fullshield 0.1.3 → 0.2.6

package/dist/mcp.js

@@ -1,14 +1,15 @@
 import { createHash } from 'crypto';
 import { readFile, mkdir, writeFile, stat, readdir } from 'fs/promises';
-import { resolve, join, basename, dirname, relative, posix } from 'path';
+import { resolve, join, basename, dirname, posix, relative } from 'path';
 import { execFile, spawnSync, spawn, execFileSync } from 'child_process';
 import { createInterface } from 'readline';
 import { promisify } from 'util';
 import { existsSync, statSync, readFileSync, readdirSync, mkdtempSync, cpSync, writeFileSync, rmSync } from 'fs';
-import { homedir, tmpdir } from 'os';
+import { homedir, availableParallelism, tmpdir } from 'os';
 import { performance } from 'perf_hooks';
-import ignoreModule from 'ignore';
+import { Worker } from 'worker_threads';
 import { fileURLToPath } from 'url';
+import ignoreModule from 'ignore';
 
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -1139,6 +1140,9 @@ function classesEnabled() {
 function mcpCfgEnabled() {
   return process.env.FULLSHIELD_EXPERIMENTAL_MCPCFG === "1";
 }
+function taintV2Enabled() {
+  return process.env.FULLSHIELD_EXPERIMENTAL_TAINT_V2 === "1";
+}
 
 // src/modules/config/finding.ts
 init_finding();
@@ -1945,6 +1949,103 @@ function exactPinsFromManifest(pkg) {
 
 // src/modules/deps/reachability.ts
 init_finding();
+
+// src/modules/deps/symbol-reachability.ts
+function affectedFunctionNames(vuln) {
+  const names = /* @__PURE__ */ new Set();
+  for (const affected of vuln.affected ?? []) {
+    const list = affected.ecosystem_specific?.affected_functions;
+    if (!Array.isArray(list)) continue;
+    for (const item of list) {
+      if (typeof item === "string" && item.length > 0) names.add(item);
+    }
+  }
+  return [...names];
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function called(source, local) {
+  return new RegExp(`\\b${escapeRegExp(local)}\\s*\\(`).test(source);
+}
+function memberCalled(source, object, member) {
+  return new RegExp(`\\b${escapeRegExp(object)}\\s*\\.\\s*${escapeRegExp(member)}\\s*\\(`).test(source);
+}
+function sourceCallsAffectedSymbol(source, symbol) {
+  const esc = escapeRegExp(symbol);
+  const named = new RegExp(
+    `import\\s*\\{([^}]+)\\}\\s*from\\s*['"][^'"]+['"]`,
+    "g"
+  );
+  let match;
+  while ((match = named.exec(source)) !== null) {
+    const parts = (match[1] ?? "").split(",");
+    for (const part of parts) {
+      const bits = part.trim().split(/\s+as\s+/);
+      const imported = bits[0]?.trim();
+      const local = (bits[1] ?? bits[0])?.trim();
+      if (imported === symbol && local !== void 0 && called(source, local)) return true;
+    }
+  }
+  const star = /import\s+\*\s+as\s+([A-Za-z_$][\w$]*)\s+from\s+['"][^'"]+['"]/g;
+  while ((match = star.exec(source)) !== null) {
+    const local = match[1];
+    if (local !== void 0 && memberCalled(source, local, symbol)) return true;
+  }
+  const subDefault = new RegExp(
+    `import\\s+([A-Za-z_$][\\w$]*)\\s+from\\s+['"][^'"]+/${esc}['"]`
+  );
+  const sub = subDefault.exec(source);
+  if (sub?.[1] !== void 0 && called(source, sub[1])) return true;
+  const reqMember = new RegExp(
+    `(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*require\\(\\s*['"][^'"]+['"]\\s*\\)\\s*\\.\\s*${esc}`
+  );
+  const reqHit = reqMember.exec(source);
+  if (reqHit?.[1] !== void 0 && called(source, reqHit[1])) return true;
+  const reqNs = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\(\s*['"][^'"]+['"]\s*\)/g;
+  while ((match = reqNs.exec(source)) !== null) {
+    const local = match[1];
+    if (local !== void 0 && memberCalled(source, local, symbol)) return true;
+  }
+  const reqNamed = /(?:const|let|var)\s*\{([^}]+)\}\s*=\s*require\(\s*['"][^'"]+['"]\s*\)/g;
+  while ((match = reqNamed.exec(source)) !== null) {
+    const parts = (match[1] ?? "").split(",");
+    for (const part of parts) {
+      const bits = part.trim().split(/\s*:\s*/);
+      const imported = bits[0]?.trim();
+      const local = (bits[1] ?? bits[0])?.trim();
+      if (imported === symbol && local !== void 0 && called(source, local)) return true;
+    }
+  }
+  const reqSub = new RegExp(
+    `(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*require\\(\\s*['"][^'"]+/${esc}['"]\\s*\\)`
+  );
+  const subReq = reqSub.exec(source);
+  if (subReq?.[1] !== void 0 && called(source, subReq[1])) return true;
+  const barrel = new RegExp(`export\\s*\\{([^}]+)\\}\\s*from\\s*['"][^'"]+['"]`, "g");
+  while ((match = barrel.exec(source)) !== null) {
+    const parts = (match[1] ?? "").split(",");
+    for (const part of parts) {
+      const bits = part.trim().split(/\s+as\s+/);
+      const exported = (bits[1] ?? bits[0])?.trim();
+      if (exported === symbol) {
+        const local = bits[0]?.trim();
+        if (local !== void 0 && called(source, local)) return true;
+      }
+    }
+  }
+  return false;
+}
+function classifySymbolUse(symbols, sources) {
+  for (const symbol of symbols) {
+    for (const source of sources.values()) {
+      if (sourceCallsAffectedSymbol(source, symbol)) return "symbol-reachable";
+    }
+  }
+  return "symbol-not-called";
+}
+
+// src/modules/deps/reachability.ts
 function packageNameFromSnippet(snippet) {
   if (snippet.startsWith("@")) {
     const second = snippet.indexOf("@", 1);
@@ -1973,9 +2074,9 @@ function isProductionSource(rel) {
 }
 function indexPackageUsage(sources) {
   const usage = /* @__PURE__ */ new Map();
-  const bump = (pkg, called) => {
+  const bump = (pkg, called2) => {
     const prev = usage.get(pkg) ?? { called: false };
-    usage.set(pkg, { imported: true, called: prev.called || called });
+    usage.set(pkg, { imported: true, called: prev.called || called2 });
   };
   const nsRe = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\(\s*['"]([^'"]+)['"]\s*\)/g;
   const namedRe = /(?:const|let|var)\s*\{([^}]+)\}\s*=\s*require\(\s*['"]([^'"]+)['"]\s*\)/g;
@@ -2063,10 +2164,10 @@ function classifyReachability(pkgName, productionUsage, graph) {
   return { reachability: "not-imported" };
 }
 function reachabilitySteps(reachability) {
-  if (reachability === "reachable" || reachability === "reachable-via-dependency" || reachability === "reachability-unknown") {
+  if (reachability === "reachable" || reachability === "reachable-via-dependency" || reachability === "reachability-unknown" || reachability === "symbol-reachable") {
     return 0;
   }
-  if (reachability === "imported-not-called") return 1;
+  if (reachability === "imported-not-called" || reachability === "symbol-not-called") return 1;
   return 2;
 }
 function downgradeSeverity(severity, steps) {
@@ -2083,7 +2184,7 @@ function isDevOnly(pkgName, ctx) {
   if (inProd) return false;
   return directDev.has(pkgName) || reachableFrom(pkgName, directDev, edges);
 }
-function applyReachability(findings, ctx) {
+function applyReachability(findings, ctx, symbols = /* @__PURE__ */ new Map()) {
   return findings.map((finding4) => {
     if (finding4.ruleId === "DEPS-MALICIOUS-001") {
       if (finding4.snippet === void 0) return finding4;
@@ -2100,7 +2201,12 @@ function applyReachability(findings, ctx) {
     if (finding4.ruleId !== "DEPS-VULN-001" || finding4.snippet === void 0) return finding4;
     const pkg = packageNameFromSnippet(finding4.snippet);
     if (pkg === void 0 || pkg.length === 0) return finding4;
-    const classified = classifyReachability(pkg, ctx.productionUsage, ctx.graph);
+    let classified = classifyReachability(pkg, ctx.productionUsage, ctx.graph);
+    const named = symbols.get(finding4.id) ?? [];
+    if (named.length > 0 && ctx.sources !== void 0) {
+      const symbolClass = classifySymbolUse(named, ctx.sources);
+      classified = { reachability: symbolClass, path: classified.path };
+    }
     const steps = reachabilitySteps(classified.reachability);
     let severity = steps === 0 ? finding4.severity : downgradeSeverity(finding4.severity, steps);
     let message = finding4.message;
@@ -4408,14 +4514,17 @@ var depsModule = {
         findings2.push(typosquatFinding("package.json", hit));
       }
       const osvHits2 = await queryOsv(pins, osvOpts);
+      const symbols2 = /* @__PURE__ */ new Map();
       for (const hit of osvHits2) {
         for (const vuln of hit.vulns) {
-          findings2.push(
-            isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit.pkg, vuln) : vulnFinding("package.json", hit.pkg, vuln, depLoc(hit.pkg.name))
-          );
+          const finding4 = isMaliciousAdvisory(vuln) ? maliciousFinding("package.json", hit.pkg, vuln) : vulnFinding("package.json", hit.pkg, vuln, depLoc(hit.pkg.name));
+          const names = affectedFunctionNames(vuln);
+          if (names.length > 0 && finding4.ruleId === "DEPS-VULN-001") symbols2.set(finding4.id, names);
+          findings2.push(finding4);
         }
       }
-      return applyReachability(findings2, await reachabilityCtx(ctx.cwd, ctx.files, graphFromManifest(manifest)));
+      const noLockCtx = await reachabilityCtx(ctx.cwd, ctx.files, graphFromManifest(manifest));
+      return applyReachability(findings2, noLockCtx, symbols2);
     }
     let contents;
     try {
@@ -4436,14 +4545,16 @@ var depsModule = {
       }
     }
     const osvHits = await queryOsv(packages, osvOpts);
+    const symbols = /* @__PURE__ */ new Map();
     for (const hit of osvHits) {
       for (const vuln of hit.vulns) {
-        findings.push(
-          isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit.pkg, vuln) : vulnFinding(lockFile, hit.pkg, vuln, depLoc(hit.pkg.name))
-        );
+        const finding4 = isMaliciousAdvisory(vuln) ? maliciousFinding(lockFile, hit.pkg, vuln) : vulnFinding(lockFile, hit.pkg, vuln, depLoc(hit.pkg.name));
+        const names = affectedFunctionNames(vuln);
+        if (names.length > 0 && finding4.ruleId === "DEPS-VULN-001") symbols.set(finding4.id, names);
+        findings.push(finding4);
       }
     }
-    let reached = applyReachability(findings, await reachabilityCtx(ctx.cwd, ctx.files, graph));
+    let reached = applyReachability(findings, await reachabilityCtx(ctx.cwd, ctx.files, graph), symbols);
     if (experimentalVex()) {
       reached = attachOverrideProposals(reached, graph, lockFile, manifestRaw);
       reached.push(...scanInstalledPackages(ctx.cwd, packages));
@@ -4477,7 +4588,7 @@ async function reachabilityCtx(cwd, files, graph) {
     } catch {
     }
   }
-  return { productionUsage: indexPackageUsage(prodSources), graph };
+  return { productionUsage: indexPackageUsage(prodSources), graph, sources: prodSources };
 }
 
 // src/modules/mcp/index.ts
@@ -5015,6 +5126,26 @@ function isXssSanitizerCall(node) {
   return false;
 }
 var NO_RETURNERS = /* @__PURE__ */ new Set();
+var CALLBACK_METHODS = /* @__PURE__ */ new Set([
+  "then",
+  "catch",
+  "finally",
+  "map",
+  "forEach",
+  "filter",
+  "flatMap",
+  "find",
+  "reduce"
+]);
+var taintedThisFields = /* @__PURE__ */ new WeakMap();
+function enclosingClass(node) {
+  let current = node.parent;
+  while (current !== void 0) {
+    if (current.type === "ClassDeclaration" || current.type === "ClassExpression") return current;
+    current = current.parent;
+  }
+  return void 0;
+}
 function exprIsTainted(node, tainted, returners = NO_RETURNERS) {
   if (node === void 0) return false;
   if (isTaintSource(node) || isFrameworkMemberTaint(node) || isFrameworkTaintCall(node) || isMcpArgsTaintSource(node)) {
@@ -5026,8 +5157,34 @@ function exprIsTainted(node, tainted, returners = NO_RETURNERS) {
     case "Identifier":
       return tainted.has(node.name);
     case "MemberExpression":
+      if (taintV2Enabled() && node.object.type === "ThisExpression") {
+        const cls = enclosingClass(node);
+        const name = propName(node);
+        if (cls !== void 0 && name !== void 0 && taintedThisFields.get(cls)?.has(name) === true) {
+          return true;
+        }
+      }
       return exprIsTainted(node.object, tainted, returners);
+    case "ArrayExpression":
+      if (!taintV2Enabled()) return false;
+      return node.elements.some((el) => {
+        if (el === null) return false;
+        if (el.type === "SpreadElement") return exprIsTainted(el.argument, tainted, returners);
+        return exprIsTainted(el, tainted, returners);
+      });
+    case "ObjectExpression":
+      if (!taintV2Enabled()) return false;
+      return node.properties.some((prop) => {
+        if (prop.type === "SpreadElement") return exprIsTainted(prop.argument, tainted, returners);
+        if (prop.type !== "Property") return false;
+        return exprIsTainted(prop.value, tainted, returners);
+      });
     case "CallExpression":
+      if (taintV2Enabled() && node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "Object" && propName(node.callee) === "assign") {
+        return node.arguments.some(
+          (arg) => arg.type !== "SpreadElement" && exprIsTainted(arg, tainted, returners)
+        );
+      }
       if (isSchemaValidatorCall(node)) return false;
       if (node.callee.type === "Identifier" && returners.has(node.callee.name)) return true;
       if (node.callee.type === "MemberExpression" && exprIsTainted(node.callee.object, tainted, returners)) {
@@ -5258,6 +5415,65 @@ function scopeReturnsTaint(scope, tainted, returners) {
   return yes;
 }
 var MAX_TAINT_HOPS = 5;
+function seedTaintV2(functions, facts, seeds, returners, nameToFn) {
+  let changed = false;
+  const mark = (fn, name) => {
+    if (name === void 0) return;
+    const set = seeds.get(fn) ?? /* @__PURE__ */ new Set();
+    if (set.has(name)) return;
+    set.add(name);
+    seeds.set(fn, set);
+    changed = true;
+  };
+  for (const fn of functions) {
+    const f = facts.get(fn);
+    if (f === void 0) continue;
+    let parent = fn.parent;
+    while (parent !== void 0 && !isFunctionNode(parent)) {
+      parent = parent.parent;
+    }
+    if (parent !== void 0 && isFunctionNode(parent)) {
+      const outer = facts.get(parent);
+      if (outer !== void 0) {
+        for (const name of outer.tainted) mark(fn, name);
+      }
+    }
+    walkScope(fn, (node) => {
+      if (node.type === "AssignmentExpression" && node.left.type === "MemberExpression") {
+        if (node.left.object.type === "ThisExpression" && exprIsTainted(node.right, f.tainted, returners)) {
+          const cls = enclosingClass(node);
+          const field = propName(node.left);
+          if (cls !== void 0 && field !== void 0) {
+            const fields = taintedThisFields.get(cls) ?? /* @__PURE__ */ new Set();
+            if (!fields.has(field)) {
+              fields.add(field);
+              taintedThisFields.set(cls, fields);
+              changed = true;
+            }
+          }
+        }
+      }
+      if (node.type !== "CallExpression" || node.callee.type !== "MemberExpression") return;
+      const method = propName(node.callee);
+      if (method === void 0) return;
+      if (CALLBACK_METHODS.has(method) && exprIsTainted(node.callee.object, f.tainted, returners)) {
+        const callback = node.arguments[0];
+        if (callback !== void 0 && isFunctionNode(callback)) {
+          mark(callback, boundNames(callback.params[0])[0]);
+        }
+      }
+      if ((method === "call" || method === "apply") && node.callee.object.type === "Identifier") {
+        const target = nameToFn.get(node.callee.object.name);
+        if (target === void 0 || !isFunctionNode(target)) return;
+        const arg = node.arguments[1];
+        if (arg !== void 0 && arg.type !== "SpreadElement" && exprIsTainted(arg, f.tainted, returners)) {
+          mark(target, boundNames(target.params[0])[0]);
+        }
+      }
+    });
+  }
+  return changed;
+}
 function analyzeFile(ast, extraReturners = NO_RETURNERS) {
   attachParents(ast);
   const facts = /* @__PURE__ */ new WeakMap();
@@ -5312,6 +5528,9 @@ function analyzeFile(ast, extraReturners = NO_RETURNERS) {
         });
       });
     }
+    if (taintV2Enabled() && seedTaintV2(functions, facts, seeds, returners, nameToFn)) {
+      changed = true;
+    }
     if (!changed) break;
   }
   return facts;
@@ -5454,6 +5673,21 @@ function requireCall(node) {
   }
   return void 0;
 }
+function reexportsOf(ast) {
+  const out = /* @__PURE__ */ new Map();
+  walk(ast, (node) => {
+    if (node.type !== "ExportNamedDeclaration" || node.source === null || node.source === void 0) return;
+    const spec = literalString(node.source);
+    if (spec === void 0) return;
+    for (const specNode of node.specifiers) {
+      if (specNode.type !== "ExportSpecifier") continue;
+      const exported = specNode.exported.type === "Identifier" ? specNode.exported.name : void 0;
+      const local = specNode.local.type === "Identifier" ? specNode.local.name : exported;
+      if (exported !== void 0 && local !== void 0) out.set(exported, { spec, name: local });
+    }
+  });
+  return out;
+}
 function resolveRelative(fromFile, spec, files) {
   if (!spec.startsWith(".")) return void 0;
   const base = posix.normalize(posix.join(posix.dirname(fromFile), spec));
@@ -5531,6 +5765,22 @@ function runInterproc(parsed) {
       functions.set(`${fn.file}#${fn.name}`, fn);
     }
   }
+  if (taintV2Enabled()) {
+    const barrels = /* @__PURE__ */ new Map();
+    for (const p of parsed) barrels.set(p.file, reexportsOf(p.ast));
+    for (const ns of requires.values()) {
+      for (const [local, target] of ns) {
+        const hash = target.indexOf("#");
+        if (hash < 0) continue;
+        const file = target.slice(0, hash);
+        const name = target.slice(hash + 1);
+        const re = barrels.get(file)?.get(name);
+        if (re === void 0) continue;
+        const resolved = resolveRelative(file, re.spec, files);
+        if (resolved !== void 0) ns.set(local, `${resolved}#${re.name}`);
+      }
+    }
+  }
   const queue = [];
   for (const p of parsed) {
     const facts = analyzeFile(p.ast);
@@ -6046,7 +6296,10 @@ function isMongoReceiver(node, source) {
   const obj = node.callee.object;
   if (obj.type === "Identifier") {
     if (isCollectionName(obj.name)) return true;
-    if (isPascalModel(obj.name)) return !fileHasSqlOrm;
+    if (isPascalModel(obj.name)) {
+      if (/extends\s+BaseEntity\b/.test(source)) return false;
+      return !fileHasSqlOrm;
+    }
     return fileHasMongo;
   }
   if (obj.type === "MemberExpression") {
@@ -7107,6 +7360,72 @@ function scanPromptInjection(file, source) {
   });
   return findings;
 }
+function packageVersion() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (let depth = 0; depth < 6; depth += 1) {
+    try {
+      const raw = readFileSync(join(dir, "package.json"), "utf8");
+      const pkg = JSON.parse(raw);
+      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
+        return pkg.version;
+      }
+    } catch {
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error("fullshield package.json not found");
+}
+
+// src/core/parse-pool.ts
+var workerUrl = new URL("./parse-worker.mjs", import.meta.url);
+var cache = /* @__PURE__ */ new Map();
+function parsePoolEnabled() {
+  return process.env.FULLSHIELD_PARSE_POOL === "1";
+}
+function parsePoolSize() {
+  const raw = process.env.FULLSHIELD_PARSE_WORKERS;
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed >= 1) return Math.floor(parsed);
+  }
+  return Math.max(1, availableParallelism() - 1);
+}
+function parseCacheKey(code) {
+  return createHash("sha256").update(packageVersion()).update("\0").update(code).digest("hex");
+}
+function parseOne(code) {
+  const key = parseCacheKey(code);
+  const hit = cache.get(key);
+  if (hit !== void 0) return Promise.resolve(hit);
+  return new Promise((resolve5, reject) => {
+    const worker = new Worker(fileURLToPath(workerUrl), { workerData: { code } });
+    worker.once("message", (ast) => {
+      cache.set(key, ast);
+      resolve5(ast);
+    });
+    worker.once("error", reject);
+  });
+}
+async function parseWithPool(codes) {
+  const size = parsePoolSize();
+  const out = new Array(codes.length);
+  let next = 0;
+  async function run() {
+    for (; ; ) {
+      const index = next;
+      next += 1;
+      if (index >= codes.length) return;
+      const code = codes[index];
+      if (code === void 0) return;
+      out[index] = await parseOne(code);
+    }
+  }
+  const workers = Math.min(size, Math.max(1, codes.length));
+  await Promise.all(Array.from({ length: workers }, () => run()));
+  return out;
+}
 
 // src/modules/sast/engine.ts
 var sastRules = [
@@ -7240,7 +7559,8 @@ var sastModule = {
         continue;
       }
       try {
-        const ast = await parseSource(source);
+        const ast = parsePoolEnabled() ? (await parseWithPool([source]))[0] : await parseSource(source);
+        if (ast === void 0) continue;
         parsed.push({ file: rel, source, ast });
       } catch {
       }
@@ -7618,7 +7938,7 @@ function createAiClient(options) {
   const useFixtures = options.useFixtures ?? !isLiveAi();
   const model = options.model ?? process.env.FULLSHIELD_AI_MODEL ?? (useFixtures ? "recorded-fixture" : "qwen2.5-coder:7b");
   const provider = options.provider ?? process.env.FULLSHIELD_AI_PROVIDER ?? (useFixtures ? "fixture" : "ollama");
-  const cache = /* @__PURE__ */ new Map();
+  const cache2 = /* @__PURE__ */ new Map();
   let spentUsd = 0;
   let networkCalls = 0;
   const liveCost = provider === "ollama" ? 0 : FIXTURE_COST;
@@ -7638,7 +7958,7 @@ function createAiClient(options) {
       const redactedPrompt = `${modeInstruction(req.mode)}
 ${wrapUntrustedCode(req.prompt)}`;
       const key = cacheKey(req.model ?? model, redactedPrompt);
-      const cached = cache.get(key);
+      const cached = cache2.get(key);
       if (cached !== void 0) {
         return { ...cached, cached: true, costUsd: 0 };
       }
@@ -7652,7 +7972,7 @@ ${wrapUntrustedCode(req.prompt)}`;
           cached: false,
           redactedPrompt
         };
-        cache.set(key, response2);
+        cache2.set(key, response2);
         return response2;
       }
       const fetchImpl = options.fetchImpl ?? fetch;
@@ -7702,7 +8022,7 @@ ${wrapUntrustedCode(req.prompt)}`;
         cached: false,
         redactedPrompt
       };
-      cache.set(key, response);
+      cache2.set(key, response);
       return response;
     }
   };
@@ -7929,23 +8249,6 @@ async function listStagedFiles(cwd) {
 // src/core/engine.ts
 init_suppression();
 init_finding();
-function packageVersion() {
-  let dir = dirname(fileURLToPath(import.meta.url));
-  for (let depth = 0; depth < 6; depth += 1) {
-    try {
-      const raw = readFileSync(join(dir, "package.json"), "utf8");
-      const pkg = JSON.parse(raw);
-      if (pkg.name === "fullshield" && typeof pkg.version === "string") {
-        return pkg.version;
-      }
-    } catch {
-    }
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  throw new Error("fullshield package.json not found");
-}
 
 // src/policy/index.ts
 init_finding();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullshield",
-  "version": "0.1.3",
+  "version": "0.2.6",
   "description": "Full-cycle security scanner for Node.js/TypeScript backends: detect, classify, report, notify, fix, prevent.",
   "license": "MIT",
   "type": "module",