {string} [cwd]
+ * @throws {Error} when the path escapes the project through a link
+ */
+export function assertTargetContained(file, cwd = process.cwd()) {
+  if (symlinkTargetsAllowed()) return;
+
+  const root = canonical(resolve(cwd));
+  const given = resolve(file);
+  // A path with nothing readable behind it cannot leak a file: either it does
+  // not exist, or it is a symlink whose target does not exist (existsSync
+  // follows the link). Missing targets are reported elsewhere; refusing one here
+  // as an "escape" is a false positive -- and canonical() cannot resolve a
+  // nonexistent path, so its symlink-normalized fallback would not even match
+  // `root` on a platform where the temp root is itself a symlink (macOS /var).
+  if (!existsSync(given)) return;
+  // Whether the target is *nominally* inside the project. Canonicalize its
+  // containing directory rather than the path itself: the directory is a real
+  // directory, never the symlink under test, so this normalizes Windows drive-
+  // letter case and 8.3 short names -- which would otherwise make an in-repo
+  // path compare as external and skip the check entirely -- without following
+  // the final link. On POSIX the two forms already agree, so this is a no-op
+  // there.
+  const nominal = join(canonical(dirname(given)), basename(given));
+  // Named from outside the project: nothing was escaped, it was never inside.
+  if (!isInside(nominal, root)) return;
+
+  const real = canonical(given);
+  if (isInside(real, root)) return;
+
+  throw new Error(
+    `Refusing to read "${relative(root, nominal).split(sep).join('/') || given}": it is a link out of the project, `
+    + `resolving to ${real}.\n`
+    + 'File names and links are attacker-controlled on an untrusted pull request, and '
+    + 'reading one would put a file from outside the repository into Flecto\'s output.\n'
+    + 'Set FLECTO_ALLOW_SYMLINK_TARGETS=1 if this link is intentional.',
+  );
+}
+
+/**
+ * Has the operator explicitly opted in to write destinations that `.flectorc`
+ * points outside the project?
+ * @returns {boolean}
+ */
+function rcWritesAllowed() {
+  const raw = process.env.FLECTO_ALLOW_RC_WRITES;
+  return raw === '1' || String(raw).toLowerCase() === 'true';
+}
+
+/**
+ * Refuse a *write* destination that leaves the project.
+ *
+ * The read rule ({@link assertTargetContained}) is about escape, and treats a
+ * path named from outside the project as operator intent. A write cannot be read
+ * that way, because the path is not always the operator's: `output` and
+ * `baseline` can be declared in `.flectorc`, and on an untrusted pull request
+ * `.flectorc` is attacker-controlled. Both destinations carry content the
+ * attacker partly controls — the report embeds config values and file names, a
+ * baseline embeds rule ids, paths, and messages — so an unconstrained
+ * destination is an arbitrary file overwrite with partly chosen content, which
+ * on a CI runner is a shell profile, a workflow file, or an SSH config.
+ *
+ * Two rules, matching the provenance:
+ *
+ * - **Declared in `.flectorc`** — must resolve inside the project.
+ *   `FLECTO_ALLOW_RC_WRITES=1` opts out, for a repository that genuinely
+ *   configures a destination elsewhere.
+ * - **Any source** — must not leave the project through a symlink, on the path
+ *   itself or on the directory it is written into. That is the shape a pull
+ *   request can author without touching the workflow, and it is refused for the
+ *   same reason a symlinked *target* is; `FLECTO_ALLOW_SYMLINK_TARGETS=1` opts
+ *   out of this half, as it does for reads.
+ *
+ * Refusing loudly rather than falling back to a default path is deliberate: a
+ * report that silently went somewhere else is worse than one that was not
+ * written.
+ * @param {string} file destination path, already resolved against the cwd
+ * @param {{ option: string, fromCli?: boolean, cwd?: string }} context
+ * @throws {Error} when the destination escapes the project
+ */
+export function assertWriteDestinationContained(file, context) {
+  const { option, fromCli = false } = context;
+  const cwd = context.cwd ?? process.cwd();
+  const lexicalRoot = resolve(cwd);
+  const root = canonical(lexicalRoot);
+  const given = resolve(cwd, file);
+  const shown = relative(lexicalRoot, given).split(sep).join('/') || given;
+
+  // A destination need not exist yet, and neither need the directories above it,
+  // so normalize from the nearest ancestor that does: canonical() cannot resolve
+  // a path that is not there, and its fallback leaves the spelling as written —
+  // which on Windows is an 8.3 short name that compares as a different directory
+  // from the long form `root` carries, making an in-project path look external.
+  const { base, rest } = nearestExistingDir(dirname(given));
+  const nominal = join(canonical(base), ...rest, basename(given));
+  // Either spelling counts as inside: the lexical form covers a path derived
+  // from the cwd, the canonical form a path named some other way.
+  const insideProject = isInside(given, lexicalRoot) || isInside(nominal, root);
+
+  if (!fromCli && !rcWritesAllowed() && !insideProject) {
+    throw new Error(
+      `Refusing to write "${option}" to ${given}: .flectorc points it outside the project.\n`
+      + '.flectorc is attacker-controlled on an untrusted pull request, and this file carries '
+      + 'config values and file names into whatever it overwrites.\n'
+      + `Pass ${option} on the command line for a destination outside the project, or set `
+      + 'FLECTO_ALLOW_RC_WRITES=1 if this repository genuinely configures one.',
+    );
+  }
+
+  if (symlinkTargetsAllowed()) return;
+
+  // Two ways a write leaves through a link: the destination is itself a link, or
+  // the nearest directory that exists on the way to it is. The second covers a
+  // path several levels deep whose parents have not been created yet.
+  for (const candidate of [given, base]) {
+    const real = linkDestination(candidate);
+    // Nothing there at all: no link to follow, so nothing to refuse.
+    if (real === null) continue;
+    // Named from outside the project: nothing escaped, it was never inside.
+    if (!isInside(candidate, lexicalRoot)) continue;
+    if (isInside(real, root)) continue;
+    throw new Error(
+      `Refusing to write "${option}" to "${shown}": it is a link out of the project, `
+      + `resolving to ${real}.\n`
+      + 'File names and links are attacker-controlled on an untrusted pull request, and '
+      + 'writing through one would overwrite a file outside the repository.\n'
+      + 'Set FLECTO_ALLOW_SYMLINK_TARGETS=1 if this link is intentional.',
+    );
+  }
+}
+
+/**
+ * How many links to walk before giving up. The OS gives up around 40; this only
+ * needs to outlast any chain a repository would legitimately contain.
+ */
+const MAX_LINK_HOPS = 32;
+
+/**
+ * Where a path actually lands, following links even when the chain ends
+ * somewhere that does not exist yet.
+ *
+ * `existsSync` follows links, so it reports *nothing* for a link whose target is
+ * missing — and `realpathSync` fails on one, leaving {@link canonical} to fall
+ * back to the path as written, which is still inside the project. So a link to a
+ * file the runner does not have yet reads as contained twice over. That is not
+ * the weaker half of this attack but the stronger one: overwriting needs the
+ * file to already be there, while a link to a file the runner does *not* have
+ * yet has Flecto create it. `~/.ssh/authorized_keys` is the one that stings,
+ * because sshd skips lines it cannot parse, so HTML wrapped around one
+ * attacker-authored line is still a usable key file.
+ *
+ * So the link is resolved by hand, hop by hop, and judged wherever it ends up.
+ * @param {string} path
+ * @param {number} [depth]
+ * @returns {string | null} null when there is nothing at `path` at all
+ */
+function linkDestination(path, depth = 0) {
+  const stats = lstatSync(path, { throwIfNoEntry: false });
+  if (!stats) return null;
+  if (!stats.isSymbolicLink()) return canonical(path);
+
+  const target = resolve(dirname(path), readlinkSync(path));
+  // A cycle, or a chain long enough that the write would fail with ELOOP
+  // anyway: judge the hop we have rather than walking forever.
+  if (depth >= MAX_LINK_HOPS) return target;
+  // The next hop may not exist; normalize what is there and keep the rest as
+  // written, the same way an ordinary destination is normalized above.
+  const { base, rest } = nearestExistingDir(dirname(target));
+  return linkDestination(target, depth + 1) ?? join(canonical(base), ...rest, basename(target));
+}
+
+/**
+ * The nearest ancestor of a path that exists on disk, plus the segments below it
+ * that do not.
+ * @param {string} path
+ * @returns {{ base: string, rest: string[] }}
+ */
+function nearestExistingDir(path) {
+  let current = resolve(path);
+  /** @type {string[]} */
+  const rest = [];
+  while (!existsSync(current)) {
+    const parent = dirname(current);
+    if (parent === current) break;
+    rest.unshift(basename(current));
+    current = parent;
+  }
+  return { base: current, rest };
+}
+
 /**
  * Split a policy list that may arrive as an array or a comma-separated string.
  * @param {unknown} raw
@@ -162,29 +449,249 @@ export function resolvePolicyOptions(effective, provenance = {}) {
   return { policies, plugins, severityRemap };
 }
 
+/**
+ * Convert a glob pattern to the separators `fast-glob` requires.
+ *
+ * fast-glob only understands POSIX separators and treats a backslash as an
+ * escape character, so a Windows path used as a pattern matches nothing at all:
+ * `config\*.yaml` asks for a file literally named `config*.yaml`. Since
+ * PowerShell and cmd tab-completion produce backslash paths, that is the
+ * default way a Windows user would invoke Flecto, and the failure looks like
+ * "no files matched" rather than like a platform bug.
+ *
+ * The rewrite is deliberately **Windows-only**. On POSIX a backslash is a legal
+ * character in a filename *and* a meaningful glob escape, so rewriting there
+ * would break patterns that work today. On Windows a backslash can only ever be
+ * a separator — the filesystem forbids it in a name — so there is nothing to
+ * lose.
+ *
+ * Only patterns are rewritten. Resolved paths stay native, which is what every
+ * `fs` call and the snapshot key derivation expect.
+ * @param {string} pattern
+ * @param {NodeJS.Platform} [platform] Injectable so the Windows behavior is
+ *   testable from any host.
+ * @returns {string}
+ */
+export function normalizeGlobPattern(pattern, platform = process.platform) {
+  if (platform !== 'win32') return pattern;
+  return String(pattern).replaceAll('\\', '/');
+}
+
 /**
  * Expand file patterns from rc include/files and direct CLI inputs.
- * @param {{ cwd?: string, files?: string[], include?: string[], exclude?: string[] }} input
+ * @param {{
+ *  cwd?: string,
+ *  files?: string[],
+ *  include?: string[],
+ *  exclude?: string[],
+ *  platform?: NodeJS.Platform
+ * }} input
  * @returns {Promise<string[]>}
  */
 export async function resolveFiles(input) {
   const cwd = input.cwd ?? process.cwd();
+  const platform = input.platform ?? process.platform;
   const files = input.files ?? [];
   const include = input.include ?? [];
   const exclude = input.exclude ?? [];
-  const patterns = [...files, ...include].filter(Boolean);
+  const patterns = [...files, ...include]
+    .filter(Boolean)
+    .map((pattern) => normalizeGlobPattern(pattern, platform));
   if (patterns.length === 0) return [];
+  // `exclude` is matched against the same pattern syntax, so it needs the same
+  // rewrite -- an exclude that silently stops excluding is the worse failure.
+  const ignore = exclude.filter(Boolean).map((pattern) => normalizeGlobPattern(pattern, platform));
   const matches = await fg(patterns, {
     cwd,
     absolute: true,
     onlyFiles: true,
     unique: true,
-    ignore: exclude,
+    ignore,
     dot: true,
   });
+  // Back to native separators: everything downstream reads these off disk.
   return matches.map((p) => resolve(p));
 }
 
+/**
+ * Collect candidate files to sniff: YAML/JSON at the repo root plus, one level
+ * of recursion deep, the conventional manifest directories. Bounded by
+ * MAX_SNIFF_FILES so a large repo never turns `init` into a full-tree read.
+ * @param {string} cwd
+ * @param {string[]} rootFileNames
+ * @param {Set<string>} dirNames
+ * @returns {string[]} absolute paths, root files first
+ */
+function sniffCandidates(cwd, rootFileNames, dirNames) {
+  /** @type {string[]} */
+  const candidates = [];
+  const push = (abs) => {
+    if (candidates.length < MAX_SNIFF_FILES) candidates.push(abs);
+  };
+
+  for (const name of rootFileNames) {
+    if (SNIFF_EXTENSIONS.includes(extLower(name))) push(resolve(cwd, name));
+  }
+
+  for (const dir of MANIFEST_DIRS) {
+    if (!dirNames.has(dir)) continue;
+    for (const abs of walkYamlish(resolve(cwd, dir))) {
+      push(abs);
+      if (candidates.length >= MAX_SNIFF_FILES) break;
+    }
+  }
+
+  return candidates.slice(0, MAX_SNIFF_FILES);
+}
+
+/**
+ * Depth-first list of sniffable files under a directory, skipping node_modules
+ * and dot directories, capped by MAX_SNIFF_FILES so a deep tree cannot run away.
+ * @param {string} root
+ * @returns {string[]}
+ */
+function walkYamlish(root) {
+  /** @type {string[]} */
+  const out = [];
+  /** @type {string[]} */
+  const stack = [root];
+  while (stack.length > 0 && out.length < MAX_SNIFF_FILES) {
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        if (entry.name === 'node_modules' || entry.name.startsWith('.')) continue;
+        stack.push(join(dir, entry.name));
+      } else if (entry.isFile() && SNIFF_EXTENSIONS.includes(extLower(entry.name))) {
+        out.push(join(dir, entry.name));
+        if (out.length >= MAX_SNIFF_FILES) break;
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * @param {string} name
+ * @returns {string} lower-cased extension including the dot, or ''
+ */
+function extLower(name) {
+  const dot = name.lastIndexOf('.');
+  return dot === -1 ? '' : name.slice(dot).toLowerCase();
+}
+
+/**
+ * Parse a candidate file for detection, cheaply and defensively. Returns null
+ * for anything too large, unreadable, or unparseable — detection never fails a
+ * run, it just learns less. The byte cap is enforced before the read so a huge
+ * file is skipped rather than slurped.
+ * @param {string} abs
+ * @returns {unknown}
+ */
+function sniffParse(abs) {
+  try {
+    if (statSync(abs).size > MAX_SNIFF_BYTES) return null;
+    return parseContent(abs, readFileSync(abs, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * True when a parsed tree (single- or multi-document) contains a
+ * Kubernetes-shaped document: `apiVersion` + `kind`. A multi-document file is
+ * the identity-keyed wrapper, so its documents are one level down.
+ * @param {unknown} tree
+ * @returns {boolean}
+ */
+function hasKubernetesDocument(tree) {
+  if (!isPlainObjectLike(tree)) return false;
+  if (isKubernetesShaped(tree)) return true;
+  return Object.values(tree).some((value) => isKubernetesShaped(value));
+}
+
+/**
+ * @param {unknown} doc
+ * @returns {boolean}
+ */
+function isKubernetesShaped(doc) {
+  return isPlainObjectLike(doc)
+    && typeof doc.apiVersion === 'string' && doc.apiVersion.trim() !== ''
+    && typeof doc.kind === 'string' && doc.kind.trim() !== '';
+}
+
+/**
+ * @param {unknown} v
+ * @returns {v is Record<string, unknown>}
+ */
+function isPlainObjectLike(v) {
+  return v !== null && typeof v === 'object' && !Array.isArray(v);
+}
+
+/**
+ * Sniff the manifest locations for Kubernetes and SOPS signals. Content-based
+ * and cost-bounded; see MAX_SNIFF_FILES / MAX_SNIFF_BYTES. `.sops.yaml` is a
+ * plaintext creation-rules config, not an encrypted file, but its presence is
+ * still a reliable sign the repo uses SOPS, so it counts on its own.
+ * @param {string} cwd
+ * @param {string[]} rootFileNames
+ * @param {Set<string>} dirNames
+ * @returns {{
+ *   kubernetes: { files: string[] } | null,
+ *   sops: { files: string[], creationRules: boolean } | null
+ * }}
+ */
+function sniffManifestDirs(cwd, rootFileNames, dirNames) {
+  const candidates = sniffCandidates(cwd, rootFileNames, dirNames);
+
+  /** @type {Set<string>} */
+  const k8sRel = new Set();
+  /** @type {Set<string>} */
+  const sopsRel = new Set();
+  const creationRules = rootFileNames.some((name) => name === '.sops.yaml' || name === '.sops.yml');
+
+  for (const abs of candidates) {
+    const tree = sniffParse(abs);
+    if (tree == null) continue;
+    const rel = relative(cwd, abs).split(sep).join('/');
+    if (hasKubernetesDocument(tree)) k8sRel.add(rel);
+    if (encryptionState(tree) !== 'plaintext') sopsRel.add(rel);
+  }
+
+  return {
+    kubernetes: k8sRel.size > 0 ? { files: [...k8sRel].sort() } : null,
+    sops: sopsRel.size > 0 || creationRules
+      ? { files: [...sopsRel].sort(), creationRules }
+      : null,
+  };
+}
+
+/**
+ * Watch patterns for the directories that held Kubernetes manifests, plus the
+ * repo root when a manifest lived there. One pattern per conventional dir keeps
+ * the generated config short instead of listing every file.
+ * @param {string[]} relFiles
+ * @returns {string[]}
+ */
+function manifestWatchPatterns(relFiles) {
+  /** @type {Set<string>} */
+  const patterns = new Set();
+  for (const rel of relFiles) {
+    const top = rel.includes('/') ? rel.slice(0, rel.indexOf('/')) : null;
+    if (top && MANIFEST_DIRS.includes(top)) {
+      patterns.add(`${top}/${K8S_DIR_PATTERN}`);
+    } else {
+      patterns.add(K8S_ROOT_PATTERN);
+    }
+  }
+  return [...patterns].sort();
+}
+
 /**
  * Detect stack signals in a directory and map them to policy packs and file
  * patterns. Only built-in pack ids and patterns Flecto can actually parse are
@@ -235,6 +742,18 @@ export function detectStack(cwd = process.cwd()) {
     });
   }
 
+  const githubWorkflowsDir = resolve(cwd, '.github', 'workflows');
+  if (dirNames.has('.github') && existsSync(githubWorkflowsDir) && statSync(githubWorkflowsDir).isDirectory()) {
+    packs.push('github-actions');
+    files.push(GITHUB_ACTIONS_WORKFLOW_PATTERN);
+    signals.push({
+      id: 'github-actions',
+      evidence: ['.github/workflows/'],
+      pack: 'github-actions',
+      summary: 'Detected .github/workflows/ → enabled the `github-actions` policy pack and watched workflow YAML',
+    });
+  }
+
   const terraformFiles = fileNames.filter((name) => name.toLowerCase().endsWith('.tf')).sort();
   if (terraformFiles.length > 0) {
     signals.push({
@@ -266,6 +785,45 @@ export function detectStack(cwd = process.cwd()) {
     });
   }
 
+  // Content-based signals for the two shapes 3.0 was built around. Sniffed, not
+  // guessed from filenames, and bounded (#123). Enabling `kubernetes` on a repo
+  // that is not Kubernetes would produce confusing findings on the first run, so
+  // a manifest must actually carry apiVersion + kind to count.
+  const manifests = sniffManifestDirs(cwd, fileNames, dirNames);
+
+  if (manifests.kubernetes) {
+    packs.push('kubernetes');
+    const watched = manifestWatchPatterns(manifests.kubernetes.files);
+    files.push(...watched);
+    const shown = manifests.kubernetes.files.slice(0, 3);
+    const more = manifests.kubernetes.files.length - shown.length;
+    const evidenceList = more > 0 ? `${shown.join(', ')}, +${more} more` : shown.join(', ');
+    signals.push({
+      id: 'kubernetes',
+      evidence: manifests.kubernetes.files,
+      pack: 'kubernetes',
+      summary: `Detected Kubernetes manifests (${evidenceList}) → enabled the \`kubernetes\` policy pack and watched ${watched.join(', ')}`,
+    });
+  }
+
+  if (manifests.sops) {
+    packs.push('sops');
+    if (manifests.sops.files.length > 0) files.push(...manifests.sops.files);
+    const evidence = [
+      ...(manifests.sops.creationRules ? ['.sops.yaml'] : []),
+      ...manifests.sops.files,
+    ];
+    const watchedNote = manifests.sops.files.length > 0
+      ? ` and watched ${manifests.sops.files.join(', ')}`
+      : ' (no encrypted files found yet; the pack applies when they appear)';
+    signals.push({
+      id: 'sops',
+      evidence,
+      pack: 'sops',
+      summary: `Detected SOPS usage (${evidence.join(', ')}) → enabled the \`sops\` policy pack${watchedNote}`,
+    });
+  }
+
   return { signals, packs, files: [...new Set(files)] };
 }