hullproof 0.0.0-stage → 0.5.0

package/dist/discover/extract.js

@@ -0,0 +1,282 @@
+// Fact extractors: declared dependencies from manifests, and imports from source files. Small built in readers only,
+// line based where the format allows, so every fact carries a file and a line (or a JSON key).
+const base = (f) => f.slice(f.lastIndexOf('/') + 1);
+const lines = (t) => t.split(/\r?\n/);
+const pyName = (n) => n.toLowerCase().replace(/_/g, '-');
+function jsonDeps(eco, file, text, sections) {
+    let j;
+    try {
+        j = JSON.parse(text);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const s of sections) {
+        const deps = j?.[s];
+        if (!deps || typeof deps !== 'object')
+            continue;
+        for (const [name, v] of Object.entries(deps)) {
+            out.push({ eco, name, version: typeof v === 'string' ? v : null, file, key: `${s}.${name}` });
+        }
+    }
+    return out;
+}
+function eachLine(text, fn) {
+    lines(text).forEach((l, i) => fn(l, i + 1));
+}
+function requirementString(s) {
+    const m = /^\s*([A-Za-z0-9][A-Za-z0-9_.-]*)(?:\[[^\]]*\])?\s*((?:===|[<>=!~]=?)[^;#,\s]*(?:\s*,\s*[<>=!~]=?[^;#,\s]*)*)?\s*(?:;.*)?$/.exec(s);
+    return m ? { name: pyName(m[1]), version: m[2] ?? null } : null;
+}
+function requirementsTxt(file, text) {
+    const out = [];
+    eachLine(text, (l, n) => {
+        const t = l.replace(/\s+#.*$/, '').trim();
+        if (!t || t.startsWith('#') || t.startsWith('-') || t.includes('://'))
+            return;
+        const r = requirementString(t);
+        if (r)
+            out.push({ eco: 'pypi', ...r, file, line: n });
+    });
+    return out;
+}
+function pyproject(file, text) {
+    const out = [];
+    let section = '';
+    let arrayKey = null;
+    eachLine(text, (l, n) => {
+        const sec = /^\s*\[{1,2}([^\]]+)\]{1,2}\s*$/.exec(l);
+        if (sec) {
+            section = sec[1].trim();
+            arrayKey = null;
+            return;
+        }
+        let rest = l;
+        if (arrayKey === null) {
+            const a = /^\s*"?([A-Za-z0-9_.-]+)"?\s*=\s*\[(.*)$/.exec(l);
+            if (a) {
+                arrayKey = a[1];
+                rest = a[2];
+            }
+            else if (/(^|\.)dependencies$/.test(section) && section !== 'project') {
+                const p = /^\s*([A-Za-z0-9_.-]+)\s*=\s*(.*)$/.exec(l); // poetry style: name = "^1.0" or { version = "1.0" }
+                if (p && p[1].toLowerCase() !== 'python') {
+                    const v = /^"([^"]*)"/.exec(p[2])?.[1] ?? /version\s*=\s*"([^"]*)"/.exec(p[2])?.[1] ?? null;
+                    out.push({ eco: 'pypi', name: pyName(p[1]), version: v, file, line: n });
+                }
+                return;
+            }
+            else
+                return;
+        }
+        const depArray = (section === 'project' && arrayKey === 'dependencies') || section === 'project.optional-dependencies'
+            || section === 'dependency-groups' || (section === 'build-system' && arrayKey === 'requires');
+        if (depArray) {
+            for (const m of rest.matchAll(/"([^"]+)"|'([^']+)'/g)) {
+                const r = requirementString(m[1] ?? m[2]);
+                if (r)
+                    out.push({ eco: 'pypi', ...r, file, line: n });
+            }
+        }
+        if (rest.includes(']'))
+            arrayKey = null;
+    });
+    return out;
+}
+function sectionKeyValues(eco, file, text, isDepSection, norm) {
+    const out = [];
+    let section = '';
+    eachLine(text, (l, n) => {
+        const sec = /^\s*\[([^\]]+)\]\s*$/.exec(l);
+        if (sec) {
+            section = sec[1].trim();
+            return;
+        }
+        if (!isDepSection(section))
+            return;
+        const p = /^\s*"?([A-Za-z0-9_.-]+)"?\s*=\s*(.*)$/.exec(l);
+        if (!p)
+            return;
+        const v = /^"([^"]*)"/.exec(p[2])?.[1] ?? /version\s*=\s*"([^"]*)"/.exec(p[2])?.[1] ?? null;
+        out.push({ eco, name: norm(p[1]), version: v, file, line: n });
+    });
+    return out;
+}
+function regexLines(eco, file, text, re, nameOf, verOf) {
+    const out = [];
+    eachLine(text, (l, n) => {
+        const m = re.exec(l);
+        if (m)
+            out.push({ eco, name: nameOf(m), version: verOf(m), file, line: n });
+    });
+    return out;
+}
+function goMod(file, text) {
+    const out = [];
+    let inBlock = false;
+    eachLine(text, (l, n) => {
+        if (/^\s*require\s*\(\s*$/.test(l)) {
+            inBlock = true;
+            return;
+        }
+        if (inBlock && /^\s*\)/.test(l)) {
+            inBlock = false;
+            return;
+        }
+        const m = inBlock ? /^\s*(\S+)\s+(v\S+)/.exec(l) : /^\s*require\s+(\S+)\s+(v\S+)/.exec(l);
+        if (m)
+            out.push({ eco: 'go', name: m[1], version: m[2], file, line: n });
+    });
+    return out;
+}
+function pomXml(file, text) {
+    const out = [];
+    for (const m of text.matchAll(/<(dependency|parent|plugin)>([\s\S]*?)<\/\1>/g)) {
+        const body = m[2];
+        const g = /<groupId>\s*([^<\s]+)\s*<\/groupId>/.exec(body)?.[1] ?? '';
+        const a = /<artifactId>\s*([^<\s]+)\s*<\/artifactId>/.exec(body);
+        if (!a)
+            continue;
+        const v = /<version>\s*([^<\s]+)\s*<\/version>/.exec(body)?.[1] ?? null;
+        const at = (m.index ?? 0) + m[0].indexOf(a[0]);
+        out.push({ eco: 'maven', name: `${g}:${a[1]}`, version: v, file, line: text.slice(0, at).split('\n').length });
+    }
+    return out;
+}
+function pubspec(file, text) {
+    const out = [];
+    let inDeps = false;
+    eachLine(text, (l, n) => {
+        if (/^\S/.test(l)) {
+            inDeps = /^(dependencies|dev_dependencies|dependency_overrides):\s*$/.test(l);
+            return;
+        }
+        if (!inDeps)
+            return;
+        const m = /^ {2}([A-Za-z0-9_]+):\s*(.*)$/.exec(l);
+        if (m)
+            out.push({ eco: 'pub', name: m[1], version: m[2].trim() || null, file, line: n });
+    });
+    return out;
+}
+function terraform(file, text) {
+    const out = [];
+    eachLine(text, (l, n) => {
+        // Provider blocks, and the provider prefix of resource and data types (aws_s3_bucket is provider aws).
+        const p = /^\s*provider\s+"([a-z0-9_-]+)"/.exec(l) ?? /^\s*(?:resource|data)\s+"([a-z0-9]+)_/.exec(l);
+        if (p)
+            out.push({ eco: 'terraform', name: p[1], version: null, file, line: n });
+    });
+    return out;
+}
+// Every manifest format the engine reads, by file name.
+export function extractDeps(file, text) {
+    const b = base(file);
+    if (b === 'package.json')
+        return jsonDeps('npm', file, text, ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']);
+    if (b === 'composer.json')
+        return jsonDeps('composer', file, text, ['require', 'require-dev']);
+    if (/^requirements.*\.(txt|in)$/.test(b) || /(^|\/)requirements\/[^/]+\.(txt|in)$/.test(file))
+        return requirementsTxt(file, text);
+    if (b === 'pyproject.toml')
+        return pyproject(file, text);
+    if (b === 'Pipfile')
+        return sectionKeyValues('pypi', file, text, (s) => s === 'packages' || s === 'dev-packages', pyName);
+    if (b === 'setup.py')
+        return regexLines('pypi', file, text, /^\s*['"]([A-Za-z][A-Za-z0-9_.-]*)(?:\[[^\]]*\])?\s*((?:[<>=!~]=?)[^'"]*)?['"],?\s*$/, (m) => pyName(m[1]), (m) => m[2] ?? null);
+    if (b === 'go.mod')
+        return goMod(file, text);
+    if (b === 'Cargo.toml')
+        return sectionKeyValues('cargo', file, text, (s) => /(^|\.)(dev-|build-)?dependencies$/.test(s), (s) => s);
+    if (b === 'Gemfile')
+        return regexLines('rubygems', file, text, /^\s*gem\s+['"]([^'"]+)['"](?:\s*,\s*['"]([^'"]+)['"])?/, (m) => m[1], (m) => m[2] ?? null);
+    if (b === 'pom.xml')
+        return pomXml(file, text);
+    if (b === 'build.gradle' || b === 'build.gradle.kts') {
+        return regexLines('maven', file, text, /\b(?:implementation|api|compileOnly|runtimeOnly|testImplementation|testRuntimeOnly|androidTestImplementation|kapt|ksp|annotationProcessor|classpath|compile)\s*\(?\s*(?:platform\s*\(\s*)?['"]([^'":\s]+):([^'":\s]+)(?::([^'"\s]+))?['"]/, (m) => `${m[1]}:${m[2]}`, (m) => m[3] ?? null);
+    }
+    if (b === 'pubspec.yaml')
+        return pubspec(file, text);
+    if (/\.(cs|fs|vb)proj$/.test(b))
+        return regexLines('nuget', file, text, /<PackageReference\s+Include="([^"]+)"(?:\s+Version="([^"]+)")?/i, (m) => m[1], (m) => m[2] ?? null);
+    if (b === 'packages.config')
+        return regexLines('nuget', file, text, /<package\s+id="([^"]+)"\s+version="([^"]+)"/i, (m) => m[1], (m) => m[2]);
+    if (b === 'Package.swift') {
+        return regexLines('swiftpm', file, text, /\.package\s*\([^)]*?url:\s*"(?:https?:\/\/|git@)?([^"]+?)(?:\.git)?"(?:[^)]*?(?:from|exact):\s*"([^"]+)")?/, (m) => m[1].replace(':', '/').toLowerCase(), (m) => m[2] ?? null);
+    }
+    if (b === 'Podfile')
+        return regexLines('cocoapods', file, text, /^\s*pod\s+['"]([^'"]+)['"](?:\s*,\s*['"]([^'"]+)['"])?/, (m) => m[1], (m) => m[2] ?? null);
+    if (b === 'mix.exs')
+        return regexLines('hex', file, text, /\{\s*:([a-z0-9_]+)\s*,\s*"([^"]+)"/, (m) => m[1], (m) => m[2]);
+    if (b.endsWith('.tf'))
+        return terraform(file, text);
+    return [];
+}
+export const MANIFEST_NAMES = /(^|\/)(package\.json|composer\.json|requirements[^/]*\.(txt|in)|requirements\/[^/]+\.(txt|in)|pyproject\.toml|Pipfile|setup\.py|go\.mod|Cargo\.toml|Gemfile|pom\.xml|build\.gradle(\.kts)?|pubspec\.yaml|[^/]+\.(cs|fs|vb)proj|packages\.config|Package\.swift|Podfile|mix\.exs|[^/]+\.tf)$/;
+export const IMPORT_LANGS = {
+    js: { exts: ['js', 'jsx', 'mjs', 'cjs', 'ts', 'tsx', 'mts', 'cts', 'vue', 'svelte', 'astro'], sep: '/',
+        res: [/(?:\bfrom\s*|\bimport\s*\(\s*|\bimport\s+|\brequire\s*\(\s*)['"]([^'"\s]+)['"]/g] },
+    python: { exts: ['py'], sep: '.', res: [/^\s*import\s+([A-Za-z_][\w.]*)/g, /^\s*from\s+([A-Za-z_][\w.]*)\s+import\b/g] },
+    go: { exts: ['go'], sep: '/', res: [/^\s*import\s+(?:[\w.]+\s+)?"([^"]+)"/g],
+        block: { start: /^\s*import\s*\(\s*$/, end: /^\s*\)/, item: /^\s*(?:[\w.]+\s+)?"([^"]+)"/ } },
+    ruby: { exts: ['rb'], sep: '/', res: [/^\s*require\s+['"]([^'"]+)['"]/g] },
+    php: { exts: ['php'], sep: '\\', res: [/^\s*use\s+\\?([A-Za-z_][\w\\]*)/g] },
+    jvm: { exts: ['java', 'kt', 'scala', 'groovy'], sep: '.', res: [/^\s*import\s+(?:static\s+)?([\w.]+)/g] },
+    swift: { exts: ['swift'], sep: '.', res: [/^\s*(?:@testable\s+)?import\s+(?:(?:class|struct|enum|protocol|func|var|typealias)\s+)?(\w+)/g] },
+    dart: { exts: ['dart'], sep: '/', res: [/^\s*import\s+['"](?:package:)?((?:dart:)?[^'"]+)['"]/g] },
+    csharp: { exts: ['cs'], sep: '.', res: [/^\s*(?:global\s+)?using\s+(?:static\s+)?([A-Z][\w.]*)\s*;/g] },
+    rust: { exts: ['rs'], sep: '::', res: [/^\s*(?:pub\s+)?use\s+([a-z_]\w*)::/g, /^\s*extern\s+crate\s+(\w+)/g] },
+};
+const LANG_BY_EXT = new Map();
+for (const [k, v] of Object.entries(IMPORT_LANGS))
+    for (const e of v.exts)
+        LANG_BY_EXT.set(e, k);
+export const importLangOf = (file) => {
+    const b = base(file);
+    const dot = b.lastIndexOf('.');
+    return dot > 0 ? LANG_BY_EXT.get(b.slice(dot + 1).toLowerCase()) ?? null : null;
+};
+// First line per module per file. Relative and alias imports (".", "/", "~", "@/", "#") are dropped.
+export function extractImports(file, text) {
+    const lang = importLangOf(file);
+    if (!lang)
+        return [];
+    const spec = IMPORT_LANGS[lang];
+    const seen = new Map();
+    let inBlock = false;
+    eachLine(text, (l, n) => {
+        const found = [];
+        if (spec.block) {
+            if (!inBlock && spec.block.start.test(l)) {
+                inBlock = true;
+                return;
+            }
+            if (inBlock) {
+                if (spec.block.end.test(l)) {
+                    inBlock = false;
+                    return;
+                }
+                const m = spec.block.item.exec(l);
+                if (m)
+                    found.push(m[1]);
+            }
+        }
+        for (const re of spec.res)
+            for (const m of l.matchAll(re))
+                found.push(m[1]);
+        for (const mod of found) {
+            if (lang === 'js' && /^(\.|\/|~|@\/|#)/.test(mod))
+                continue;
+            if (!seen.has(mod))
+                seen.set(mod, n);
+        }
+    });
+    return [...seen].map(([module, line]) => ({ lang, module, file, line }));
+}
+// Does a fact name match a rule pattern? Exact, or a prefix on the separator, or "prefix*".
+export function nameMatches(name, pattern, sep) {
+    if (pattern.endsWith('*'))
+        return name.startsWith(pattern.slice(0, -1));
+    return name === pattern || (sep !== '' && name.startsWith(pattern + sep));
+}

package/dist/discover/git.js

@@ -0,0 +1,40 @@
+// Reads the HEAD commit from the .git folder without running git.
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+const SHA = /^[0-9a-f]{40}$/;
+const read = (p) => { try {
+    return readFileSync(p, 'utf8');
+}
+catch {
+    return null;
+} };
+export function readHeadCommit(root) {
+    let gitDir = join(root, '.git');
+    if (!existsSync(gitDir))
+        return null;
+    if (statSync(gitDir).isFile()) {
+        const m = /^gitdir:\s*(.+)$/m.exec(read(gitDir) ?? '');
+        if (!m)
+            return null;
+        gitDir = resolve(root, m[1].trim());
+    }
+    const head = (read(join(gitDir, 'HEAD')) ?? '').trim();
+    if (SHA.test(head))
+        return head;
+    const ref = /^ref:\s*(\S+)$/.exec(head)?.[1];
+    if (!ref)
+        return null;
+    const common = read(join(gitDir, 'commondir'));
+    const dirs = [gitDir, ...(common ? [resolve(gitDir, common.trim())] : [])];
+    for (const d of dirs) {
+        const loose = (read(join(d, ref)) ?? '').trim();
+        if (SHA.test(loose))
+            return loose;
+        for (const line of (read(join(d, 'packed-refs')) ?? '').split('\n')) {
+            const [sha, name] = line.trim().split(' ');
+            if (name === ref && SHA.test(sha))
+                return sha;
+        }
+    }
+    return null;
+}

package/dist/discover/kit-files.js

@@ -0,0 +1,47 @@
+// Files of the Hullproof kit that were copied into the scanned project and are still byte for byte what the kit says.
+// They hold planted samples on purpose (the kit's own test files, hook self tests), so scanning them reports the kit's samples as findings in the
+// user's project. The list comes from the manifest of the kit the run was given (--kit), never from a manifest inside the scanned project, because a
+// project could name its own files in a manifest of its own and hide them from the scan. A file that differs by one byte is not skipped.
+import { createHash } from 'node:crypto';
+import { lstatSync, readFileSync, realpathSync } from 'node:fs';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+const MANIFEST_REL = 'docs/hullproof/.kit-manifest';
+const LINE = /^([0-9a-f]{64})  (\S.*)$/;
+export function kitOwnedFiles(repo, kitDir) {
+    const out = new Set();
+    if (!kitDir)
+        return out;
+    let manifest;
+    try {
+        manifest = readFileSync(join(kitDir, MANIFEST_REL), 'utf8');
+    }
+    catch {
+        return out;
+    }
+    // A kit folder inside the scanned project is the project's own content, so its manifest is not a trusted list.
+    try {
+        const rel = relative(realpathSync(resolve(repo)), realpathSync(resolve(kitDir)));
+        if (rel === '' || (!rel.startsWith('..') && !rel.startsWith(sep) && rel.split(sep)[0] !== '..'))
+            return out;
+    }
+    catch {
+        return out;
+    }
+    for (const line of manifest.split('\n')) {
+        const m = LINE.exec(line);
+        if (!m || m[2].includes('..') || m[2].startsWith('/'))
+            continue;
+        const f = join(repo, m[2]);
+        try {
+            const st = lstatSync(f);
+            if (!st.isFile())
+                continue;
+            if (createHash('sha256').update(readFileSync(f)).digest('hex') === m[1])
+                out.add(m[2]);
+        }
+        catch { /* not in the project */ }
+    }
+    return out;
+}
+// The folders that hold the skipped kit files, collapsed to three levels, for the list of what discovery left out.
+export const kitFolders = (files) => [...new Set([...files].map((f) => dirname(f).split('/').slice(0, 3).join('/') + '/'))].sort();

package/dist/discover/walk.js

@@ -0,0 +1,110 @@
+// File listing for discovery. Reads the folder tree directly and applies .gitignore files itself, so discovery never runs
+// git (a repository's git config can make git run code). Dependency, build output and tool folders are skipped and reported.
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { cmp, globBody } from '../util.js';
+import { kitFolders } from './kit-files.js';
+const SKIP_DIRS = {
+    node_modules: 'dependency folder', bower_components: 'dependency folder', jspm_packages: 'dependency folder',
+    vendor: 'dependency folder', '.venv': 'dependency folder', venv: 'dependency folder', Pods: 'dependency folder',
+    Carthage: 'dependency folder', '.bundle': 'dependency folder', '.pnpm-store': 'dependency folder', '.yarn': 'dependency folder',
+    dist: 'build output', build: 'build output', out: 'build output', '.next': 'build output', '.nuxt': 'build output',
+    '.svelte-kit': 'build output', '.output': 'build output', '.vercel': 'build output', '.netlify': 'build output',
+    target: 'build output', '.gradle': 'build output', DerivedData: 'build output', coverage: 'build output',
+    '__pycache__': 'build output', '.pytest_cache': 'build output', '.mypy_cache': 'build output', '.tox': 'build output',
+    '.dart_tool': 'build output', '.expo': 'build output', '.turbo': 'build output', '.cache': 'build output',
+    '.parcel-cache': 'build output', '.terraform': 'build output', '.serverless': 'build output', '.aws-sam': 'build output',
+    'cdk.out': 'build output',
+    '.git': 'tool folder', '.hg': 'tool folder', '.svn': 'tool folder', '.hullproof': 'tool folder', '.idea': 'tool folder',
+};
+export function parseGitignore(text, base) {
+    const rules = [];
+    for (const raw of text.split(/\r?\n/)) {
+        let p = raw.replace(/(?<!\\)\s+$/, '');
+        if (!p || p.startsWith('#'))
+            continue;
+        const negate = p.startsWith('!');
+        if (negate)
+            p = p.slice(1);
+        if (p.startsWith('\\'))
+            p = p.slice(1);
+        const dirOnly = p.endsWith('/');
+        if (dirOnly)
+            p = p.slice(0, -1);
+        if (!p)
+            continue;
+        const anchored = p.includes('/');
+        if (p.startsWith('/'))
+            p = p.slice(1);
+        const body = globBody(p); // ponytail: also reads {a,b} as alternation, which gitignore does not; rare in practice
+        rules.push({ base, negate, dirOnly, re: new RegExp(anchored ? `^${body}$` : `^(?:.*/)?${body}$`) });
+    }
+    return rules;
+}
+function ignored(rel, isDir, rules) {
+    let out = false;
+    for (const r of rules) {
+        if (r.dirOnly && !isDir)
+            continue;
+        let sub;
+        if (!r.base)
+            sub = rel;
+        else if (rel.startsWith(r.base + '/'))
+            sub = rel.slice(r.base.length + 1);
+        else
+            continue;
+        if (r.re.test(sub))
+            out = !r.negate;
+    }
+    return out;
+}
+export function walk(root, maxFiles, skipFiles) {
+    const files = [];
+    const skipped = [];
+    let capReached = false;
+    const absRoot = resolve(root);
+    const visit = (dirRel, inherited) => {
+        const abs = dirRel ? join(absRoot, dirRel) : absRoot;
+        let rules = inherited;
+        try {
+            rules = inherited.concat(parseGitignore(readFileSync(join(abs, '.gitignore'), 'utf8'), dirRel));
+        }
+        catch { /* no .gitignore here */ }
+        const entries = readdirSync(abs, { withFileTypes: true }).sort((a, b) => cmp(a.name, b.name));
+        for (const e of entries) {
+            if (capReached)
+                return;
+            const rel = dirRel ? `${dirRel}/${e.name}` : e.name;
+            if (e.isSymbolicLink()) {
+                skipped.push({ path: rel, reason: 'symlink' });
+                continue;
+            }
+            const isDir = e.isDirectory();
+            if (!isDir && !e.isFile())
+                continue;
+            if (isDir && SKIP_DIRS[e.name]) {
+                skipped.push({ path: rel + '/', reason: SKIP_DIRS[e.name] });
+                continue;
+            }
+            if (ignored(rel, isDir, rules)) {
+                skipped.push({ path: isDir ? rel + '/' : rel, reason: 'gitignore' });
+                continue;
+            }
+            if (isDir)
+                visit(rel, rules);
+            else if (skipFiles?.has(rel))
+                continue;
+            else if (files.length >= maxFiles)
+                capReached = true;
+            else
+                files.push(rel);
+        }
+    };
+    if (!statSync(absRoot).isDirectory())
+        throw new Error(`not a folder: ${root}`);
+    visit('', []);
+    if (skipFiles?.size)
+        for (const d of kitFolders(skipFiles))
+            skipped.push({ path: d, reason: 'unchanged kit files' });
+    return { files, skipped, capReached };
+}

package/dist/env.js

@@ -0,0 +1,57 @@
+// Reads provider settings from a .env.local file without any dependency. Real environment variables always win. Only the names
+// in HUNT_ENV_NAMES are read, and no value is ever logged or returned in a message: callers get the names that came from a file.
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+export const HUNT_ENV_NAMES = [
+    'HULLPROOF_PROVIDER', 'HULLPROOF_MODEL', 'ANTHROPIC_API_KEY', 'OPENAI_API_KEY', 'GEMINI_API_KEY',
+    'HULLPROOF_OPENAI_COMPAT_BASE_URL', 'HULLPROOF_OPENAI_COMPAT_KEY',
+];
+const ALLOWED = new Set(HUNT_ENV_NAMES);
+const ENGINE_ROOT = fileURLToPath(new URL('../', import.meta.url));
+const MAX_BYTES = 64 * 1024;
+// Parses KEY=VALUE lines: blank lines and # comments skipped, an optional "export " prefix, matching quotes removed.
+export function parseEnvText(text) {
+    const out = {};
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const m = /^(?:export\s+)?([A-Z][A-Z0-9_]*)\s*=\s*(.*)$/.exec(line);
+        if (!m || !ALLOWED.has(m[1]))
+            continue;
+        let v = m[2].trim();
+        const q = v[0] === '"' || v[0] === "'" ? v.indexOf(v[0], 1) : -1;
+        if (q > 0)
+            v = v.slice(1, q);
+        else
+            v = v.replace(/\s+#.*$/, '');
+        if (v)
+            out[m[1]] = v;
+    }
+    return out;
+}
+// The scanned repository's .env.local first, then the engine's. A name already set (and not empty) in `base` is never replaced.
+export function loadHuntEnv(repo, base = process.env, engineRoot = ENGINE_ROOT) {
+    const env = { ...base };
+    const fromFile = [];
+    // CI sets this: the scanned repository is untrusted there, so a .env.local inside it must not supply a provider address or key.
+    if (base.HULLPROOF_NO_ENV_FILE === '1')
+        return { env, fromFile };
+    const roots = [...(repo ? [resolve(repo)] : []), resolve(engineRoot)];
+    for (const root of roots) {
+        const p = join(root, '.env.local');
+        try {
+            if (!existsSync(p) || statSync(p).size > MAX_BYTES)
+                continue;
+            for (const [k, v] of Object.entries(parseEnvText(readFileSync(p, 'utf8')))) {
+                if (env[k])
+                    continue;
+                env[k] = v;
+                fromFile.push(k);
+            }
+        }
+        catch { /* an unreadable file is the same as no file */ }
+    }
+    return { env, fromFile: [...new Set(fromFile)].sort() };
+}