nerdsystem 0.0.0-stage → 0.0.1

package/dist/gates/rules.js

@@ -0,0 +1,58 @@
+const SECRET_FIX = "Remove the value from the code. Put it in .dev.vars locally, set it for production with `nerd secret set NAME` (the person pastes the value; never put a real value in a command you run), and read it from c.env.NAME on the server.";
+const SECRET_EXAMPLE = { wrong: 'const stripe = new Stripe("sk_live_...");', right: 'const stripe = new Stripe(c.env.STRIPE_SECRET_KEY);' };
+export const RULES = {
+    "secrets/aws-access-key": { title: "AWS access key in source", severity: "block", audience: "agent", risk: "Anyone who can read your code can use your AWS account and run up charges.", fix: SECRET_FIX, example: SECRET_EXAMPLE },
+    "secrets/github-token": { title: "GitHub token in source", severity: "block", audience: "agent", risk: "The token gives access to your GitHub repositories and could be used to push malicious code.", fix: SECRET_FIX, example: SECRET_EXAMPLE },
+    "secrets/github-pat": { title: "GitHub personal access token in source", severity: "block", audience: "agent", risk: "The token gives access to your GitHub account.", fix: SECRET_FIX, example: SECRET_EXAMPLE },
+    "secrets/stripe-secret": { title: "Stripe secret key in source", severity: "block", audience: "agent", risk: "Your Stripe secret key can move money and read every customer's payment details.", fix: SECRET_FIX, example: SECRET_EXAMPLE },
+    "secrets/stripe-webhook": { title: "Stripe webhook secret in source", severity: "block", audience: "agent", risk: "With the webhook secret, anyone can forge payment events and mark orders as paid.", fix: SECRET_FIX, example: SECRET_EXAMPLE },
+    "secrets/slack-token": { title: "Slack token in source", severity: "block", audience: "agent", risk: "The token can read and post in your Slack workspace.", fix: SECRET_FIX, example: SECRET_EXAMPLE },
+    "secrets/google-api-key": { title: "Google API key in source", severity: "block", audience: "agent", risk: "The key can be used to run up charges on your Google Cloud account.", fix: SECRET_FIX, example: SECRET_EXAMPLE },
+    "secrets/openai-key": { title: "OpenAI API key in source", severity: "block", audience: "agent", risk: "Anyone with the key can make API calls billed to your account.", fix: SECRET_FIX, example: SECRET_EXAMPLE },
+    "secrets/anthropic-key": { title: "Anthropic API key in source", severity: "block", audience: "agent", risk: "Anyone with the key can make API calls billed to your account.", fix: SECRET_FIX, example: SECRET_EXAMPLE },
+    "secrets/cloudflare-token": { title: "Cloudflare API token in source", severity: "block", audience: "agent", risk: "The token can change your DNS, Workers, and storage.", fix: SECRET_FIX, example: SECRET_EXAMPLE },
+    "secrets/sendgrid-key": { title: "SendGrid API key in source", severity: "block", audience: "agent", risk: "The key can send email as you.", fix: SECRET_FIX, example: SECRET_EXAMPLE },
+    "secrets/private-key": { title: "Private key in source", severity: "block", audience: "agent", risk: "A private key in the repository lets anyone impersonate the service it belongs to.", fix: "Delete the key file from the repository and keep keys in secrets. If it was ever committed, generate a new key.", example: { wrong: "-----BEGIN RSA PRIVATE KEY----- in a committed file", right: "The key lives in a platform secret and is read at runtime" } },
+    "secrets/jwt": { title: "Signed token in source", severity: "block", audience: "agent", risk: "A token in the code may still be valid and grant access to whatever issued it.", fix: "Remove it. Tokens are issued at runtime; nothing in source should carry one.", example: SECRET_EXAMPLE },
+    "secrets/nerdsystem-token": { title: "nerdsystem token in source", severity: "block", audience: "agent", risk: "A platform token in the code lets anyone deploy or change this project.", fix: "Remove it and revoke it in the dashboard under API tokens. The CLI stores tokens outside the project.", example: SECRET_EXAMPLE },
+    "secrets/db-url-with-password": { title: "Database URL with password in source", severity: "block", audience: "agent", risk: "The password gives full access to that database.", fix: SECRET_FIX, example: SECRET_EXAMPLE },
+    "secrets/generic-assignment": { title: "Hard-coded credential", severity: "block", audience: "agent", risk: "A value assigned to something named key, secret, token, or password ships to everyone who can read the code.", fix: SECRET_FIX, example: SECRET_EXAMPLE },
+    "secrets/env-file-committed": { title: "Environment file in the repository", severity: "block", audience: "agent", risk: "An .env file in git carries every secret in it to everyone with repository access.", fix: "Delete the file from the repository, add it to .gitignore, and keep local values in .dev.vars.", example: { wrong: ".env committed", right: ".env in .gitignore; values in .dev.vars and platform secrets" } },
+    "secrets/dev-vars-committed": { title: ".dev.vars in the repository", severity: "block", audience: "agent", risk: ".dev.vars holds the platform secrets for local development.", fix: "Remove it from the repository and keep it in .gitignore." },
+    "secrets/gitignore-dev-vars": { title: ".gitignore does not list .dev.vars", severity: "warn", audience: "agent", risk: "A future commit could include local secrets by accident.", fix: "Add a line `.dev.vars` to .gitignore." },
+    "secrets/rotate-committed-secret": { title: "A committed secret must be rotated", severity: "block", audience: "human", risk: "Removing a secret from the code does not remove it from git history; anyone who fetched the repository still has it.", fix: "Rotate the credential at the provider that issued it (create a new one, update the platform secret, revoke the old one). Then the agent can remove it from the code.", example: { wrong: "Delete the line and commit", right: "Rotate at the provider first, then delete the line" } },
+    "bundle/known-secret-in-client": { title: "A server secret is in the client bundle", severity: "block", audience: "agent", risk: "A value from .dev.vars is compiled into JavaScript that every visitor downloads.", fix: "Only VITE_-prefixed variables belong in the client, and none of them may be secrets. Move the call that needs the secret to a server route.", example: { wrong: "fetch(api, { headers: { Authorization: import.meta.env.VITE_API_SECRET } })", right: "app.post('/api/thing', async (c) => fetch(api, { headers: { Authorization: c.env.API_SECRET } }))" } },
+    "bundle/known-secret-in-server": { title: "A local secret value is in the server bundle", severity: "block", audience: "agent", risk: "A value that should come from platform secrets is hard-coded in the built server.", fix: "Read it from c.env instead of embedding it." },
+    "bundle/vite-secret-exposed": { title: "A VITE_ variable looks like a secret", severity: "block", audience: "agent", risk: "VITE_ variables are public: this one is compiled into the client where anyone can read it.", fix: "Rename it without the VITE_ prefix, set it as a server secret, and use it only in server code.", example: { wrong: "VITE_STRIPE_SECRET_KEY=sk_live_...", right: "STRIPE_SECRET_KEY as a platform secret, read on the server" } },
+    "deps/lockfile-required": { title: "No lockfile", severity: "block", audience: "agent", risk: "Without a lockfile every install can pull different versions, so what passed checks is not what deploys.", fix: "Run `pnpm install` and commit pnpm-lock.yaml." },
+    "deps/critical-vulnerability": { title: "Dependency with a critical vulnerability", severity: "block", audience: "agent", risk: "A known, exploitable bug in a package your app ships.", fix: "Update the package to a fixed version (`pnpm update <name>`), or replace it if no fix exists. Dependabot pull requests do this automatically.", example: { wrong: '"lodash": "4.17.15"', right: '"lodash": "^4.17.21"' } },
+    "deps/high-vulnerability": { title: "Dependency with a high-severity advisory", severity: "warn", audience: "agent", risk: "A known bug in a package your app ships; exploitable in some setups.", fix: "Update the package when a fixed version exists." },
+    "deps/advisory": { title: "Dependency advisory", severity: "info", audience: "agent", risk: "A known issue of lower severity.", fix: "Update when convenient." },
+    "deps/audit-unavailable": { title: "Dependency audit could not run", severity: "warn", audience: "human", risk: "Vulnerable packages would not be detected this run.", fix: "Check network access and the package manager, then run `nerd verify` again." },
+    "rules/platform": { title: "Platform rule", severity: "block", audience: "agent", risk: "The app would not run correctly on the platform.", fix: "Follow the instruction in the finding; the rules are listed in the nerdsystem skill." },
+    "rules/advisory": { title: "Platform advisory", severity: "warn", audience: "agent", risk: "Not blocking, but the project is missing something the platform expects.", fix: "Follow the instruction in the finding." },
+    "typecheck/error": { title: "TypeScript error", severity: "block", audience: "agent", risk: "The code would not compile reliably; the build may fail or behave unexpectedly.", fix: "Fix the type error at the file and line shown. Run `npx tsc -b` for the full message." },
+    "typecheck/failed": { title: "Typecheck failed", severity: "block", audience: "agent", risk: "The project does not compile.", fix: "Run `npx tsc -b` and fix the errors it prints." },
+    "policy/blocked-package": { title: "Package not allowed", severity: "block", audience: "agent", risk: "The package is a miner, proxy, or headless browser, which the acceptable use policy forbids and the platform cannot run.", fix: "Remove the package and the code that uses it. If the app genuinely needs a browser or scraping, say so to the person; it is not supported here." },
+    "policy/mining-pool": { title: "Mining pool reference", severity: "block", audience: "human", risk: "The code references a cryptocurrency mining pool, which is forbidden by the acceptable use policy.", fix: "Remove it. If this is unexpected, inspect the file: it may have been added by a compromised dependency." },
+    "policy/worker-size": { title: "Server bundle too large", severity: "block", audience: "agent", risk: "The server bundle exceeds the platform limit and cannot be deployed.", fix: "Remove large dependencies from server code, or load big data from storage at runtime instead of bundling it." },
+    "policy/assets-size": { title: "Static assets too large", severity: "block", audience: "agent", risk: "The client assets exceed the platform limit.", fix: "Move large files to the app's storage bucket and serve them from there." },
+    "pii/log-credentials": { title: "Logging something that looks like a credential", severity: "warn", audience: "agent", risk: "Passwords, tokens, or cookies written to logs are visible to anyone who can read logs.", fix: "Log an identifier instead of the value.", example: { wrong: 'console.log("login", body.password)', right: 'console.log("login attempt", user.id)' } },
+    "pii/log-request-body": { title: "Logging a request body", severity: "warn", audience: "agent", risk: "Request bodies often carry personal data; logging them keeps copies you did not mean to keep.", fix: "Log only the fields you need, never the whole body." },
+    "pii/email-in-query-string": { title: "Email address in a URL", severity: "warn", audience: "agent", risk: "URLs end up in browser history, logs, and referrer headers.", fix: "Send it in the request body or use an id." },
+    "pii/plaintext-password-column": { title: "A password column in the schema", severity: "warn", audience: "agent", risk: "Storing passwords yourself is unnecessary here and easy to get wrong.", fix: "Remove the column; the platform handles passwords. If you must store a secret, store a hash." },
+    "pii/unscoped-user-table": { title: "Query on user data without a user filter", severity: "warn", audience: "agent", risk: "One user could see or change another user's rows.", fix: "Add .where(eq(table.userId, c.var.user.id)) to every read and write on tables with a user_id column.", example: { wrong: "db.select().from(schema.notes).all()", right: "db.select().from(schema.notes).where(eq(schema.notes.userId, c.var.user!.id)).all()" } },
+    "pii/wildcard-cors": { title: "Wildcard CORS with cookies", severity: "warn", audience: "agent", risk: "Any website could call your API with the visitor's cookies.", fix: "Remove the wildcard. Same-origin requests need no CORS headers." },
+    "suppressions/ignore-comment": { title: "A scanner ignore comment was added", severity: "block", audience: "human", risk: "Ignore comments turn off a check for that line. They are sometimes right and sometimes a way to hide a problem.", fix: "Review the line in the dashboard and approve the suppression if it is correct; the agent must not add or approve suppressions itself." },
+    "suppressions/ignore-file": { title: "A scanner ignore file was changed", severity: "block", audience: "human", risk: "Ignore files silence checks across the whole project.", fix: "Review the change in the dashboard and approve it if it is correct." },
+    "suppressions/gate-config": { title: "Gate configuration was changed", severity: "block", audience: "human", risk: "Changing gate settings can disable checks for every future deploy.", fix: "Review the change in the dashboard and approve it if it is correct." },
+    "gates/retry-cap": { title: "Automatic fixing stopped after three attempts", severity: "block", audience: "human", risk: "The same rule has failed three runs in a row; further automatic attempts are unlikely to help and may make things worse.", fix: "Read the findings above and decide: fix it by hand, ask the agent a different way, or approve a suppression in the dashboard if the finding is wrong." },
+    "smoke/unreachable": { title: "Deployed app did not respond", severity: "block", audience: "human", risk: "The app is not serving requests.", fix: "Check `nerd logs` for startup errors and the deployment status." },
+    "smoke/header-missing": { title: "A security header is missing", severity: "warn", audience: "agent", risk: "Browsers lose a protection against clickjacking, content sniffing, or script injection.", fix: "Keep createNerdApp()'s default security headers; if you disabled them, re-enable or set the header yourself." },
+    "smoke/auth-me": { title: "Session endpoint misbehaves", severity: "block", audience: "agent", risk: "Visitors cannot tell whether they are signed in, so the app's login flow is broken.", fix: "/api/auth/me must return 200 with {user:null} when signed out. Do not override the SDK's auth routes." },
+    "smoke/auth-login": { title: "Wrong credentials are not rejected", severity: "block", audience: "agent", risk: "The login endpoint does not return 401 for a wrong password.", fix: "Do not override the SDK's /api/auth/login route." },
+};
+/** Fallback for scanner rule ids not in the catalog (semgrep and gitleaks have their own). */
+export function ruleFor(id, fallback = {}) {
+    return RULES[id] ?? { title: fallback.title ?? id, severity: fallback.severity ?? "warn", audience: fallback.audience ?? "agent", risk: fallback.risk ?? "A scanner flagged this pattern.", fix: fallback.fix ?? "Review the line and change the pattern; see the scanner's documentation for the rule." };
+}

package/dist/gates/secrets.d.ts

@@ -0,0 +1,11 @@
+import { type Finding, type Gate } from "./types.js";
+export { mask } from "./text.js";
+export declare function fingerprint(...parts: (string | number | undefined)[]): string;
+export declare function finding(ruleId: string, extra: Partial<Finding> & {
+    file?: string | undefined;
+    line?: number | undefined;
+}): Finding;
+export declare function scanText(text: string, file: string): Finding[];
+export declare const secretsGate: Gate;
+/** Built output must not carry server secrets or anything that looks like one. */
+export declare const bundleGate: Gate;

package/dist/gates/secrets.js

@@ -0,0 +1,98 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { exec } from "./code.js";
+import { sourceFiles } from "./fs.js";
+import { findSecrets, mask } from "./text.js";
+import { RULES } from "./rules.js";
+import { counts, result, verdict } from "./types.js";
+export { mask } from "./text.js";
+export function fingerprint(...parts) {
+    return createHash("sha256").update(parts.map((p) => String(p ?? "")).join("\u0000")).digest("hex").slice(0, 16);
+}
+export function finding(ruleId, extra) {
+    const def = RULES[ruleId];
+    if (!def)
+        throw new Error(`unknown rule ${ruleId}`);
+    return {
+        rule_id: ruleId,
+        severity: def.severity,
+        audience: def.audience,
+        risk: def.risk,
+        fix: def.fix,
+        verify: `nerd verify --rule ${ruleId}`,
+        attempt: 1,
+        ...extra,
+        fingerprint: extra.fingerprint ?? fingerprint(ruleId, extra.file, extra.line),
+    };
+}
+export function scanText(text, file) {
+    return findSecrets(text, file).map((h) => finding(`secrets/${h.rule}`, { file: h.file, line: h.line, masked: h.masked }));
+}
+async function isTracked(root, file) {
+    if (!existsSync(path.join(root, ".git")))
+        return false;
+    const r = await exec("git", ["ls-files", "--error-unmatch", "--", file], root);
+    return r.code === 0;
+}
+export const secretsGate = {
+    name: "secrets",
+    title: "No secrets in source",
+    blocking: true,
+    rulePrefixes: ["secrets/"],
+    async run(ctx) {
+        const t = Date.now();
+        const findings = [];
+        for (const f of sourceFiles(ctx.root)) {
+            if (/(^|\/)\.env(\.|$)/.test(f.rel) && !f.rel.endsWith(".example") && !f.rel.endsWith(".dev.vars.example"))
+                findings.push(finding("secrets/env-file-committed", { file: f.rel }));
+            if (/(^|\/)\.dev\.vars$/.test(f.rel))
+                findings.push(finding("secrets/dev-vars-committed", { file: f.rel }));
+            if (f.rel.endsWith(".example"))
+                continue;
+            findings.push(...scanText(f.text, f.rel));
+        }
+        const gitignore = path.join(ctx.root, ".gitignore");
+        if (!existsSync(gitignore) || !/\.dev\.vars/.test(readFileSync(gitignore, "utf8")))
+            findings.push(finding("secrets/gitignore-dev-vars", { file: ".gitignore" }));
+        // A secret in a committed file is already in history: removing it is not enough, a person must rotate it.
+        const credentialFiles = Array.from(new Set(findings.filter((f) => f.file && f.masked).map((f) => f.file)));
+        for (const file of credentialFiles) {
+            if (ctx.committed || (await isTracked(ctx.root, file))) {
+                const first = findings.find((f) => f.file === file && f.masked);
+                findings.push(finding("secrets/rotate-committed-secret", { file, line: first.line, masked: first.masked }));
+            }
+        }
+        return result(this, verdict(findings), findings.length ? counts(findings) : "No credentials found in source", findings, t);
+    },
+};
+/** Built output must not carry server secrets or anything that looks like one. */
+export const bundleGate = {
+    name: "bundle",
+    title: "No secrets in the built bundle",
+    blocking: true,
+    rulePrefixes: ["bundle/", "secrets/"],
+    async run(ctx) {
+        const t = Date.now();
+        if (!ctx.build)
+            return result(this, "skip", "No build output to scan", [], t);
+        const findings = [];
+        const scan = (rel, text, isClient) => {
+            findings.push(...scanText(text, rel));
+            for (const secret of ctx.knownSecrets ?? []) {
+                if (secret.length >= 12 && text.includes(secret))
+                    findings.push(finding(isClient ? "bundle/known-secret-in-client" : "bundle/known-secret-in-server", { file: rel, masked: mask(secret) }));
+            }
+            if (isClient && /VITE_[A-Z0-9_]*(SECRET|PRIVATE|PASSWORD|TOKEN|API_KEY)[A-Z0-9_]*/.test(text))
+                findings.push(finding("bundle/vite-secret-exposed", { file: rel }));
+        };
+        for (const m of ctx.build.modules)
+            if (/\.(js|mjs)$/.test(m))
+                scan(`dist/worker/${m}`, readFileSync(path.join(ctx.build.workerDir, m), "utf8"), false);
+        if (ctx.build.assetsDir)
+            for (const a of ctx.build.assets)
+                if (/\.(js|mjs|html|css|json|map)$/.test(a))
+                    scan(`dist/client/${a}`, readFileSync(path.join(ctx.build.assetsDir, a), "utf8"), true);
+        return result(this, verdict(findings), findings.length ? counts(findings) : "Built output is clean", findings, t);
+    },
+};

package/dist/gates/suppressions.d.ts

@@ -0,0 +1,2 @@
+import { type Gate } from "./types.js";
+export declare const suppressionsGate: Gate;

package/dist/gates/suppressions.js

@@ -0,0 +1,57 @@
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { lineOf, sourceFiles } from "./fs.js";
+import { fingerprint, finding } from "./secrets.js";
+import { counts, result, verdict } from "./types.js";
+/**
+ * Suppressions need a human. Any ignore comment, ignore file, or gate configuration in the tree is
+ * reported with audience "human" and keeps being reported on every run until its fingerprint is
+ * approved in the dashboard. The agent is never the one who decides a check does not apply.
+ */
+const IGNORE_COMMENT = /(nerd-ignore|nosemgrep|semgrep-ignore|gitleaks:allow|nerd-allow)\b/g;
+const IGNORE_FILES = [".gitleaksignore", ".semgrepignore", ".nerdignore", ".gitleaks.toml", ".semgrep.yml", ".semgrep.yaml"];
+export const suppressionsGate = {
+    name: "suppressions",
+    title: "Scanner suppressions",
+    blocking: true,
+    rulePrefixes: ["suppressions/"],
+    async run(ctx) {
+        const t = Date.now();
+        const findings = [];
+        const approved = ctx.approvedSuppressions ?? new Set();
+        const add = (f) => {
+            if (approved.has(f.fingerprint))
+                findings.push({ ...f, severity: "info", audience: "agent", risk: `${f.risk} This one was approved in the dashboard.`, fix: "No action." });
+            else
+                findings.push(f);
+        };
+        for (const f of sourceFiles(ctx.root)) {
+            if (!/\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs)$/.test(f.rel))
+                continue;
+            IGNORE_COMMENT.lastIndex = 0;
+            let m;
+            while ((m = IGNORE_COMMENT.exec(f.text))) {
+                const line = lineOf(f.text, m.index);
+                const lineText = f.text.split("\n")[line - 1] ?? "";
+                add(finding("suppressions/ignore-comment", { file: f.rel, line, fingerprint: fingerprint("ignore-comment", f.rel, lineText.trim()) }));
+            }
+        }
+        for (const name of IGNORE_FILES) {
+            const p = path.join(ctx.root, name);
+            if (existsSync(p))
+                add(finding("suppressions/ignore-file", { file: name, fingerprint: fingerprint("ignore-file", name, readFileSync(p, "utf8")) }));
+        }
+        const nerdJson = path.join(ctx.root, "nerd.json");
+        if (existsSync(nerdJson)) {
+            try {
+                const cfg = JSON.parse(readFileSync(nerdJson, "utf8"));
+                if (cfg.gates !== undefined)
+                    add(finding("suppressions/gate-config", { file: "nerd.json", fingerprint: fingerprint("gate-config", JSON.stringify(cfg.gates)) }));
+            }
+            catch {
+                // nerd.json problems are reported by the rules gate
+            }
+        }
+        return result(this, verdict(findings), findings.length ? counts(findings) : "No suppressions", findings, t);
+    },
+};

package/dist/gates/text.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The parts of the gates that work on text alone: no filesystem, no child processes, no Node
+ * imports. The CLI, the builder, and the control plane's public repo scanner all use these, so a
+ * pattern added here is caught everywhere.
+ */
+/** Known credential formats. Each must be specific enough to avoid matching ordinary code. */
+export declare const SECRET_PATTERNS: {
+    rule: string;
+    re: RegExp;
+}[];
+export declare function isAllowedLine(line: string): boolean;
+/** Type and last four characters only: "sk_live_****4f2a". Never the value. */
+export declare function mask(match: string): string;
+export declare function lineAt(text: string, index: number): number;
+export interface SecretHit {
+    /** Rule id without the "secrets/" prefix. */
+    rule: string;
+    file: string;
+    line: number;
+    masked: string;
+}
+/** Every credential-shaped value in a text, one hit per line, masked. */
+export declare function findSecrets(text: string, file: string, limit?: number): SecretHit[];
+/** Packages that exist to mine, proxy, or drive browsers from a customer Worker, and known pool hosts. */
+export declare const BLOCKED_PACKAGES: Set<string>;
+export declare const MINING_POOLS: RegExp;
+/** Files that must never be committed. */
+export declare const ENV_FILES: RegExp;
+/** Source files worth scanning for text patterns; everything else is skipped as binary or generated. */
+export declare const TEXT_FILE: RegExp;
+export declare const SKIP_DIR: RegExp;

package/dist/gates/text.js

@@ -0,0 +1,72 @@
+/**
+ * The parts of the gates that work on text alone: no filesystem, no child processes, no Node
+ * imports. The CLI, the builder, and the control plane's public repo scanner all use these, so a
+ * pattern added here is caught everywhere.
+ */
+/** Known credential formats. Each must be specific enough to avoid matching ordinary code. */
+export const SECRET_PATTERNS = [
+    { rule: "aws-access-key", re: /\b(AKIA|ASIA)[A-Z0-9]{16}\b/g },
+    { rule: "github-token", re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g },
+    { rule: "github-pat", re: /\bgithub_pat_[A-Za-z0-9_]{80,}\b/g },
+    { rule: "stripe-secret", re: /\b(sk|rk)_(live|test)_[A-Za-z0-9]{20,}\b/g },
+    { rule: "stripe-webhook", re: /\bwhsec_[A-Za-z0-9]{20,}\b/g },
+    { rule: "slack-token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+    { rule: "google-api-key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+    { rule: "openai-key", re: /\bsk-(proj-)?[A-Za-z0-9_-]{32,}\b/g },
+    { rule: "anthropic-key", re: /\bsk-ant-[A-Za-z0-9_-]{32,}\b/g },
+    { rule: "cloudflare-token", re: /\bv1\.0-[a-f0-9]{24}-[a-f0-9]{144}\b/g },
+    { rule: "sendgrid-key", re: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/g },
+    { rule: "private-key", re: /-----BEGIN (RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY( BLOCK)?-----/g },
+    { rule: "jwt", re: /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g },
+    { rule: "nerdsystem-token", re: /\bn(sk|as|bt|rt|ss|pr|iv)_[a-z0-9]{40}\b/g },
+    { rule: "db-url-with-password", re: /\b(postgres|postgresql|mysql|mongodb(\+srv)?|redis):\/\/[^:\s/]+:[^@\s/]{4,}@/g },
+    { rule: "generic-assignment", re: /\b(api[_-]?key|secret|password|passwd|token|client[_-]?secret)\b\s*[:=]\s*["'`]([A-Za-z0-9+/_=.-]{24,})["'`]/gi },
+];
+const ALLOW = [/example/i, /placeholder/i, /your[-_ ]?key/i, /xxxx/i, /\$\{/, /process\.env/, /c\.env\./, /import\.meta\.env/, /nsk_\.\.\./];
+export function isAllowedLine(line) {
+    return ALLOW.some((a) => a.test(line));
+}
+/** Type and last four characters only: "sk_live_****4f2a". Never the value. */
+export function mask(match) {
+    const compact = match.replace(/\s+/g, "");
+    const prefix = /^[A-Za-z0-9]+[_-]/.exec(compact)?.[0] ?? compact.slice(0, 4);
+    return `${prefix}****${compact.slice(-4)}`;
+}
+export function lineAt(text, index) {
+    let line = 1;
+    for (let i = 0; i < index && i < text.length; i++)
+        if (text.charCodeAt(i) === 10)
+            line++;
+    return line;
+}
+/** Every credential-shaped value in a text, one hit per line, masked. */
+export function findSecrets(text, file, limit = 50) {
+    const hits = [];
+    const hitLines = new Set();
+    const lines = text.split("\n");
+    for (const p of SECRET_PATTERNS) {
+        p.re.lastIndex = 0;
+        let m;
+        while ((m = p.re.exec(text))) {
+            const line = lineAt(text, m.index);
+            if (hitLines.has(line))
+                continue;
+            if (isAllowedLine(lines[line - 1] ?? ""))
+                continue;
+            hitLines.add(line);
+            const matched = p.rule === "generic-assignment" ? (m[2] ?? m[0]) : m[0];
+            hits.push({ rule: p.rule, file, line, masked: p.rule === "private-key" ? "private key" : mask(matched) });
+            if (hits.length >= limit)
+                return hits;
+        }
+    }
+    return hits;
+}
+/** Packages that exist to mine, proxy, or drive browsers from a customer Worker, and known pool hosts. */
+export const BLOCKED_PACKAGES = new Set(["coin-hive", "coinhive", "cryptonight-wasm", "xmrig", "webminer", "tor-request", "proxy-chain", "http-mitm-proxy", "puppeteer", "playwright"]);
+export const MINING_POOLS = /(stratum\+tcp:\/\/|pool\.minexmr|supportxmr\.com|nanopool\.org|2miners\.com)/i;
+/** Files that must never be committed. */
+export const ENV_FILES = /(^|\/)(\.env(\.[A-Za-z0-9_-]+)?|\.dev\.vars(\.[A-Za-z0-9_-]+)?)$/;
+/** Source files worth scanning for text patterns; everything else is skipped as binary or generated. */
+export const TEXT_FILE = /(\.(ts|tsx|js|jsx|mjs|cjs|json|jsonc|toml|yaml|yml|env|vars|md|html|css|sql|py|rb|go|rs|java|kt|swift|php|sh|txt|cfg|ini|conf|xml)|(^|\/)(README|LICENSE|Dockerfile|Makefile|Procfile|\.gitignore|\.npmrc))$/i;
+export const SKIP_DIR = /(^|\/)(node_modules|dist|build|\.git|\.wrangler|\.next|\.nuxt|coverage|vendor|target)(\/|$)/;

package/dist/gates/tools.d.ts

@@ -0,0 +1,5 @@
+import { type Gate } from "./types.js";
+/** gitleaks over the working tree. Complements the built-in scanner with its larger rule set. */
+export declare const gitleaksGate: Gate;
+/** Semgrep with the nerdsystem rule set. ERROR rules block, WARNING rules advise. */
+export declare const semgrepGate: Gate;

package/dist/gates/tools.js

@@ -0,0 +1,69 @@
+import { existsSync, readFileSync, unlinkSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { exec, hasTool } from "./code.js";
+import { ruleFor } from "./rules.js";
+import { fingerprint, mask } from "./secrets.js";
+import { counts, result, verdict } from "./types.js";
+/** gitleaks over the working tree. Complements the built-in scanner with its larger rule set. */
+export const gitleaksGate = {
+    name: "gitleaks",
+    title: "Secret scan (gitleaks)",
+    blocking: true,
+    rulePrefixes: ["gitleaks/"],
+    async run(ctx) {
+        const t = Date.now();
+        if (!(await hasTool("gitleaks")))
+            return result(this, "skip", "gitleaks not installed; built-in scan still ran", [], t, "gitleaks");
+        const report = path.join(ctx.root, ".nerd-gitleaks.json");
+        const r = await exec("gitleaks", ["dir", ctx.root, "--no-banner", "--exit-code", "2", "--report-format", "json", "--report-path", report], ctx.root);
+        const findings = [];
+        try {
+            if (existsSync(report)) {
+                const json = JSON.parse(readFileSync(report, "utf8"));
+                for (const f of json.slice(0, 50)) {
+                    const rule_id = `gitleaks/${f.RuleID}`;
+                    const def = ruleFor(rule_id, { title: f.RuleID, severity: "block", risk: "A credential of this type is in the source. Anyone with read access to the code can use it.", fix: "Remove the value from the code and read it from a platform secret. If it was committed, rotate it at the provider." });
+                    const file = path.relative(ctx.root, f.File).split(path.sep).join("/");
+                    findings.push({ rule_id, severity: def.severity, audience: def.audience, file, line: f.StartLine, risk: def.risk, fix: def.fix, verify: `nerd verify --rule ${rule_id}`, attempt: 1, masked: f.Secret ? mask(f.Secret) : undefined, fingerprint: fingerprint(rule_id, file, f.StartLine) });
+                }
+                unlinkSync(report);
+            }
+        }
+        catch {
+            // no report means no findings
+        }
+        if (r.code !== 0 && r.code !== 2)
+            return result(this, "warn", "gitleaks could not run", [], t, "gitleaks");
+        return result(this, verdict(findings), findings.length ? counts(findings) : "No secrets found", findings, t, "gitleaks");
+    },
+};
+/** Semgrep with the nerdsystem rule set. ERROR rules block, WARNING rules advise. */
+export const semgrepGate = {
+    name: "semgrep",
+    title: "Static analysis (semgrep)",
+    blocking: true,
+    rulePrefixes: ["semgrep/"],
+    async run(ctx) {
+        const t = Date.now();
+        if (!(await hasTool("semgrep")))
+            return result(this, "skip", "semgrep not installed", [], t, "semgrep");
+        const rules = process.env.NERD_SEMGREP_RULES ?? path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../rules/semgrep.yml");
+        const r = await exec("semgrep", ["scan", "--config", rules, "--json", "--quiet", "--metrics", "off", "--exclude", "node_modules", "--exclude", "dist", "src"], ctx.root);
+        const findings = [];
+        try {
+            const json = JSON.parse(r.stdout);
+            for (const x of json.results.slice(0, 100)) {
+                const short = x.check_id.split(".").pop() ?? x.check_id;
+                const rule_id = `semgrep/${short}`;
+                // Our own rule messages are templates we wrote; they carry no repository text.
+                const def = ruleFor(rule_id, { title: short, severity: x.extra.severity === "ERROR" ? "block" : "warn", risk: x.extra.message, fix: "Change the pattern at the file and line shown; the rule message says what to use instead." });
+                findings.push({ rule_id, severity: def.severity, audience: def.audience, file: x.path, line: x.start.line, risk: def.risk, fix: def.fix, verify: `nerd verify --rule ${rule_id}`, attempt: 1, fingerprint: fingerprint(rule_id, x.path, x.start.line) });
+            }
+        }
+        catch {
+            return result(this, "warn", "semgrep could not run", [], t, "semgrep");
+        }
+        return result(this, verdict(findings), findings.length ? counts(findings) : "No findings", findings, t, "semgrep");
+    },
+};

package/dist/gates/types.d.ts

@@ -0,0 +1,72 @@
+/**
+ * One gate = one named check with a verdict and a list of failures the coding agent can act on.
+ * Every failure is written for a beginner: what could happen (risk), what to change (fix), and how
+ * to confirm it (verify). Text comes from rule templates, never from repository content, so a
+ * malicious repo cannot plant instructions. Secrets are reported masked.
+ */
+export type GateStatus = "pass" | "warn" | "fail" | "skip";
+export type Severity = "block" | "warn" | "info";
+export type Audience = "agent" | "human";
+export interface Finding {
+    /** Namespaced rule id, e.g. secrets/aws-access-key. */
+    rule_id: string;
+    severity: Severity;
+    /** Who should act. "human" for things an agent must not or cannot do (rotating a leaked key, approving a suppression). */
+    audience: Audience;
+    file?: string | undefined;
+    line?: number | undefined;
+    /** What could happen if this ships. One or two sentences, plain words. */
+    risk: string;
+    /** What to change. Concrete, no repository strings. */
+    fix: string;
+    /** The command that confirms the fix. */
+    verify: string;
+    /** How many consecutive runs this rule has failed, maintained by the runner. */
+    attempt: number;
+    /** For credentials: type and last four characters only, e.g. "sk_live_****4f2a". */
+    masked?: string | undefined;
+    /** Stable id for suppression approvals. */
+    fingerprint?: string | undefined;
+}
+export interface GateResult {
+    name: string;
+    title: string;
+    status: GateStatus;
+    summary: string;
+    findings: Finding[];
+    durationMs: number;
+    /** Which tool produced it: "builtin" or an external scanner name. */
+    tool: string;
+}
+export interface GateContext {
+    root: string;
+    /** Built output, when the build gate has run. */
+    build?: {
+        workerDir: string;
+        modules: string[];
+        assetsDir: string | undefined;
+        assets: string[];
+    } | undefined;
+    /** Secret values known to be server-side (from .dev.vars) so their presence in client assets can be flagged. */
+    knownSecrets?: string[] | undefined;
+    /** Fingerprints of suppressions a human approved in the dashboard. */
+    approvedSuppressions?: Set<string> | undefined;
+    /** Run only rules whose id starts with one of these (e.g. ["secrets/"]); empty = all. */
+    onlyRules?: string[] | undefined;
+    /** Whether files in this tree are committed to git (builds) or may be uncommitted (local). */
+    committed?: boolean | undefined;
+    log: (line: string) => void;
+}
+export interface Gate {
+    name: string;
+    title: string;
+    /** Gates that fail stop the pipeline; warn-only gates never block. */
+    blocking: boolean;
+    /** Rule id prefixes this gate can emit; used by onlyRules. */
+    rulePrefixes: string[];
+    run(ctx: GateContext): Promise<GateResult>;
+}
+export declare function result(gate: Gate, status: GateStatus, summary: string, findings: Finding[], startedAt: number, tool?: string): GateResult;
+/** Status from findings: any block = fail, any warn = warn, else pass. */
+export declare function verdict(findings: Finding[]): GateStatus;
+export declare function counts(findings: Finding[]): string;

package/dist/gates/types.js

@@ -0,0 +1,18 @@
+export function result(gate, status, summary, findings, startedAt, tool = "builtin") {
+    return { name: gate.name, title: gate.title, status, summary, findings, durationMs: Date.now() - startedAt, tool };
+}
+/** Status from findings: any block = fail, any warn = warn, else pass. */
+export function verdict(findings) {
+    if (findings.some((f) => f.severity === "block"))
+        return "fail";
+    if (findings.some((f) => f.severity === "warn"))
+        return "warn";
+    return "pass";
+}
+export function counts(findings) {
+    const b = findings.filter((f) => f.severity === "block").length;
+    const w = findings.filter((f) => f.severity === "warn").length;
+    if (!findings.length)
+        return "No findings";
+    return [b ? `${b} blocking` : "", w ? `${w} advisory` : "", findings.length - b - w ? `${findings.length - b - w} informational` : ""].filter(Boolean).join(", ");
+}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};