renma 0.1.0 → 0.2.0

package/dist/security-diagnostics.js

@@ -0,0 +1,403 @@
+const constraints = [
+    "Do not remove legitimate setup steps solely because this finding exists.",
+    "Preserve required platform-specific setup instructions.",
+    "Prefer pinning, scoping, confirmation, and recovery guidance over deleting operational detail.",
+];
+const verificationSteps = [
+    "Review the reported command or instruction.",
+    "Add version pinning, checksum verification, confirmation, scoping, or recovery steps as appropriate.",
+    "Run `renma scan` again.",
+];
+const remoteScriptMetadata = {
+    id: "SEC-UNPINNED-REMOTE-SCRIPT",
+    title: "Remote script execution without pinning or inspection",
+    whyItMatters: "Agent-facing instructions that pipe remote code directly into a shell can cause unreviewed code execution.",
+    remediation: "Download the script first, inspect it, pin the source/version/checksum, and run it only after human approval.",
+    llmHint: "Replace one-line remote shell execution with download, checksum/version pinning, inspection, and explicit human approval steps.",
+};
+const unpinnedDependencyMetadata = {
+    id: "SEC-UNPINNED-DEPENDENCY-INSTALL",
+    title: "Dependency install without a version pin",
+    whyItMatters: "Agent-facing install instructions that resolve the latest package can change behavior between runs and pull unreviewed code.",
+    remediation: "Pin package versions or document why the latest version is intentionally required.",
+    llmHint: "Prefer explicit package versions, image tags, or a written reason why latest is required.",
+};
+const privilegedCommandMetadata = {
+    id: "SEC-PRIVILEGED-COMMAND-WITHOUT-GUARD",
+    title: "Privileged command without nearby guardrails",
+    whyItMatters: "Privileged commands in reusable instructions can alter system state broadly when copied by an agent without confirmation or rollback guidance.",
+    remediation: "Add explicit scope, confirmation, and rollback/verification instructions before privileged commands.",
+    llmHint: "Keep the setup step if it is required, but add confirmation, path scope, backup or rollback, and verification language nearby.",
+};
+const predictableTempMetadata = {
+    id: "SEC-PREDICTABLE-TEMP-PATH",
+    title: "Predictable temporary path in operational instructions",
+    whyItMatters: "Predictable temporary paths can expose sensitive files or collide with existing files when reused by agents or scripts.",
+    remediation: "Use `mktemp` or a workspace-scoped temporary directory, and avoid predictable paths for sensitive data.",
+    llmHint: "Use mktemp or a repository-scoped temporary path, especially for tokens, credentials, signing material, or auth files.",
+};
+const credentialArgMetadata = {
+    id: "SEC-CREDENTIAL-IN-COMMAND-ARG",
+    title: "Credential-like value embedded in a command argument",
+    whyItMatters: "Credentials in command arguments or reusable headers can leak through shell history, process listings, logs, or copied instructions.",
+    remediation: "Use environment variables, secret managers, or interactive prompts. Avoid putting credentials directly in command arguments or reusable instructions.",
+    llmHint: "Move literal secrets out of command arguments and into environment variables, secret managers, or interactive prompts.",
+};
+const guardWords = [
+    "confirm",
+    "ask the user",
+    "approval",
+    "dry run",
+    "backup",
+    "restore",
+    "rollback",
+    "revert",
+    "scope",
+    "only this path",
+    "verify",
+];
+const sensitiveTempWords = [
+    "token",
+    "secret",
+    "password",
+    "credential",
+    "key",
+    "cert",
+    "certificate",
+    "profile",
+    "provisioning",
+    "signing",
+    "auth",
+];
+const commandStarters = [
+    "bash",
+    "brew",
+    "chmod",
+    "chown",
+    "curl",
+    "docker",
+    "npm",
+    "pip",
+    "pip3",
+    "sh",
+    "sudo",
+    "wget",
+];
+export function securityDiagnosticFindings(artifacts) {
+    return artifacts
+        .flatMap((artifact) => securityFindingsForArtifact(artifact))
+        .sort(compareDiagnostics);
+}
+function securityFindingsForArtifact(artifact) {
+    const lines = artifact.content.split(/\r?\n/);
+    const findings = [];
+    let inFence = false;
+    for (let index = 0; index < lines.length; index += 1) {
+        const line = lines[index] ?? "";
+        const trimmed = line.trim();
+        if (trimmed.startsWith("```")) {
+            inFence = !inFence;
+            continue;
+        }
+        if (isCommentOnlyShellLine(trimmed))
+            continue;
+        const context = nearbyContext(lines, index);
+        const operational = inFence || looksOperational(trimmed);
+        const detections = [
+            ...detectRemoteScript(trimmed, operational),
+            ...detectUnpinnedDependency(trimmed, operational),
+            ...detectPrivilegedCommand(trimmed, context, operational),
+            ...detectPredictableTempPath(trimmed, context, operational),
+            ...detectCredentialArgument(trimmed, operational),
+        ];
+        for (const detection of detections) {
+            findings.push(toFinding(artifact.path, { ...detection, line: index + 1 }));
+        }
+    }
+    return collapsePredictableTempPathFindings(findings);
+}
+function detectRemoteScript(line, operational) {
+    if (!operational)
+        return [];
+    const directPipe = /\b(curl|wget)\b[^\n|]*(https?:\/\/\S+)[^\n|]*\|\s*(sudo\s+)?(ba)?sh\b/i.test(line);
+    const processSubstitution = /\b(ba)?sh\s*<\(\s*(curl|wget)\b[^\n)]*https?:\/\/\S+/i.test(line);
+    if (!directPipe && !processSubstitution)
+        return [];
+    return [
+        {
+            metadata: remoteScriptMetadata,
+            severity: directPipe ? "high" : "medium",
+            confidence: "high",
+            line: 0,
+            snippet: line,
+        },
+    ];
+}
+function detectUnpinnedDependency(line, operational) {
+    if (!operational)
+        return [];
+    const detections = [];
+    const npm = line.match(/\bnpm\s+(?:install|i)\s+([^\n#]+)/i);
+    if (npm) {
+        const args = splitCommandArgs(npm[1] ?? "");
+        const globalInstall = args.includes("-g") || args.includes("--global");
+        const packages = args.filter((arg) => isPackageToken(arg) && arg !== "-g");
+        const unpinned = packages.find((arg) => !isPinnedNpmPackage(arg));
+        if (unpinned) {
+            detections.push({
+                metadata: unpinnedDependencyMetadata,
+                severity: globalInstall ? "medium" : "low",
+                confidence: "medium",
+                line: 0,
+                snippet: line,
+            });
+        }
+    }
+    const pip = line.match(/\bpip3?\s+install\s+([^\n#]+)/i);
+    if (pip) {
+        const packages = splitCommandArgs(pip[1] ?? "").filter(isPackageToken);
+        const unpinned = packages.find((arg) => !/[<>=~!]=/.test(arg));
+        if (unpinned) {
+            detections.push({
+                metadata: unpinnedDependencyMetadata,
+                severity: "low",
+                confidence: "medium",
+                line: 0,
+                snippet: line,
+            });
+        }
+    }
+    const brew = line.match(/\bbrew\s+install\s+([^\n#]+)/i);
+    if (brew) {
+        const packages = splitCommandArgs(brew[1] ?? "").filter(isPackageToken);
+        if (packages.length > 0) {
+            detections.push({
+                metadata: unpinnedDependencyMetadata,
+                severity: "low",
+                confidence: "medium",
+                line: 0,
+                snippet: line,
+            });
+        }
+    }
+    if (/\bdocker\s+(pull|run)\b[^\n#]*\S+:latest\b/i.test(line)) {
+        detections.push({
+            metadata: unpinnedDependencyMetadata,
+            severity: "medium",
+            confidence: "high",
+            line: 0,
+            snippet: line,
+        });
+    }
+    if (/\bcurl\b[^\n#]*https?:\/\/\S*\/latest(?:\/|\b|\S*)/i.test(line)) {
+        detections.push({
+            metadata: unpinnedDependencyMetadata,
+            severity: "low",
+            confidence: "medium",
+            line: 0,
+            snippet: line,
+        });
+    }
+    return detections;
+}
+function detectPrivilegedCommand(line, context, operational) {
+    if (!operational)
+        return [];
+    const hasPrivilegedCommand = /\bsudo\s+(npm|rm|chmod|chown|sh|bash|curl|wget)\b/i.test(line) ||
+        /\bchmod\s+-R\s+777\b/i.test(line) ||
+        /\bchown\s+-R\b/i.test(line);
+    if (!hasPrivilegedCommand || hasGuardrail(context))
+        return [];
+    return [
+        {
+            metadata: privilegedCommandMetadata,
+            severity: "medium",
+            confidence: "medium",
+            line: 0,
+            snippet: line,
+        },
+    ];
+}
+function detectPredictableTempPath(line, context, operational) {
+    if (!operational || !/\/tmp\/[A-Za-z0-9._/-]+/.test(line))
+        return [];
+    const sensitive = sensitiveTempWords.some((word) => new RegExp(`\\b${word}\\b`, "i").test(context));
+    return [
+        {
+            metadata: predictableTempMetadata,
+            severity: sensitive ? "medium" : "low",
+            confidence: sensitive ? "high" : "medium",
+            line: 0,
+            snippet: line,
+        },
+    ];
+}
+function detectCredentialArgument(line, operational) {
+    if (!operational)
+        return [];
+    const detections = [];
+    const optionMatch = line.match(/\B--(?:password|token)\s+(?:"([^"]+)"|'([^']+)'|(\S+))/i);
+    const optionValue = optionMatch?.[1] ?? optionMatch?.[2] ?? optionMatch?.[3];
+    if (optionValue && !isSafePlaceholder(optionValue)) {
+        detections.push({
+            metadata: credentialArgMetadata,
+            severity: "high",
+            confidence: "high",
+            line: 0,
+            snippet: line,
+        });
+    }
+    else if (optionValue) {
+        detections.push({
+            metadata: credentialArgMetadata,
+            severity: "medium",
+            confidence: "medium",
+            line: 0,
+            snippet: line,
+        });
+    }
+    const basicAuthMatch = line.match(/\s-u\s+(?:"([^"]+)"|'([^']+)'|(\S+:\S+))/i);
+    const basicAuthValue = basicAuthMatch?.[1] ?? basicAuthMatch?.[2] ?? basicAuthMatch?.[3];
+    if (basicAuthValue && basicAuthValue.includes(":")) {
+        detections.push({
+            metadata: credentialArgMetadata,
+            severity: isSafePlaceholder(basicAuthValue) ? "medium" : "high",
+            confidence: isSafePlaceholder(basicAuthValue) ? "medium" : "high",
+            line: 0,
+            snippet: line,
+        });
+    }
+    const bearerMatch = line.match(/Authorization:\s*Bearer\s+(?:"([^"]+)"|'([^']+)'|(\S+))/i);
+    const bearerValue = bearerMatch?.[1] ?? bearerMatch?.[2] ?? bearerMatch?.[3];
+    if (bearerValue && !isSafePlaceholder(bearerValue)) {
+        detections.push({
+            metadata: credentialArgMetadata,
+            severity: bearerValue === "..." ? "medium" : "high",
+            confidence: bearerValue === "..." ? "medium" : "high",
+            line: 0,
+            snippet: line,
+        });
+    }
+    else if (bearerValue) {
+        detections.push({
+            metadata: credentialArgMetadata,
+            severity: "medium",
+            confidence: "medium",
+            line: 0,
+            snippet: line,
+        });
+    }
+    return dedupeDetections(detections);
+}
+function toFinding(path, detection) {
+    return {
+        ...detection.metadata,
+        category: "safety",
+        severity: detection.severity,
+        confidence: detection.confidence,
+        evidence: {
+            path,
+            startLine: detection.line,
+            endLine: detection.line,
+            snippet: detection.snippet,
+        },
+        constraints,
+        verificationSteps,
+        llmHint: detection.metadata.llmHint,
+    };
+}
+function nearbyContext(lines, index) {
+    const start = Math.max(0, index - 3);
+    const end = Math.min(lines.length, index + 4);
+    return lines.slice(start, end).join("\n").toLowerCase();
+}
+function looksOperational(line) {
+    if (line.length === 0)
+        return false;
+    if (line.startsWith("$ "))
+        return true;
+    if (/[|<>]/.test(line) &&
+        /\b(curl|wget|bash|sh|tmp|Authorization)\b/i.test(line)) {
+        return true;
+    }
+    return commandStarters.some((command) => new RegExp(`^(?:[-*]\\s+)?${command}\\b`, "i").test(line));
+}
+function isCommentOnlyShellLine(line) {
+    return line.startsWith("#");
+}
+function collapsePredictableTempPathFindings(findings) {
+    const collapsed = [];
+    const lastByPath = new Map();
+    for (const finding of findings) {
+        if (finding.id !== "SEC-PREDICTABLE-TEMP-PATH") {
+            collapsed.push(finding);
+            continue;
+        }
+        const tempPath = extractTempPath(finding.evidence.snippet);
+        if (!tempPath) {
+            collapsed.push(finding);
+            continue;
+        }
+        const key = `${finding.evidence.path}:${tempPath}`;
+        const previous = lastByPath.get(key);
+        if (previous &&
+            finding.evidence.startLine - previous.evidence.startLine <= 10) {
+            continue;
+        }
+        lastByPath.set(key, finding);
+        collapsed.push(finding);
+    }
+    return collapsed;
+}
+function extractTempPath(value) {
+    return value.match(/\/tmp\/[A-Za-z0-9._/-]+/)?.[0];
+}
+function splitCommandArgs(value) {
+    return value
+        .split(/\s+/)
+        .map((arg) => arg.replace(/^["']|["']$/g, ""))
+        .filter(Boolean);
+}
+function isPackageToken(arg) {
+    return (!arg.startsWith("-") && !arg.includes("/") && arg !== "." && arg !== "..");
+}
+function isPinnedNpmPackage(arg) {
+    if (arg.startsWith("@")) {
+        const lastAt = arg.lastIndexOf("@");
+        return lastAt > 0 && lastAt < arg.length - 1;
+    }
+    return /@\d/.test(arg);
+}
+function hasGuardrail(context) {
+    return guardWords.some((word) => context.includes(word));
+}
+function isSafePlaceholder(value) {
+    const normalized = value.trim().replace(/[",]$/g, "");
+    return (normalized.startsWith("$") ||
+        /^<[^>]+>$/.test(normalized) ||
+        /^YOUR_[A-Z0-9_]+$/.test(normalized) ||
+        /^REDACTED$/i.test(normalized) ||
+        /^\*+$/.test(normalized));
+}
+function dedupeDetections(detections) {
+    const seen = new Set();
+    return detections.filter((detection) => {
+        const key = `${detection.metadata.id}:${detection.snippet}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+function compareDiagnostics(a, b) {
+    const aPath = a.evidence.path;
+    const bPath = b.evidence.path;
+    if (aPath !== bPath)
+        return aPath.localeCompare(bPath);
+    const aLine = a.evidence.startLine;
+    const bLine = b.evidence.startLine;
+    if (aLine !== bLine)
+        return aLine - bLine;
+    return a.id.localeCompare(b.id);
+}
+//# sourceMappingURL=security-diagnostics.js.map

package/dist/security-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-diagnostics.js","sourceRoot":"","sources":["../src/security-diagnostics.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,GAAG;IAClB,0EAA0E;IAC1E,yDAAyD;IACzD,gGAAgG;CACjG,CAAC;AAEF,MAAM,iBAAiB,GAAG;IACxB,6CAA6C;IAC7C,sGAAsG;IACtG,yBAAyB;CAC1B,CAAC;AAEF,MAAM,oBAAoB,GAAiB;IACzC,EAAE,EAAE,4BAA4B;IAChC,KAAK,EAAE,uDAAuD;IAC9D,YAAY,EACV,4GAA4G;IAC9G,WAAW,EACT,+GAA+G;IACjH,OAAO,EACL,iIAAiI;CACpI,CAAC;AAEF,MAAM,0BAA0B,GAAiB;IAC/C,EAAE,EAAE,iCAAiC;IACrC,KAAK,EAAE,0CAA0C;IACjD,YAAY,EACV,8HAA8H;IAChI,WAAW,EACT,oFAAoF;IACtF,OAAO,EACL,2FAA2F;CAC9F,CAAC;AAEF,MAAM,yBAAyB,GAAiB;IAC9C,EAAE,EAAE,sCAAsC;IAC1C,KAAK,EAAE,8CAA8C;IACrD,YAAY,EACV,gJAAgJ;IAClJ,WAAW,EACT,sGAAsG;IACxG,OAAO,EACL,gIAAgI;CACnI,CAAC;AAEF,MAAM,uBAAuB,GAAiB;IAC5C,EAAE,EAAE,2BAA2B;IAC/B,KAAK,EAAE,wDAAwD;IAC/D,YAAY,EACV,yHAAyH;IAC3H,WAAW,EACT,yGAAyG;IAC3G,OAAO,EACL,wHAAwH;CAC3H,CAAC;AAEF,MAAM,qBAAqB,GAAiB;IAC1C,EAAE,EAAE,+BAA+B;IACnC,KAAK,EAAE,sDAAsD;IAC7D,YAAY,EACV,sIAAsI;IACxI,WAAW,EACT,uJAAuJ;IACzJ,OAAO,EACL,wHAAwH;CAC3H,CAAC;AAEF,MAAM,UAAU,GAAG;IACjB,SAAS;IACT,cAAc;IACd,UAAU;IACV,SAAS;IACT,QAAQ;IACR,SAAS;IACT,UAAU;IACV,QAAQ;IACR,OAAO;IACP,gBAAgB;IAChB,QAAQ;CACT,CAAC;AAEF,MAAM,kBAAkB,GAAG;IACzB,OAAO;IACP,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,KAAK;IACL,MAAM;IACN,aAAa;IACb,SAAS;IACT,cAAc;IACd,SAAS;IACT,MAAM;CACP,CAAC;AAEF,MAAM,eAAe,GAAG;IACtB,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,QAAQ;IACR,KAAK;IACL,KAAK;IACL,MAAM;IACN,IAAI;IACJ,MAAM;IACN,MAAM;CACP,CAAC;AAEF,MAAM,UAAU,0BAA0B,CAAC,SAAqB;IAC9D,OAAO,SAAS;SACb,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC;SAC5D,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,2BAA2B,CAAC,QAAkB;IACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,GAAG,CAAC,OAAO,CAAC;YACnB,SAAS;QACX,CAAC;QAED,IAAI,sBAAsB,CAAC,OAAO,CAAC;YAAE,SAAS;QAE9C,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,OAAO,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG;YACjB,GAAG,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC;YAC3C,GAAG,wBAAwB,CAAC,OAAO,EAAE,WAAW,CAAC;YACjD,GAAG,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC;YACzD,GAAG,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC;YAC3D,GAAG,wBAAwB,CAAC,OAAO,EAAE,WAAW,CAAC;SAClD,CAAC;QAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CACX,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,mCAAmC,CAAC,QAAQ,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,WAAoB;IAC5D,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAE5B,MAAM,UAAU,GACd,wEAAwE,CAAC,IAAI,CAC3E,IAAI,CACL,CAAC;IACJ,MAAM,mBAAmB,GACvB,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAErE,IAAI,CAAC,UAAU,IAAI,CAAC,mBAAmB;QAAE,OAAO,EAAE,CAAC;IAEnD,OAAO;QACL;YACE,QAAQ,EAAE,oBAAoB;YAC9B,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;YACxC,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,IAAI;SACd;KACF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAY,EACZ,WAAoB;IAEpB,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAE5B,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC7D,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,IAAI,QAAQ,EAAE,CAAC;YACb,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,0BAA0B;gBACpC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;gBAC1C,UAAU,EAAE,QAAQ;gBACpB,IAAI,EAAE,CAAC;gBACP,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACzD,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,IAAI,QAAQ,EAAE,CAAC;YACb,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,0BAA0B;gBACpC,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,QAAQ;gBACpB,IAAI,EAAE,CAAC;gBACP,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACzD,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACxE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,0BAA0B;gBACpC,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,QAAQ;gBACpB,IAAI,EAAE,CAAC;gBACP,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,0BAA0B;YACpC,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IAED,IAAI,qDAAqD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,0BAA0B;YACpC,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,QAAQ;YACpB,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,uBAAuB,CAC9B,IAAY,EACZ,OAAe,EACf,WAAoB;IAEpB,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAE5B,MAAM,oBAAoB,GACxB,oDAAoD,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/D,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;QAClC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE/B,IAAI,CAAC,oBAAoB,IAAI,YAAY,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAE9D,OAAO;QACL;YACE,QAAQ,EAAE,yBAAyB;YACnC,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,QAAQ;YACpB,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,IAAI;SACd;KACF,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,IAAY,EACZ,OAAe,EACf,WAAoB;IAEpB,IAAI,CAAC,WAAW,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAErE,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACjD,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAC/C,CAAC;IAEF,OAAO;QACL;YACE,QAAQ,EAAE,uBAAuB;YACjC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;YACtC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;YACzC,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,IAAI;SACd;KACF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAY,EACZ,WAAoB;IAEpB,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAE5B,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAC5B,yDAAyD,CAC1D,CAAC;IACF,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,WAAW,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;QACnD,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,qBAAqB;YAC/B,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,WAAW,EAAE,CAAC;QACvB,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,qBAAqB;YAC/B,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,QAAQ;YACpB,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAC/B,2CAA2C,CAC5C,CAAC;IACF,MAAM,cAAc,GAClB,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,cAAc,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,qBAAqB;YAC/B,QAAQ,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;YAC/D,UAAU,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;YACjE,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAC5B,0DAA0D,CAC3D,CAAC;IACF,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,WAAW,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;QACnD,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,qBAAqB;YAC/B,QAAQ,EAAE,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;YACnD,UAAU,EAAE,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;YACrD,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,WAAW,EAAE,CAAC;QACvB,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,qBAAqB;YAC/B,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,QAAQ;YACpB,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IAED,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,SAAoB;IACnD,OAAO;QACL,GAAG,SAAS,CAAC,QAAQ;QACrB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,QAAQ,EAAE;YACR,IAAI;YACJ,SAAS,EAAE,SAAS,CAAC,IAAI;YACzB,OAAO,EAAE,SAAS,CAAC,IAAI;YACvB,OAAO,EAAE,SAAS,CAAC,OAAO;SAC3B;QACD,WAAW;QACX,iBAAiB;QACjB,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,OAAO;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAe,EAAE,KAAa;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IACE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAClB,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,EACvD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACtC,IAAI,MAAM,CAAC,iBAAiB,OAAO,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,mCAAmC,CAAC,QAAmB;IAC9D,MAAM,SAAS,GAAc,EAAE,CAAC;IAChC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmB,CAAC;IAE9C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,EAAE,KAAK,2BAA2B,EAAE,CAAC;YAC/C,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IACE,QAAQ;YACR,OAAO,CAAC,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,EAC9D,CAAC;YACD,SAAS;QACX,CAAC;QAED,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK;SACT,KAAK,CAAC,KAAK,CAAC;SACZ,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;SAC7C,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,CACL,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACtD,OAAO,CACL,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAC1B,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;QAC5B,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC;QACpC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CACzB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAuB;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAU,EAAE,CAAU;IAChD,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC9B,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAEvD,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;IACnC,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,GAAG,KAAK,CAAC;IAE1C,OAAO,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAClC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "renma",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Git-native governance and quality CLI for LLM-ready skills and shared context assets.",
   "license": "MIT",
   "repository": {
@@ -20,7 +20,7 @@
     "codex",
     "skills"
   ],
-"type": "module",
+  "type": "module",
   "bin": {
     "renma": "./dist/index.js"
   },