musubix2 0.5.34 → 0.5.36

package/.claude/.musubix-managed

@@ -1 +1 @@
-{"generator":"musubix2","version":"0.5.34","timestamp":"2026-07-09T22:41:04.058Z"}
+{"generator":"musubix2","version":"0.5.36","timestamp":"2026-07-09T23:23:30.681Z"}

package/dist/assets/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "version": "1.0",
-  "generatedAt": "2026-07-09T22:41:04.097Z",
+  "generatedAt": "2026-07-09T23:23:30.711Z",
   "entries": [
     {
       "platform": "copilot",

package/dist/cli.d.ts

@@ -105,6 +105,8 @@ export declare function cgSubcommandHelp(sub: string | undefined): string;
 export declare function handleCodegraph(sub: string | undefined, args: string[]): Promise<ExitCodeValue>;
 /** Heuristic: does this path look like test / fixture code rather than production? */
 export declare function isTestFile(file: string): boolean;
+/** Third-party / generated files that shouldn't be audited as the user's code. */
+export declare function isVendorOrMinified(file: string): boolean;
 export declare function handleSecurity(filePath: string, failOn?: string, excludeTests?: boolean): Promise<ExitCodeValue>;
 export declare function handleWorkflow(sub: string | undefined, args: string[]): Promise<ExitCodeValue>;
 export declare function handleStatus(): Promise<ExitCodeValue>;

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAgC9D,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;CACzC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAmDpD;AAwGD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAuBjD;AAID,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC1E,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,EAAE,CAAC;CACxB;AAID,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,MAAM,CAAY;gBAEd,MAAM,EAAE,SAAS;IAI7B,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI;IAInC,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,IAAI;IAM3C,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIhD,YAAY,IAAI,UAAU,EAAE;IAItB,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAUhC,OAAO,IAAI,MAAM;IAajB,UAAU,IAAI,MAAM;IAIpB;;;OAGG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;CA4ClD;AAID,OAAO,EAGL,KAAK,QAAQ,EAKd,MAAM,2BAA2B,CAAC;AAInC;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,EAAE,CAmBzD;AAWD,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAWlF;AAED,wBAAsB,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAc/E;AAED,wBAAsB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAsBhF;AAMD,wBAAsB,UAAU,CAC9B,UAAU,GAAE,MAAY,EACxB,IAAI,CAAC,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,OAAO,GACd,OAAO,CAAC,aAAa,CAAC,CAyDxB;AAOD,UAAU,aAAa;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACpE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,CAoCnF;AASD,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,OAAO,CAAC,aAAa,CAAC,CA8CxB;AAID,wBAAsB,iBAAiB,CACrC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,OAAO,CAAC,aAAa,CAAC,CAuBxB;AAID,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,aAAa,CAAC,CA2CxB;AA+BD,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,GAAE,MAAM,EAAO,GAClB,OAAO,CAAC,aAAa,CAAC,CAuDxB;AAcD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,EAAE,CAmB3F;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAYtF;AAED,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKjD;AA0WD,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAQhE;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,aAAa,CAAC,CA2wBxB;AAMD,sFAAsF;AACtF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQhD;AAED,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,OAAO,GACrB,OAAO,CAAC,aAAa,CAAC,CAoExB;AAuBD,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,aAAa,CAAC,CAgDxB;AAID,wBAAsB,YAAY,IAAI,OAAO,CAAC,aAAa,CAAC,CAiB3D;AAkBD,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAgDhF;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,aAAa,CAAC,CAe9D;AASD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAyG9F;AAED,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAwBnF;AAED,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,GAAE,MAAkB,GACxB,OAAO,CAAC,aAAa,CAAC,CA2BxB;AAED,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAyBjF;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAgB,GACrB,OAAO,CAAC,aAAa,CAAC,CAcxB;AAED,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA0B5E;AAID,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,aAAa,CAAC,CA2DxB;AAID,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,aAAa,CAAC,CA4GxB;AAID,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,aAAa,CAAC,CAyFxB;AAID,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,aAAa,CAAC,CAkDxB;AAID,wBAAsB,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,CAOzD;AAID,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,aAAa,CAAC,CA0FxB;AAID,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAAC,aAAa,CAAC,CAgCxB;AAID,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,aAAa,CAAC,CAiExB;AAID,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,OAAO,CAAC,aAAa,CAAC,CAyExB;AAID,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAAC,aAAa,CAAC,CAexB;AAID;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAUhG;AAiBD,wBAAgB,kBAAkB,IAAI,UAAU,EAAE,CAwejD;AAED,wBAAgB,mBAAmB,IAAI,aAAa,CASnD"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAgC9D,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;CACzC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAmDpD;AAwGD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAuBjD;AAID,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC1E,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,EAAE,CAAC;CACxB;AAID,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,MAAM,CAAY;gBAEd,MAAM,EAAE,SAAS;IAI7B,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI;IAInC,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,IAAI;IAM3C,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIhD,YAAY,IAAI,UAAU,EAAE;IAItB,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAUhC,OAAO,IAAI,MAAM;IAajB,UAAU,IAAI,MAAM;IAIpB;;;OAGG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;CA4ClD;AAID,OAAO,EAGL,KAAK,QAAQ,EAKd,MAAM,2BAA2B,CAAC;AAInC;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,EAAE,CAmBzD;AAWD,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAWlF;AAED,wBAAsB,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAc/E;AAED,wBAAsB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAsBhF;AAMD,wBAAsB,UAAU,CAC9B,UAAU,GAAE,MAAY,EACxB,IAAI,CAAC,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,OAAO,GACd,OAAO,CAAC,aAAa,CAAC,CAyDxB;AAOD,UAAU,aAAa;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACpE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,CAoCnF;AASD,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,OAAO,CAAC,aAAa,CAAC,CA8CxB;AAID,wBAAsB,iBAAiB,CACrC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,OAAO,CAAC,aAAa,CAAC,CAuBxB;AAID,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,aAAa,CAAC,CA2CxB;AA+BD,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,GAAE,MAAM,EAAO,GAClB,OAAO,CAAC,aAAa,CAAC,CAuDxB;AAcD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,EAAE,CAmB3F;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAYtF;AAED,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKjD;AA0WD,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAQhE;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,aAAa,CAAC,CA2wBxB;AAMD,sFAAsF;AACtF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQhD;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOxD;AAED,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,OAAO,GACrB,OAAO,CAAC,aAAa,CAAC,CAuExB;AAuBD,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,aAAa,CAAC,CAgDxB;AAID,wBAAsB,YAAY,IAAI,OAAO,CAAC,aAAa,CAAC,CAiB3D;AAkBD,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAgDhF;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,aAAa,CAAC,CAe9D;AASD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAyG9F;AAED,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAwBnF;AAED,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,GAAE,MAAkB,GACxB,OAAO,CAAC,aAAa,CAAC,CA2BxB;AAED,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAyBjF;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAgB,GACrB,OAAO,CAAC,aAAa,CAAC,CAcxB;AAED,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA0B5E;AAID,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,aAAa,CAAC,CA2DxB;AAID,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,aAAa,CAAC,CA4GxB;AAID,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,aAAa,CAAC,CAyFxB;AAID,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,aAAa,CAAC,CAkDxB;AAID,wBAAsB,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,CAOzD;AAID,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,aAAa,CAAC,CA0FxB;AAID,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAAC,aAAa,CAAC,CAgCxB;AAID,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,aAAa,CAAC,CAiExB;AAID,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,OAAO,CAAC,aAAa,CAAC,CAyExB;AAID,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAAC,aAAa,CAAC,CAexB;AAID;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAUhG;AAiBD,wBAAgB,kBAAkB,IAAI,UAAU,EAAE,CAwejD;AAED,wBAAgB,mBAAmB,IAAI,aAAa,CASnD"}

package/dist/cli.js

@@ -8227,11 +8227,13 @@ __export(dist_exports5, {
   SecretDetector: () => SecretDetector,
   SecurityScanner: () => SecurityScanner,
   TaintAnalyzer: () => TaintAnalyzer,
+  blankNonCode: () => blankNonCode,
   createComplianceChecker: () => createComplianceChecker,
   createSecretDetector: () => createSecretDetector,
   createSecurityScanner: () => createSecurityScanner,
   isLikelySecret: () => isLikelySecret,
-  isNotFormatMarker: () => isNotFormatMarker
+  isNotFormatMarker: () => isNotFormatMarker,
+  isNotUrlPlaceholder: () => isNotUrlPlaceholder
 });
 function getLineNumber(code, index) {
   return code.substring(0, index).split("\n").length;
@@ -8253,10 +8255,29 @@ function shannonEntropy(s) {
   }
   return h;
 }
+function hasSequentialRun(s, len = 6) {
+  let run = 1;
+  for (let i = 1; i < s.length; i++) {
+    if (s.charCodeAt(i) === s.charCodeAt(i - 1) + 1) {
+      if (++run >= len)
+        return true;
+    } else {
+      run = 1;
+    }
+  }
+  return false;
+}
 function isLikelySecret(raw) {
   const s = raw.replace(/^['"]|['"]$/g, "");
-  const classes = [/[a-z]/, /[A-Z]/, /[0-9]/].filter((re) => re.test(s)).length;
-  return classes >= 2 && shannonEntropy(s) >= 3;
+  if (!/[0-9]/.test(s) || !/[a-zA-Z]/.test(s))
+    return false;
+  if (shannonEntropy(s) < 3)
+    return false;
+  if (hasSequentialRun(s))
+    return false;
+  if (/^[0-9a-f]{32}$|^[0-9a-f]{40}$|^[0-9a-f]{64}$|^[0-9a-f]{128}$/.test(s))
+    return false;
+  return true;
 }
 function isNotFormatMarker(matchText) {
   const lit = matchText.match(/['"]([^'"]*)['"]\s*$/)?.[1] ?? "";
@@ -8264,9 +8285,76 @@ function isNotFormatMarker(matchText) {
     return false;
   if (lit.trim().length < 3)
     return false;
+  if (/%\(?\w*\)?[sd]|%[sd]|\$\{[^}]*\}|#\{[^}]*\}|\{\d*\}|:\w+\b/.test(lit))
+    return false;
+  if (/^--?[\w-]+=?$/.test(lit.trim()))
+    return false;
+  if (/\$\w|\.\$/.test(lit))
+    return false;
   return true;
 }
-function runPatterns(patterns, code, filePath) {
+function isNotUrlPlaceholder(matchText) {
+  const pass = matchText.match(/:\/\/[^:@/]+:([^:@/]+)@/)?.[1] ?? "";
+  if (/^(pass(word)?|secret|changeme|example|xxx+|\*+|test)$/i.test(pass))
+    return false;
+  if (/[$#]\{|<|%s|:\w+$/.test(pass))
+    return false;
+  return true;
+}
+function blankNonCode(code, hashComments) {
+  const out = code.split("");
+  const n = code.length;
+  const blank = (from, to) => {
+    for (let k = from; k < to && k < n; k++)
+      if (out[k] !== "\n")
+        out[k] = " ";
+  };
+  let i = 0;
+  while (i < n) {
+    const c = code[i];
+    const next = i + 1 < n ? code[i + 1] : "";
+    if (c === "/" && next === "/") {
+      let j = i;
+      while (j < n && code[j] !== "\n")
+        j++;
+      blank(i, j);
+      i = j;
+      continue;
+    }
+    if (hashComments && c === "#") {
+      let j = i;
+      while (j < n && code[j] !== "\n")
+        j++;
+      blank(i, j);
+      i = j;
+      continue;
+    }
+    if (c === "/" && next === "*") {
+      let j = i + 2;
+      while (j < n && !(code[j] === "*" && code[j + 1] === "/"))
+        j++;
+      j = Math.min(j + 2, n);
+      blank(i, j);
+      i = j;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      const q = c;
+      let j = i + 1;
+      while (j < n && code[j] !== q) {
+        if (code[j] === "\\")
+          j++;
+        j++;
+      }
+      blank(i + 1, j);
+      i = j + 1;
+      continue;
+    }
+    i++;
+  }
+  return out.join("");
+}
+function runPatterns(patterns, code, filePath, snippetSource = code) {
   const findings = [];
   for (const p of patterns) {
     const regex = new RegExp(p.regex.source, p.regex.flags);
@@ -8281,7 +8369,7 @@ function runPatterns(patterns, code, filePath) {
         location: {
           file: filePath,
           line,
-          snippet: getSnippet(code, line)
+          snippet: getSnippet(snippetSource, line)
         },
         description: p.description,
         suggestion: p.suggestion,
@@ -8347,6 +8435,57 @@ var init_dist5 = __esm({
           cweId: "CWE-798",
           confidence: 0.85
         },
+        {
+          // GitHub personal access / OAuth / server / refresh tokens.
+          regex: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g,
+          severity: "critical",
+          type: "secret-leak",
+          description: "GitHub token detected",
+          suggestion: "Revoke the token and load it from a secrets manager",
+          cweId: "CWE-798",
+          confidence: 0.95
+        },
+        {
+          // Slack tokens (bot/user/app/refresh/legacy).
+          regex: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g,
+          severity: "critical",
+          type: "secret-leak",
+          description: "Slack token detected",
+          suggestion: "Revoke the token and load it from a secrets manager",
+          cweId: "CWE-798",
+          confidence: 0.9
+        },
+        {
+          // Stripe / similar `sk_live_` / `rk_live_` secret keys.
+          regex: /\b[sr]k_live_[A-Za-z0-9]{16,}\b/g,
+          severity: "critical",
+          type: "secret-leak",
+          description: "Stripe live secret key detected",
+          suggestion: "Revoke the key and load it from a secrets manager",
+          cweId: "CWE-798",
+          confidence: 0.95
+        },
+        {
+          // Google API key.
+          regex: /\bAIza[A-Za-z0-9_\-]{35}\b/g,
+          severity: "high",
+          type: "secret-leak",
+          description: "Google API key detected",
+          suggestion: "Restrict/revoke the key and load it from a secrets manager",
+          cweId: "CWE-798",
+          confidence: 0.9
+        },
+        {
+          // Credentials embedded in a connection URL: scheme://user:pass@host.
+          regex: /\b[a-z][a-z0-9+.-]*:\/\/[^\s:'"@/]+:[^\s:'"@/]+@[^\s'"/]+/g,
+          severity: "high",
+          type: "hardcoded-credential",
+          description: "Credentials in a connection string / URL detected",
+          suggestion: "Move the username/password out of the URL into a secrets manager",
+          cweId: "CWE-798",
+          confidence: 0.75,
+          validate: isNotUrlPlaceholder
+        },
         {
           regex: /['"][A-Za-z0-9]{32,}['"]/g,
           severity: "medium",
@@ -8367,7 +8506,10 @@ var init_dist5 = __esm({
     TaintAnalyzer = class {
       patterns = [
         {
-          regex: /\beval\s*\(/g,
+          // Bare builtin eval( only — not member access `x.eval` / `x->eval` /
+          // `X::eval` (method calls, e.g. Redis `->eval`), nor `def`/`function`
+          // definitions of one's own eval.
+          regex: /(?<![.\w>:])(?<!\bdef\s)(?<!\bfunction\s)(?<!\bfn\s)eval\s*\(/g,
           severity: "critical",
           type: "injection",
           description: "Use of eval() detected \u2014 potential code injection",
@@ -8376,7 +8518,9 @@ var init_dist5 = __esm({
           confidence: 0.9
         },
         {
-          regex: /\.innerHTML\s*=/g,
+          // Flag dynamic assignments only — `innerHTML = "static"` / `= ''` (clearing
+          // or a constant) is not an XSS sink; a variable/expression RHS is.
+          regex: /\.innerHTML\s*=\s*[^\s'"=]/g,
           severity: "high",
           type: "xss",
           description: "Direct innerHTML assignment \u2014 potential XSS vulnerability",
@@ -8394,7 +8538,9 @@ var init_dist5 = __esm({
           confidence: 0.85
         },
         {
-          regex: /\bexec\s*\(/g,
+          // Bare exec( only — not member access `re.exec` / `$schedule->exec` /
+          // `X::exec` (method calls) nor `def exec(...)` definitions.
+          regex: /(?<![.\w>:])(?<!\bdef\s)(?<!\bfunction\s)(?<!\bfn\s)exec\s*\(/g,
           severity: "critical",
           type: "injection",
           description: "Use of exec() detected \u2014 potential command injection",
@@ -8428,10 +8574,125 @@ var init_dist5 = __esm({
           suggestion: "Use parameterized queries instead of template literals",
           cweId: "CWE-89",
           confidence: 0.75
+        },
+        // --- Command injection ---------------------------------------------------
+        {
+          regex: /\bos\.system\s*\(/g,
+          severity: "critical",
+          type: "injection",
+          description: "Use of os.system() \u2014 potential command injection",
+          suggestion: "Use subprocess with an argument list and shell=False",
+          cweId: "CWE-78",
+          confidence: 0.85
+        },
+        {
+          regex: /\bsubprocess\.\w+\([^)]*shell\s*=\s*True/g,
+          severity: "high",
+          type: "injection",
+          description: "subprocess call with shell=True \u2014 potential command injection",
+          suggestion: "Pass an argument list and use shell=False",
+          cweId: "CWE-78",
+          confidence: 0.8
+        },
+        {
+          regex: /(?<![.\w>:])(?:shell_exec|passthru|proc_open|popen)\s*\(/g,
+          severity: "critical",
+          type: "injection",
+          description: "Use of a shell-execution function \u2014 potential command injection",
+          suggestion: "Avoid shell execution of untrusted input; use safe APIs with argument arrays",
+          cweId: "CWE-78",
+          confidence: 0.8
+        },
+        {
+          regex: /(?<![.\w>:])(?<!\bdef\s)(?<!\bfunction\s)system\s*\(/g,
+          severity: "high",
+          type: "injection",
+          description: "Use of system() \u2014 potential command injection",
+          suggestion: "Avoid passing untrusted input to system(); use safe execution APIs",
+          cweId: "CWE-78",
+          confidence: 0.65
+        },
+        {
+          regex: /Runtime\.getRuntime\(\)\s*\.\s*exec\s*\(/g,
+          severity: "critical",
+          type: "injection",
+          description: "Runtime.exec() \u2014 potential command injection",
+          suggestion: "Use ProcessBuilder with an argument list and validate inputs",
+          cweId: "CWE-78",
+          confidence: 0.8
+        },
+        // --- SQL injection (formatting/concatenation in DB calls) ----------------
+        {
+          regex: /\b(?:execute|query|raw|prepare|executemany)\s*\(\s*f['"]/g,
+          severity: "high",
+          type: "injection",
+          description: "Potential SQL injection \u2014 f-string in a database call",
+          suggestion: "Use parameterized queries; never build SQL with f-strings",
+          cweId: "CWE-89",
+          confidence: 0.75
+        },
+        {
+          regex: /\b(?:execute|query|raw|prepare)\s*\([^)]*\.format\s*\(/g,
+          severity: "high",
+          type: "injection",
+          description: "Potential SQL injection \u2014 .format() building a query",
+          suggestion: "Use parameterized queries instead of str.format()",
+          cweId: "CWE-89",
+          confidence: 0.7
+        },
+        {
+          regex: /\b(?:execute|query|raw)\s*\([^)]*\+/g,
+          severity: "high",
+          type: "injection",
+          description: "Potential SQL injection \u2014 string concatenation in a query call",
+          suggestion: "Use parameterized queries instead of string concatenation",
+          cweId: "CWE-89",
+          confidence: 0.7
+        },
+        // --- Insecure deserialization -------------------------------------------
+        // --- Insecure deserialization (low severity: real but commonly intentional
+        // in framework internals; triage with --fail-on) ------------------------
+        {
+          regex: /\bpickle\.loads?\s*\(/g,
+          severity: "low",
+          type: "injection",
+          description: "Insecure deserialization \u2014 pickle.load(s) (unsafe on untrusted data)",
+          suggestion: "Never unpickle untrusted data; use a safe format such as JSON",
+          cweId: "CWE-502",
+          confidence: 0.6
+        },
+        {
+          regex: /\byaml\.load\s*\(/g,
+          severity: "low",
+          type: "injection",
+          description: "Insecure deserialization \u2014 yaml.load() without SafeLoader",
+          suggestion: "Use yaml.safe_load() instead of yaml.load()",
+          cweId: "CWE-502",
+          confidence: 0.6
+        },
+        {
+          regex: /(?<![.\w>:])unserialize\s*\(/g,
+          severity: "low",
+          type: "injection",
+          description: "Insecure deserialization \u2014 unserialize() (unsafe on untrusted data)",
+          suggestion: "Avoid unserialize() on untrusted input; use JSON",
+          cweId: "CWE-502",
+          confidence: 0.6
+        },
+        // --- Weak cryptography (low: often used for non-security checksums) -------
+        {
+          regex: /\bhashlib\.(?:md5|sha1)\s*\(|createHash\s*\(\s*['"](?:md5|sha1)['"]/g,
+          severity: "low",
+          type: "injection",
+          description: "Weak cryptographic hash (MD5/SHA-1) detected",
+          suggestion: "Use SHA-256+ (or bcrypt/argon2 for passwords) instead of MD5/SHA-1",
+          cweId: "CWE-327",
+          confidence: 0.5
         }
       ];
       analyze(code, filePath) {
-        return runPatterns(this.patterns, code, filePath);
+        const hashComments = /\.(py|rb|sh|php|pl|yaml|yml|r)$/i.test(filePath);
+        return runPatterns(this.patterns, blankNonCode(code, hashComments), filePath, code);
       }
     };
     DependencyScanner = class {
@@ -17683,6 +17944,10 @@ function isTestFile(file) {
   const p = file.replace(/\\/g, "/").toLowerCase();
   return /(^|\/)(tests?|__tests__|spec|specs|fixtures?|phpunit|behat)(\/|$)/.test(p) || /(\.|_)(test|spec)\.[a-z]+$/.test(p) || /(^|\/)[a-z0-9_-]*_test\.[a-z]+$/.test(p) || /(^|\/)test[a-z0-9_-]*\.[a-z]+$/.test(p);
 }
+function isVendorOrMinified(file) {
+  const p = file.replace(/\\/g, "/").toLowerCase();
+  return /\.min\.(js|css|mjs)$/.test(p) || /\.bundle\.(js|css)$/.test(p) || /(^|\/)(node_modules|vendor|third_party|third-party|bower_components|dist|build)(\/)/.test(p);
+}
 async function handleSecurity(filePath, failOn, excludeTests) {
   try {
     if (!existsSync11(filePath)) {
@@ -17692,7 +17957,7 @@ async function handleSecurity(filePath, failOn, excludeTests) {
     const secrets = createSecretDetector();
     const taint = new TaintAnalyzer();
     const deps = new DependencyScanner();
-    const allFiles = collectFiles(filePath, (ext) => ext in EXT_TO_LANG);
+    const allFiles = collectFiles(filePath, (ext) => ext in EXT_TO_LANG).filter((f) => !isVendorOrMinified(f));
     const files = excludeTests ? allFiles.filter((f) => !isTestFile(f)) : allFiles;
     const skipped = allFiles.length - files.length;
     const findings = [];
@@ -19250,6 +19515,7 @@ export {
   handleWatch,
   handleWorkflow,
   isTestFile,
+  isVendorOrMinified,
   parseArgs,
   parseTaskFile,
   resolveTarget,