srclawyer 0.6.1 → 0.6.3

package/dist/engine/rootBoundary.js

@@ -0,0 +1,102 @@
+import { realpath, realpathSync } from "node:fs";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
+// Directories whose symlinks are never scanned anyway (they are globbed with ignore patterns); a
+// symlink out of one of these is blocked as usual but not worth a warning -- e.g. a package manager
+// pointing node_modules entries at a shared store outside the repo.
+const QUIET_SEGMENTS = new Set(["node_modules", ".git"]);
+/**
+ * The scanned root as a security boundary: a scanned repo is untrusted input, so no file whose REAL
+ * path resolves outside it may be read, and no directory symlink leaving it may be walked (a symlink
+ * to "/" or "~" would otherwise make a scan traverse the whole filesystem and report lines from files
+ * the repo's author chose). In-root symlinks, including loops that stay inside, keep working.
+ */
+export class RootBoundary {
+    root;
+    realRoot;
+    // canonical in-repo location of the link entry -> its shortest lexical path. A link reached again
+    // through an in-root directory loop is the same link, counted once.
+    blocked = new Map();
+    resolved = new Map();
+    constructor(root) {
+        this.root = root;
+        try {
+            this.realRoot = realpathSync(root);
+        }
+        catch {
+            this.realRoot = resolve(root);
+        }
+    }
+    isInsideRealPath(resolved) {
+        return resolved === this.realRoot || resolved.startsWith(this.realRoot + sep);
+    }
+    /** Records a blocked link by its in-repo (lexical) path only -- never its target. */
+    recordBlocked(linkPath) {
+        const rel = relative(this.root, linkPath);
+        if (rel === "" || rel.startsWith(".."))
+            return;
+        if (rel.split(sep).some((segment) => QUIET_SEGMENTS.has(segment)))
+            return;
+        let canonical = rel;
+        try {
+            canonical = join(realpathSync(dirname(linkPath)), basename(linkPath));
+        }
+        catch {
+            // keep the lexical path
+        }
+        const existing = this.blocked.get(canonical);
+        if (existing === undefined || rel.length < existing.length)
+            this.blocked.set(canonical, rel);
+    }
+    /** Read-time check, independent of how the path was discovered: the real path if it is inside the
+     *  root, else null (and an out-of-root link is recorded). Unresolvable paths fail closed. Cached. */
+    resolveInside(path) {
+        if (this.resolved.has(path))
+            return this.resolved.get(path);
+        let result = null;
+        try {
+            const real = realpathSync(path);
+            if (this.isInsideRealPath(real))
+                result = real;
+            else
+                this.recordBlocked(path);
+        }
+        catch {
+            result = null;
+        }
+        this.resolved.set(path, result);
+        return result;
+    }
+    allowsPath(path) {
+        return this.resolveInside(path) !== null;
+    }
+    /** `fs` overrides for tinyglobby: a symlink resolving outside the root errors out, so it is neither
+     *  walked (directories) nor returned (files). */
+    globFs() {
+        const checked = (path, resolved) => {
+            if (this.isInsideRealPath(resolved))
+                return null;
+            this.recordBlocked(path);
+            return "outside-root";
+        };
+        const asyncRealpath = ((path, callback) => {
+            realpath(path, (err, resolved) => {
+                if (err)
+                    return callback(err);
+                const problem = checked(path, resolved);
+                callback(problem ? Object.assign(new Error(problem), { code: "EXDEV" }) : null, problem ? undefined : resolved);
+            });
+        });
+        const syncRealpath = ((path) => {
+            const resolved = realpathSync(path);
+            const problem = checked(path, resolved);
+            if (problem)
+                throw Object.assign(new Error(problem), { code: "EXDEV" });
+            return resolved;
+        });
+        return { realpath: asyncRealpath, realpathSync: syncRealpath };
+    }
+    /** Relative in-repo paths of every blocked link, sorted; call after discovery and reading are done. */
+    blockedLinks() {
+        return [...this.blocked.values()].sort();
+    }
+}

package/dist/engine/scanEngine.js

@@ -1,5 +1,5 @@
 import { readFileSync } from "node:fs";
-import { extname } from "node:path";
+import { extname, relative } from "node:path";
 import { discoverProjects } from "./discoverProjects.js";
 import { discoverFiles } from "./discoverFiles.js";
 import { detectUnsupportedStack } from "./languageDetection.js";
@@ -13,7 +13,9 @@ import { runPythonSdkRules } from "../rules/pythonSdkRules.js";
 import { runPythonFrameworkRules } from "../rules/pythonFrameworkRules.js";
 import { findZodCandidates } from "../rules/zodPreFilter.js";
 import { buildTsProject } from "./tsProject.js";
-import { runHtmlInputRules, extractInlineScripts } from "../rules/htmlRules.js";
+import { runHtmlInputRules, extractInlineScriptsBounded } from "../rules/htmlRules.js";
+import { containsTemplateSyntax, isOversizedFile, summarizeSkippedFiles, summarizeTemplateScripts, } from "./scanLimits.js";
+import { RootBoundary } from "./rootBoundary.js";
 import { parseOpenApiSpec } from "../schemaParsers/openapi.js";
 import { parseGraphQLSchema } from "../schemaParsers/graphql.js";
 const OPENAPI_NAME = /(openapi|swagger)\.(ya?ml|json)$/i;
@@ -23,12 +25,12 @@ const GRAPHQL_NAME = /\.(graphql|gql)$/i;
 // ~2.5s/~800MB and ~2.2s/~650MB respectively for a full ts.Program build. Eager construction would tax
 // every scan of a large project regardless of whether it ever hits the one pattern that needs it;
 // memoized-lazy pays that cost at most once, only on the scan that actually earns it.
-function makeLazyTsProject(files) {
+function makeLazyTsProject(files, boundary) {
     let handle;
     return () => {
         if (handle === undefined) {
             try {
-                handle = buildTsProject(files);
+                handle = buildTsProject(files, boundary);
             }
             catch {
                 handle = null;
@@ -37,25 +39,69 @@ function makeLazyTsProject(files) {
         return handle;
     };
 }
+/**
+ * Per-file containment: nothing a single file does (a parse failure, or an exception such as the
+ * RangeError a very deep AST throws inside @babel/traverse) may abort the scan or discard the other
+ * files' findings. Each rule group is isolated so one group failing keeps the others' findings for the
+ * same file, and the failure comes back as a reason for the caller to record -- never swallowed.
+ */
 function runCodeRules(filePath, source, root, getTsProject, zodCandidates, oversizedZodFiles) {
-    const ast = parseSource(source, filePath);
-    const zodResult = findZodCandidates(source, filePath, root);
-    zodCandidates.push(...zodResult.candidates);
-    oversizedZodFiles.push(...zodResult.oversizedFiles);
+    let failure = null;
+    const findings = [];
+    let ast = null;
+    try {
+        ast = parseSource(source, filePath);
+    }
+    catch {
+        ast = null;
+    }
+    try {
+        const zodResult = findZodCandidates(source, filePath, root);
+        zodCandidates.push(...zodResult.candidates);
+        oversizedZodFiles.push(...zodResult.oversizedFiles);
+    }
+    catch {
+        failure = "analysis-failed";
+    }
     if (!ast)
-        return [];
-    return [
-        ...runSdkRules(ast, filePath, source, root),
-        ...runFrameworkRules(ast, filePath, source, root),
-        ...runWebApiRules(ast, filePath, source, root),
-        ...runTypedRequestBodyRules(ast, filePath, source, root, getTsProject),
+        return { findings, failure: failure ?? "parse-failed" };
+    const groups = [
+        () => runSdkRules(ast, filePath, source, root),
+        () => runFrameworkRules(ast, filePath, source, root),
+        () => runWebApiRules(ast, filePath, source, root),
+        () => runTypedRequestBodyRules(ast, filePath, source, root, getTsProject),
     ];
+    for (const run of groups) {
+        try {
+            findings.push(...run());
+        }
+        catch {
+            failure = "analysis-failed";
+        }
+    }
+    return { findings, failure };
 }
 async function runPythonCodeRules(filePath, source, root) {
-    const tree = await parsePythonSource(source);
+    let tree = null;
+    try {
+        tree = await parsePythonSource(source);
+    }
+    catch {
+        tree = null;
+    }
     if (!tree)
-        return [];
-    return [...runPythonSdkRules(tree, filePath, source, root), ...runPythonFrameworkRules(tree, filePath, source, root)];
+        return { findings: [], failure: "parse-failed" };
+    const findings = [];
+    let failure = null;
+    for (const run of [() => runPythonSdkRules(tree, filePath, source, root), () => runPythonFrameworkRules(tree, filePath, source, root)]) {
+        try {
+            findings.push(...run());
+        }
+        catch {
+            failure = "analysis-failed";
+        }
+    }
+    return { findings, failure };
 }
 /**
  * Pure, local, offline — no network access anywhere in this function or anything it calls. Zod
@@ -67,13 +113,60 @@ async function runPythonCodeRules(filePath, source, root) {
  * reading this file alone.
  */
 export async function scan(root) {
-    const [projects, unsupportedStackWarning] = await Promise.all([discoverProjects(root), detectUnsupportedStack(root)]);
+    const boundary = new RootBoundary(root);
+    const [{ projects, workspaceWarning }, unsupportedStackWarning] = await Promise.all([
+        discoverProjects(root, boundary),
+        detectUnsupportedStack(root, boundary),
+    ]);
     const findings = [];
     const pendingZodCandidates = [];
     const oversizedZodFiles = [];
+    const skippedFiles = [];
     let filesScanned = 0;
+    const recordSkip = (filePath, reason) => {
+        const file = relative(root, filePath);
+        if (!skippedFiles.some((s) => s.file === file && s.reason === reason))
+            skippedFiles.push({ file, reason });
+    };
+    // The one gate every scanned file passes through before any content is read: real path inside the
+    // scanned root (the glob layer already refuses to return out-of-root symlinks; this re-checks at read
+    // time), then the shared size cap, then the read itself. A skipped file is recorded and surfaced as
+    // a warning, never silently dropped. Returns null when the file must not be analyzed.
+    const readScannable = (filePath) => {
+        if (!boundary.allowsPath(filePath))
+            return null; // recorded by the boundary as a blocked link
+        if (isOversizedFile(filePath)) {
+            recordSkip(filePath, "oversized");
+            return null;
+        }
+        filesScanned += 1;
+        try {
+            return readFileSync(filePath, "utf8");
+        }
+        catch {
+            recordSkip(filePath, "unreadable");
+            return null;
+        }
+    };
     const projectRootList = [...new Set(projects.map((p) => p.root))];
-    const fileSets = await Promise.all(projectRootList.map((projectRoot) => discoverFiles(projectRoot)));
+    const fileSets = await Promise.all(projectRootList.map((projectRoot) => discoverFiles(projectRoot, boundary)));
+    // The same real file can be reached by several paths (an in-root symlink, or a directory loop that
+    // stays inside the root); scan it once, under its shortest path, so findings aren't duplicated.
+    const seenRealPaths = new Map();
+    const claimsRealPath = (filePath) => {
+        const real = boundary.resolveInside(filePath);
+        if (real === null)
+            return true; // let readScannable record why it is being skipped
+        const holder = seenRealPaths.get(real);
+        if (holder === undefined) {
+            seenRealPaths.set(real, filePath);
+            return true;
+        }
+        return holder === filePath;
+    };
+    const shortestPathFirst = (paths) => [...paths].sort((a, b) => a.length - b.length || a.localeCompare(b));
+    // Claimed shortest-first, but returned in the original sorted order so report order is unchanged.
+    const claimed = (paths) => shortestPathFirst(paths).filter(claimsRealPath).sort();
     const allCodeFiles = new Set();
     const allPythonFiles = new Set();
     const allHtmlFiles = new Set();
@@ -82,74 +175,93 @@ export async function scan(root) {
     const tsProjectByRoot = new Map();
     fileSets.forEach((set, i) => {
         const projectRoot = projectRootList[i];
-        tsProjectByRoot.set(projectRoot, makeLazyTsProject(set.codeFiles));
-        set.codeFiles.forEach((f) => {
+        tsProjectByRoot.set(projectRoot, makeLazyTsProject(set.codeFiles, boundary));
+        claimed(set.codeFiles).forEach((f) => {
             allCodeFiles.add(f);
             rootForFile.set(f, projectRoot);
         });
-        set.pythonFiles.forEach((f) => allPythonFiles.add(f));
-        set.htmlFiles.forEach((f) => allHtmlFiles.add(f));
-        set.schemaFiles.forEach((f) => allSchemaFiles.add(f));
+        claimed(set.pythonFiles).forEach((f) => allPythonFiles.add(f));
+        claimed(set.htmlFiles).forEach((f) => allHtmlFiles.add(f));
+        claimed(set.schemaFiles).forEach((f) => allSchemaFiles.add(f));
     });
     // HTML files (and their inline <script> blocks) aren't part of any codeFiles list and never carry
     // a resolvable TS type, so they get a permanently-null thunk rather than a project association.
     const noTsProject = () => null;
     for (const filePath of allCodeFiles) {
-        filesScanned += 1;
-        let source;
-        try {
-            source = readFileSync(filePath, "utf8");
-        }
-        catch {
+        const source = readScannable(filePath);
+        if (source === null)
             continue;
-        }
         const getTsProject = tsProjectByRoot.get(rootForFile.get(filePath) ?? "") ?? noTsProject;
-        findings.push(...runCodeRules(filePath, source, root, getTsProject, pendingZodCandidates, oversizedZodFiles));
+        const result = runCodeRules(filePath, source, root, getTsProject, pendingZodCandidates, oversizedZodFiles);
+        findings.push(...result.findings);
+        if (result.failure)
+            recordSkip(filePath, result.failure);
     }
     for (const filePath of allPythonFiles) {
-        filesScanned += 1;
-        let source;
+        const source = readScannable(filePath);
+        if (source === null)
+            continue;
+        const result = await runPythonCodeRules(filePath, source, root);
+        findings.push(...result.findings);
+        if (result.failure)
+            recordSkip(filePath, result.failure);
+    }
+    for (const filePath of allHtmlFiles) {
+        const html = readScannable(filePath);
+        if (html === null)
+            continue;
         try {
-            source = readFileSync(filePath, "utf8");
+            findings.push(...runHtmlInputRules(html, filePath, root));
         }
         catch {
-            continue;
+            recordSkip(filePath, "analysis-failed");
         }
-        findings.push(...(await runPythonCodeRules(filePath, source, root)));
-    }
-    for (const filePath of allHtmlFiles) {
-        filesScanned += 1;
-        let html;
+        let extraction = { scripts: [], skippedCount: 0 };
         try {
-            html = readFileSync(filePath, "utf8");
+            extraction = extractInlineScriptsBounded(html);
         }
         catch {
-            continue;
+            recordSkip(filePath, "analysis-failed");
         }
-        findings.push(...runHtmlInputRules(html, filePath, root));
-        for (const script of extractInlineScripts(html)) {
-            findings.push(...runCodeRules(filePath, script.code, root, noTsProject, pendingZodCandidates, oversizedZodFiles));
+        if (extraction.skippedCount > 0)
+            recordSkip(filePath, "inline-scripts-truncated");
+        let templateScripts = 0;
+        for (const script of extraction.scripts) {
+            const result = runCodeRules(filePath, script.code, root, noTsProject, pendingZodCandidates, oversizedZodFiles);
+            findings.push(...result.findings);
+            if (result.failure === "parse-failed" && containsTemplateSyntax(script.code))
+                templateScripts += 1;
+            else if (result.failure)
+                recordSkip(filePath, result.failure);
         }
+        if (templateScripts > 0)
+            skippedFiles.push({ file: relative(root, filePath), reason: "template-syntax", scripts: templateScripts });
     }
     for (const filePath of allSchemaFiles) {
+        if (!boundary.allowsPath(filePath))
+            continue;
+        if (isOversizedFile(filePath)) {
+            recordSkip(filePath, "oversized");
+            continue;
+        }
         filesScanned += 1;
-        if (OPENAPI_NAME.test(filePath)) {
-            try {
-                findings.push(...parseOpenApiSpec(filePath, root));
-            }
-            catch {
-                continue;
+        try {
+            if (OPENAPI_NAME.test(filePath)) {
+                const report = { hadErrors: false };
+                findings.push(...parseOpenApiSpec(filePath, root, report));
+                if (report.hadErrors)
+                    recordSkip(filePath, "parse-failed");
             }
-        }
-        else if (GRAPHQL_NAME.test(filePath) || extname(filePath) === ".graphql") {
-            try {
+            else if (GRAPHQL_NAME.test(filePath) || extname(filePath) === ".graphql") {
                 findings.push(...parseGraphQLSchema(filePath, root));
             }
-            catch {
-                continue;
-            }
+        }
+        catch {
+            recordSkip(filePath, "parse-failed");
         }
     }
+    for (const link of boundary.blockedLinks())
+        skippedFiles.push({ file: link, reason: "symlink-outside-root" });
     const ambiguousCount = findings.filter((f) => f.requiresReview).length;
     const maxZodFragmentBytes = pendingZodCandidates.length
         ? Math.max(...pendingZodCandidates.map((c) => Buffer.byteLength(c.codeFragment, "utf8")))
@@ -160,6 +272,10 @@ export async function scan(root) {
         ambiguousCount,
         filesScanned,
         unsupportedStackWarning,
+        workspaceWarning,
+        skippedFiles,
+        skippedFilesWarning: summarizeSkippedFiles(skippedFiles),
+        templateSyntaxNote: summarizeTemplateScripts(skippedFiles),
         pendingZodCandidates,
         oversizedZodFiles,
         maxZodFragmentBytes,

package/dist/engine/scanLimits.d.ts

@@ -0,0 +1,29 @@
+/**
+ * One cap for every scanned file type (code, Python, HTML, OpenAPI/GraphQL). The largest real file in
+ * the golden corpus is a 408KB OpenAPI spec, so 2 MiB leaves ~5x headroom while still bounding the
+ * parse/regex/memory cost a single hostile file can impose. Files over it are skipped WITH a warning
+ * (see summarizeSkippedFiles), never silently.
+ */
+export declare const MAX_SCANNED_FILE_BYTES: number;
+export type SkipReason = "oversized" | "inline-scripts-truncated" | "symlink-outside-root" | "unreadable" | "parse-failed" | "analysis-failed" | "template-syntax";
+export interface SkippedFile {
+    file: string;
+    reason: SkipReason;
+    /** For "template-syntax" only: how many inline scripts in the file were not analyzed. */
+    scripts?: number;
+}
+/**
+ * Informational reasons: the content was deliberately not analyzed because it isn't JavaScript yet
+ * (an inline script still carrying Jinja/ERB/Handlebars delimiters), which is expected for template
+ * files rather than a sign the scan is incomplete. They are listed in --json and noted in one line,
+ * but get no policy banner and no non-zero exit code. Every other reason is a real gap.
+ */
+export declare function isInformationalSkip(reason: SkipReason): boolean;
+export declare function containsTemplateSyntax(code: string): boolean;
+/** One informational line, or null when no template-syntax scripts were skipped. */
+export declare function summarizeTemplateScripts(skipped: SkippedFile[]): string | null;
+/** False for files that can't be stat'ed -- the existing read-failure handling covers those. */
+export declare function isOversizedFile(path: string, maxBytes?: number): boolean;
+/** A single summarized line -- a few names, the rest only in ScanResult.skippedFiles (--json). Names
+ *  are in-repo paths only; a blocked symlink's target is never recorded or printed. */
+export declare function summarizeSkippedFiles(allSkipped: SkippedFile[]): string | null;

package/dist/engine/scanLimits.js

@@ -0,0 +1,70 @@
+import { statSync } from "node:fs";
+/**
+ * One cap for every scanned file type (code, Python, HTML, OpenAPI/GraphQL). The largest real file in
+ * the golden corpus is a 408KB OpenAPI spec, so 2 MiB leaves ~5x headroom while still bounding the
+ * parse/regex/memory cost a single hostile file can impose. Files over it are skipped WITH a warning
+ * (see summarizeSkippedFiles), never silently.
+ */
+export const MAX_SCANNED_FILE_BYTES = 2 * 1024 * 1024;
+/**
+ * Informational reasons: the content was deliberately not analyzed because it isn't JavaScript yet
+ * (an inline script still carrying Jinja/ERB/Handlebars delimiters), which is expected for template
+ * files rather than a sign the scan is incomplete. They are listed in --json and noted in one line,
+ * but get no policy banner and no non-zero exit code. Every other reason is a real gap.
+ */
+export function isInformationalSkip(reason) {
+    return reason === "template-syntax";
+}
+// Content a template engine fills in before the browser ever sees it: Jinja/Django/Twig/Liquid
+// ({{ }}, {% %}, {# #}) and ERB/EJS (<% %>).
+const TEMPLATE_DELIMITERS = /\{\{|\{%|<%|\{#/;
+export function containsTemplateSyntax(code) {
+    return TEMPLATE_DELIMITERS.test(code);
+}
+/** One informational line, or null when no template-syntax scripts were skipped. */
+export function summarizeTemplateScripts(skipped) {
+    const total = skipped.filter((s) => s.reason === "template-syntax").reduce((n, s) => n + (s.scripts ?? 0), 0);
+    if (total === 0)
+        return null;
+    const subject = total === 1 ? "1 inline script in template files was" : `${total} inline scripts in template files were`;
+    return `${subject} not analyzed (listed in --json output).`;
+}
+const REASON_LABELS = {
+    oversized: "over the size cap",
+    "inline-scripts-truncated": "too many inline scripts to analyze",
+    "symlink-outside-root": "symlink(s) resolving outside the scanned root, not followed",
+    unreadable: "unreadable",
+    "parse-failed": "failed to parse",
+    "analysis-failed": "aborted during analysis",
+    "template-syntax": "inline scripts with template syntax",
+};
+/** False for files that can't be stat'ed -- the existing read-failure handling covers those. */
+export function isOversizedFile(path, maxBytes = MAX_SCANNED_FILE_BYTES) {
+    try {
+        return statSync(path).size > maxBytes;
+    }
+    catch {
+        return false;
+    }
+}
+const PREVIEW_COUNT = 3;
+/** A single summarized line -- a few names, the rest only in ScanResult.skippedFiles (--json). Names
+ *  are in-repo paths only; a blocked symlink's target is never recorded or printed. */
+export function summarizeSkippedFiles(allSkipped) {
+    const skipped = allSkipped.filter((s) => !isInformationalSkip(s.reason));
+    if (skipped.length === 0)
+        return null;
+    const names = [...new Set(skipped.map((s) => s.file))];
+    const preview = names.slice(0, PREVIEW_COUNT).join(", ");
+    const remaining = names.length - PREVIEW_COUNT;
+    const suffix = remaining > 0 ? `, and ${remaining} more (full list in --json output)` : "";
+    const counts = new Map();
+    for (const s of skipped)
+        counts.set(s.reason, (counts.get(s.reason) ?? new Set()).add(s.file));
+    const breakdown = Object.keys(REASON_LABELS)
+        .filter((reason) => counts.has(reason))
+        .map((reason) => `${counts.get(reason).size} ${REASON_LABELS[reason]}`)
+        .join("; ");
+    const limit = `${MAX_SCANNED_FILE_BYTES / (1024 * 1024)} MiB`;
+    return `${names.length} file(s) were skipped or only partially scanned (${breakdown.replace("over the size cap", `over the ${limit} size cap`)}): ${preview}${suffix}. Findings in them may be missing, so this scan is incomplete.`;
+}

package/dist/engine/tsProject.d.ts

@@ -1,4 +1,5 @@
+import type { RootBoundary } from "./rootBoundary.js";
 export interface TsProjectHandle {
     getObjectTypeMembersAt(filePath: string, line: number, column: number): string[] | null;
 }
-export declare function buildTsProject(files: string[]): TsProjectHandle;
+export declare function buildTsProject(files: string[], boundary?: RootBoundary): TsProjectHandle;

package/dist/engine/tsProject.js

@@ -1,3 +1,5 @@
+import { realpathSync } from "node:fs";
+import { dirname, sep } from "node:path";
 import ts from "typescript";
 // Purely defensive, not a tuned threshold: the largest repo actually measured (dub, 4211 files) took
 // ~2.5s/~800MB to build. This is ~5x that, so a project this large skips type resolution entirely
@@ -20,18 +22,53 @@ function findNodeAtPosition(root, position) {
     });
     return found ?? (root.getStart() <= position && position < root.getEnd() ? root : undefined);
 }
-export function buildTsProject(files) {
+const NODE_MODULES_SEGMENT = `${sep}node_modules${sep}`;
+/**
+ * TypeScript follows imports on its own, so the list of files handed to createProgram is not the whole
+ * set it reads: an import crossing a symlink that leaves the scanned root would otherwise pull that
+ * file's type members into findings. The host refuses any file whose REAL path is outside the root,
+ * except TypeScript's own lib files and package type declarations (a real path under node_modules --
+ * package managers legitimately keep those outside the repo, e.g. pnpm's store).
+ */
+function restrictHostToBoundary(host, options, boundary) {
+    const libDir = dirname(ts.getDefaultLibFilePath(options));
+    const verdicts = new Map();
+    const allowed = (path) => {
+        const cached = verdicts.get(path);
+        if (cached !== undefined)
+            return cached;
+        let verdict;
+        try {
+            const real = realpathSync(path);
+            verdict = boundary.isInsideRealPath(real) || real.startsWith(libDir + sep) || real.includes(NODE_MODULES_SEGMENT);
+        }
+        catch {
+            verdict = true; // doesn't exist (or can't be resolved): the original host answers "no such file"
+        }
+        verdicts.set(path, verdict);
+        return verdict;
+    };
+    const { fileExists, readFile, getSourceFile } = host;
+    host.fileExists = (path) => allowed(path) && fileExists.call(host, path);
+    host.readFile = (path) => (allowed(path) ? readFile.call(host, path) : undefined);
+    host.getSourceFile = (path, ...rest) => (allowed(path) ? getSourceFile.call(host, path, ...rest) : undefined);
+}
+export function buildTsProject(files, boundary) {
     if (files.length === 0 || files.length > MAX_PROGRAM_FILES)
         return NULL_HANDLE;
     let program;
     let checker;
     try {
-        program = ts.createProgram(files, {
+        const options = {
             allowJs: true,
             checkJs: false,
             noEmit: true,
             skipLibCheck: true,
-        });
+        };
+        const host = ts.createCompilerHost(options);
+        if (boundary)
+            restrictHostToBoundary(host, options, boundary);
+        program = ts.createProgram(files, options, host);
         checker = program.getTypeChecker();
     }
     catch {

package/dist/engine/types.d.ts

@@ -56,6 +56,22 @@ export interface ScanResult {
     ambiguousCount: number;
     filesScanned: number;
     unsupportedStackWarning: string | null;
+    /** Non-null when the scanned repo's workspace config was rejected and the default package
+     *  locations were scanned instead (see discoverProjects.ts) -- the scan may be incomplete. */
+    workspaceWarning: string | null;
+    /** Every file skipped, blocked (out-of-root symlink), unparseable, or aborted mid-analysis, or only
+     *  partially scanned -- the complete list, including everything the one-line warning below elides. */
+    skippedFiles: Array<{
+        file: string;
+        reason: "oversized" | "inline-scripts-truncated" | "symlink-outside-root" | "unreadable" | "parse-failed" | "analysis-failed" | "template-syntax";
+        /** "template-syntax" only: inline scripts in the file that were not analyzed. */
+        scripts?: number;
+    }>;
+    /** One summarized line naming a few of skippedFiles; null when nothing was skipped. */
+    skippedFilesWarning: string | null;
+    /** One informational line when inline scripts carrying template syntax ({{, {%, <%, {#) were not
+     *  analyzed; deliberately NOT part of skippedFilesWarning -- no banner, no non-zero exit. */
+    templateSyntaxNote: string | null;
     /**
      * Files that look like they might define a Zod schema used to validate incoming request data —
      * unconfirmed, since the actual schema/anchor detection is protected logic and runs server-side.

package/dist/engine/workspacePatterns.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Validation for workspace glob patterns read from a SCANNED repo's own package.json -- i.e. input an
+ * attacker controls whenever the repo being scanned isn't the user's own. Brace expansion in glob
+ * libraries can be driven to stack overflow, memory exhaustion, or minutes of CPU by very short
+ * patterns (a 37-character `{1..300}{1..300}{1..300}` is enough), so patterns are bounded here before
+ * they ever reach a glob library. Real workspace patterns (`packages/*`, `{apps,packages}/*`,
+ * `tools/*\/packages/*`) are tens of characters with at most one small brace group.
+ */
+export declare const MAX_WORKSPACE_PATTERNS = 100;
+export declare const MAX_PATTERN_LENGTH = 200;
+export declare const MAX_BRACE_DEPTH = 2;
+export declare const MAX_BRACE_GROUPS = 3;
+export declare const MAX_BRACE_EXPANSION = 64;
+export declare const MAX_RANGE_SPAN = 100;
+export type WorkspacePatternsResult = {
+    ok: true;
+    patterns: string[];
+} | {
+    ok: false;
+    reason: string;
+};
+/** `raw` is whatever package.json's `workspaces` (or `workspaces.packages`) held, unvalidated. */
+export declare function validateWorkspacePatterns(raw: unknown): WorkspacePatternsResult;