surfscan 0.0.0-stage → 0.1.0

package/dist/chunk-5SNUPVTB.js

@@ -0,0 +1,2883 @@
+// src/core/types.ts
+var SEVERITIES = ["high", "medium", "low", "info"];
+var SEVERITY_RANK = {
+  high: 3,
+  medium: 2,
+  low: 1,
+  info: 0
+};
+function isSeverity(value) {
+  return typeof value === "string" && SEVERITIES.includes(value);
+}
+
+// src/core/runner.ts
+var DEFAULT_IGNORE_PATHS = ["**/node_modules/**", "**/.git/**"];
+function compareFindings(a, b) {
+  return SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity] || a.file.localeCompare(b.file) || a.line - b.line || (a.column ?? 0) - (b.column ?? 0) || a.ruleId.localeCompare(b.ruleId);
+}
+function sortFindings(findings) {
+  return [...findings].sort(compareFindings);
+}
+function listTargets(provider, config, patterns, extraIgnore = []) {
+  return provider.list(patterns, [...DEFAULT_IGNORE_PATHS, ...extraIgnore, ...config.ignorePaths]);
+}
+async function runScanner(scanner, opts) {
+  const warnings = [];
+  let incomplete = false;
+  const paths = await scanner.findTargets(opts.provider, opts.config);
+  for (const link of opts.provider.takeSkippedLinks?.() ?? []) {
+    warnings.push(`${link}: not scanned, because surfscan does not follow links to folders or to files outside the project`);
+    incomplete = true;
+  }
+  const readOptions = scanner.maxFileBytes === void 0 ? void 0 : { maxBytes: scanner.maxFileBytes };
+  const files = [];
+  for (const path of paths) {
+    try {
+      const content = await opts.provider.read(path, readOptions);
+      if (content !== void 0) files.push({ path, content });
+    } catch (err) {
+      warnings.push(`${path}: skipped (${err.message})`);
+      incomplete = true;
+    }
+  }
+  const context = {
+    files,
+    config: opts.config,
+    provider: opts.provider,
+    options: opts.options ?? {},
+    warn: (message, warnOpts) => {
+      warnings.push(message);
+      if (warnOpts?.incomplete) incomplete = true;
+    }
+  };
+  const ignored = new Set(opts.config.ignore);
+  const findings = [];
+  for (const rule of scanner.rules) {
+    if (ignored.has(rule.id)) continue;
+    try {
+      findings.push(...await rule.check(context));
+    } catch (err) {
+      warnings.push(`${rule.id}: rule failed (${err.message})`);
+      incomplete = true;
+    }
+  }
+  return { findings: sortFindings(findings), warnings, incomplete };
+}
+async function runScanners(scanners, opts) {
+  const findings = [];
+  const warnings = [];
+  let incomplete = false;
+  for (const scanner of scanners) {
+    const result = await runScanner(scanner, opts);
+    findings.push(...result.findings);
+    warnings.push(...result.warnings);
+    incomplete ||= result.incomplete;
+  }
+  return { findings: sortFindings(findings), warnings, incomplete };
+}
+function summarize(findings) {
+  const summary = { high: 0, medium: 0, low: 0, info: 0 };
+  for (const f of findings) summary[f.severity]++;
+  return summary;
+}
+function hasFailures(findings, failOn) {
+  return findings.some((f) => SEVERITY_RANK[f.severity] >= SEVERITY_RANK[failOn]);
+}
+
+// src/core/text.ts
+var LineIndex = class {
+  constructor(text) {
+    this.text = text;
+    for (let i = 0; i < text.length; i++) {
+      if (text.charCodeAt(i) === 10) this.starts.push(i + 1);
+    }
+  }
+  text;
+  starts = [0];
+  positionOf(offset) {
+    let lo = 0;
+    let hi = this.starts.length - 1;
+    while (lo < hi) {
+      const mid = lo + hi + 1 >> 1;
+      if (this.starts[mid] <= offset) lo = mid;
+      else hi = mid - 1;
+    }
+    return { line: lo + 1, column: offset - this.starts[lo] + 1 };
+  }
+  get lineCount() {
+    return this.starts.length;
+  }
+  /** Line text without the trailing newline (or \r\n). */
+  lineText(line) {
+    const start = this.starts[line - 1];
+    if (start === void 0) return "";
+    const next = this.starts[line];
+    let end = next === void 0 ? this.text.length : next - 1;
+    if (end > start && this.text.charCodeAt(end - 1) === 13) end--;
+    return this.text.slice(start, end);
+  }
+  lineStart(line) {
+    return this.starts[line - 1] ?? this.text.length;
+  }
+};
+function stripBom(text) {
+  return text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+}
+function excerpt(text, max = 80) {
+  const oneLine = text.replace(/\s+/g, " ").trim();
+  return oneLine.length > max ? `${oneLine.slice(0, max - 3)}...` : oneLine;
+}
+function codePointLabel(cp) {
+  return `U+${cp.toString(16).toUpperCase().padStart(4, "0")}`;
+}
+
+// src/core/config.ts
+var CONFIG_FILE_NAME = "surfscan.json";
+var DEFAULT_CONFIG = {
+  ignore: [],
+  ignorePaths: [],
+  deps: { minAgeDays: 30 }
+};
+var ConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ConfigError";
+  }
+};
+var TOP_LEVEL_KEYS = ["ignore", "ignorePaths", "deps"];
+var DEPS_KEYS = ["minAgeDays"];
+var RULE_ID = /^[A-Z]+-\d{3}$/;
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function checkKeys(obj, allowed, where, source) {
+  for (const key of Object.keys(obj)) {
+    if (!allowed.includes(key)) {
+      throw new ConfigError(
+        `${source}: unknown key "${where}${key}". Allowed keys: ${allowed.map((k) => where + k).join(", ")}`
+      );
+    }
+  }
+}
+function stringArray(value, name, source) {
+  if (!Array.isArray(value) || !value.every((v) => typeof v === "string")) {
+    throw new ConfigError(`${source}: "${name}" must be an array of strings`);
+  }
+  return value;
+}
+function validateConfig(raw, source = CONFIG_FILE_NAME) {
+  if (!isPlainObject(raw)) {
+    throw new ConfigError(`${source}: config must be a JSON object`);
+  }
+  checkKeys(raw, TOP_LEVEL_KEYS, "", source);
+  const config = {
+    ignore: [...DEFAULT_CONFIG.ignore],
+    ignorePaths: [...DEFAULT_CONFIG.ignorePaths],
+    deps: { ...DEFAULT_CONFIG.deps }
+  };
+  if (raw.ignore !== void 0) {
+    config.ignore = stringArray(raw.ignore, "ignore", source);
+    for (const id of config.ignore) {
+      if (!RULE_ID.test(id)) {
+        throw new ConfigError(`${source}: "ignore" entry "${id}" is not a rule ID (expected something like RULES-001)`);
+      }
+    }
+  }
+  if (raw.ignorePaths !== void 0) {
+    config.ignorePaths = stringArray(raw.ignorePaths, "ignorePaths", source);
+  }
+  if (raw.deps !== void 0) {
+    if (!isPlainObject(raw.deps)) {
+      throw new ConfigError(`${source}: "deps" must be an object`);
+    }
+    checkKeys(raw.deps, DEPS_KEYS, "deps.", source);
+    const { minAgeDays } = raw.deps;
+    if (minAgeDays !== void 0) {
+      if (typeof minAgeDays !== "number" || !Number.isInteger(minAgeDays) || minAgeDays < 0) {
+        throw new ConfigError(`${source}: "deps.minAgeDays" must be a non-negative integer`);
+      }
+      config.deps.minAgeDays = minAgeDays;
+    }
+  }
+  return config;
+}
+function parseConfig(text, source = CONFIG_FILE_NAME) {
+  let raw;
+  try {
+    raw = JSON.parse(stripBom(text));
+  } catch (err) {
+    throw new ConfigError(`${source}: invalid JSON (${err.message})`);
+  }
+  return validateConfig(raw, source);
+}
+async function loadConfig(read, path, required) {
+  const text = await read(path);
+  if (text === void 0) {
+    if (required) throw new ConfigError(`config file not found: ${path}`);
+    return validateConfig({});
+  }
+  return parseConfig(text, path);
+}
+
+// src/core/node-provider.ts
+import { readFile, realpath, stat } from "fs/promises";
+import { isAbsolute, join, relative, sep } from "path";
+import fg from "fast-glob";
+var MAX_FILE_BYTES = 2 * 1024 * 1024;
+var AGENT_FOLDERS = "**/.{claude,codex,cursor,github,surfscan,vscode}";
+var UTF16_LE = [255, 254];
+var UTF16_BE = [254, 255];
+var startsWith = (bytes, mark) => mark.every((b, i) => bytes[i] === b);
+function decode(bytes) {
+  if (startsWith(bytes, UTF16_LE)) return new TextDecoder("utf-16le").decode(bytes);
+  if (startsWith(bytes, UTF16_BE)) return new TextDecoder("utf-16be").decode(bytes);
+  return bytes.toString("utf8");
+}
+function createNodeProvider(root) {
+  const pendingLinks = /* @__PURE__ */ new Set();
+  const reportedLinks = /* @__PURE__ */ new Set();
+  async function resolveLinks(patterns, ignore, paths) {
+    const entries = await fg([...patterns, AGENT_FOLDERS], {
+      cwd: root,
+      dot: true,
+      onlyFiles: false,
+      objectMode: true,
+      followSymbolicLinks: false,
+      suppressErrors: true,
+      ignore
+    });
+    const realRoot = await realpath(root);
+    const extra = [];
+    for (const entry of entries) {
+      if (!entry.dirent.isSymbolicLink() || paths.includes(entry.path)) continue;
+      let target;
+      let isFile;
+      try {
+        target = await realpath(join(root, entry.path));
+        isFile = (await stat(target)).isFile();
+      } catch {
+        continue;
+      }
+      const inside = relative(realRoot, target);
+      if (isFile && !isAbsolute(inside) && !inside.startsWith(`..${sep}`)) {
+        if (!paths.includes(inside.split(sep).join("/"))) extra.push(entry.path);
+      } else if (!reportedLinks.has(entry.path)) {
+        reportedLinks.add(entry.path);
+        pendingLinks.add(entry.path);
+      }
+    }
+    return extra;
+  }
+  return {
+    async list(patterns, ignore) {
+      const paths = await fg(patterns, {
+        cwd: root,
+        dot: true,
+        onlyFiles: true,
+        unique: true,
+        followSymbolicLinks: false,
+        suppressErrors: true,
+        ignore
+      });
+      return [...paths, ...await resolveLinks(patterns, ignore, paths)].sort();
+    },
+    async read(path, opts) {
+      const abs = join(root, path);
+      const limit = opts?.maxBytes ?? MAX_FILE_BYTES;
+      try {
+        const info = await stat(abs);
+        if (!info.isFile()) return void 0;
+        if (info.size > limit) {
+          throw new Error(`larger than ${limit} bytes`);
+        }
+        return decode(await readFile(abs));
+      } catch (err) {
+        if (err.code === "ENOENT") return void 0;
+        throw err;
+      }
+    },
+    takeSkippedLinks() {
+      const links = [...pendingLinks];
+      pendingLinks.clear();
+      return links;
+    }
+  };
+}
+
+// src/core/secret-patterns.ts
+var SECRET_PATTERNS = [
+  { name: "AWS access key ID", regex: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
+  { name: "Stripe live key", regex: /\b(?:sk|rk)_live_[0-9A-Za-z]{10,}\b/g },
+  { name: "GitHub token", regex: /\b(?:ghp|gho|ghu|ghs|ghr)_[0-9A-Za-z]{30,}\b/g },
+  { name: "GitHub fine-grained token", regex: /\bgithub_pat_[0-9A-Za-z_]{30,}\b/g },
+  { name: "Slack token", regex: /\bxox[abposr]-[0-9A-Za-z-]{10,}\b/g },
+  { name: "Anthropic API key", regex: /\bsk-ant-[0-9A-Za-z_-]{20,}/g },
+  { name: "OpenAI API key", regex: /\bsk-(?:proj|svcacct|admin)-[0-9A-Za-z_-]{20,}|\bsk-[0-9A-Za-z]{32,}\b/g },
+  { name: "Google API key", regex: /\bAIza[0-9A-Za-z_-]{35}(?![0-9A-Za-z_-])/g },
+  { name: "npm token", regex: /\bnpm_[0-9A-Za-z]{36}\b/g },
+  { name: "GitLab token", regex: /\bglpat-[0-9A-Za-z_-]{20,}/g },
+  { name: "Hugging Face token", regex: /\bhf_[0-9A-Za-z]{30,}\b/g },
+  { name: "SendGrid API key", regex: /\bSG\.[0-9A-Za-z_-]{22}\.[0-9A-Za-z_-]{43}(?![0-9A-Za-z_-])/g },
+  { name: "JSON Web Token", regex: /\beyJ[0-9A-Za-z_-]{8,}\.eyJ[0-9A-Za-z_-]{8,}\.[0-9A-Za-z_-]{8,}/g },
+  {
+    name: "PEM private key",
+    regex: /-----BEGIN (?:[A-Z]+ )*PRIVATE KEY-----[\s\S]*?(?:-----END (?:[A-Z]+ )*PRIVATE KEY-----|$)/g
+  }
+];
+var HIDDEN = "[redacted]";
+var NOT_A_VALUE = /^(?:\$|<|\{|%)|\.\.\.$|^\[redacted\]$/;
+var SECRET_IN_CONTEXT = [
+  // Authorization: Bearer x. First, or the next pattern would take "Bearer" for the value.
+  /(\b(?:Bearer|Basic|Token)\s+)([A-Za-z0-9._~+/=-]{8,})/g,
+  // password=x  "api_key": "x"  the token is x
+  /(\b[\w-]*(?:password|passwd|pwd|secret|token|api[_-]?key|credential|auth)[\w-]*["']?\s*(?:=|:|\s(?:is|was)\s)\s*["']?)([^\s"',;)]{4,})/gi,
+  // --token x  --password=x
+  /(--[\w-]*(?:password|passwd|token|api-?key|secret|auth)[\w-]*[= ]+["']?)([^\s"',;)]{4,})/gi,
+  // curl -u user:password
+  /((?:^|\s)(?:-u|--user)[ =]+["']?[^\s:"']+:)([^\s"']+)/g,
+  // https://user:password@host
+  /(:\/\/[^\s:/@]+:)([^\s@/]+)(?=@)/g
+];
+var OPAQUE_TOKEN = /(?<![\w+/-])[A-Za-z0-9_+-]{32,}(?![\w+/-])/g;
+function hideOpaqueToken(token) {
+  return /[A-Z]/.test(token) && /[a-z]/.test(token) && /\d/.test(token) ? maskSecret(token) : token;
+}
+function maskSecret(value) {
+  return `${value.slice(0, 4)}...`;
+}
+function redactSecrets(text) {
+  let out = text;
+  for (const { regex } of SECRET_PATTERNS) {
+    out = out.replace(new RegExp(regex.source, regex.flags), (m) => maskSecret(m));
+  }
+  for (const regex of SECRET_IN_CONTEXT) {
+    out = out.replace(
+      new RegExp(regex.source, regex.flags),
+      (whole, keep, value) => NOT_A_VALUE.test(value) ? whole : `${keep}${HIDDEN}`
+    );
+  }
+  return out.replace(OPAQUE_TOKEN, hideOpaqueToken);
+}
+
+// src/core/report/sanitize.ts
+var UNSAFE = /[\u0000-\u0008\u000A-\u001F\u007F-\u009F­؜᠎​-‏‪-‮⁠-⁤⁦-⁩]|[\u{E0000}-\u{E007F}]/gu;
+function escapeUnsafe(text) {
+  return text.replace(UNSAFE, (ch) => {
+    const cp = ch.codePointAt(0);
+    return cp > 65535 ? `\\u{${cp.toString(16).toUpperCase()}}` : `\\u${cp.toString(16).toUpperCase().padStart(4, "0")}`;
+  });
+}
+function redactFinding(f) {
+  return {
+    ...f,
+    message: redactSecrets(f.message),
+    fix: redactSecrets(f.fix),
+    file: redactSecrets(f.file)
+  };
+}
+
+// src/core/report/text.ts
+var COLORS = {
+  high: "\x1B[31m",
+  // red
+  medium: "\x1B[33m",
+  // yellow
+  low: "\x1B[36m",
+  // cyan
+  info: "\x1B[90m"
+  // grey
+};
+var RESET = "\x1B[0m";
+var DIM = "\x1B[2m";
+function location(f) {
+  return f.line > 0 ? `${f.file}:${f.line}` : f.file;
+}
+function summaryLine(findings) {
+  if (findings.length === 0) return "No findings";
+  const summary = summarize(findings);
+  const parts = SEVERITIES.filter((s) => summary[s] > 0).map((s) => `${summary[s]} ${s}`);
+  const noun = findings.length === 1 ? "finding" : "findings";
+  return `${findings.length} ${noun} (${parts.join(", ")})`;
+}
+function formatText(findings, opts) {
+  const safe = findings.map((f) => {
+    const r = redactFinding(f);
+    return { ...r, file: escapeUnsafe(r.file), message: escapeUnsafe(r.message), fix: escapeUnsafe(r.fix) };
+  });
+  const locWidth = Math.max(0, ...safe.map((f) => location(f).length));
+  const idWidth = Math.max(0, ...safe.map((f) => f.ruleId.length));
+  const lines = [];
+  for (const f of safe) {
+    const sev = `${f.severity.toUpperCase().padEnd(6)}  `;
+    const sevText = opts.color ? `${COLORS[f.severity]}${sev}${RESET}` : sev;
+    lines.push(`${location(f).padEnd(locWidth)}   ${sevText}${f.ruleId.padEnd(idWidth)}  ${f.message}`);
+    lines.push(opts.color ? `  ${DIM}Fix: ${f.fix}${RESET}` : `  Fix: ${f.fix}`);
+  }
+  lines.push(summaryLine(findings));
+  if (opts.incomplete) lines.push("Incomplete: some checks could not run, so this result is not a clean bill of health (see the warnings)");
+  return `${lines.join("\n")}
+`;
+}
+
+// src/core/report/json.ts
+var JSON_REPORT_VERSION = 1;
+function toJsonReport(findings, meta = {}) {
+  return {
+    version: JSON_REPORT_VERSION,
+    summary: summarize(findings),
+    complete: !meta.incomplete,
+    warnings: (meta.warnings ?? []).map((w) => escapeUnsafe(redactSecrets(w))),
+    findings: findings.map((f) => {
+      const r = redactFinding(f);
+      const out = r.column === void 0 ? { ruleId: r.ruleId, severity: r.severity, message: r.message, file: r.file, line: r.line, fix: r.fix } : { ruleId: r.ruleId, severity: r.severity, message: r.message, file: r.file, line: r.line, column: r.column, fix: r.fix };
+      return out;
+    })
+  };
+}
+function formatJson(findings, meta = {}) {
+  return `${JSON.stringify(toJsonReport(findings, meta), null, 2)}
+`;
+}
+
+// src/scanners/shared.ts
+function findingsFromMatches(rule, file, matches, message, fix, index = new LineIndex(file.content)) {
+  const seenLines = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const m of [...matches].sort((a, b) => a.index - b.index)) {
+    const pos = index.positionOf(m.index);
+    if (seenLines.has(pos.line)) continue;
+    seenLines.add(pos.line);
+    out.push({
+      ruleId: rule.id,
+      severity: rule.severity,
+      message: message(m.detail),
+      file: file.path,
+      line: pos.line,
+      column: pos.column,
+      fix
+    });
+  }
+  return out;
+}
+function* matchAll(regex, text) {
+  const flags = regex.flags.includes("g") ? regex.flags : `${regex.flags}g`;
+  const re = new RegExp(regex.source, flags);
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    yield m;
+    if (m[0].length === 0) re.lastIndex++;
+  }
+}
+
+// src/scanners/rules/patterns.ts
+var CLAUSE_BOUNDARY = /[.!?;\n]/;
+function clauseBefore(text, index) {
+  let start = index;
+  while (start > 0 && index - start < 60 && !CLAUSE_BOUNDARY.test(text[start - 1])) start--;
+  return text.slice(start, index);
+}
+var NEGATION = /\b(?:never|not|no|avoid|refuse|forbidden|prohibited)\b|n't\b/gi;
+var PERMISSIVE = /\b(?:hesitate|forget|fail|need|afraid|worry|reason|problem|wait)\b/i;
+var NEW_ACTION = /\b(?:but|then|instead|just|and)\b|:/i;
+var CONDITION = /\b(?:if|when|unless|once|after|before|while)\b/i;
+var MAX_WORDS_AFTER_NEGATION = 4;
+var wordCount = (text) => text.split(/\s+/).filter(Boolean).length;
+function isNegated(text, index) {
+  const before = clauseBefore(text, index);
+  const negation = [...before.matchAll(NEGATION)].at(-1);
+  if (!negation) return false;
+  const between = before.slice(negation.index + negation[0].length);
+  if (PERMISSIVE.test(between) || NEW_ACTION.test(between)) return false;
+  const comma = between.indexOf(",");
+  if (comma === -1) return wordCount(between) <= MAX_WORDS_AFTER_NEGATION;
+  const isList = /\b(?:or|nor)\b/i.test(text.slice(index, index + 40));
+  return isList && wordCount(between.slice(0, comma)) <= 2 && !CONDITION.test(before.slice(0, negation.index));
+}
+var INVISIBLE_NAMES = {
+  8203: "ZERO WIDTH SPACE",
+  8204: "ZERO WIDTH NON-JOINER",
+  8205: "ZERO WIDTH JOINER",
+  8206: "LEFT-TO-RIGHT MARK",
+  8207: "RIGHT-TO-LEFT MARK",
+  8288: "WORD JOINER",
+  65279: "ZERO WIDTH NO-BREAK SPACE",
+  8234: "LEFT-TO-RIGHT EMBEDDING",
+  8235: "RIGHT-TO-LEFT EMBEDDING",
+  8236: "POP DIRECTIONAL FORMATTING",
+  8237: "LEFT-TO-RIGHT OVERRIDE",
+  8238: "RIGHT-TO-LEFT OVERRIDE",
+  8294: "LEFT-TO-RIGHT ISOLATE",
+  8295: "RIGHT-TO-LEFT ISOLATE",
+  8296: "FIRST STRONG ISOLATE",
+  8297: "POP DIRECTIONAL ISOLATE"
+};
+var INVISIBLE = /[\u200B-\u200F\u2060\uFEFF\u202A-\u202E\u2066-\u2069]|[\u{E0000}-\u{E007F}]/gu;
+var TAG_RUN = /[\u{E0000}-\u{E007F}]+/gu;
+var BEFORE_EMOJI_JOINER = new RegExp("(?:\\p{Extended_Pictographic}|\\uFE0F|[\\u{1F3FB}-\\u{1F3FF}])$", "u");
+var AFTER_EMOJI_JOINER = new RegExp("^\\p{Extended_Pictographic}", "u");
+function isEmojiJoiner(text, index) {
+  return text.charCodeAt(index) === 8205 && BEFORE_EMOJI_JOINER.test(text.slice(Math.max(0, index - 4), index)) && AFTER_EMOJI_JOINER.test(text.slice(index + 1, index + 3));
+}
+function findInvisibleChars(text) {
+  const byLine = /* @__PURE__ */ new Map();
+  let lineNo = 0;
+  let lastScanned = 0;
+  for (const m of matchAll(INVISIBLE, text)) {
+    if (m.index === 0 && m[0] === "\uFEFF") continue;
+    if (isEmojiJoiner(text, m.index)) continue;
+    for (let i = lastScanned; i < m.index; i++) if (text.charCodeAt(i) === 10) lineNo++;
+    lastScanned = m.index;
+    const cp = m[0].codePointAt(0);
+    const existing = byLine.get(lineNo);
+    if (existing) {
+      if (!existing.codePoints.includes(cp)) existing.codePoints.push(cp);
+    } else {
+      byLine.set(lineNo, { index: m.index, detail: "", codePoints: [cp] });
+    }
+  }
+  const out = [...byLine.values()];
+  for (const match of out) {
+    const tags = match.codePoints.filter((cp) => cp >= 917504);
+    const named = match.codePoints.filter((cp) => cp < 917504).map((cp) => `${codePointLabel(cp)} ${INVISIBLE_NAMES[cp] ?? ""}`.trim());
+    const parts = [...named];
+    if (tags.length > 0) {
+      const lineEnd = text.indexOf("\n", match.index);
+      const lineText = text.slice(match.index, lineEnd === -1 ? void 0 : lineEnd);
+      const decoded = [...lineText.matchAll(TAG_RUN)].map((r) => [...r[0]].map((ch) => decodeTag(ch.codePointAt(0))).join("")).join(" ");
+      parts.push(`Unicode tag characters decoding to "${excerpt(decoded, 60)}"`);
+    }
+    match.detail = parts.join(", ");
+  }
+  return out;
+}
+function decodeTag(cp) {
+  const ascii = cp - 917504;
+  return ascii >= 32 && ascii < 127 ? String.fromCharCode(ascii) : "";
+}
+var DIRECTIVE = /(?<![-\w])(?:you (?:must|should|are|will|need to|have to)|ignore|disregard|forget|pretend|instructions?|assistant|agents?|ai|llm|claude|copilot|cursor|codex|gemini|system prompt|run|execute|install|download|upload|send|post|fetch|curl|wget|delete|exfiltrate|secrets?|passwords?|tokens?|credentials?|api[ _-]?keys?|ssh|(?:do not|don't|never) (?:tell|mention|reveal|inform))(?![-\w])|\.env\b/i;
+var HTML_COMMENT = /<!--([\s\S]*?)(?:-->|$)/g;
+var MD_COMMENT = /^[ \t]*\[(?:\/\/|comment|_)\]:\s*(?:#|<>)\s*(?:\((.*)\)|"(.*)"|'(.*)')[ \t]*$/gim;
+var TAG_NAME = /[a-z][a-z0-9-]*\b/iy;
+var HIDDEN_ATTRIBUTE = /\shidden(?=[\s/>=])/i;
+var STYLE_ATTRIBUTE = /\sstyle\s*=\s*(["'])/gi;
+var HIDING_STYLE = /display\s*:\s*none|visibility\s*:\s*hidden|font-size\s*:\s*0(?![.\d]*[1-9])|opacity\s*:\s*0(?![.\d]*[1-9])/i;
+function tagEnd(text, from) {
+  let quote = "";
+  for (let i = from; i < text.length; i++) {
+    const ch = text[i];
+    if (quote) {
+      if (ch === quote) quote = "";
+    } else if (ch === '"' || ch === "'") {
+      quote = ch;
+    } else if (ch === ">") {
+      return i;
+    }
+  }
+  return text.indexOf(">", from);
+}
+function hidesContent(tag) {
+  if (HIDDEN_ATTRIBUTE.test(tag)) return true;
+  STYLE_ATTRIBUTE.lastIndex = 0;
+  let m;
+  while ((m = STYLE_ATTRIBUTE.exec(tag)) !== null) {
+    const close = tag.indexOf(m[1], STYLE_ATTRIBUTE.lastIndex);
+    const value = tag.slice(STYLE_ATTRIBUTE.lastIndex, close === -1 ? void 0 : close);
+    if (HIDING_STYLE.test(value)) return true;
+    if (close === -1) return false;
+    STYLE_ATTRIBUTE.lastIndex = close + 1;
+  }
+  return false;
+}
+function findHiddenTags(text) {
+  const out = [];
+  let at = text.indexOf("<");
+  while (at !== -1) {
+    TAG_NAME.lastIndex = at + 1;
+    if (!TAG_NAME.test(text)) {
+      at = text.indexOf("<", at + 1);
+      continue;
+    }
+    const end = tagEnd(text, TAG_NAME.lastIndex);
+    if (end === -1) break;
+    const tag = text.slice(at, end + 1);
+    if (hidesContent(tag)) out.push({ index: at, detail: `hidden markup: ${excerpt(tag, 60)}` });
+    at = text.indexOf("<", end + 1);
+  }
+  return out;
+}
+function findHiddenContent(text) {
+  const out = [];
+  for (const m of matchAll(HTML_COMMENT, text)) {
+    const body = m[1] ?? "";
+    if (DIRECTIVE.test(body)) {
+      out.push({ index: m.index, detail: `HTML comment: "${excerpt(body, 60)}"` });
+    }
+  }
+  for (const m of matchAll(MD_COMMENT, text)) {
+    const body = m[1] ?? m[2] ?? m[3] ?? "";
+    if (DIRECTIVE.test(body)) {
+      out.push({ index: m.index, detail: `Markdown comment: "${excerpt(body, 60)}"` });
+    }
+  }
+  out.push(...findHiddenTags(text));
+  return out;
+}
+var SHELLS = "(?:sudo\\s+)?(?:ba|z|k|da|fi)?sh|python[0-9.]*|node|perl|ruby|pwsh|powershell|iex|invoke-expression";
+var DOWNLOADER = /\b(?:curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)\b/gi;
+var INTO_SHELL = new RegExp(`\\|\\s*(?:${SHELLS})\\b`, "iy");
+var SHELL_AROUND_DOWNLOAD = new RegExp(
+  [
+    // bash <(curl ...)   sh -c "$(curl ...)"
+    `\\b(?:(?:ba|z|k|da)?sh|source)\\s+(?:-c\\s+)?["']?(?:<\\(|\\$\\()\\s*(?:curl|wget)\\b`,
+    // iex (iwr ...)   Invoke-Expression (New-Object Net.WebClient).DownloadString(...)
+    `\\b(?:iex|invoke-expression)\\s*(?:\\(\\s*){0,2}(?:iwr|irm|invoke-webrequest|invoke-restmethod|new-object\\s+net\\.webclient)\\b`
+  ].join("|"),
+  "gi"
+);
+function findDownloadPipes(text) {
+  const out = [];
+  const downloader = new RegExp(DOWNLOADER.source, DOWNLOADER.flags);
+  let m;
+  while ((m = downloader.exec(text)) !== null) {
+    let i = m.index + m[0].length;
+    let found = false;
+    for (; i < text.length && text[i] !== "\n"; i++) {
+      if (text[i] !== "|") continue;
+      if (text[i + 1] === "|") {
+        i++;
+        continue;
+      }
+      INTO_SHELL.lastIndex = i;
+      const shell = INTO_SHELL.exec(text);
+      if (shell) {
+        i += shell[0].length;
+        out.push({ index: m.index, detail: excerpt(text.slice(m.index, i), 70) });
+        found = true;
+        break;
+      }
+    }
+    downloader.lastIndex = found ? i : i + 1;
+  }
+  return out;
+}
+function findPipeToShell(text) {
+  const around = [...matchAll(SHELL_AROUND_DOWNLOAD, text)].map((m) => ({ index: m.index, detail: excerpt(m[0], 70) }));
+  return [...findDownloadPipes(text), ...around].sort((a, b) => a.index - b.index);
+}
+var CRED_VERBS = "read|cat|open|print|output|echo|display|show|reveal|include|send|post|upload|exfiltrate|transmit|forward|copy|paste|share|e-?mail|leak|dump|collect|log|attach|embed|base64|curl|submit|report|grab|extract|access";
+var CRED_TARGETS = [
+  "\\.env(?!\\.(?:example|sample|template|dist)\\b)(?:\\.[\\w-]+)*\\b",
+  "env(?:ironment)? files?",
+  "environment variables",
+  "process\\.env",
+  "~?/?\\.ssh\\b",
+  "id_(?:rsa|dsa|ecdsa|ed25519)",
+  "ssh keys?",
+  "private keys?",
+  "\\.aws/credentials",
+  "aws credentials",
+  "\\.npmrc",
+  "\\.netrc",
+  "\\.pypirc",
+  "\\.git-credentials",
+  "\\.docker/config\\.json",
+  "\\.kube/config",
+  "kubeconfig",
+  "credentials?",
+  "secrets?",
+  "api[ _-]?keys?",
+  "(?:access|auth|bearer|session|github|npm|api) ?tokens?",
+  "passwords?"
+].join("|");
+var CRED_ACCESS = new RegExp(`\\b(?:${CRED_VERBS})\\b[^.!?;\\n]{0,60}?(?:${CRED_TARGETS})`, "gi");
+var ENV_DUMP = /\b(?:printenv|env|set)\s*\|\s*(?:curl|wget|nc|netcat)\b/gi;
+var UNRELATED_VERB = /^(?:log\s+(?:in|on|out)\b|open\s+(?:a|an|the)\s+(?:pr|pull request|mr|merge request|issue|ticket)\b)/i;
+var ONLY_A_CONDITION = /\b(?:when|if|unless|whether)\b/i;
+var CRED_STATE_AFTER = /^\s+(?:is|are)\s+(?:missing|invalid|expired|required|empty|unset|not set|wrong|incorrect)\b/i;
+var FROM_ENVIRONMENT_AFTER = /^\s+from\s+(?:the\s+|your\s+)?(?:environment(?:\s+variables?)?|env\s+vars?|process\.env)\b/i;
+var FROM_ENVIRONMENT_END = /\b(?:from|via|using|through)\s+(?:the\s+|your\s+)?(?:environment variables|process\.env)$/i;
+var SENDS_IT_ON = /\b(?:send|post|upload|exfiltrate|transmit|forward|curl|share|e-?mail)\b|https?:/i;
+function isBenignCredentialMention(text, match, index) {
+  if (UNRELATED_VERB.test(match) || ONLY_A_CONDITION.test(match)) return true;
+  const end = index + match.length;
+  const after = text.slice(end, end + 120).split(/[.!?;\n]/, 1)[0];
+  if (CRED_STATE_AFTER.test(after)) return true;
+  return (FROM_ENVIRONMENT_END.test(match) || FROM_ENVIRONMENT_AFTER.test(after)) && !SENDS_IT_ON.test(after);
+}
+function findCredentialAccess(text) {
+  const out = [];
+  for (const m of matchAll(CRED_ACCESS, text)) {
+    if (isNegated(text, m.index) || isBenignCredentialMention(text, m[0], m.index)) continue;
+    if (/\.env\.(?:example|sample|template|dist)\b/i.test(m[0])) continue;
+    out.push({ index: m.index, detail: excerpt(m[0], 70) });
+  }
+  for (const m of matchAll(ENV_DUMP, text)) {
+    out.push({ index: m.index, detail: excerpt(m[0], 70) });
+  }
+  return out;
+}
+var OVERRIDE = [
+  // ignore previous instructions / disregard the system prompt
+  /\b(?:ignore|disregard|forget|override|bypass)\b[^.!?;\n]{0,30}?\b(?:previous|prior|earlier|above|preceding|system|safety|original|your|initial)\b[^.!?;\n]{0,20}?\b(?:instructions?|rules|prompts?|guidelines|directives?|guardrails|polic(?:y|ies)|constraints|restrictions|messages?|context)\b/gi,
+  // ignore all instructions
+  /\b(?:ignore|disregard|forget)\s+(?:all|any)\s+(?:other\s+)?(?:instructions|prompts|directives|guidelines)\b/gi
+];
+var DISABLE_SAFEGUARD = [
+  ...OVERRIDE,
+  // skip confirmation / bypass approval
+  /\b(?:skip|bypass|disable|turn off)\b[^.!?;\n]{0,20}?\b(?:confirmations?|approvals?|permission (?:checks?|prompts?)|safety checks?|human review|review step)\b/gi,
+  // flags and modes that turn off prompts
+  /--dangerously-skip-permissions\b|\bbypassPermissions\b|--yolo\b/gi
+];
+var SKIP_CONFIRM_DIRECT = [
+  // do not ask for confirmation / no need to ask the user
+  /\b(?:do not|don't|dont|never|no need to|stop|avoid)\s+(?:ask(?:ing)?|request(?:ing)?|wait(?:ing)? for|seek(?:ing)?|prompt(?:ing)?)\b[^.!?;\n]{0,30}?\b(?:confirm(?:ation)?s?|approvals?|permission|consent|sign-?off|the user|me|anyone|humans?)\b/gi,
+  // do not tell the user
+  /\b(?:do not|don't|dont|never)\s+(?:tell|inform|notify|alert|mention (?:this |it )?to|reveal (?:this |it )?to)\b[^.!?;\n]{0,15}?\b(?:the user|users?|anyone|the human|humans|the developer)\b/gi,
+  /\b(?:do not|don't|dont|never)\s+(?:mention|reveal|disclose)\s+(?:this|these instructions|that you)\b/gi
+];
+var WITHOUT_CONFIRM = /\bwithout\s+(?:asking|confirm(?:ation|ing)?|approval|permission|consent|human review|review|prompting|checking with)\b/gi;
+function findInstructionOverride(text) {
+  const out = [];
+  for (const re of SKIP_CONFIRM_DIRECT) {
+    for (const m of matchAll(re, text)) out.push({ index: m.index, detail: excerpt(m[0], 70) });
+  }
+  for (const re of [...DISABLE_SAFEGUARD, WITHOUT_CONFIRM]) {
+    for (const m of matchAll(re, text)) {
+      if (!isNegated(text, m.index)) out.push({ index: m.index, detail: excerpt(m[0], 70) });
+    }
+  }
+  return out;
+}
+var MIN_BASE64_LENGTH = 80;
+var MIN_HEX_LENGTH = 80;
+var BASE64_RUN = new RegExp(`[A-Za-z0-9+/_-]{${MIN_BASE64_LENGTH},}={0,2}`, "g");
+var HEX_RUN = new RegExp(`\\b[0-9a-fA-F]{${MIN_HEX_LENGTH},}\\b`, "g");
+var HEX_ESCAPES = /(?:\\x[0-9a-fA-F]{2}){20,}/g;
+function findEncodedBlocks(text) {
+  const out = [];
+  const hexSpans = [];
+  for (const m of matchAll(HEX_RUN, text)) {
+    if (!/[a-f]/i.test(m[0]) || !/\d/.test(m[0])) continue;
+    hexSpans.push([m.index, m.index + m[0].length]);
+    out.push({ index: m.index, detail: `${m[0].length}-character hex block` });
+  }
+  for (const m of matchAll(HEX_ESCAPES, text)) {
+    out.push({ index: m.index, detail: `${m[0].length / 4}-byte \\x escape sequence` });
+  }
+  let hexAt = 0;
+  let scanned = 0;
+  let tokenHasUrl = false;
+  for (const m of matchAll(BASE64_RUN, text)) {
+    const run = m[0];
+    for (let i = scanned; i < m.index; i++) {
+      if (/\s/.test(text[i])) tokenHasUrl = false;
+      else if (text.startsWith("://", i)) tokenHasUrl = true;
+    }
+    scanned = m.index;
+    if (!/[A-Z]/.test(run) || !/[a-z]/.test(run) || !/\d/.test(run)) continue;
+    while (hexAt < hexSpans.length && hexSpans[hexAt][1] <= m.index) hexAt++;
+    if (hexAt < hexSpans.length && m.index >= hexSpans[hexAt][0]) continue;
+    if (tokenHasUrl) continue;
+    out.push({ index: m.index, detail: `${run.length}-character base64 block` });
+  }
+  return out;
+}
+var INSTALL_COMMANDS = [
+  { re: /\b(?:npm|pnpm|bun)\s+(?:install|i|add)\b/gi, eco: "npm" },
+  { re: /\byarn\s+(?:global\s+)?add\b/gi, eco: "npm" },
+  { re: /\b(?:npx|bunx|pnpx)\b|\b(?:pnpm|yarn)\s+dlx\b|\bnpm\s+exec\b/gi, eco: "npx" },
+  { re: /\bdeno\s+run\b/gi, eco: "deno" },
+  { re: /\b(?:pip3?|python3?\s+-m\s+pip|uv\s+pip)\s+install\b|\buv\s+add\b|\bpoetry\s+add\b/gi, eco: "pip" },
+  { re: /\buvx\b|\buv\s+tool\s+(?:install|run)\b/gi, eco: "uvx" },
+  { re: /\bpipx\s+(?:install|run)\b/gi, eco: "pipx" },
+  { re: /\bgem\s+install\b/gi, eco: "gem" },
+  { re: /\bcargo\s+install\b/gi, eco: "cargo" },
+  { re: /\bgo\s+(?:install|get)\b/gi, eco: "go" }
+];
+var VALUE_FLAGS = {
+  npm: ["--registry", "--prefix", "-w", "--workspace", "--tag", "--cache"],
+  npx: ["-c", "--call", "--registry", "--cache"],
+  deno: ["--config", "-c", "--import-map", "--lock"],
+  pip: ["-r", "--requirement", "-c", "--constraint", "-e", "--editable", "-i", "--index-url", "--extra-index-url", "-f", "--find-links", "-t", "--target", "--prefix", "--python", "--group"],
+  uvx: ["--python", "--index-url", "--extra-index-url"],
+  pipx: ["--python", "--pip-args", "--index-url"],
+  gem: ["-v", "--version", "-i", "--install-dir", "--source"],
+  cargo: ["--version", "--vers", "--git", "--path", "--root", "--branch", "--tag", "--rev", "--registry"],
+  go: []
+};
+var EXACT_SEMVER = /^v?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
+var REMOTE_SPEC = /:\/\/|^(?:git(?:\+\w+)?|github|gitlab|bitbucket):/i;
+var LOCAL_SPEC = /^(?:\.|\/|~|[a-z]:[\\/])|^(?:file|link|workspace):|\.(?:whl|tar\.gz|tgz|zip)$/i;
+var COMMIT_PINNED = /[#@][0-9a-f]{40}$/i;
+function isLocal(spec) {
+  return !REMOTE_SPEC.test(spec) && LOCAL_SPEC.test(spec);
+}
+function isPlaceholder(spec) {
+  return /^<.*>$|[{}$]|^\.\.\.$/.test(spec);
+}
+function npmPinned(spec) {
+  const at = spec.lastIndexOf("@");
+  if (at <= 0) return false;
+  return EXACT_SEMVER.test(spec.slice(at + 1));
+}
+function pipPinned(spec) {
+  return /^[A-Za-z0-9._-]+(?:\[[^\]]*\])?===?[0-9][0-9A-Za-z.+!-]*$/.test(spec);
+}
+function stripQuotes(token) {
+  return token.replace(/^["']|["']$/g, "");
+}
+function unpinnedPackages(eco, args) {
+  const tokens = args.map(stripQuotes).filter((t) => t.length > 0);
+  const valueFlags = VALUE_FLAGS[eco];
+  const positionals = [];
+  const packageFlagValues = [];
+  let hasVersionFlag = false;
+  for (let i = 0; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (t.startsWith("-")) {
+      const [flag, inline] = t.split("=", 2);
+      if (eco === "gem" && (flag === "-v" || flag === "--version") || eco === "cargo" && (flag === "--version" || flag === "--vers")) {
+        hasVersionFlag = true;
+      }
+      if (eco === "npx" && (flag === "-p" || flag === "--package") || eco === "uvx" && (flag === "--from" || flag === "--with")) {
+        const value = inline ?? tokens[++i];
+        if (value) packageFlagValues.push(stripQuotes(value));
+        continue;
+      }
+      if (valueFlags.includes(flag) && inline === void 0) i++;
+      continue;
+    }
+    positionals.push(t);
+  }
+  let candidates;
+  switch (eco) {
+    case "npx":
+    case "uvx":
+    case "pipx":
+    case "deno":
+      candidates = packageFlagValues.length > 0 ? packageFlagValues : positionals.slice(0, 1);
+      break;
+    default:
+      candidates = positionals;
+  }
+  const unpinned = [];
+  for (const spec of candidates) {
+    if (isPlaceholder(spec) || isLocal(spec)) continue;
+    if (REMOTE_SPEC.test(spec)) {
+      if (!COMMIT_PINNED.test(spec) && !(eco === "deno" && /@\d+\.\d+\.\d+/.test(spec))) unpinned.push(spec);
+      continue;
+    }
+    let pinned;
+    switch (eco) {
+      case "deno":
+        if (!/^(?:npm|jsr):/i.test(spec)) continue;
+        pinned = npmPinned(spec);
+        break;
+      case "npm":
+      case "npx":
+        pinned = npmPinned(spec);
+        break;
+      case "pip":
+      case "pipx":
+        pinned = pipPinned(spec);
+        break;
+      case "uvx":
+        pinned = pipPinned(spec) || npmPinned(spec);
+        break;
+      case "gem":
+        pinned = hasVersionFlag || /:\d/.test(spec);
+        break;
+      case "cargo":
+        pinned = hasVersionFlag || npmPinned(spec);
+        break;
+      case "go":
+        pinned = npmPinned(spec);
+        break;
+    }
+    if (!pinned) unpinned.push(spec);
+  }
+  return unpinned;
+}
+var ARG_TERMINATOR = /[;&|`)\n]|\s#|\s(?:and|then)\s/;
+function findUnpinnedInstalls(text) {
+  const out = [];
+  for (const { re, eco } of INSTALL_COMMANDS) {
+    const commands = [...matchAll(re, text)];
+    for (const [i, m] of commands.entries()) {
+      const rest = text.slice(m.index + m[0].length, commands[i + 1]?.index);
+      const end = rest.search(ARG_TERMINATOR);
+      const argText = end === -1 ? rest : rest.slice(0, end);
+      const names = unpinnedPackages(eco, argText.split(/\s+/));
+      if (names.length > 0) {
+        out.push({ index: m.index, detail: `${m[0].replace(/\s+/g, " ")} ${names.join(" ")}` });
+      }
+    }
+  }
+  return out;
+}
+var URL_RE = /\bhttps?:\/\/[^\s)>\]'"`]+/i;
+var FOLLOW_PHRASE = [
+  /\b(?:follow|obey|apply|execute|run|carry out|adhere to|comply with|do what)\b[^.!?;\n]{0,40}?\b(?:instructions?|directions|steps|rules|commands?|guidance|it says|they say)\b/i,
+  /\b(?:fetch|load|read|retrieve|download|pull|get|import)\b[^.!?;\n]{0,30}?\b(?:instructions?|rules|guidelines|prompts?|directives|polic(?:y|ies))\b[^.!?;\n]{0,10}?\bfrom\b/i
+];
+function findRemoteInstructions(text) {
+  const out = [];
+  let offset = 0;
+  for (const line of text.split("\n")) {
+    const url = URL_RE.exec(line);
+    if (url && FOLLOW_PHRASE.some((re) => re.test(line))) {
+      out.push({ index: offset + url.index, detail: excerpt(url[0], 70) });
+    }
+    offset += line.length + 1;
+  }
+  return out;
+}
+
+// src/scanners/rules/index.ts
+var RULES_TARGETS = [
+  "**/CLAUDE.md",
+  "**/CLAUDE.local.md",
+  "**/AGENTS.md",
+  "**/.cursorrules",
+  "**/.cursor/rules/**/*",
+  "**/.github/copilot-instructions.md"
+];
+function findRulesTargets(provider, config) {
+  return listTargets(provider, config, RULES_TARGETS);
+}
+function textRule(spec) {
+  return {
+    id: spec.id,
+    severity: spec.severity,
+    title: spec.title,
+    check(context) {
+      const out = [];
+      for (const file of context.files) {
+        const matches = spec.detect(file.content);
+        if (matches.length === 0) continue;
+        out.push(...findingsFromMatches(spec, file, matches, spec.message, spec.fix, new LineIndex(file.content)));
+      }
+      return out;
+    }
+  };
+}
+var rules = [
+  textRule({
+    id: "RULES-001",
+    severity: "high",
+    title: "Invisible Unicode in instruction file",
+    detect: findInvisibleChars,
+    message: (d) => `Invisible Unicode in instruction file: ${d}`,
+    fix: "remove the hidden characters and review the surrounding text"
+  }),
+  textRule({
+    id: "RULES-002",
+    severity: "high",
+    title: "Hidden instructions in comment or markup",
+    detect: findHiddenContent,
+    message: (d) => `Hidden content in instruction file, ${d}`,
+    fix: "move the text into visible prose or delete it; agents read comments that rendered previews hide"
+  }),
+  textRule({
+    id: "RULES-003",
+    severity: "high",
+    title: "Download piped into a shell",
+    detect: findPipeToShell,
+    message: (d) => `Download piped into a shell: ${d}`,
+    fix: "download the script, review it, pin it by checksum, then run the local copy"
+  }),
+  textRule({
+    id: "RULES-004",
+    severity: "high",
+    title: "Instruction to read or send credentials",
+    detect: findCredentialAccess,
+    message: (d) => `Instruction touches credentials: ${d}`,
+    fix: "remove the instruction; agents should never read or transmit secrets, env files or SSH keys"
+  }),
+  textRule({
+    id: "RULES-005",
+    severity: "high",
+    title: "Instruction to override earlier instructions or skip confirmation",
+    detect: findInstructionOverride,
+    message: (d) => `Instruction overrides safeguards: ${d}`,
+    fix: "remove the instruction; keep human confirmation for actions with side effects"
+  }),
+  textRule({
+    id: "RULES-006",
+    severity: "medium",
+    title: "Long encoded block in instruction file",
+    detect: findEncodedBlocks,
+    message: (d) => `Encoded content in instruction file: ${d}`,
+    fix: "decode and review the block; replace it with plain text or a reference to a reviewed file"
+  }),
+  textRule({
+    id: "RULES-007",
+    severity: "medium",
+    title: "Instruction to install unpinned packages",
+    detect: findUnpinnedInstalls,
+    message: (d) => `Unpinned package install: ${d}`,
+    fix: "pin exact versions (for example pkg@1.2.3 or pkg==1.2.3) or install from the lock file"
+  }),
+  textRule({
+    id: "RULES-008",
+    severity: "medium",
+    title: "Instruction to fetch and follow an external URL",
+    detect: findRemoteInstructions,
+    message: (d) => `Instructions loaded from an external URL: ${d}`,
+    fix: "copy the reviewed instructions into the repo instead of telling the agent to fetch and follow them"
+  })
+];
+var rulesScanner = {
+  name: "rules",
+  rules,
+  findTargets: findRulesTargets
+};
+
+// src/scanners/keys/gitignore.ts
+function escapeRegex(ch) {
+  return /[\\^$.+()|{}]/.test(ch) ? `\\${ch}` : ch;
+}
+function globToRegex(glob) {
+  let out = "";
+  for (let i = 0; i < glob.length; i++) {
+    const ch = glob[i];
+    if (ch === "*") {
+      if (glob[i + 1] === "*") {
+        const atStart = i === 0 || glob[i - 1] === "/";
+        const next = glob[i + 2];
+        if (atStart && next === "/") {
+          out += "(?:.*/)?";
+          i += 2;
+        } else if (atStart && next === void 0) {
+          out += ".*";
+          i += 1;
+        } else {
+          out += "[^/]*";
+          i += 1;
+        }
+      } else {
+        out += "[^/]*";
+      }
+    } else if (ch === "?") {
+      out += "[^/]";
+    } else if (ch === "[") {
+      const end = glob.indexOf("]", i + 1);
+      if (end === -1) {
+        out += "\\[";
+      } else {
+        let cls = glob.slice(i + 1, end);
+        if (cls.startsWith("!")) cls = `^${cls.slice(1)}`;
+        out += `[${cls.replace(/\\/g, "\\\\")}]`;
+        i = end;
+      }
+    } else if (ch === "\\" && i + 1 < glob.length) {
+      const next = glob[++i];
+      out += /[A-Za-z0-9]/.test(next) ? next : `\\${next}`;
+    } else {
+      out += escapeRegex(ch);
+    }
+  }
+  return out;
+}
+function parseGitignore(text, base) {
+  const patterns = [];
+  for (let raw of text.split(/\r?\n/)) {
+    raw = raw.replace(/(?<!\\)\s+$/, "");
+    if (raw === "" || raw.startsWith("#")) continue;
+    let negate = false;
+    if (raw.startsWith("!")) {
+      negate = true;
+      raw = raw.slice(1);
+    } else if (raw.startsWith("\\!") || raw.startsWith("\\#")) {
+      raw = raw.slice(1);
+    }
+    let dirOnly = false;
+    if (raw.endsWith("/")) {
+      dirOnly = true;
+      raw = raw.slice(0, -1);
+    }
+    const anchored = raw.includes("/");
+    if (raw.startsWith("/")) raw = raw.slice(1);
+    if (raw === "") continue;
+    const body = globToRegex(raw);
+    const prefix = base === "" ? "" : `${base.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}/`;
+    const source = anchored ? `^${prefix}${body}$` : `^${prefix}(?:.*/)?${body}$`;
+    patterns.push({ base, regex: new RegExp(source), negate, dirOnly });
+  }
+  return patterns;
+}
+function isIgnoredBy(patterns, path, isDir) {
+  let result;
+  for (const p of patterns) {
+    if (p.dirOnly && !isDir) continue;
+    if (p.regex.test(path)) result = !p.negate;
+  }
+  return result;
+}
+var GitignoreChecker = class {
+  constructor(provider) {
+    this.provider = provider;
+  }
+  provider;
+  cache = /* @__PURE__ */ new Map();
+  async patternsFor(dir) {
+    const cached = this.cache.get(dir);
+    if (cached) return cached;
+    const file = dir === "" ? ".gitignore" : `${dir}/.gitignore`;
+    let patterns = [];
+    try {
+      const text = await this.provider.read(file);
+      if (text !== void 0) patterns = parseGitignore(text, dir);
+      if (dir === "") {
+        const exclude = await this.provider.read(".git/info/exclude");
+        if (exclude !== void 0) patterns = [...parseGitignore(exclude, ""), ...patterns];
+      }
+    } catch {
+    }
+    this.cache.set(dir, patterns);
+    return patterns;
+  }
+  /** True when the project's ignore files exclude `path` (relative, forward slashes). */
+  async isIgnored(path) {
+    const parts = path.split("/");
+    const all = [];
+    for (let i = 0; i < parts.length; i++) {
+      const dir = parts.slice(0, i).join("/");
+      all.push(...await this.patternsFor(dir));
+      const current = parts.slice(0, i + 1).join("/");
+      const isDir = i < parts.length - 1;
+      const ignored = isIgnoredBy(all, current, isDir);
+      if (isDir && ignored) return true;
+      if (!isDir) return ignored ?? false;
+    }
+    return false;
+  }
+};
+
+// src/scanners/keys/index.ts
+var KEYS_TARGETS = [
+  // Env files
+  "**/.env",
+  "**/.env.*",
+  "**/*.env",
+  // Agent configs
+  "**/.mcp.json",
+  "**/.cursor/mcp.json",
+  "**/.vscode/mcp.json",
+  "**/.claude/settings.json",
+  "**/.claude/settings.local.json",
+  "**/.codex/config.toml",
+  // Credential and config files
+  "**/.npmrc",
+  "**/.pypirc",
+  "**/.netrc",
+  "**/.git-credentials",
+  "**/*.{json,jsonc,yaml,yml,toml,ini,cfg,conf,properties,xml,tf,tfvars}",
+  "**/*.{pem,key}",
+  "**/id_{rsa,dsa,ecdsa,ed25519}"
+];
+var KEYS_EXCLUDE = ["**/package-lock.json", "**/npm-shrinkwrap.json", "**/pnpm-lock.yaml", "**/composer.lock"];
+var MAX_KEYS_FILE_BYTES = 32 * 1024 * 1024;
+function findKeysTargets(provider, config) {
+  return listTargets(provider, config, KEYS_TARGETS, KEYS_EXCLUDE);
+}
+function basename(path) {
+  return path.slice(path.lastIndexOf("/") + 1);
+}
+function isEnvFile(path) {
+  const name = basename(path);
+  return /^\.env(?:\..+)?$/.test(name) || /\.env$/.test(name);
+}
+function isEnvTemplate(path) {
+  return /(?:^|[.-])(?:example|sample|template|dist|defaults?|schema)(?:$|[.-])/i.test(basename(path));
+}
+var SECRET_NAME_PARTS = /* @__PURE__ */ new Set([
+  "KEY",
+  "APIKEY",
+  "SECRET",
+  "TOKEN",
+  "PASSWORD",
+  "PASSWD",
+  "PASS",
+  "PWD",
+  "CREDENTIAL",
+  "CREDENTIALS",
+  "AUTH",
+  "AUTHORIZATION",
+  "PRIVATE",
+  "DSN"
+]);
+function nameParts(name) {
+  return name.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toUpperCase().split(/[^A-Z0-9]+/).filter(Boolean);
+}
+function isSecretName(name) {
+  return nameParts(name).some(
+    (p) => SECRET_NAME_PARTS.has(p) || /(?:KEY|TOKEN|SECRET|PASSWORD)$/.test(p)
+  );
+}
+function isProdName(name) {
+  return nameParts(name).some((p) => p === "PROD" || p === "PRODUCTION");
+}
+var PLACEHOLDER = /^(?:|x+|\*+|\.+|-+|changeme|change[-_]me|replace[-_]?me|todo|tbd|placeholder|null|none|nil|undefined|true|false|dummy|redacted|secret|password)$|^<.*>$|^\$\{.*\}$|^\$[A-Za-z_]\w*$|^\{\{.*\}\}$|^%\w+%$|^your[-_]|example/i;
+function isRealValue(value) {
+  return value.length >= 8 && !PLACEHOLDER.test(value);
+}
+var URL_WITH_PASSWORD = /^[a-z][a-z0-9+.-]*:\/\/[^:/\s@]+:([^@/\s]+)@/i;
+var ASSIGNMENT = /(?:^|[\s{,])(?:export\s+)?["']?([A-Za-z_][A-Za-z0-9_.-]*)["']?[ \t]*[:=][ \t]*(?:"((?:[^"\\\n]|\\.)*)"|'([^'\n]*)'|(\$\{[^}\n]*\}|[^\s,#;}\]{[][^\s,#;}\]]*))/gm;
+function findAssignments(text) {
+  const out = [];
+  for (const m of matchAll(ASSIGNMENT, text)) {
+    const value = m[2] ?? m[3] ?? m[4] ?? "";
+    const valueIndex = m.index + m[0].length - value.length - (m[4] === void 0 ? 1 : 0);
+    out.push({ name: m[1], value, index: Math.max(m.index, valueIndex) });
+  }
+  return out;
+}
+function hasSecret(file) {
+  for (const a of findAssignments(file.content)) {
+    if (isSecretName(a.name) && isRealValue(a.value)) return a;
+    if (URL_WITH_PASSWORD.test(a.value)) return a;
+  }
+  for (const { regex } of SECRET_PATTERNS) {
+    const m = new RegExp(regex.source, regex.flags.replace("g", "")).exec(file.content);
+    if (m && !/example/i.test(m[0])) return { index: m.index, detail: "" };
+  }
+  return void 0;
+}
+var AWS_SECRET_NAME = /^aws[_-]?secret(?:[_-]?access)?[_-]?key$/i;
+var AGENT_CONFIG = /(?:^|\/)(?:\.mcp\.json|\.cursor\/mcp\.json|\.vscode\/mcp\.json|\.claude\/settings(?:\.local)?\.json|\.codex\/config\.toml)$/;
+var REFERENCES_VARIABLE = /\$\{|\$[A-Za-z_]|%\w+%/;
+function findYamlProductionSecrets(text) {
+  const out = [];
+  let blockIndent = -1;
+  let offset = 0;
+  for (const rawLine of text.split("\n")) {
+    const line = rawLine.replace(/\r$/, "");
+    if (line.trim() !== "" && !line.trimStart().startsWith("#")) {
+      const indent = line.length - line.trimStart().length;
+      if (blockIndent !== -1 && indent <= blockIndent) blockIndent = -1;
+      if (/^\s*["']?(?:prod|production)["']?:\s*$/i.test(line)) {
+        if (blockIndent === -1) blockIndent = indent;
+      } else if (blockIndent !== -1) {
+        for (const a of findAssignments(line)) out.push({ ...a, index: offset + a.index });
+      }
+    }
+    offset += rawLine.length + 1;
+  }
+  return out;
+}
+function findLiveKeys(text, path = "") {
+  const out = [];
+  for (const { name, regex } of SECRET_PATTERNS) {
+    for (const m of matchAll(regex, text)) {
+      if (/example/i.test(m[0])) continue;
+      const shown = name === "PEM private key" ? "BEGIN ... PRIVATE KEY" : maskSecret(m[0]);
+      out.push({ index: m.index, detail: `${name} ${shown}` });
+    }
+  }
+  const assignments = findAssignments(text);
+  const agentConfig = AGENT_CONFIG.test(path);
+  for (const a of assignments) {
+    if (AWS_SECRET_NAME.test(a.name) && isRealValue(a.value)) {
+      out.push({ index: a.index, detail: `AWS secret access key ${maskSecret(a.value)}` });
+    } else if (isProdName(a.name) && (isSecretName(a.name) && isRealValue(a.value) || URL_WITH_PASSWORD.test(a.value))) {
+      out.push({ index: a.index, detail: `production credential ${a.name}=${maskSecret(a.value)}` });
+    } else if (agentConfig && isSecretName(a.name) && isRealValue(a.value) && !REFERENCES_VARIABLE.test(a.value)) {
+      out.push({ index: a.index, detail: `credential written into an agent config, ${a.name}=${maskSecret(a.value)}` });
+    }
+  }
+  for (const a of findYamlProductionSecrets(text)) {
+    if (isSecretName(a.name) && isRealValue(a.value) || URL_WITH_PASSWORD.test(a.value)) {
+      out.push({ index: a.index, detail: `production credential ${a.name}=${maskSecret(a.value)}` });
+    }
+  }
+  return out;
+}
+function asList(value) {
+  return Array.isArray(value) ? value : value === void 0 ? [] : [value];
+}
+function findWildcardStatements(node, found = []) {
+  if (Array.isArray(node)) {
+    for (const item of node) findWildcardStatements(item, found);
+  } else if (node && typeof node === "object") {
+    const obj = node;
+    const effect = obj.Effect ?? obj.effect;
+    const actions = asList(obj.Action ?? obj.action ?? obj.actions);
+    const resources = asList(obj.Resource ?? obj.resource ?? obj.resources);
+    if ((effect === void 0 || effect === "Allow") && actions.includes("*") && resources.includes("*")) {
+      found.push(obj);
+    }
+    for (const value of Object.values(obj)) findWildcardStatements(value, found);
+  }
+  return found;
+}
+var ACTION_STAR = /["']?\b(?:Action|actions)\b["']?\s*[:=]\s*(?:\[\s*)?(?:-\s*)?["']\*["']/gi;
+var RESOURCE_STAR = /["']?\b(?:Resource|resources)\b["']?\s*[:=]\s*(?:\[\s*)?(?:-\s*)?["']\*["']/i;
+var ADMIN_POLICY = /\barn:aws:iam::aws:policy\/AdministratorAccess\b|["'\s/]AdministratorAccess["'\s]|\broles\/(?:owner|editor)\b/g;
+function findAdminPolicies(path, text) {
+  const out = [];
+  let parsedJson = false;
+  if (/\.json$/i.test(path)) {
+    try {
+      const data = JSON.parse(stripBom(text));
+      parsedJson = true;
+      if (findWildcardStatements(data).length > 0) {
+        for (const m of matchAll(ACTION_STAR, text)) {
+          out.push({ index: m.index, detail: 'statement allows Action "*" on Resource "*"' });
+        }
+        if (out.length === 0) out.push({ index: 0, detail: 'statement allows Action "*" on Resource "*"' });
+      }
+    } catch {
+    }
+  }
+  if (!parsedJson) {
+    for (const m of matchAll(ACTION_STAR, text)) {
+      const window = text.slice(Math.max(0, m.index - 300), m.index + 300);
+      if (RESOURCE_STAR.test(window)) out.push({ index: m.index, detail: 'statement allows Action "*" on Resource "*"' });
+    }
+  }
+  for (const m of matchAll(ADMIN_POLICY, text)) {
+    const what = /roles\//.test(m[0]) ? `GCP basic role ${m[0].trim()}` : "AWS AdministratorAccess policy";
+    out.push({ index: m.index + (/^["'\s/]/.test(m[0]) ? 1 : 0), detail: what });
+  }
+  return out;
+}
+var rules2 = [
+  {
+    id: "KEYS-001",
+    severity: "high",
+    title: "Live or production key in a file the agent can read",
+    check(context) {
+      const out = [];
+      for (const file of context.files) {
+        const matches = findLiveKeys(file.content, file.path);
+        out.push(
+          ...findingsFromMatches(
+            this,
+            file,
+            matches,
+            (d) => `Live key the agent can read: ${d}`,
+            "move the key to a secret manager or a file outside the project, rotate it, and give agents a scoped test key instead"
+          )
+        );
+      }
+      return out;
+    }
+  },
+  {
+    id: "KEYS-002",
+    severity: "high",
+    title: "Env file with secrets not covered by .gitignore",
+    async check(context) {
+      const checker = new GitignoreChecker(context.provider);
+      const out = [];
+      for (const file of context.files) {
+        if (!isEnvFile(file.path) || isEnvTemplate(file.path)) continue;
+        const secret = hasSecret(file);
+        if (!secret) continue;
+        if (await checker.isIgnored(file.path)) continue;
+        const pos = new LineIndex(file.content).positionOf(secret.index);
+        out.push({
+          ruleId: this.id,
+          severity: this.severity,
+          message: "Env file with secrets is not covered by .gitignore",
+          file: file.path,
+          line: pos.line,
+          fix: `add ${basename(file.path)} (or .env*) to .gitignore; if it was ever committed, rotate the secrets`
+        });
+      }
+      return out;
+    }
+  },
+  {
+    id: "KEYS-003",
+    severity: "medium",
+    title: "Wildcard or admin scope in cloud policy",
+    check(context) {
+      const out = [];
+      for (const file of context.files) {
+        const matches = findAdminPolicies(file.path, file.content);
+        out.push(
+          ...findingsFromMatches(
+            this,
+            file,
+            matches,
+            (d) => `Over-scoped cloud permission: ${d}`,
+            "grant only the actions and resources the task needs; keep admin roles away from keys agents can use"
+          )
+        );
+      }
+      return out;
+    }
+  }
+];
+var keysScanner = {
+  name: "keys",
+  rules: rules2,
+  findTargets: findKeysTargets,
+  maxFileBytes: MAX_KEYS_FILE_BYTES
+};
+
+// src/scanners/shared-json.ts
+function parseJsonc(raw) {
+  const text = stripBom(raw);
+  const out = [];
+  let inString = false;
+  let pendingComma = -1;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (inString) {
+      out.push(ch);
+      if (ch === "\\") out.push(text[++i] ?? "");
+      else if (ch === '"') inString = false;
+    } else if (ch === '"') {
+      inString = true;
+      pendingComma = -1;
+      out.push(ch);
+    } else if (ch === "/" && text[i + 1] === "/") {
+      const end = text.indexOf("\n", i);
+      i = end === -1 ? text.length : end - 1;
+    } else if (ch === "/" && text[i + 1] === "*") {
+      const end = text.indexOf("*/", i + 2);
+      i = end === -1 ? text.length : end + 1;
+    } else if (ch === "}" || ch === "]") {
+      if (pendingComma !== -1) out[pendingComma] = "";
+      pendingComma = -1;
+      out.push(ch);
+    } else {
+      if (ch === ",") pendingComma = out.length;
+      else if (!/\s/.test(ch)) pendingComma = -1;
+      out.push(ch);
+    }
+  }
+  return JSON.parse(out.join(""));
+}
+var JsonLocator = class {
+  constructor(text) {
+    this.text = text;
+    this.index = new LineIndex(text);
+  }
+  text;
+  index;
+  lineAt(offset) {
+    return offset < 0 ? 1 : this.index.positionOf(offset).line;
+  }
+  /** Line of `"key"` (first occurrence at or after `from`). */
+  key(key, from = 0) {
+    return this.lineAt(this.text.indexOf(JSON.stringify(key), from));
+  }
+  /** Offset of `"key"`, or -1. */
+  keyOffset(key, from = 0) {
+    return this.text.indexOf(JSON.stringify(key), from);
+  }
+  /** Line of a string value, searching after the given key when present. */
+  stringValue(value, afterKey) {
+    return this.lineAt(this.stringValueOffset(value, afterKey ? this.keyOffset(afterKey) : 0));
+  }
+  /** Offset of a string value at or after `from`, or anywhere if not found there; -1 if absent. */
+  stringValueOffset(value, from = 0) {
+    const literal = JSON.stringify(value);
+    const at = this.text.indexOf(literal, Math.max(0, from));
+    return at === -1 ? this.text.indexOf(literal) : at;
+  }
+  /** Line of a known offset. */
+  lineOfOffset(offset) {
+    return this.lineAt(offset);
+  }
+};
+
+// src/scanners/approvals/adapters/claude-code.ts
+var SHELL_TOOLS = /* @__PURE__ */ new Set(["Bash", "PowerShell"]);
+var BYPASS_MODES = /* @__PURE__ */ new Set(["bypassPermissions", "auto"]);
+var PARTIAL_MODES = /* @__PURE__ */ new Set(["acceptEdits"]);
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseRule(raw, line) {
+  const m = /^\s*([A-Za-z0-9_*-]+)\s*(?:\(([\s\S]*)\))?\s*$/.exec(raw);
+  if (!m) return { raw, line, kind: "other" };
+  const tool = m[1];
+  const specifier = m[2];
+  if (SHELL_TOOLS.has(tool)) {
+    const command = specifier?.trim();
+    return { raw, line, kind: "shell", command: command === void 0 || command === "" ? void 0 : command };
+  }
+  const mcp = /^mcp__(.+?)(?:__(.*))?$/.exec(tool);
+  if (mcp && specifier === void 0) {
+    const server = mcp[1];
+    if (server.includes("*")) return { raw, line, kind: "other" };
+    const toolPattern = mcp[2];
+    return {
+      raw,
+      line,
+      kind: "mcp",
+      mcpServer: server,
+      mcpTool: toolPattern === void 0 || toolPattern === "*" ? void 0 : toolPattern
+    };
+  }
+  return { raw, line, kind: "other" };
+}
+var claudeCodeAdapter = {
+  agent: "Claude Code",
+  targets: ["**/.claude/settings.json", "**/.claude/settings.local.json"],
+  matches(path) {
+    return /(?:^|\/)\.claude\/settings(?:\.local)?\.json$/.test(path);
+  },
+  parse(file) {
+    const data = JSON.parse(stripBom(file.content));
+    if (!isObject(data)) return void 0;
+    const loc = new JsonLocator(file.content);
+    const settings = {
+      agent: this.agent,
+      file: file.path,
+      bypass: [],
+      partial: [],
+      allow: [],
+      allMcpServers: []
+    };
+    const permissions = isObject(data.permissions) ? data.permissions : {};
+    const permOffset = Math.max(0, loc.keyOffset("permissions"));
+    const mode = permissions.defaultMode;
+    if (typeof mode === "string" && BYPASS_MODES.has(mode)) {
+      settings.bypass.push({
+        value: `permissions.defaultMode is "${mode}" (ignored from project files since v2.1.257, honoured by older versions)`,
+        line: loc.key("defaultMode", permOffset)
+      });
+    } else if (typeof mode === "string" && PARTIAL_MODES.has(mode)) {
+      settings.partial.push({
+        value: `permissions.defaultMode is "${mode}" (file edits and filesystem commands run without asking)`,
+        line: loc.key("defaultMode", permOffset)
+      });
+    }
+    if (data.skipDangerousModePermissionPrompt === true) {
+      settings.bypass.push({
+        value: "skipDangerousModePermissionPrompt is true",
+        line: loc.key("skipDangerousModePermissionPrompt")
+      });
+    }
+    if (Array.isArray(permissions.allow)) {
+      let cursor = Math.max(0, loc.keyOffset("allow"));
+      for (const rule of permissions.allow) {
+        if (typeof rule !== "string") continue;
+        const offset = loc.stringValueOffset(rule, cursor);
+        if (offset >= cursor) cursor = offset;
+        settings.allow.push(parseRule(rule, loc.lineOfOffset(offset)));
+      }
+    }
+    if (data.enableAllProjectMcpServers === true) {
+      settings.allMcpServers.push({
+        value: "enableAllProjectMcpServers is true",
+        line: loc.key("enableAllProjectMcpServers")
+      });
+    }
+    return settings;
+  }
+};
+
+// src/scanners/approvals/destructive.ts
+var DESTRUCTIVE_SAMPLES = [
+  { command: "rm -rf /", label: "recursive delete" },
+  { command: "rm -rf ~", label: "recursive delete" },
+  { command: "rm -fr ./build", label: "recursive delete" },
+  { command: "git push --force origin main", label: "force push" },
+  { command: "git push -f origin main", label: "force push" },
+  { command: "git reset --hard origin/main", label: "discard local work" },
+  { command: "git clean -fdx", label: "discard local work" },
+  { command: "aws s3 rb s3://bucket --force", label: "cloud resource deletion" },
+  { command: "aws s3 rm s3://bucket --recursive", label: "cloud resource deletion" },
+  { command: "aws ec2 terminate-instances --instance-ids i-0", label: "cloud resource deletion" },
+  { command: "aws rds delete-db-instance --db-instance-identifier db", label: "cloud resource deletion" },
+  { command: "aws cloudformation delete-stack --stack-name app", label: "cloud resource deletion" },
+  { command: "gcloud projects delete my-project", label: "cloud resource deletion" },
+  { command: "gcloud compute instances delete vm-1", label: "cloud resource deletion" },
+  { command: "gcloud sql instances delete db", label: "cloud resource deletion" },
+  { command: "az group delete --name rg --yes", label: "cloud resource deletion" },
+  { command: "kubectl delete namespace prod", label: "cloud resource deletion" },
+  { command: "terraform destroy -auto-approve", label: "cloud resource deletion" },
+  { command: "pulumi destroy --yes", label: "cloud resource deletion" },
+  { command: 'psql -c "DROP DATABASE app"', label: "database drop" },
+  { command: 'mysql -e "DROP DATABASE app"', label: "database drop" },
+  { command: "dropdb app", label: "database drop" },
+  { command: 'mongosh --eval "db.dropDatabase()"', label: "database drop" },
+  { command: "redis-cli FLUSHALL", label: "database drop" },
+  { command: "Remove-Item -Recurse -Force C:\\", label: "recursive delete" }
+];
+var DESTRUCTIVE_TEXT = [
+  { re: /\brm\s+(?:-[a-z]*r[a-z]*f[a-z]*|-[a-z]*f[a-z]*r[a-z]*|-r\s+-f|-f\s+-r)\b|\brm\b.*--recursive/i, label: "recursive delete" },
+  { re: /\bgit\s+push\b.*(?:--force\b|--force-with-lease\b|\s-f\b|\s\+\S)/, label: "force push" },
+  { re: /\bgit\s+(?:reset\s+--hard|clean\s+-[a-z]*f)/, label: "discard local work" },
+  { re: /\b(?:drop\s+(?:database|table|schema)|truncate\s+table|dropdb|dropdatabase|flushall|flushdb)\b/i, label: "database drop" },
+  {
+    re: /\b(?:aws|gcloud|az|kubectl|terraform|pulumi|doctl|heroku|flyctl|vercel)\b.*\b(?:delete|destroy|terminate|rb|rm|remove|purge)\b/i,
+    label: "cloud resource deletion"
+  },
+  { re: /\bRemove-Item\b.*-Recurse/i, label: "recursive delete" }
+];
+function patternToRegex(pattern) {
+  let p = pattern.trim();
+  if (p.endsWith(":*")) p = `${p.slice(0, -2)} *`;
+  const escape = (s) => s.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+  const stars = (p.match(/\*/g) ?? []).length;
+  if (stars === 1 && p.endsWith(" *")) {
+    return new RegExp(`^${escape(p.slice(0, -2))}(?: [\\s\\S]*)?$`);
+  }
+  return new RegExp(`^${p.split("*").map(escape).join("[\\s\\S]*")}$`);
+}
+var LAUNCHERS = /^(?:sudo|doas|sh|bash|zsh|fish|dash|ksh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?|eval|exec|env|xargs|nohup|command|builtin|nice|timeout|watch|python[0-9.]*|py|node|deno|bun|ruby|perl|php|lua|Rscript|osascript|npx|bunx|uvx|pipx\s+run)(?:\s+(?:-c|\/c|-Command|-e|--eval|run))?\s*(?::\*|\*|\s\*)$/i;
+function isWildcardShell(command) {
+  if (command === void 0) return true;
+  const c = command.trim();
+  return /^[\s*:]*$/.test(c) || c.startsWith("*") || LAUNCHERS.test(c);
+}
+function destructiveMatch(command) {
+  for (const { re, label } of DESTRUCTIVE_TEXT) {
+    if (re.test(command)) return label;
+  }
+  const regex = patternToRegex(command);
+  for (const sample of DESTRUCTIVE_SAMPLES) {
+    if (regex.test(sample.command)) return `${sample.label}, for example \`${sample.command}\``;
+  }
+  return void 0;
+}
+
+// src/scanners/approvals/index.ts
+var adapters = [claudeCodeAdapter];
+function findApprovalsTargets(provider, config) {
+  return listTargets(provider, config, adapters.flatMap((a) => a.targets));
+}
+var parsed = /* @__PURE__ */ new WeakMap();
+function settingsFor(context) {
+  const cached = parsed.get(context);
+  if (cached) return cached;
+  const out = [];
+  for (const file of context.files) {
+    const adapter = adapters.find((a) => a.matches(file.path));
+    if (!adapter) continue;
+    try {
+      const settings = adapter.parse(file);
+      if (settings) out.push(settings);
+    } catch (err) {
+      context.warn(`${file.path}: could not parse ${adapter.agent} settings (${err.message})`, { incomplete: true });
+    }
+  }
+  parsed.set(context, out);
+  return out;
+}
+function finding(rule, file, line, message, fix) {
+  return { ruleId: rule.id, severity: rule.severity, message, file, line, fix };
+}
+var rules3 = [
+  {
+    id: "APPR-001",
+    severity: "high",
+    title: "Bypass or auto-approve mode enabled",
+    check(context) {
+      return settingsFor(context).flatMap(
+        (s) => s.bypass.map(
+          (b) => finding(
+            this,
+            s.file,
+            b.line,
+            `${s.agent} skips permission prompts: ${b.value}`,
+            "remove the setting; use bypass mode only for one session inside an isolated container"
+          )
+        )
+      );
+    }
+  },
+  {
+    id: "APPR-002",
+    severity: "high",
+    title: "Allowlist includes destructive commands",
+    check(context) {
+      const out = [];
+      for (const s of settingsFor(context)) {
+        for (const entry of s.allow) {
+          if (entry.kind !== "shell" || isWildcardShell(entry.command)) continue;
+          const why = destructiveMatch(entry.command);
+          if (!why) continue;
+          out.push(
+            finding(
+              this,
+              s.file,
+              entry.line,
+              `${s.agent} runs a destructive command without asking: ${entry.raw} (${why})`,
+              "remove the rule or narrow it to a safe subcommand; keep destructive commands behind a prompt or in deny"
+            )
+          );
+        }
+      }
+      return out;
+    }
+  },
+  {
+    id: "APPR-003",
+    severity: "high",
+    title: "Wildcard shell permission",
+    check(context) {
+      const out = [];
+      for (const s of settingsFor(context)) {
+        for (const entry of s.allow) {
+          if (entry.kind !== "shell" || !isWildcardShell(entry.command)) continue;
+          out.push(
+            finding(
+              this,
+              s.file,
+              entry.line,
+              `${s.agent} runs any shell command without asking: ${entry.raw}`,
+              "replace the wildcard with rules for the specific commands the project needs, such as Bash(npm run test *)"
+            )
+          );
+        }
+      }
+      return out;
+    }
+  },
+  {
+    id: "APPR-004",
+    severity: "medium",
+    title: "All project MCP servers or tools auto-approved",
+    check(context) {
+      const out = [];
+      for (const s of settingsFor(context)) {
+        for (const m of s.allMcpServers) {
+          out.push(
+            finding(
+              this,
+              s.file,
+              m.line,
+              `${s.agent} approves every project MCP server: ${m.value}`,
+              "approve servers one by one after reviewing them (enabledMcpjsonServers in Claude Code)"
+            )
+          );
+        }
+        for (const entry of s.allow) {
+          if (entry.kind !== "mcp" || entry.mcpTool !== void 0) continue;
+          out.push(
+            finding(
+              this,
+              s.file,
+              entry.line,
+              `${s.agent} auto-approves every tool of MCP server "${entry.mcpServer}": ${entry.raw}`,
+              "allow only the specific read-only tools you need, such as mcp__server__get_issue"
+            )
+          );
+        }
+      }
+      return out;
+    }
+  },
+  {
+    id: "APPR-005",
+    severity: "medium",
+    title: "File edits auto-approved",
+    check(context) {
+      return settingsFor(context).flatMap(
+        (s) => s.partial.map(
+          (p) => finding(
+            this,
+            s.file,
+            p.line,
+            `${s.agent} approves some actions without asking: ${p.value}`,
+            "use the default mode in shared project settings; let each developer opt in for their own session"
+          )
+        )
+      );
+    }
+  }
+];
+var approvalsScanner = {
+  name: "approvals",
+  rules: rules3,
+  findTargets: findApprovalsTargets
+};
+
+// src/scanners/mcp/tools.ts
+var LOCK_FILE_PATH = ".surfscan/mcp.lock.json";
+var UNNAMED_SERVER = "*";
+function isObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function toTools(value) {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((item) => isObject2(item) && typeof item.name === "string" ? [{ name: item.name, definition: item }] : []);
+}
+function toolArray(value) {
+  if (Array.isArray(value)) return value;
+  if (!isObject2(value)) return void 0;
+  if (Array.isArray(value.tools)) return value.tools;
+  return isObject2(value.result) ? value.result.tools : void 0;
+}
+function parseToolList(text) {
+  const data = JSON.parse(stripBom(text));
+  if (isObject2(data) && isObject2(data.servers)) {
+    return Object.fromEntries(Object.entries(data.servers).map(([name, value]) => [name, toTools(toolArray(value))]));
+  }
+  const tools = toolArray(data);
+  if (!Array.isArray(tools)) {
+    throw new Error('expected a tools array or a "servers" object');
+  }
+  return { [UNNAMED_SERVER]: toTools(tools) };
+}
+function toolTexts(node, out = []) {
+  if (Array.isArray(node)) {
+    for (const item of node) toolTexts(item, out);
+  } else if (isObject2(node)) {
+    for (const [key, value] of Object.entries(node)) {
+      if ((key === "description" || key === "title") && typeof value === "string") out.push(value);
+      else toolTexts(value, out);
+    }
+  }
+  return out;
+}
+function canonical(value) {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (!isObject2(value)) return value;
+  return Object.fromEntries(
+    Object.keys(value).sort().map((key) => [key, canonical(value[key])])
+  );
+}
+async function hashTool(tool) {
+  const { description, inputSchema } = tool.definition;
+  const bytes = new TextEncoder().encode(JSON.stringify(canonical({ description, inputSchema })));
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
+  const hex = [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+  return `sha256:${hex}`;
+}
+async function buildLock(tools) {
+  const servers = {};
+  for (const name of Object.keys(tools).sort()) {
+    const hashes = {};
+    for (const tool of [...tools[name]].sort((a, b) => a.name.localeCompare(b.name))) {
+      hashes[tool.name] = await hashTool(tool);
+    }
+    servers[name] = hashes;
+  }
+  return { version: 1, servers };
+}
+function parseLock(text) {
+  const data = JSON.parse(stripBom(text));
+  if (!isObject2(data) || !isObject2(data.servers)) throw new Error('expected a "servers" object');
+  return data;
+}
+
+// src/scanners/mcp/config.ts
+function isObject3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringMap(value) {
+  if (!isObject3(value)) return {};
+  return Object.fromEntries(Object.entries(value).filter((e) => typeof e[1] === "string"));
+}
+function serverMap(path, data) {
+  const key = /(?:^|\/)\.vscode\/mcp\.json$/.test(path) ? "servers" : "mcpServers";
+  const map = data[key];
+  return isObject3(map) ? map : {};
+}
+function parseMcpConfig(file) {
+  const data = parseJsonc(file.content);
+  if (!isObject3(data)) return [];
+  const loc = new JsonLocator(file.content);
+  const servers = [];
+  for (const [name, value] of Object.entries(serverMap(file.path, data))) {
+    if (!isObject3(value)) continue;
+    const offset = Math.max(0, loc.keyOffset(name));
+    const line = loc.key(name);
+    servers.push({
+      name,
+      file: file.path,
+      line,
+      command: typeof value.command === "string" ? value.command : void 0,
+      args: Array.isArray(value.args) ? value.args.filter((a) => typeof a === "string") : [],
+      env: stringMap(value.env),
+      url: typeof value.url === "string" ? value.url : void 0,
+      lineOf: (text) => loc.keyOffset(text, offset) === -1 ? line : loc.key(text, offset)
+    });
+  }
+  return servers;
+}
+
+// src/scanners/mcp/known-hosts.json
+var known_hosts_default = [
+  "anthropic.com",
+  "asana.com",
+  "atlassian.com",
+  "cloudflare.com",
+  "figma.com",
+  "github.com",
+  "githubcopilot.com",
+  "gitlab.com",
+  "huggingface.co",
+  "intercom.com",
+  "linear.app",
+  "neon.tech",
+  "notion.com",
+  "openai.com",
+  "paypal.com",
+  "sentry.dev",
+  "sentry.io",
+  "stripe.com",
+  "supabase.com",
+  "vercel.com",
+  "zapier.com"
+];
+
+// src/scanners/mcp/index.ts
+var MCP_TARGETS = ["**/.mcp.json", "**/.cursor/mcp.json", "**/.vscode/mcp.json"];
+function findMcpTargets(provider, config) {
+  return listTargets(provider, config, MCP_TARGETS);
+}
+var parsed2 = /* @__PURE__ */ new WeakMap();
+function serversFor(context) {
+  const cached = parsed2.get(context);
+  if (cached) return cached;
+  const out = [];
+  for (const file of context.files) {
+    try {
+      out.push(...parseMcpConfig(file));
+    } catch (err) {
+      context.warn(`${file.path}: could not parse MCP config (${err.message})`, { incomplete: true });
+    }
+  }
+  parsed2.set(context, out);
+  return out;
+}
+function toolSource(context) {
+  return context.options.toolSource;
+}
+function locateTools(context, source) {
+  const servers = serversFor(context);
+  const loc = source.content === void 0 ? void 0 : new JsonLocator(source.content);
+  return Object.entries(source.tools).flatMap(([server, tools]) => {
+    const configured = servers.find((s) => s.name === server);
+    return tools.map((tool) => {
+      const line = loc ? loc.key(tool.name) : configured?.line ?? 0;
+      return {
+        server,
+        tool,
+        file: source.file ?? configured?.file ?? server,
+        line,
+        lineOf: (text) => loc && source.content.includes(JSON.stringify(text)) ? loc.key(text) : line
+      };
+    });
+  });
+}
+var POISON_TAG = /<\s*(?:important|system|secret|hidden)\s*>/gi;
+function findPoisonTag(text) {
+  return [...matchAll(POISON_TAG, text)].map((m) => ({ index: m.index, detail: m[0] }));
+}
+var TEXT_DETECTORS = [findInstructionOverride, findCredentialAccess, findInvisibleChars, findHiddenContent, findPoisonTag];
+function programName(command) {
+  return (command.split(/[\\/]/).pop() ?? command).toLowerCase().replace(/\.(?:exe|cmd|bat)$/, "");
+}
+var isDocker = (server) => ["docker", "podman"].includes(programName(server.command ?? ""));
+var HOME_OR_ROOT = /^(?:\/|~|\$HOME|\$\{HOME\}|\$\{env:HOME\}|\$\{env:USERPROFILE\}|\$\{userHome\}|%USERPROFILE%|[a-z]:|\/home\/[^/]+|\/Users\/[^/]+|[a-z]:[\\/]Users[\\/][^\\/]+)$/i;
+var CREDENTIAL_DIR = /(?:^|[\\/])\.(?:ssh|aws|gnupg|kube)(?:[\\/]|$)/i;
+function isBroadPath(path) {
+  const trimmed = path.replace(/[\\/]+$/, "");
+  return HOME_OR_ROOT.test(trimmed === "" ? "/" : trimmed) || CREDENTIAL_DIR.test(path);
+}
+function mountSource(flag, value) {
+  if (flag === "--mount") return /(?:^|,)(?:source|src)=([^,]+)/.exec(value)?.[1];
+  return /^((?:[a-z]:)?[^:]+):/i.exec(value)?.[1];
+}
+function broadAccess(server) {
+  const out = [];
+  if (isDocker(server)) {
+    server.args.forEach((arg, i) => {
+      const inline = /^(--volume|--mount)=(.+)$/.exec(arg);
+      const flag = inline?.[1] ?? (["-v", "--volume", "--mount"].includes(arg) ? arg : void 0);
+      const value = inline?.[2] ?? (flag ? server.args[i + 1] : void 0);
+      if (!flag || !value) return;
+      const source = mountSource(flag, value);
+      if (!source) return;
+      if (source.includes("docker.sock")) out.push({ what: "the Docker socket is mounted, which gives root on the host", source: value });
+      else if (isBroadPath(source)) out.push({ what: `host path ${source} is mounted`, source: value });
+    });
+  } else if (/filesystem|\bfs\b/i.test(`${server.name} ${server.command ?? ""} ${server.args.join(" ")}`)) {
+    for (const arg of server.args) {
+      if (!arg.startsWith("-") && isBroadPath(arg)) out.push({ what: `it can read and write ${arg}`, source: arg });
+    }
+  }
+  return out;
+}
+var DOCKER_VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "-e",
+  "--env",
+  "--env-file",
+  "-v",
+  "--volume",
+  "--mount",
+  "--name",
+  "--network",
+  "--net",
+  "-p",
+  "--publish",
+  "-u",
+  "--user",
+  "-w",
+  "--workdir",
+  "--entrypoint",
+  "--platform",
+  "-l",
+  "--label",
+  "-m",
+  "--memory",
+  "--cpus",
+  "--add-host",
+  "-h",
+  "--hostname",
+  "--pull",
+  "--cap-add",
+  "--cap-drop",
+  "--security-opt"
+]);
+function dockerImage(args) {
+  const run = args.indexOf("run");
+  if (run === -1) return void 0;
+  for (let i = run + 1; i < args.length; i++) {
+    const arg = args[i];
+    if (!arg.startsWith("-")) return arg;
+    if (DOCKER_VALUE_FLAGS.has(arg)) i++;
+  }
+  return void 0;
+}
+function imagePinned(image) {
+  if (image.includes("@sha256:")) return true;
+  const tag = /:([^:/]+)$/.exec(image)?.[1];
+  return tag !== void 0 && /^v?\d+\.\d+/.test(tag);
+}
+function unpinnedTarget(server) {
+  if (isDocker(server)) {
+    const image = dockerImage(server.args);
+    return image && !imagePinned(image) ? `container image ${image}` : void 0;
+  }
+  const launch = [server.command ?? "", ...server.args].join(" ");
+  return findUnpinnedInstalls(launch)[0]?.detail ?? findPipeToShell(launch)[0]?.detail;
+}
+var LOOPBACK = /^(?:localhost|127(?:\.\d+){3}|\[::1\]|0\.0\.0\.0|host\.docker\.internal)$/i;
+var KNOWN_HOSTS = known_hosts_default;
+function remoteProblem(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return void 0;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return void 0;
+  const host = url.hostname.toLowerCase();
+  if (LOOPBACK.test(host)) return void 0;
+  if (url.protocol === "http:") return `connects to ${host} over plain http`;
+  const known = KNOWN_HOSTS.some((k) => host === k || host.endsWith(`.${k}`));
+  return known ? void 0 : `connects to ${host}, which is not on the known host list`;
+}
+function remoteUrls(server) {
+  const urls = server.url ? [server.url] : [];
+  return [...urls, ...server.args.filter((a) => /^https?:\/\//i.test(a))];
+}
+async function readLock(context) {
+  const text = await context.provider.read(LOCK_FILE_PATH);
+  if (text === void 0) return void 0;
+  try {
+    return parseLock(text);
+  } catch (err) {
+    context.warn(`${LOCK_FILE_PATH}: could not parse lock file (${err.message})`, { incomplete: true });
+    return void 0;
+  }
+}
+var rules4 = [
+  {
+    id: "MCP-001",
+    severity: "high",
+    title: "Injection-style text in tool description",
+    check(context) {
+      const source = toolSource(context);
+      if (!source) return [];
+      const out = [];
+      for (const { server, tool, file, lineOf } of locateTools(context, source)) {
+        for (const text of toolTexts(tool.definition)) {
+          const details = new Set(TEXT_DETECTORS.flatMap((detect) => detect(text).map((m) => excerpt(m.detail, 90))));
+          for (const detail of details) {
+            out.push({
+              ruleId: this.id,
+              severity: this.severity,
+              message: `Tool "${tool.name}" (server ${server}) has injection-style text: ${detail}`,
+              file,
+              line: lineOf(text),
+              fix: "do not use this server until the text is reviewed; agents follow tool descriptions that users never see"
+            });
+          }
+        }
+      }
+      return out;
+    }
+  },
+  {
+    id: "MCP-002",
+    severity: "high",
+    title: "Tool description changed since the saved lock",
+    async check(context) {
+      const source = toolSource(context);
+      const lock = source ? await readLock(context) : void 0;
+      if (!source || !lock) return [];
+      const out = [];
+      for (const { server, tool, file, line } of locateTools(context, source)) {
+        const saved = lock.servers[server]?.[tool.name];
+        if (saved === await hashTool(tool)) continue;
+        out.push({
+          ruleId: this.id,
+          severity: this.severity,
+          message: saved ? `Tool "${tool.name}" (server ${server}) changed since the saved lock` : `Tool "${tool.name}" (server ${server}) is not in the saved lock`,
+          file,
+          line,
+          fix: "review the new description; if it is safe, save it with surfscan mcp --update-lock"
+        });
+      }
+      return out;
+    }
+  },
+  {
+    id: "MCP-003",
+    severity: "high",
+    title: "Server with filesystem access to the home directory or root",
+    check(context) {
+      return serversFor(context).flatMap(
+        (s) => broadAccess(s).map(({ what, source }) => ({
+          ruleId: this.id,
+          severity: this.severity,
+          message: `Server "${s.name}" reaches too much of the filesystem: ${what}`,
+          file: s.file,
+          line: s.lineOf(source),
+          fix: "limit the server to the project directory"
+        }))
+      );
+    }
+  },
+  {
+    id: "MCP-004",
+    severity: "medium",
+    title: "Server launched from an unpinned remote package",
+    check(context) {
+      const out = [];
+      for (const s of serversFor(context)) {
+        const target = unpinnedTarget(s);
+        if (!target) continue;
+        out.push({
+          ruleId: this.id,
+          severity: this.severity,
+          message: `Server "${s.name}" runs whatever is newest each time it starts: ${target}`,
+          file: s.file,
+          line: s.line,
+          fix: "pin an exact version (pkg@1.2.3, pkg==1.2.3) or a container image digest (image@sha256:...)"
+        });
+      }
+      return out;
+    }
+  },
+  {
+    id: "MCP-005",
+    severity: "medium",
+    title: "Server reached over plain http or an unknown host",
+    check(context) {
+      const out = [];
+      for (const s of serversFor(context)) {
+        for (const url of remoteUrls(s)) {
+          const problem = remoteProblem(url);
+          if (!problem) continue;
+          out.push({
+            ruleId: this.id,
+            severity: this.severity,
+            message: `Server "${s.name}" ${problem}`,
+            file: s.file,
+            line: s.lineOf(url),
+            fix: "use https, and confirm you trust this host; it controls the tool descriptions your agent reads"
+          });
+        }
+      }
+      return out;
+    }
+  },
+  {
+    id: "MCP-006",
+    severity: "info",
+    title: "No lock file yet",
+    async check(context) {
+      if (serversFor(context).length === 0) return [];
+      if (await context.provider.read(LOCK_FILE_PATH) !== void 0) return [];
+      return [
+        {
+          ruleId: this.id,
+          severity: this.severity,
+          message: "No MCP lock file yet, so tool description changes cannot be detected",
+          file: LOCK_FILE_PATH,
+          line: 0,
+          fix: "export the tool list and run surfscan mcp --tools <file.json> --update-lock, then commit the lock file"
+        }
+      ];
+    }
+  }
+];
+var mcpScanner = {
+  name: "mcp",
+  rules: rules4,
+  findTargets: findMcpTargets
+};
+
+// src/scanners/deps/lockfile.ts
+var LOCK_FILE_NAMES = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"];
+function parsePackageLock(content) {
+  const lock = JSON.parse(stripBom(content));
+  const packages = lock?.packages;
+  return (name, prefix) => {
+    const entry = packages?.[`${prefix}node_modules/${name}`] ?? packages?.[`node_modules/${name}`];
+    return typeof entry?.version === "string" ? entry.version : void 0;
+  };
+}
+var remember = (map, name, version) => {
+  if (!map.has(name)) map.set(name, version);
+};
+function parsePnpmLock(content) {
+  const importers = /* @__PURE__ */ new Map();
+  const packages = /* @__PURE__ */ new Map();
+  const lines = content.split(/\r?\n/);
+  lines.forEach((line, i) => {
+    const key = /^[ \t]+['"]?((?:@[^\s'"/]+\/)?[^\s'"@/:]+)['"]?:\s*$/.exec(line);
+    if (key && /^\s+specifier:/.test(lines[i + 1] ?? "")) {
+      const version = /^\s+version:\s*['"]?(\d[^\s('"]*)/.exec(lines[i + 2] ?? "");
+      if (version) remember(importers, key[1], version[1]);
+    }
+    const entry = /^[ \t]+['"]?\/?((?:@[^\s'"/]+\/)?[^\s'"@/]+)@(\d[^\s('":]*)['"]?:/.exec(line);
+    if (entry) remember(packages, entry[1], entry[2]);
+  });
+  return (name) => importers.get(name) ?? packages.get(name);
+}
+function parseYarnLock(content) {
+  const versions = /* @__PURE__ */ new Map();
+  const lines = content.split(/\r?\n/);
+  lines.forEach((line, i) => {
+    const entry = /^"?((?:@[^/\s"]+\/)?[^@\s"]+)@.*:\s*$/.exec(line);
+    const version = entry && /^\s+version:?\s+"?([^"\s]+)/.exec(lines[i + 1] ?? "");
+    if (version) remember(versions, entry[1], version[1]);
+  });
+  return (name) => versions.get(name);
+}
+var PARSERS = {
+  "package-lock.json": parsePackageLock,
+  "pnpm-lock.yaml": parsePnpmLock
+};
+var parsed3 = /* @__PURE__ */ new Map();
+var MAX_PARSED = 16;
+function lockedVersion(fileName, content, name, prefix) {
+  let lookup = parsed3.get(content);
+  if (!lookup) {
+    lookup = (PARSERS[fileName] ?? parseYarnLock)(content);
+    if (parsed3.size >= MAX_PARSED) parsed3.clear();
+    parsed3.set(content, lookup);
+  }
+  return lookup(name, prefix);
+}
+
+// src/scanners/deps/registry.ts
+var DEFAULT_REGISTRY_URL = "https://registry.npmjs.org";
+var DEFAULT_DOWNLOADS_URL = "https://api.npmjs.org/downloads/point/last-week";
+var TIMEOUT_MS = 3e4;
+var CONCURRENCY = 8;
+function isObject4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function strings(value) {
+  if (!isObject4(value)) return {};
+  return Object.fromEntries(Object.entries(value).filter((e) => typeof e[1] === "string"));
+}
+function maintainerNames(value) {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((m) => {
+    if (typeof m === "string") return [m.replace(/\s*<.*$/, "")];
+    return isObject4(m) && typeof m.name === "string" ? [m.name] : [];
+  });
+}
+function toPackument(raw) {
+  const doc = isObject4(raw) ? raw : {};
+  const time = isObject4(doc.time) ? doc.time : {};
+  const versions = {};
+  if (isObject4(doc.versions)) {
+    for (const [version, data] of Object.entries(doc.versions)) {
+      const v = isObject4(data) ? data : {};
+      versions[version] = {
+        scripts: strings(v.scripts),
+        maintainers: maintainerNames(v.maintainers),
+        ...typeof v.deprecated === "string" && v.deprecated ? { deprecated: v.deprecated } : {}
+      };
+    }
+  }
+  return {
+    latest: strings(doc["dist-tags"]).latest,
+    created: typeof time.created === "string" ? time.created : void 0,
+    unpublished: time.unpublished !== void 0,
+    versions,
+    times: strings(time)
+  };
+}
+function packagePath(name) {
+  return encodeURIComponent(name).replace(/^%40/, "@").replace(/%2F/, "%2f");
+}
+async function fetchPackument(fetcher, registryUrl, name) {
+  try {
+    const res = await fetcher(`${registryUrl}/${packagePath(name)}`, {
+      headers: { accept: "application/json" },
+      signal: AbortSignal.timeout(TIMEOUT_MS)
+    });
+    if (res.status === 404) return { status: "missing" };
+    if (!res.ok) return { status: "error", message: `HTTP ${res.status}` };
+    return { status: "found", packument: toPackument(await res.json()) };
+  } catch (err) {
+    return { status: "error", message: err.message };
+  }
+}
+async function fetchWeeklyDownloads(fetcher, downloadsUrl, name) {
+  try {
+    const res = await fetcher(`${downloadsUrl}/${packagePath(name)}`, { signal: AbortSignal.timeout(TIMEOUT_MS) });
+    if (!res.ok) return void 0;
+    const body = await res.json();
+    return isObject4(body) && typeof body.downloads === "number" ? body.downloads : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function mapLimit(items, fn, limit = CONCURRENCY) {
+  const results = new Array(items.length);
+  let next = 0;
+  const worker = async () => {
+    while (next < items.length) {
+      const i = next++;
+      results[i] = await fn(items[i]);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+  return results;
+}
+
+// src/scanners/deps/popular-packages.json
+var popular_packages_default = [
+  "@angular/core",
+  "@babel/core",
+  "@babel/preset-env",
+  "@emotion/react",
+  "@modelcontextprotocol/sdk",
+  "@nestjs/core",
+  "@playwright/test",
+  "@prisma/client",
+  "@tanstack/react-query",
+  "@types/node",
+  "@types/react",
+  "@typescript-eslint/parser",
+  "async",
+  "autoprefixer",
+  "axios",
+  "bcrypt",
+  "bcryptjs",
+  "body-parser",
+  "bootstrap",
+  "chalk",
+  "cheerio",
+  "chokidar",
+  "classnames",
+  "commander",
+  "concurrently",
+  "cookie-parser",
+  "cors",
+  "cross-env",
+  "cross-spawn",
+  "date-fns",
+  "dayjs",
+  "debug",
+  "dotenv",
+  "drizzle-orm",
+  "electron",
+  "esbuild",
+  "eslint",
+  "express",
+  "fast-glob",
+  "fastify",
+  "firebase",
+  "form-data",
+  "fs-extra",
+  "glob",
+  "graphql",
+  "handlebars",
+  "helmet",
+  "husky",
+  "inquirer",
+  "jest",
+  "jquery",
+  "js-yaml",
+  "jsonwebtoken",
+  "knex",
+  "langchain",
+  "lint-staged",
+  "lodash",
+  "mocha",
+  "moment",
+  "mongodb",
+  "mongoose",
+  "morgan",
+  "multer",
+  "mysql2",
+  "nanoid",
+  "next",
+  "nodemailer",
+  "nodemon",
+  "nuxt",
+  "openai",
+  "passport",
+  "pino",
+  "playwright",
+  "postcss",
+  "preact",
+  "prettier",
+  "prisma",
+  "prop-types",
+  "puppeteer",
+  "react",
+  "react-dom",
+  "react-redux",
+  "react-router",
+  "react-router-dom",
+  "redis",
+  "redux",
+  "request",
+  "rimraf",
+  "rollup",
+  "rxjs",
+  "sass",
+  "semver",
+  "sequelize",
+  "server",
+  "sharp",
+  "socket.io",
+  "stripe",
+  "styled-components",
+  "supertest",
+  "svelte",
+  "tailwindcss",
+  "ts-node",
+  "tslib",
+  "tslint",
+  "tsup",
+  "turbo",
+  "typeorm",
+  "typescript",
+  "underscore",
+  "uuid",
+  "validator",
+  "vite",
+  "vitest",
+  "webpack",
+  "webpack-cli",
+  "winston",
+  "yargs",
+  "zod",
+  "zustand"
+];
+
+// src/scanners/deps/typosquat.ts
+var POPULAR_PACKAGES = popular_packages_default;
+var POPULAR = new Set(POPULAR_PACKAGES);
+var MIN_LENGTH = 5;
+function withinOneEdit(a, b) {
+  if (Math.abs(a.length - b.length) > 1) return false;
+  let start = 0;
+  while (start < a.length && start < b.length && a[start] === b[start]) start++;
+  const restA = a.slice(start);
+  const restB = b.slice(start);
+  if (restA === restB) return true;
+  if (restA.slice(1) === restB.slice(1)) return true;
+  if (restA.slice(1) === restB || restA === restB.slice(1)) return true;
+  return restA.length >= 2 && restA[0] === restB[1] && restA[1] === restB[0] && restA.slice(2) === restB.slice(2);
+}
+var withoutSeparators = (name) => name.replace(/[-_.]/g, "");
+function typosquatTarget(name) {
+  const lower = name.toLowerCase();
+  if (POPULAR.has(lower)) return void 0;
+  return POPULAR_PACKAGES.find(
+    (target) => target.length >= MIN_LENGTH && (withinOneEdit(lower, target) || withoutSeparators(lower) === withoutSeparators(target))
+  );
+}
+
+// src/scanners/deps/index.ts
+var DEPS_TARGETS = ["**/package.json", ...LOCK_FILE_NAMES.map((name) => `**/${name}`)];
+var MAX_DEPS_FILE_BYTES = 32 * 1024 * 1024;
+function findDepsTargets(provider, config) {
+  return listTargets(provider, config, DEPS_TARGETS);
+}
+var SECTIONS = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+var INSTALL_HOOKS = ["preinstall", "install", "postinstall"];
+var NAME = /^(?:@[a-z0-9~-][a-z0-9._~-]*\/)?[a-z0-9~-][a-z0-9._~-]*$/i;
+var NOT_FROM_REGISTRY = /^(?:workspace|file|link|portal|git|git\+\w+|https?|github|gitlab|bitbucket):|^[^@/\s]+\/[^/\s]+$|^\.{0,2}\//i;
+var EXACT_VERSION = /^[=v]*(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.+-]+)?)$/;
+var UNPINNED_SPEC = /^(?:\*|x|latest|)$/i;
+var ESTABLISHED_WEEKLY_DOWNLOADS = 1e4;
+var DAY_MS = 24 * 60 * 60 * 1e3;
+function isObject5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function dirOf(path) {
+  const at = path.lastIndexOf("/");
+  return at === -1 ? "" : path.slice(0, at);
+}
+var joinPath = (dir, name) => dir ? `${dir}/${name}` : name;
+function lockLookup(files, dir, context) {
+  return (name) => {
+    let current = dir;
+    for (; ; ) {
+      for (const lockName of LOCK_FILE_NAMES) {
+        const lock = files.get(joinPath(current, lockName));
+        if (!lock) continue;
+        const prefix = current === dir ? "" : `${dir.slice(current.length).replace(/^\//, "")}/`;
+        try {
+          const version = lockedVersion(lockName, lock.content, name, prefix);
+          if (version) return version;
+        } catch (err) {
+          context.warn(`${lock.path}: could not parse lock file (${err.message})`, { incomplete: true });
+          files.delete(lock.path);
+        }
+      }
+      if (current === "") return void 0;
+      current = dirOf(current);
+    }
+  };
+}
+function parseNpmrc(text) {
+  const out = /* @__PURE__ */ new Map();
+  for (const line of text.split(/\r?\n/)) {
+    const m = /^\s*(?:(@[^:=\s]+):)?registry\s*=\s*(\S+)/.exec(line);
+    if (m) out.set(m[1] ?? "", m[2]);
+  }
+  return out;
+}
+var PUBLIC_REGISTRY = /^https?:\/\/registry\.(?:npmjs\.org|yarnpkg\.com)\/?$/i;
+function usesPrivateRegistry(name, npmrc) {
+  const scope = name.startsWith("@") ? name.slice(0, name.indexOf("/")) : "";
+  const url = npmrc.get(scope) ?? npmrc.get("");
+  return url !== void 0 && !PUBLIC_REGISTRY.test(url);
+}
+function resolveSpec(declared, spec) {
+  const alias = /^npm:((?:@[^/]+\/)?[^@]+)(?:@(.*))?$/.exec(spec);
+  if (alias) return { name: alias[1], spec: alias[2] ?? "" };
+  return NOT_FROM_REGISTRY.test(spec) ? void 0 : { name: declared, spec };
+}
+async function collectRefs(context) {
+  const byPath = new Map(context.files.map((f) => [f.path, f]));
+  const manifests = [];
+  for (const file of context.files) {
+    if (!file.path.endsWith("package.json")) continue;
+    try {
+      const data = JSON.parse(stripBom(file.content));
+      if (isObject5(data)) manifests.push({ file, data });
+    } catch (err) {
+      context.warn(`${file.path}: could not parse package.json (${err.message})`, { incomplete: true });
+    }
+  }
+  const workspaceNames = new Set(manifests.map((m) => m.data.name).filter((n) => typeof n === "string"));
+  const rootNpmrc = await context.provider.read(".npmrc").catch(() => void 0);
+  const refs = [];
+  const skippedPrivate = /* @__PURE__ */ new Set();
+  for (const { file, data } of manifests) {
+    const dir = dirOf(file.path);
+    const localNpmrc = dir ? await context.provider.read(joinPath(dir, ".npmrc")).catch(() => void 0) : void 0;
+    const npmrc = new Map([...parseNpmrc(rootNpmrc ?? ""), ...parseNpmrc(localNpmrc ?? "")]);
+    const locked = lockLookup(byPath, dir, context);
+    const loc = new JsonLocator(file.content);
+    for (const section of SECTIONS) {
+      const deps = data[section];
+      if (!isObject5(deps)) continue;
+      const from = Math.max(0, loc.keyOffset(section));
+      let cursor = from;
+      for (const [declared, rawSpec] of Object.entries(deps)) {
+        const offset = loc.keyOffset(declared, cursor);
+        if (offset !== -1) cursor = offset;
+        if (typeof rawSpec !== "string") continue;
+        const resolved = resolveSpec(declared, rawSpec.trim());
+        if (!resolved || workspaceNames.has(resolved.name)) continue;
+        if (!NAME.test(resolved.name)) {
+          context.warn(`${file.path}: skipped invalid package name "${excerpt(resolved.name, 60)}"`);
+          continue;
+        }
+        if (usesPrivateRegistry(resolved.name, npmrc)) {
+          skippedPrivate.add(resolved.name);
+          continue;
+        }
+        refs.push({
+          name: resolved.name,
+          file: file.path,
+          line: loc.key(declared, offset === -1 ? from : offset),
+          spec: resolved.spec,
+          version: EXACT_VERSION.exec(resolved.spec)?.[1] ?? locked(declared)
+        });
+      }
+    }
+  }
+  if (skippedPrivate.size > 0) {
+    context.warn(`deps: skipped ${skippedPrivate.size} package(s) that use a private registry set in .npmrc`);
+  }
+  return refs;
+}
+var cache = /* @__PURE__ */ new WeakMap();
+function dataFor(context) {
+  const cached = cache.get(context);
+  if (cached) return cached;
+  const pending = (async () => {
+    const options = context.options;
+    const refs = await collectRefs(context);
+    if (options.offline) {
+      context.warn("deps: offline, so only DEPS-002 and DEPS-006 ran; the other deps rules need the registry");
+      return { refs, options };
+    }
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const registryUrl = options.registryUrl ?? DEFAULT_REGISTRY_URL;
+    const names = [...new Set(refs.map((r) => r.name))];
+    const results = await mapLimit(names, (name) => fetchPackument(fetcher, registryUrl, name));
+    const lookups = new Map(names.map((name, i) => [name, results[i]]));
+    const failed = names.filter((name) => lookups.get(name).status === "error");
+    if (failed.length > 0) {
+      const first = lookups.get(failed[0]);
+      context.warn(
+        `deps: results are incomplete, could not check ${failed.length} of ${names.length} package(s) on the registry (${failed[0]}: ${first.message})`,
+        { incomplete: true }
+      );
+    }
+    return { refs, lookups, options };
+  })();
+  cache.set(context, pending);
+  return pending;
+}
+function finding2(rule, ref, message, fix) {
+  return { ruleId: rule.id, severity: rule.severity, message, file: ref.file, line: ref.line, fix };
+}
+async function registryFindings(context, check) {
+  const { refs, lookups } = await dataFor(context);
+  const out = [];
+  for (const ref of refs) {
+    const lookup = lookups?.get(ref.name);
+    if (lookup?.status !== "found" || lookup.packument.unpublished) continue;
+    const result = check(ref, lookup.packument);
+    if (result) out.push(result);
+  }
+  return out;
+}
+function latestTwoVersions(packument) {
+  const published = Object.keys(packument.versions).filter((v) => packument.times[v] !== void 0).sort((a, b) => Date.parse(packument.times[b]) - Date.parse(packument.times[a]));
+  return published.length >= 2 ? [published[0], published[1]] : void 0;
+}
+var rules5 = [
+  {
+    id: "DEPS-001",
+    severity: "high",
+    title: "Package does not exist on the registry",
+    async check(context) {
+      const { refs, lookups } = await dataFor(context);
+      const fix = "check the name is real before installing; agents invent package names that attackers then register";
+      const out = [];
+      for (const ref of refs) {
+        const lookup = lookups?.get(ref.name);
+        if (!lookup || lookup.status === "error") continue;
+        if (lookup.status === "missing") {
+          out.push(finding2(this, ref, `"${ref.name}" does not exist on the npm registry`, fix));
+        } else if (lookup.packument.unpublished) {
+          out.push(finding2(this, ref, `"${ref.name}" was unpublished from the npm registry`, fix));
+        } else if (ref.version && !(ref.version in lookup.packument.versions)) {
+          out.push(finding2(this, ref, `"${ref.name}" has no published version ${ref.version}`, fix));
+        }
+      }
+      return out;
+    }
+  },
+  {
+    id: "DEPS-002",
+    severity: "high",
+    title: "Name very close to a popular package",
+    async check(context) {
+      const { refs, options, lookups } = await dataFor(context);
+      const suspects = [...new Set(refs.map((r) => r.name))].filter((name) => typosquatTarget(name));
+      const isSuspect = new Set(suspects);
+      const established = /* @__PURE__ */ new Set();
+      if (lookups) {
+        const fetcher = options.fetch ?? globalThis.fetch;
+        const url = options.downloadsUrl ?? DEFAULT_DOWNLOADS_URL;
+        const counts = await mapLimit(suspects, (name) => fetchWeeklyDownloads(fetcher, url, name));
+        suspects.forEach((name, i) => {
+          if ((counts[i] ?? 0) >= ESTABLISHED_WEEKLY_DOWNLOADS) established.add(name);
+        });
+      }
+      return refs.filter((ref) => isSuspect.has(ref.name) && !established.has(ref.name)).map((ref) => {
+        const target = typosquatTarget(ref.name);
+        return finding2(this, ref, `"${ref.name}" is very close to the popular package "${target}"`, `confirm you meant this package and not "${target}"`);
+      });
+    }
+  },
+  {
+    id: "DEPS-003",
+    severity: "medium",
+    title: "Recent maintainer or owner change",
+    check(context) {
+      return registryFindings(context, (ref, packument) => {
+        const pair = latestTwoVersions(packument);
+        if (!pair) return void 0;
+        const [newest, previous] = pair;
+        const before = packument.versions[previous].maintainers;
+        const added = packument.versions[newest].maintainers.filter((m) => !before.includes(m));
+        if (before.length === 0 || added.length === 0) return void 0;
+        return finding2(
+          this,
+          ref,
+          `"${ref.name}" gained maintainer(s) in ${newest}, compared with ${previous}: ${added.join(", ")}`,
+          "review what changed in the newest release, and stay on a version you have reviewed until you are satisfied"
+        );
+      });
+    }
+  },
+  {
+    id: "DEPS-004",
+    severity: "medium",
+    title: "Newly published package",
+    check(context) {
+      const { minAgeDays } = context.config.deps;
+      const now = Date.now();
+      return registryFindings(context, (ref, packument) => {
+        const created = Date.parse(packument.created ?? "");
+        if (Number.isNaN(created)) return void 0;
+        const ageDays = Math.floor((now - created) / DAY_MS);
+        if (ageDays >= minAgeDays) return void 0;
+        return finding2(
+          this,
+          ref,
+          `"${ref.name}" was first published ${ageDays} day(s) ago (minimum ${minAgeDays})`,
+          "review the package and its maintainer before using it, or wait until it has a track record"
+        );
+      });
+    }
+  },
+  {
+    id: "DEPS-005",
+    severity: "medium",
+    title: "Install scripts present",
+    check(context) {
+      return registryFindings(context, (ref, packument) => {
+        const version = ref.version ?? packument.latest;
+        const scripts = version ? packument.versions[version]?.scripts : void 0;
+        const hook = INSTALL_HOOKS.find((h) => scripts?.[h]);
+        if (!hook) return void 0;
+        return finding2(
+          this,
+          ref,
+          `"${ref.name}@${version}" runs a ${hook} script: ${excerpt(scripts[hook], 60)}`,
+          "review the script; install with --ignore-scripts or allow only the packages that need it"
+        );
+      });
+    }
+  },
+  {
+    id: "DEPS-006",
+    severity: "low",
+    title: "Unpinned version",
+    async check(context) {
+      const { refs } = await dataFor(context);
+      return refs.filter((ref) => UNPINNED_SPEC.test(ref.spec)).map(
+        (ref) => finding2(
+          this,
+          ref,
+          `"${ref.name}" accepts any version ("${ref.spec}")`,
+          "pin a version or range, and commit a lock file so that installs are repeatable"
+        )
+      );
+    }
+  },
+  {
+    id: "DEPS-007",
+    severity: "low",
+    title: "Deprecated package",
+    check(context) {
+      return registryFindings(context, (ref, packument) => {
+        const version = ref.version ?? packument.latest;
+        const deprecated = version ? packument.versions[version]?.deprecated : void 0;
+        if (!deprecated) return void 0;
+        return finding2(
+          this,
+          ref,
+          `"${ref.name}@${version}" is deprecated: ${excerpt(deprecated, 80)}`,
+          "move to the suggested replacement or a maintained alternative"
+        );
+      });
+    }
+  }
+];
+var depsScanner = {
+  name: "deps",
+  rules: rules5,
+  findTargets: findDepsTargets,
+  maxFileBytes: MAX_DEPS_FILE_BYTES
+};
+
+export {
+  SEVERITIES,
+  SEVERITY_RANK,
+  isSeverity,
+  DEFAULT_IGNORE_PATHS,
+  compareFindings,
+  sortFindings,
+  listTargets,
+  runScanner,
+  runScanners,
+  summarize,
+  hasFailures,
+  CONFIG_FILE_NAME,
+  DEFAULT_CONFIG,
+  ConfigError,
+  validateConfig,
+  parseConfig,
+  loadConfig,
+  createNodeProvider,
+  SECRET_PATTERNS,
+  maskSecret,
+  redactSecrets,
+  escapeUnsafe,
+  redactFinding,
+  summaryLine,
+  formatText,
+  JSON_REPORT_VERSION,
+  toJsonReport,
+  formatJson,
+  findInvisibleChars,
+  findHiddenContent,
+  findPipeToShell,
+  findCredentialAccess,
+  findInstructionOverride,
+  findEncodedBlocks,
+  findUnpinnedInstalls,
+  findRemoteInstructions,
+  RULES_TARGETS,
+  rules,
+  rulesScanner,
+  KEYS_TARGETS,
+  rules2,
+  keysScanner,
+  adapters,
+  rules3,
+  approvalsScanner,
+  parseMcpConfig,
+  LOCK_FILE_PATH,
+  UNNAMED_SERVER,
+  parseToolList,
+  buildLock,
+  parseLock,
+  MCP_TARGETS,
+  findMcpTargets,
+  unpinnedTarget,
+  rules4,
+  mcpScanner,
+  DEPS_TARGETS,
+  rules5,
+  depsScanner
+};
+//# sourceMappingURL=chunk-5SNUPVTB.js.map