project-athena 0.2.0 → 0.3.0

package/dist/chunk-LEMPCNAY.js

@@ -0,0 +1,209 @@
+#!/usr/bin/env node
+import {
+  addRule,
+  listRules,
+  parseRules,
+  removeRule,
+  serializeRules,
+  updateRule
+} from "./chunk-3IS2X2Z7.js";
+import {
+  git
+} from "./chunk-OLPSEQS5.js";
+import {
+  scanText
+} from "./chunk-JCGDR4UV.js";
+import {
+  isBlockModified,
+  parseBlocks
+} from "./chunk-673EPYYH.js";
+import {
+  KNOWLEDGE_DOCS
+} from "./chunk-FQEGEVLY.js";
+import {
+  athenaDir,
+  readState
+} from "./chunk-2DY4PUR4.js";
+import {
+  readTextIfExists,
+  sha256,
+  writeFileAtomic
+} from "./chunk-IQQBAWSM.js";
+import {
+  AthenaError,
+  conflict,
+  notFound
+} from "./chunk-AD4OZCU2.js";
+
+// src/services/rules.ts
+import path2 from "path";
+
+// src/services/knowledge.ts
+import path from "path";
+var MAX_DOC_BYTES = 1e6;
+function resolveDoc(id) {
+  const doc = KNOWLEDGE_DOCS.find((d) => d.id === id);
+  if (!doc) throw notFound(`Unknown knowledge document: ${id.slice(0, 64)}`);
+  return doc;
+}
+function contentHash(text) {
+  return sha256(text).slice(0, 16);
+}
+function segmentDocument(text) {
+  const segments = [];
+  let cursor = 0;
+  for (const b of parseBlocks(text)) {
+    const before = text.slice(cursor, b.start);
+    if (before.trim()) segments.push({ kind: "developer", content: before });
+    segments.push({ kind: "generated", id: b.id, modified: isBlockModified(b), content: b.content });
+    cursor = b.end;
+  }
+  const rest = text.slice(cursor);
+  if (rest.trim()) segments.push({ kind: "developer", content: rest });
+  return segments;
+}
+async function meta(root, id, text) {
+  const doc = resolveDoc(id);
+  const st = await readState(athenaDir(root));
+  const ds = st.kind === "ok" ? st.state.documents[id] : void 0;
+  const blocks = text ? parseBlocks(text) : [];
+  return {
+    id,
+    file: doc.file,
+    title: doc.title,
+    purpose: doc.purpose,
+    present: text !== null,
+    bytes: text ? Buffer.byteLength(text) : 0,
+    hash: text === null ? null : contentHash(text),
+    lastGeneratedAt: ds?.lastGeneratedAt ?? (st.kind === "ok" && id === "rules" ? st.state.createdAt : null),
+    lastChangedAt: ds?.lastChangedAt ?? null,
+    generatedSections: blocks.length,
+    editedSections: blocks.filter(isBlockModified).map((b) => b.id)
+  };
+}
+async function listDocs(root) {
+  const out = [];
+  for (const d of KNOWLEDGE_DOCS) out.push(await meta(root, d.id, await readTextIfExists(path.join(athenaDir(root), d.file))));
+  return out;
+}
+async function readDoc(root, id) {
+  const doc = resolveDoc(id);
+  const text = await readTextIfExists(path.join(athenaDir(root), doc.file));
+  if (text === null) throw notFound(`${doc.file} does not exist. Run \`athena analyze\` to regenerate it.`);
+  return { ...await meta(root, doc.id, text), content: text, segments: segmentDocument(text) };
+}
+async function saveDoc(root, id, content, baseHash) {
+  const doc = resolveDoc(id);
+  if (typeof content !== "string") throw new AthenaError("content must be a string");
+  if (Buffer.byteLength(content) > MAX_DOC_BYTES) throw new AthenaError(`Document exceeds ${MAX_DOC_BYTES} bytes`, void 0, 1, "unprocessable");
+  const file = path.join(athenaDir(root), doc.file);
+  const current = await readTextIfExists(file);
+  const currentHash = current === null ? null : contentHash(current);
+  if (currentHash !== baseHash) {
+    throw conflict(`${doc.file} was changed on disk since you opened it.`, "Reload to see the latest version, then re-apply your edits.", { currentHash });
+  }
+  const secrets = scanText(content);
+  if (secrets.length) {
+    throw new AthenaError(
+      `Refusing to save: ${secrets.length} likely secret(s) found (${[...new Set(secrets.map((s) => s.type))].join(", ")}).`,
+      "Knowledge files must never contain secrets. Replace values with placeholders such as <configured externally>.",
+      1,
+      "unprocessable",
+      { secrets: secrets.map((s) => ({ type: s.type, line: s.line })) }
+    );
+  }
+  const normalized = content.replace(/\r\n/g, "\n");
+  await writeFileAtomic(file, normalized.endsWith("\n") ? normalized : `${normalized}
+`);
+  return readDoc(root, doc.id);
+}
+async function searchDocs(root, query, limit = 50) {
+  const q = query.trim().toLowerCase();
+  if (q.length < 2) return [];
+  const hits = [];
+  for (const d of KNOWLEDGE_DOCS) {
+    const text = await readTextIfExists(path.join(athenaDir(root), d.file));
+    if (!text) continue;
+    const lines = text.split("\n");
+    for (let i = 0; i < lines.length && hits.length < limit; i++) {
+      const line = lines[i];
+      if (line.startsWith("<!-- athena:")) continue;
+      if (line.toLowerCase().includes(q)) hits.push({ id: d.id, file: d.file, title: d.title, line: i + 1, text: line.trim().slice(0, 240) });
+    }
+    if (d.title.toLowerCase().includes(q) && !hits.some((h) => h.id === d.id)) hits.unshift({ id: d.id, file: d.file, title: d.title, line: 1, text: d.purpose });
+  }
+  return hits.slice(0, limit);
+}
+async function docHistory(root, id, limit = 50) {
+  const doc = resolveDoc(id);
+  const rel = `.athena/${doc.file}`;
+  const r = await git(root, ["log", `-n${limit}`, "--follow", "--format=%H%x1f%cI%x1f%s", "--", rel]);
+  if (!r.ok) return { available: false, reason: "Git history is not available (not a Git repository, or git is not installed).", entries: [] };
+  const entries = r.stdout.split("\n").filter(Boolean).map((l) => {
+    const [sha, date, subject] = l.split("");
+    return { sha, date, subject: subject ?? "" };
+  });
+  if (!entries.length) return { available: true, reason: `${rel} has not been committed yet.`, entries };
+  return { available: true, entries };
+}
+async function docAtRevision(root, id, sha) {
+  const doc = resolveDoc(id);
+  if (!/^[0-9a-f]{7,64}$/i.test(sha)) throw new AthenaError("Invalid revision");
+  const prefix = (await git(root, ["rev-parse", "--show-prefix"])).stdout.trim();
+  const r = await git(root, ["show", `${sha}:${prefix}.athena/${doc.file}`]);
+  if (!r.ok) throw notFound(`${doc.file} does not exist at revision ${sha.slice(0, 12)}`);
+  return r.stdout;
+}
+
+// src/services/rules.ts
+async function load(root) {
+  const file = path2.join(athenaDir(root), "rules.md");
+  const text = await readTextIfExists(file);
+  if (text === null) throw notFound(".athena/rules.md not found. Run `athena analyze` to recreate it.");
+  return { file, text, doc: parseRules(text) };
+}
+function view(text, doc) {
+  const rules = listRules(doc);
+  const sections = [.../* @__PURE__ */ new Set([...doc.lines.flatMap((l) => l.kind === "other" ? /^##\s+(.+?)\s*#*\s*$/.exec(l.raw)?.[1] ?? [] : []), ...rules.map((r) => r.section)])];
+  return { hash: contentHash(text), rules, sections };
+}
+async function getRules(root) {
+  const { text, doc } = await load(root);
+  return view(text, doc);
+}
+async function mutateRules(root, baseHash, fn) {
+  const { file, text, doc } = await load(root);
+  if (baseHash !== void 0 && baseHash !== contentHash(text)) {
+    throw conflict("rules.md changed since it was loaded.", "Reload the rules and try again.", { currentHash: contentHash(text) });
+  }
+  let next;
+  try {
+    next = fn(doc);
+  } catch (err) {
+    throw new AthenaError(err.message);
+  }
+  const out = serializeRules(next);
+  const secrets = scanText(out).filter((s) => !scanText(text).some((o) => o.fingerprint === s.fingerprint));
+  if (secrets.length) throw new AthenaError("Refusing to save a rule that appears to contain a secret.", "Rules must never contain credentials.", 1, "unprocessable");
+  await writeFileAtomic(file, out);
+  return view(out, next);
+}
+var rulesAdd = (root, baseHash, section, text) => mutateRules(root, baseHash, (d) => addRule(d, section, text));
+var rulesUpdate = (root, baseHash, index, patch) => mutateRules(root, baseHash, (d) => updateRule(d, index, patch));
+var rulesRemove = (root, baseHash, index) => mutateRules(root, baseHash, (d) => removeRule(d, index));
+
+export {
+  contentHash,
+  listDocs,
+  readDoc,
+  saveDoc,
+  searchDocs,
+  docHistory,
+  docAtRevision,
+  getRules,
+  mutateRules,
+  rulesAdd,
+  rulesUpdate,
+  rulesRemove
+};
+//# sourceMappingURL=chunk-LEMPCNAY.js.map

package/dist/chunk-LMOFZNTQ.js

@@ -0,0 +1,379 @@
+#!/usr/bin/env node
+import {
+  whichExecutable
+} from "./chunk-VSYBC3VY.js";
+import {
+  scanFilesForSecrets,
+  secretFingerprinter
+} from "./chunk-PANVPNYF.js";
+import {
+  walkProject
+} from "./chunk-ELKFRTZT.js";
+import {
+  loadConfig
+} from "./chunk-2DY4PUR4.js";
+
+// src/services/security.ts
+import { execFile } from "child_process";
+import { promises as fs } from "fs";
+import path from "path";
+var AuditToolError = class extends Error {
+};
+var asRecord = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : {};
+var isObject = (v) => Boolean(v) && typeof v === "object" && !Array.isArray(v);
+var sev = (s) => {
+  const v = String(s ?? "").toLowerCase();
+  if (v === "critical") return "critical";
+  if (v === "high") return "high";
+  if (v === "moderate" || v === "medium") return "moderate";
+  if (v === "low" || v === "info") return "low";
+  return "unrated";
+};
+function parseJsonObject(stdout, tool) {
+  const text = stdout.trim();
+  if (!text) throw new AuditToolError(`${tool} produced no output`);
+  const json = JSON.parse(text);
+  if (!isObject(json)) throw new AuditToolError(`${tool} produced unexpected output`);
+  return json;
+}
+function throwIfToolError(json, tool) {
+  if (json.error === void 0) return;
+  const e = asRecord(json.error);
+  const parts = [e.code, e.summary ?? e.message].filter((x) => typeof x === "string" && x.trim());
+  const text = parts.length ? parts.join(": ") : typeof json.error === "string" ? json.error : "unknown error";
+  throw new AuditToolError(`${tool} reported an error: ${text.split("\n")[0].slice(0, 200)}`);
+}
+function parseAdvisories(advisories) {
+  const out = [];
+  for (const [key, raw] of Object.entries(advisories)) {
+    const a = asRecord(raw);
+    const versions = [...new Set((Array.isArray(a.findings) ? a.findings : []).map((f) => asRecord(f).version).filter((v) => typeof v === "string"))];
+    const patched = typeof a.patched_versions === "string" ? a.patched_versions.trim() : "";
+    out.push({
+      package: String(a.module_name ?? "unknown"),
+      severity: sev(a.severity),
+      title: String(a.title ?? `Vulnerable dependency: ${String(a.module_name ?? key)}`),
+      id: typeof a.github_advisory_id === "string" ? a.github_advisory_id : Array.isArray(a.cves) && typeof a.cves[0] === "string" ? a.cves[0] : String(a.id ?? key),
+      url: typeof a.url === "string" ? a.url : void 0,
+      vulnerableRange: typeof a.vulnerable_versions === "string" ? a.vulnerable_versions + (versions.length ? ` (installed ${versions.join(", ")})` : "") : void 0,
+      fixAvailable: Boolean(patched) && patched !== "<0.0.0"
+    });
+  }
+  return out;
+}
+function parseNpmAudit(stdout) {
+  const json = parseJsonObject(stdout, "npm audit");
+  throwIfToolError(json, "npm audit");
+  if (!isObject(json.vulnerabilities)) {
+    if (isObject(json.advisories)) return parseAdvisories(json.advisories);
+    throw new AuditToolError('npm audit output has no "vulnerabilities" report');
+  }
+  const out = [];
+  for (const [name, raw] of Object.entries(json.vulnerabilities)) {
+    const v = asRecord(raw);
+    const via = Array.isArray(v.via) ? v.via : [];
+    const advisory = via.find((x) => x && typeof x === "object");
+    const viaNames = via.filter((x) => typeof x === "string");
+    out.push({
+      package: name,
+      severity: sev(v.severity),
+      title: String(advisory?.title ?? (viaNames.length ? `Depends on vulnerable ${viaNames.join(", ")}` : `Vulnerable dependency: ${name}`)),
+      id: advisory?.source !== void 0 ? String(advisory.source) : void 0,
+      url: typeof advisory?.url === "string" ? advisory.url : void 0,
+      vulnerableRange: typeof v.range === "string" ? v.range : void 0,
+      fixAvailable: Boolean(v.fixAvailable)
+    });
+  }
+  return out;
+}
+function parsePnpmAudit(stdout) {
+  const json = parseJsonObject(stdout, "pnpm audit");
+  throwIfToolError(json, "pnpm audit");
+  if (!isObject(json.advisories)) throw new AuditToolError('pnpm audit output has no "advisories" report');
+  return parseAdvisories(json.advisories);
+}
+function parsePipAudit(stdout) {
+  const text = stdout.trim();
+  if (!text) throw new AuditToolError("pip-audit produced no output");
+  const json = JSON.parse(text);
+  const deps = isObject(json) && Array.isArray(json.dependencies) ? json.dependencies : Array.isArray(json) ? json : null;
+  if (!deps) throw new AuditToolError('pip-audit output has no "dependencies" list');
+  const out = [];
+  for (const raw of deps) {
+    const d = asRecord(raw);
+    for (const vRaw of Array.isArray(d.vulns) ? d.vulns : []) {
+      const v = asRecord(vRaw);
+      const aliases = Array.isArray(v.aliases) ? v.aliases.filter((a) => typeof a === "string") : [];
+      const id = typeof v.id === "string" ? v.id : void 0;
+      out.push({
+        package: String(d.name ?? "unknown"),
+        severity: "unrated",
+        // pip-audit does not report severity
+        title: String(v.description ?? id ?? "Known vulnerability").split("\n")[0].slice(0, 300),
+        id: id ?? aliases[0],
+        url: id ? `https://osv.dev/vulnerability/${id}` : void 0,
+        vulnerableRange: typeof d.version === "string" ? `installed ${d.version}` : void 0,
+        fixAvailable: Array.isArray(v.fix_versions) && v.fix_versions.length > 0
+      });
+    }
+  }
+  return out;
+}
+function splitJsonStream(text) {
+  const out = [];
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+  let start = -1;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (inString) {
+      if (escaped) escaped = false;
+      else if (ch === "\\") escaped = true;
+      else if (ch === '"') inString = false;
+      continue;
+    }
+    if (ch === '"') {
+      if (depth > 0) inString = true;
+    } else if (ch === "{") {
+      if (depth === 0) start = i;
+      depth++;
+    } else if (ch === "}" && depth > 0) {
+      depth--;
+      if (depth === 0) {
+        out.push(JSON.parse(text.slice(start, i + 1)));
+        start = -1;
+      }
+    }
+  }
+  if (depth !== 0) throw new AuditToolError("truncated JSON output");
+  return out;
+}
+var REACH_RANK = { required: 0, imported: 1, called: 2 };
+function parseGovulncheck(stdout) {
+  const messages = splitJsonStream(stdout).map(asRecord);
+  if (!messages.some((m) => isObject(m.config))) throw new AuditToolError("govulncheck produced no JSON report");
+  const osvs = /* @__PURE__ */ new Map();
+  for (const m of messages) {
+    const osv = asRecord(m.osv);
+    if (typeof osv.id === "string") osvs.set(osv.id, osv);
+  }
+  const found = /* @__PURE__ */ new Map();
+  for (const m of messages) {
+    const f = asRecord(m.finding);
+    if (typeof f.osv !== "string") continue;
+    const trace = (Array.isArray(f.trace) ? f.trace : []).map(asRecord);
+    const reach = trace.some((t) => typeof t.function === "string") ? "called" : trace.some((t) => typeof t.package === "string") ? "imported" : "required";
+    const first = trace[0] ?? {};
+    const prev = found.get(f.osv);
+    if (prev && REACH_RANK[prev.reach] >= REACH_RANK[reach]) continue;
+    found.set(f.osv, {
+      module: typeof first.module === "string" ? first.module : prev?.module,
+      version: typeof first.version === "string" ? first.version : prev?.version,
+      fixed: typeof f.fixed_version === "string" ? f.fixed_version : prev?.fixed,
+      reach
+    });
+  }
+  const label = { called: "called by your code", imported: "package imported, vulnerable symbol not called", required: "module required, package not imported" };
+  return [...found].map(([id, f]) => {
+    const osv = osvs.get(id) ?? {};
+    const affected = Array.isArray(osv.affected) ? asRecord(osv.affected[0]) : {};
+    return {
+      package: f.module ?? String(asRecord(affected.package).name ?? "unknown"),
+      severity: "unrated",
+      // the Go vulnerability database does not assign severities
+      title: `${String(osv.summary ?? id)} (${label[f.reach]})`,
+      id,
+      url: `https://pkg.go.dev/vuln/${id}`,
+      vulnerableRange: f.version ? `installed ${f.version}` : void 0,
+      fixAvailable: Boolean(f.fixed)
+    };
+  });
+}
+function parseCargoAudit(stdout) {
+  const json = parseJsonObject(stdout, "cargo audit");
+  if (!isObject(json.vulnerabilities)) throw new AuditToolError('cargo audit output has no "vulnerabilities" report');
+  const list = Array.isArray(json.vulnerabilities.list) ? json.vulnerabilities.list : [];
+  return list.map((raw) => {
+    const v = asRecord(raw);
+    const advisory = asRecord(v.advisory);
+    const pkg = asRecord(v.package);
+    return {
+      package: String(pkg.name ?? "unknown"),
+      severity: sev(asRecord(advisory.cvss).severity ?? advisory.severity),
+      title: String(advisory.title ?? "Known vulnerability"),
+      id: typeof advisory.id === "string" ? advisory.id : void 0,
+      url: typeof advisory.url === "string" ? advisory.url : void 0
+    };
+  });
+}
+function parseComposerAudit(stdout) {
+  const json = parseJsonObject(stdout, "composer audit");
+  if (json.advisories === void 0) throw new AuditToolError('composer audit output has no "advisories" report');
+  const advisories = asRecord(json.advisories);
+  const out = [];
+  for (const [pkg, raw] of Object.entries(advisories)) {
+    for (const aRaw of Array.isArray(raw) ? raw : Object.values(asRecord(raw))) {
+      const a = asRecord(aRaw);
+      out.push({
+        package: pkg,
+        severity: sev(a.severity),
+        title: String(a.title ?? "Known vulnerability"),
+        id: typeof a.cve === "string" ? a.cve : typeof a.advisoryId === "string" ? a.advisoryId : void 0,
+        url: typeof a.link === "string" ? a.link : void 0,
+        vulnerableRange: typeof a.affectedVersions === "string" ? a.affectedVersions : void 0
+      });
+    }
+  }
+  return out;
+}
+var MAX_PIP_TARGETS = 10;
+var REQUIREMENTS_FILE = /(^|\/)requirements[\w.-]*\.txt$/i;
+async function planPipAudit(ctx) {
+  const common = ["--format", "json", "--progress-spinner", "off"];
+  const reqs = ctx.files.filter((f) => REQUIREMENTS_FILE.test(f)).sort();
+  const reqDirs = new Set(reqs.map((f) => path.posix.dirname(f)));
+  const out = reqs.map((f) => ({ target: f, args: ["-r", f, ...common] }));
+  for (const f of ctx.files.filter((x) => x === "pyproject.toml" || x.endsWith("/pyproject.toml")).sort()) {
+    const dir = path.posix.dirname(f);
+    if (reqDirs.has(dir)) continue;
+    const text = await fs.readFile(path.join(ctx.root, f), "utf8").catch(() => "");
+    if (!/^\s*\[project\]\s*$/m.test(text)) continue;
+    out.push({ target: f, args: [...common, dir === "." ? "." : `./${dir}`] });
+  }
+  if (!out.length) return "no requirements file to audit (pip-audit needs requirements*.txt or a PEP 621 pyproject.toml; the active Python environment is never audited)";
+  return out.slice(0, MAX_PIP_TARGETS);
+}
+var single = (args) => async () => [{ args }];
+var RUNNERS = [
+  {
+    tool: "npm audit",
+    ecosystem: "npm",
+    command: "npm",
+    applies: (_m, has) => has("package-lock.json") || has("npm-shrinkwrap.json"),
+    plan: single(["audit", "--json", "--audit-level=low"]),
+    parse: parseNpmAudit
+  },
+  {
+    tool: "pnpm audit",
+    ecosystem: "npm",
+    command: "pnpm",
+    applies: (_m, has) => has("pnpm-lock.yaml"),
+    plan: single(["audit", "--json"]),
+    parse: parsePnpmAudit
+  },
+  {
+    tool: "pip-audit",
+    ecosystem: "python",
+    command: "pip-audit",
+    applies: (m, _has, ctx) => m.manifests.some((x) => x.ecosystem === "python") || ctx.files.some((f) => REQUIREMENTS_FILE.test(f)),
+    plan: planPipAudit,
+    parse: parsePipAudit
+  },
+  {
+    tool: "govulncheck",
+    ecosystem: "go",
+    command: "govulncheck",
+    applies: (_m, has) => has("go.mod"),
+    plan: single(["-format=json", "./..."]),
+    parse: parseGovulncheck
+  },
+  {
+    tool: "cargo audit",
+    ecosystem: "cargo",
+    command: "cargo",
+    applies: (_m, has) => has("Cargo.lock"),
+    plan: single(["audit", "--json"]),
+    parse: parseCargoAudit
+  },
+  {
+    tool: "composer audit",
+    ecosystem: "composer",
+    command: "composer",
+    applies: (_m, has) => has("composer.lock"),
+    plan: single(["audit", "--format=json"]),
+    parse: parseComposerAudit
+  }
+];
+function run(command, args, cwd, timeoutMs) {
+  return new Promise((resolve) => {
+    execFile(command, args, { cwd, timeout: timeoutMs, maxBuffer: 32 * 1024 * 1024, windowsHide: true, env: { ...process.env, NO_COLOR: "1", npm_config_color: "false" } }, (error, stdout, stderr) => {
+      const timedOut = Boolean(error && (error.code === "ETIMEDOUT" || error.killed));
+      resolve({ stdout: String(stdout ?? ""), stderr: String(stderr ?? ""), timedOut, error: error ?? null });
+    });
+  });
+}
+async function runTool(runner, inv, root, timeoutMs) {
+  const t = Date.now();
+  const base = { tool: runner.tool, ecosystem: runner.ecosystem, ...inv.target ? { target: inv.target } : {} };
+  const r = await run(runner.command, inv.args, root, timeoutMs);
+  if (r.timedOut) return { ...base, status: "timeout", message: `Timed out after ${timeoutMs / 1e3}s`, durationMs: Date.now() - t, findings: [] };
+  try {
+    const findings = runner.parse(r.stdout, r.stderr);
+    return { ...base, status: "ok", durationMs: Date.now() - t, findings };
+  } catch (err) {
+    const reason = err instanceof AuditToolError ? err.message : `Could not parse output: ${r.stderr.trim().split("\n")[0] || r.error?.message || err.message || "unreadable output"}`;
+    return { ...base, status: "failed", message: reason.slice(0, 300), durationMs: Date.now() - t, findings: [] };
+  }
+}
+async function runSecurityScan(root, model, opts = {}) {
+  const started = Date.now();
+  const timeoutMs = opts.timeoutMs ?? 12e4;
+  const { config } = await loadConfig(root);
+  const walk = await walkProject(root, { config, signal: opts.signal });
+  const ctx = { root, files: walk.files.map((f) => f.path) };
+  const files = new Set(model.manifests.map((m) => m.path));
+  for (const pm of model.packageManagers) for (const e of pm.provenance.evidence) files.add(e.file);
+  for (const f of ctx.files) files.add(f);
+  const has = (file) => files.has(file);
+  const tools = [];
+  if (!opts.skipAudit) {
+    for (const runner of RUNNERS) {
+      if (!runner.applies(model, has, ctx)) continue;
+      opts.signal?.throwIfAborted();
+      const t = Date.now();
+      opts.onTool?.(runner.tool);
+      const bin = await whichExecutable(runner.command);
+      if (!bin) {
+        tools.push({ tool: runner.tool, ecosystem: runner.ecosystem, status: "unavailable", message: `${runner.command} is not installed or not on PATH`, durationMs: Date.now() - t, findings: [] });
+        continue;
+      }
+      const plan = await runner.plan(ctx);
+      if (typeof plan === "string") {
+        tools.push({ tool: runner.tool, ecosystem: runner.ecosystem, status: "unavailable", message: plan, durationMs: Date.now() - t, findings: [] });
+        continue;
+      }
+      for (const inv of plan) {
+        opts.signal?.throwIfAborted();
+        tools.push(await runTool(runner, inv, root, timeoutMs));
+      }
+    }
+  }
+  const counts = { critical: 0, high: 0, moderate: 0, low: 0, unrated: 0 };
+  for (const t of tools) for (const f of t.findings) counts[f.severity]++;
+  const secrets = await scanProjectSecrets(root, walk.files, opts.signal);
+  const scan = {
+    schemaVersion: 1,
+    scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    durationMs: Date.now() - started,
+    tools,
+    counts,
+    secrets: {
+      count: secrets.findings.length,
+      files: [...new Set(secrets.findings.map((s) => s.file))].slice(0, 50),
+      skippedLongLines: secrets.skippedLongLines,
+      ...secrets.truncated ? { truncated: true } : {}
+    }
+  };
+  return scan;
+}
+async function scanProjectSecrets(root, files, signal) {
+  const fingerprint = await secretFingerprinter(root);
+  const read = async (rel) => fs.readFile(path.join(root, rel), "utf8").catch(() => null);
+  return scanFilesForSecrets(files, read, { fingerprint, signal });
+}
+
+export {
+  runSecurityScan
+};
+//# sourceMappingURL=chunk-LMOFZNTQ.js.map