thuban 0.4.1 → 0.4.3

package/dist/packages/crucible/banner.js

@@ -1 +1 @@
-"use strict";const NO_COLOR=void 0!==process.env.NO_COLOR,IS_TTY=!!process.stdout.isTTY,COLORTERM=(process.env.COLORTERM||"").toLowerCase(),TERM=(process.env.TERM||"").toLowerCase(),HAS_TRUECOLOR=!NO_COLOR&&IS_TTY&&("truecolor"===COLORTERM||"24bit"===COLORTERM),HAS_256=!NO_COLOR&&IS_TTY&&(HAS_TRUECOLOR||TERM.includes("256color")||"256color"===COLORTERM),HAS_COLOR=!NO_COLOR&&IS_TTY&&(HAS_TRUECOLOR||HAS_256||""!==TERM||""!==COLORTERM);function _c(E,e,r){return HAS_COLOR?HAS_TRUECOLOR&&E?E:HAS_256&&e?e:r||"":""}const RESET=HAS_COLOR?"":"",BOLD=HAS_COLOR?"":"",DIM=HAS_COLOR?"":"",UNDER=HAS_COLOR?"":"",BLUE=_c("","",""),PURPLE=_c("","",""),RED=_c("","",""),GREEN=_c("","",""),AMBER=_c("","",""),WHITE=HAS_COLOR?"":"",DBLUE=HAS_COLOR?HAS_256?DIM+BLUE:DIM+"":"",GRAY=HAS_COLOR?"":"",YELLOW=AMBER,ORANGE=AMBER,CYAN=BLUE,SEP_WIDTH=58,SEP_CHAR="─";function _sep(){return DBLUE+" "+"─".repeat(58)+RESET}function statusTag(E,e){return GRAY+"[ "+RESET+(e||WHITE)+BOLD+E+RESET+GRAY+" ]"+RESET}const TAG_DONE=statusTag("DONE",GREEN),TAG_ACTIVE=statusTag("ACTIVE",AMBER),TAG_RUNNING=statusTag("RUNNING",PURPLE),TAG_WAITING=statusTag("WAITING",GRAY+DIM),TAG_DEFLECTED=statusTag("DEFLECTED",GREEN),TAG_MUTATED=statusTag("MUTATED",RED),TAG_PASS=statusTag("PASS",GREEN),TAG_FAIL=statusTag("FAIL",RED),TAG_BREACH=statusTag("BREACH",RED),TAG_SURVIVED=statusTag("SURVIVED",GREEN),TAG_SKIP=statusTag("SKIP",GRAY+DIM);function renderInit(E={}){const e=E.version||"0.4.0",r=E.target||".",T=E.mode||"standard",n=null!=E.seed?"0x"+Number(E.seed).toString(16).toUpperCase().padStart(9,"0"):"0x000000000",R=[];return R.push(""),R.push(" "+WHITE+BOLD+"🛡️  THUBAN CRUCIBLE"+RESET+DBLUE+" // "+RESET+WHITE+"v"+e+RESET),R.push(_sep()),R.push(" "+BLUE+BOLD+"[INIT]"+RESET+WHITE+" Target: "+RESET+WHITE+r+RESET),R.push(" "+BLUE+BOLD+"[INIT]"+RESET+WHITE+" Mode:   "+RESET+WHITE+T+RESET),R.push(" "+BLUE+BOLD+"[INIT]"+RESET+WHITE+" Seed:   "+RESET+WHITE+n+RESET+GRAY+" (Deterministic)"+RESET),R.push(""),R.join("\n")}function renderPhaseHeader(E){return"\n 🔨 "+WHITE+BOLD+(E||"THE CRUCIBLE IS BURNING...")+RESET+"\n"}function renderProgress(E,e,r={}){const T=_resolveTag(e),n=r.sub,R=r.last,t=(n||_padPhase(E),r.detail||"");if(n){const E=void 0!==r.emoji?r.emoji:"🧪";return DBLUE+" │  └─ "+RESET+GRAY+E+" "+RESET+WHITE+(r.subLabel||t)+RESET+(T?"  "+_rightAlign(T,t?"":t):"")}const s=t?GRAY+t+RESET:"",A=T?"  "+T:"";return(R?DBLUE+" └─ "+RESET:DBLUE+" ├─ "+RESET)+_padPhase(BLUE+BOLD+"["+E+"]"+RESET,E.length)+"  "+s+A}function renderVerdict(E={}){const e=!1!==E.survived,r=_fmt(E.mutationsAttempted),T=_fmt(E.deflections),n=null!=E.breaches?E.breaches:0,R=E.reportPath||"",t=E.selfHeal||"",s=E.seedHex||"",A=null!=E.score?E.score:null,a=e?GREEN+BOLD+"CODEBASE SURVIVED THE CRUCIBLE."+RESET:RED+BOLD+"CODEBASE BREACHED — CRITICAL FAILURES DETECTED."+RESET,u=[];u.push(""),u.push(" 🏁 "+WHITE+BOLD+"[VERDICT]"+RESET+" "+a),u.push(_sep()),null!==r&&u.push(" 📦 "+WHITE+"Mutations Attempted: "+RESET+WHITE+BOLD+r+RESET),null!==T&&u.push(" 🛡️  "+WHITE+"Deflections:         "+RESET+GREEN+BOLD+T+RESET);const o=n>0?RED+BOLD+String(n)+RESET+(t?GRAY+" ("+t+")"+RESET:""):GREEN+BOLD+"0"+RESET;if(u.push(" 💥 "+WHITE+"Critical Breaches:   "+RESET+o),null!==A){const E=A>=90?GREEN:A>=70?AMBER:RED;u.push(" 🌟 "+WHITE+"Crucible Score:      "+RESET+E+BOLD+A+"/100"+RESET)}return R&&u.push(" 📄 "+WHITE+"Report Generated:    "+RESET+BLUE+UNDER+R+RESET),s&&u.push(" "+GRAY+"Seed: "+s+RESET),u.push(""),u.join("\n")}function fullBanner(E={}){return renderInit({version:E.version,target:E.targetPath||".",mode:E.level?"--level "+E.level:"standard",seed:E.seed})}function compactBanner(E){return"\n 🔥 "+WHITE+BOLD+"CRUCIBLE"+RESET+(E?" "+GRAY+"["+RESET+AMBER+E+RESET+GRAY+"]"+RESET:"")+"\n"}function scoreBanner(E,e){const r=scoreColor(E),T=e||scoreLabel(E),n=buildProgressBar(E,40);return["","  "+WHITE+BOLD+"Crucible Score"+RESET,"  "+r+n+RESET+" "+r+BOLD+E+"/100"+RESET+" "+GRAY+T+RESET,""].join("\n")}function sectionHeader(E,e){return"\n"+AMBER+"  "+(e?e+" ":"")+BOLD+E+RESET+"\n"+GRAY+"  "+"─".repeat(Math.min(60,E.length+4))+RESET+"\n"}function statusLine(E,e,r){return`  ${E?GREEN+"✓"+RESET:RED+"✗"+RESET}  ${DIM+e+RESET}${r?GRAY+"  "+r+RESET:""}`}function summaryLine(E,e,r){const T=scoreColor(r),n=e-E;return["",`  ${BOLD}Results:${RESET}  ${GREEN}${E} passed${RESET}  `+(n>0?RED+n+" failed"+RESET:DIM+"0 failed"+RESET)+"  "+`${GRAY}(${e} total)${RESET}`,`  ${BOLD}Score:${RESET}    ${T}${BOLD}${r}/100${RESET}`,""].join("\n")}function plainBanner(){return["","  THUBAN CRUCIBLE","  "+"─".repeat(58),"  The Fire Test for Security Scanners",""].join("\n")}const PHASE_WIDTH=12;function _padPhase(E,e){const r=null!=e?e:_stripAnsi(E).length,T=Math.max(0,PHASE_WIDTH-r);return E+" ".repeat(T)}function _stripAnsi(E){return E.replace(/\x1b\[[0-9;]*m/g,"")}function _resolveTag(E){switch((E||"").toUpperCase()){case"DONE":return TAG_DONE;case"ACTIVE":return TAG_ACTIVE;case"RUNNING":return TAG_RUNNING;case"WAITING":return TAG_WAITING;case"DEFLECTED":return TAG_DEFLECTED;case"MUTATED":return TAG_MUTATED;case"PASS":return TAG_PASS;case"FAIL":return TAG_FAIL;case"BREACH":return TAG_BREACH;case"SURVIVED":return TAG_SURVIVED;case"SKIP":return TAG_SKIP;default:return statusTag(E||"?",GRAY)}}function _rightAlign(E,e){return E}function _fmt(E){return null==E?null:Number(E).toLocaleString("en-US")}function buildProgressBar(E,e){const r=Math.round(E/100*e),T=e-r;return"["+"█".repeat(r)+"░".repeat(T)+"]"}function scoreColor(E){return HAS_COLOR?E>=90?GREEN:E>=70||E>=50?AMBER:RED:""}function scoreLabel(E){return E>=90?"Excellent":E>=70?"Good":E>=50?"Fair":E>=30?"Poor":"Critical"}function levelColor(E){if(!HAS_COLOR)return"";switch((E||"").toLowerCase()){case"gentle":return GREEN;case"medium":return AMBER;case"hell":return RED;default:return GRAY}}module.exports={renderInit:renderInit,renderPhaseHeader:renderPhaseHeader,renderProgress:renderProgress,renderVerdict:renderVerdict,statusTag:statusTag,fullBanner:fullBanner,compactBanner:compactBanner,scoreBanner:scoreBanner,sectionHeader:sectionHeader,statusLine:statusLine,summaryLine:summaryLine,plainBanner:plainBanner,scoreColor:scoreColor,scoreLabel:scoreLabel,TAG_DONE:TAG_DONE,TAG_ACTIVE:TAG_ACTIVE,TAG_RUNNING:TAG_RUNNING,TAG_WAITING:TAG_WAITING,TAG_DEFLECTED:TAG_DEFLECTED,TAG_MUTATED:TAG_MUTATED,TAG_PASS:TAG_PASS,TAG_FAIL:TAG_FAIL,TAG_BREACH:TAG_BREACH,TAG_SURVIVED:TAG_SURVIVED,TAG_SKIP:TAG_SKIP,colors:{RESET:RESET,BOLD:BOLD,DIM:DIM,UNDER:UNDER,BLUE:BLUE,PURPLE:PURPLE,RED:RED,GREEN:GREEN,AMBER:AMBER,WHITE:WHITE,GRAY:GRAY,DBLUE:DBLUE,YELLOW:AMBER,ORANGE:AMBER,CYAN:BLUE}};
+"use strict";const _fs=require("fs"),_path=require("path");let _PKG_VERSION;try{_PKG_VERSION=JSON.parse(_fs.readFileSync(_path.join(__dirname,"..","..","package.json"),"utf-8")).version}catch(E){_PKG_VERSION="0.4.3"}const NO_COLOR=void 0!==process.env.NO_COLOR,IS_TTY=!!process.stdout.isTTY,COLORTERM=(process.env.COLORTERM||"").toLowerCase(),TERM=(process.env.TERM||"").toLowerCase(),HAS_TRUECOLOR=!NO_COLOR&&IS_TTY&&("truecolor"===COLORTERM||"24bit"===COLORTERM),HAS_256=!NO_COLOR&&IS_TTY&&(HAS_TRUECOLOR||TERM.includes("256color")||"256color"===COLORTERM),HAS_COLOR=!NO_COLOR&&IS_TTY&&(HAS_TRUECOLOR||HAS_256||""!==TERM||""!==COLORTERM);function _c(E,e,r){return HAS_COLOR?HAS_TRUECOLOR&&E?E:HAS_256&&e?e:r||"":""}const RESET=HAS_COLOR?"":"",BOLD=HAS_COLOR?"":"",DIM=HAS_COLOR?"":"",UNDER=HAS_COLOR?"":"",BLUE=_c("","",""),PURPLE=_c("","",""),RED=_c("","",""),GREEN=_c("","",""),AMBER=_c("","",""),WHITE=HAS_COLOR?"":"",DBLUE=HAS_COLOR?HAS_256?DIM+BLUE:DIM+"":"",GRAY=HAS_COLOR?"":"",YELLOW=AMBER,ORANGE=AMBER,CYAN=BLUE,SEP_WIDTH=58,SEP_CHAR="─";function _sep(){return DBLUE+" "+"─".repeat(58)+RESET}function statusTag(E,e){return GRAY+"[ "+RESET+(e||WHITE)+BOLD+E+RESET+GRAY+" ]"+RESET}const TAG_DONE=statusTag("DONE",GREEN),TAG_ACTIVE=statusTag("ACTIVE",AMBER),TAG_RUNNING=statusTag("RUNNING",PURPLE),TAG_WAITING=statusTag("WAITING",GRAY+DIM),TAG_DEFLECTED=statusTag("DEFLECTED",GREEN),TAG_MUTATED=statusTag("MUTATED",RED),TAG_PASS=statusTag("PASS",GREEN),TAG_FAIL=statusTag("FAIL",RED),TAG_BREACH=statusTag("BREACH",RED),TAG_SURVIVED=statusTag("SURVIVED",GREEN),TAG_SKIP=statusTag("SKIP",GRAY+DIM);function renderInit(E={}){const e=E.version||_PKG_VERSION,r=E.target||".",T=E.mode||"standard",n=null!=E.seed?"0x"+Number(E.seed).toString(16).toUpperCase().padStart(9,"0"):"0x000000000",t=[];return t.push(""),t.push(" "+WHITE+BOLD+"🛡️  THUBAN CRUCIBLE"+RESET+DBLUE+" // "+RESET+WHITE+"v"+e+RESET),t.push(_sep()),t.push(" "+BLUE+BOLD+"[INIT]"+RESET+WHITE+" Target: "+RESET+WHITE+r+RESET),t.push(" "+BLUE+BOLD+"[INIT]"+RESET+WHITE+" Mode:   "+RESET+WHITE+T+RESET),t.push(" "+BLUE+BOLD+"[INIT]"+RESET+WHITE+" Seed:   "+RESET+WHITE+n+RESET+GRAY+" (Deterministic)"+RESET),t.push(""),t.join("\n")}function renderPhaseHeader(E){return"\n 🔨 "+WHITE+BOLD+(E||"THE CRUCIBLE IS BURNING...")+RESET+"\n"}function renderProgress(E,e,r={}){const T=_resolveTag(e),n=r.sub,t=r.last,R=(n||_padPhase(E),r.detail||"");if(n){const E=void 0!==r.emoji?r.emoji:"🧪";return DBLUE+" │  └─ "+RESET+GRAY+E+" "+RESET+WHITE+(r.subLabel||R)+RESET+(T?"  "+_rightAlign(T,R?"":R):"")}const s=R?GRAY+R+RESET:"",A=T?"  "+T:"";return(t?DBLUE+" └─ "+RESET:DBLUE+" ├─ "+RESET)+_padPhase(BLUE+BOLD+"["+E+"]"+RESET,E.length)+"  "+s+A}function renderVerdict(E={}){const e=!1!==E.survived,r=_fmt(E.mutationsAttempted),T=_fmt(E.deflections),n=null!=E.breaches?E.breaches:0,t=E.reportPath||"",R=E.selfHeal||"",s=E.seedHex||"",A=null!=E.score?E.score:null,a=e?GREEN+BOLD+"CODEBASE SURVIVED THE CRUCIBLE."+RESET:RED+BOLD+"CODEBASE BREACHED — CRITICAL FAILURES DETECTED."+RESET,S=[];S.push(""),S.push(" 🏁 "+WHITE+BOLD+"[VERDICT]"+RESET+" "+a),S.push(_sep()),null!==r&&S.push(" 📦 "+WHITE+"Mutations Attempted: "+RESET+WHITE+BOLD+r+RESET),null!==T&&S.push(" 🛡️  "+WHITE+"Deflections:         "+RESET+GREEN+BOLD+T+RESET);const o=n>0?RED+BOLD+String(n)+RESET+(R?GRAY+" ("+R+")"+RESET:""):GREEN+BOLD+"0"+RESET;if(S.push(" 💥 "+WHITE+"Critical Breaches:   "+RESET+o),null!==A){const E=A>=90?GREEN:A>=70?AMBER:RED;S.push(" 🌟 "+WHITE+"Crucible Score:      "+RESET+E+BOLD+A+"/100"+RESET)}return t&&S.push(" 📄 "+WHITE+"Report Generated:    "+RESET+BLUE+UNDER+t+RESET),s&&S.push(" "+GRAY+"Seed: "+s+RESET),S.push(""),S.join("\n")}function fullBanner(E={}){return renderInit({version:E.version,target:E.targetPath||".",mode:E.level?"--level "+E.level:"standard",seed:E.seed})}function compactBanner(E){return"\n 🔥 "+WHITE+BOLD+"CRUCIBLE"+RESET+(E?" "+GRAY+"["+RESET+AMBER+E+RESET+GRAY+"]"+RESET:"")+"\n"}function scoreBanner(E,e){const r=scoreColor(E),T=e||scoreLabel(E),n=buildProgressBar(E,40);return["","  "+WHITE+BOLD+"Crucible Score"+RESET,"  "+r+n+RESET+" "+r+BOLD+E+"/100"+RESET+" "+GRAY+T+RESET,""].join("\n")}function sectionHeader(E,e){return"\n"+AMBER+"  "+(e?e+" ":"")+BOLD+E+RESET+"\n"+GRAY+"  "+"─".repeat(Math.min(60,E.length+4))+RESET+"\n"}function statusLine(E,e,r){return`  ${E?GREEN+"✓"+RESET:RED+"✗"+RESET}  ${DIM+e+RESET}${r?GRAY+"  "+r+RESET:""}`}function summaryLine(E,e,r){const T=scoreColor(r),n=e-E;return["",`  ${BOLD}Results:${RESET}  ${GREEN}${E} passed${RESET}  `+(n>0?RED+n+" failed"+RESET:DIM+"0 failed"+RESET)+"  "+`${GRAY}(${e} total)${RESET}`,`  ${BOLD}Score:${RESET}    ${T}${BOLD}${r}/100${RESET}`,""].join("\n")}function plainBanner(){return["","  THUBAN CRUCIBLE","  "+"─".repeat(58),"  The Fire Test for Security Scanners",""].join("\n")}const PHASE_WIDTH=12;function _padPhase(E,e){const r=null!=e?e:_stripAnsi(E).length,T=Math.max(0,PHASE_WIDTH-r);return E+" ".repeat(T)}function _stripAnsi(E){return E.replace(/\x1b\[[0-9;]*m/g,"")}function _resolveTag(E){switch((E||"").toUpperCase()){case"DONE":return TAG_DONE;case"ACTIVE":return TAG_ACTIVE;case"RUNNING":return TAG_RUNNING;case"WAITING":return TAG_WAITING;case"DEFLECTED":return TAG_DEFLECTED;case"MUTATED":return TAG_MUTATED;case"PASS":return TAG_PASS;case"FAIL":return TAG_FAIL;case"BREACH":return TAG_BREACH;case"SURVIVED":return TAG_SURVIVED;case"SKIP":return TAG_SKIP;default:return statusTag(E||"?",GRAY)}}function _rightAlign(E,e){return E}function _fmt(E){return null==E?null:Number(E).toLocaleString("en-US")}function buildProgressBar(E,e){const r=Math.round(E/100*e),T=e-r;return"["+"█".repeat(r)+"░".repeat(T)+"]"}function scoreColor(E){return HAS_COLOR?E>=90?GREEN:E>=70||E>=50?AMBER:RED:""}function scoreLabel(E){return E>=90?"Excellent":E>=70?"Good":E>=50?"Fair":E>=30?"Poor":"Critical"}function levelColor(E){if(!HAS_COLOR)return"";switch((E||"").toLowerCase()){case"gentle":return GREEN;case"medium":return AMBER;case"hell":return RED;default:return GRAY}}module.exports={renderInit:renderInit,renderPhaseHeader:renderPhaseHeader,renderProgress:renderProgress,renderVerdict:renderVerdict,statusTag:statusTag,fullBanner:fullBanner,compactBanner:compactBanner,scoreBanner:scoreBanner,sectionHeader:sectionHeader,statusLine:statusLine,summaryLine:summaryLine,plainBanner:plainBanner,scoreColor:scoreColor,scoreLabel:scoreLabel,TAG_DONE:TAG_DONE,TAG_ACTIVE:TAG_ACTIVE,TAG_RUNNING:TAG_RUNNING,TAG_WAITING:TAG_WAITING,TAG_DEFLECTED:TAG_DEFLECTED,TAG_MUTATED:TAG_MUTATED,TAG_PASS:TAG_PASS,TAG_FAIL:TAG_FAIL,TAG_BREACH:TAG_BREACH,TAG_SURVIVED:TAG_SURVIVED,TAG_SKIP:TAG_SKIP,colors:{RESET:RESET,BOLD:BOLD,DIM:DIM,UNDER:UNDER,BLUE:BLUE,PURPLE:PURPLE,RED:RED,GREEN:GREEN,AMBER:AMBER,WHITE:WHITE,GRAY:GRAY,DBLUE:DBLUE,YELLOW:AMBER,ORANGE:AMBER,CYAN:BLUE}};

package/dist/packages/crucible/rule-loader.js

@@ -1 +1 @@
-"use strict";const fs=require("fs"),path=require("path"),RULES_DIR=path.join(__dirname,"rules"),MAX_PATTERN_LENGTH=500,MAX_QUANTIFIERS=20,MAX_ALTERNATIONS=30;function _checkRegexComplexity(e){if("string"!=typeof e||!e)return{safe:!1,reason:"pattern must be a non-empty string"};if(e.length>500)return{safe:!1,reason:"pattern exceeds max length of 500"};let t=0,n=0;const r=[];for(let a=0;a<e.length;a++){const s=e[a];if("\\"!==s)if("("!==s){if(")"===s){const n=r.pop();if(!n)continue;const s=/^\{\d+(,\d*)?\}/.exec(e.slice(a+1)),i=e[a+1];if("+"===i||"*"===i||"?"===i||s){if(t++,n.hasQuantifier||n.hasAlternation)return{safe:!1,reason:"nested quantifier detected (potential catastrophic backtracking)"};r.length>0&&(r[r.length-1].hasQuantifier=!0)}continue}if("+"!==s&&"*"!==s&&"?"!==s){if("{"===s){/^\{\d+(,\d*)?\}/.exec(e.slice(a))&&(t++,r.length>0&&(r[r.length-1].hasQuantifier=!0));continue}"|"!==s||(n++,r.length>0&&(r[r.length-1].hasAlternation=!0))}else t++,r.length>0&&(r[r.length-1].hasQuantifier=!0)}else r.push({hasQuantifier:!1,hasAlternation:!1});else a++}return t>20?{safe:!1,reason:`pattern has ${t} quantifiers, exceeding max of 20`}:n>30?{safe:!1,reason:`pattern has ${n} alternations, exceeding max of 30`}:{safe:!0,reason:null}}let _compiledPatterns=null;function getPatterns(){if(_compiledPatterns)return _compiledPatterns;const e=fs.readdirSync(RULES_DIR).filter(e=>e.endsWith(".json")).sort(),t=[];for(const n of e){const e=path.join(RULES_DIR,n);let r;try{const t=fs.readFileSync(e,"utf-8");r=JSON.parse(t)}catch(e){throw new Error(`[rule-loader] Failed to read/parse rule file "${n}": ${e.message}`)}if(!Array.isArray(r))throw new Error(`[rule-loader] Rule file "${n}" must export a JSON array, got: ${typeof r}`);for(const e of r){if(e.pattern){const t=_checkRegexComplexity(e.pattern);if(!t.safe){console.warn(`[rule-loader] WARNING: Skipping rule "${e.id}" in "${n}" — ${t.reason}`);continue}}let r,a;try{r=new RegExp(e.pattern,e.flags||"")}catch(t){throw new Error(`[rule-loader] Failed to compile rule "${e&&e.id}" in file "${n}": ${t.message}\n  pattern: ${e&&e.pattern}\n  flags:   ${e&&e.flags}`)}if(e.context)try{a=new RegExp(e.context,e.contextFlags||"")}catch(t){throw new Error(`[rule-loader] Failed to compile context for rule "${e&&e.id}" in file "${n}": ${t.message}`)}t.push({regex:r,category:e.category,id:e.id,description:e.description,language:e.language,severity:e.severity,name:e.name,type:e.type,message:e.message,context:a,skipIfSafe:e.skipIfSafe,skipInTests:e.skipInTests,sourceFile:n})}}return _compiledPatterns=t,_compiledPatterns}function getCodeScannerPatterns(){return getPatterns().filter(e=>"code-scanner-core.json"===e.sourceFile).map(e=>{const t={id:e.id,name:e.name,type:e.type,pattern:e.regex,severity:e.severity,message:e.message};return e.context&&(t.context=e.context),e.skipIfSafe&&(t.skipIfSafe=!0),e.skipInTests&&(t.skipInTests=!0),t})}module.exports={getPatterns:getPatterns,getCodeScannerPatterns:getCodeScannerPatterns};
+"use strict";const fs=require("fs"),path=require("path"),RULES_DIR=path.join(__dirname,"rules"),MAX_PATTERN_LENGTH=500,MAX_QUANTIFIERS=20,MAX_ALTERNATIONS=30;function _checkRegexComplexity(e){if("string"!=typeof e||!e)return{safe:!1,reason:"pattern must be a non-empty string"};if(e.length>500)return{safe:!1,reason:"pattern exceeds max length of 500"};let t=0,n=0;const r=[];for(let s=0;s<e.length;s++){const a=e[s];if("\\"!==a)if("("!==a){if(")"===a){const n=r.pop();if(!n)continue;const a=/^\{\d+(,\d*)?\}/.exec(e.slice(s+1)),i=e[s+1];if("+"===i||"*"===i||"?"===i||a){if(t++,n.hasQuantifier)return{safe:!1,reason:"nested quantifier detected (potential catastrophic backtracking)"};r.length>0&&(r[r.length-1].hasQuantifier=!0)}continue}if("+"!==a&&"*"!==a&&"?"!==a){if("{"===a){/^\{\d+(,\d*)?\}/.exec(e.slice(s))&&(t++,r.length>0&&(r[r.length-1].hasQuantifier=!0));continue}"|"!==a||(n++,r.length>0&&(r[r.length-1].hasAlternation=!0))}else t++,r.length>0&&(r[r.length-1].hasQuantifier=!0)}else{if("?"===e[s+1]){const t=e[s+2];":"===t||"="===t||"!"===t?s+=2:"<"===t&&(s+=3)}r.push({hasQuantifier:!1,hasAlternation:!1})}else s++}return t>20?{safe:!1,reason:`pattern has ${t} quantifiers, exceeding max of 20`}:n>30?{safe:!1,reason:`pattern has ${n} alternations, exceeding max of 30`}:{safe:!0,reason:null}}let _compiledPatterns=null;function getPatterns(){if(_compiledPatterns)return _compiledPatterns;const e=fs.readdirSync(RULES_DIR).filter(e=>e.endsWith(".json")).sort(),t=[];for(const n of e){const e=path.join(RULES_DIR,n);let r;try{const t=fs.readFileSync(e,"utf-8");r=JSON.parse(t)}catch(e){throw new Error(`[rule-loader] Failed to read/parse rule file "${n}": ${e.message}`)}if(!Array.isArray(r))throw new Error(`[rule-loader] Rule file "${n}" must export a JSON array, got: ${typeof r}`);for(const e of r){if(e.pattern){const t=_checkRegexComplexity(e.pattern);if(!t.safe){console.warn(`[rule-loader] WARNING: Skipping rule "${e.id}" in "${n}" — ${t.reason}`);continue}}let r,s;try{r=new RegExp(e.pattern,e.flags||"")}catch(t){throw new Error(`[rule-loader] Failed to compile rule "${e&&e.id}" in file "${n}": ${t.message}\n  pattern: ${e&&e.pattern}\n  flags:   ${e&&e.flags}`)}if(e.context)try{s=new RegExp(e.context,e.contextFlags||"")}catch(t){throw new Error(`[rule-loader] Failed to compile context for rule "${e&&e.id}" in file "${n}": ${t.message}`)}t.push({regex:r,category:e.category,id:e.id,description:e.description,language:e.language,severity:e.severity,name:e.name,type:e.type,message:e.message,context:s,skipIfSafe:e.skipIfSafe,skipInTests:e.skipInTests,sourceFile:n})}}return _compiledPatterns=t,_compiledPatterns}function getCodeScannerPatterns(){return getPatterns().filter(e=>"code-scanner-core.json"===e.sourceFile).map(e=>{const t={id:e.id,name:e.name,type:e.type,pattern:e.regex,severity:e.severity,message:e.message};return e.context&&(t.context=e.context),e.skipIfSafe&&(t.skipIfSafe=!0),e.skipInTests&&(t.skipInTests=!0),t})}module.exports={getPatterns:getPatterns,getCodeScannerPatterns:getCodeScannerPatterns};

package/dist/packages/crucible/rules/code-scanner-core.json

@@ -0,0 +1,147 @@
+[
+  {
+    "id": "SEC001",
+    "name": "Hardcoded API Key",
+    "type": "hardcoded_secret",
+    "pattern": "['\"](?:sk-|pk-|xox[pboa]-|AKIA|ghp_|gho_|github_pat_)[a-zA-Z0-9_-]{10,}['\"]|['\"][a-zA-Z0-9]{32,}['\"]",
+    "flags": "",
+    "severity": "critical",
+    "message": "Possible hardcoded API key or secret detected",
+    "context": "(api[_-]?key|apikey|secret[_\\s]*key|token|credential|bearer)",
+    "contextFlags": "i",
+    "skipIfSafe": true
+  },
+  {
+    "id": "SEC001B",
+    "name": "Hardcoded API Key (bare)",
+    "type": "hardcoded_secret",
+    "pattern": "['\"](?:sk-|pk-|xox[pboa]-|AKIA|ghp_|gho_|github_pat_)[a-zA-Z0-9_-]{10,}['\"]",
+    "flags": "",
+    "severity": "critical",
+    "message": "Possible hardcoded API key or secret detected",
+    "skipIfSafe": true
+  },
+  {
+    "id": "SEC002",
+    "name": "Hardcoded Password",
+    "type": "hardcoded_secret",
+    "pattern": "password\\s*[:=]\\s*['\"][^'\"]+['\"]",
+    "flags": "i",
+    "severity": "critical",
+    "message": "Hardcoded password detected",
+    "skipIfSafe": true,
+    "skipInTests": true
+  },
+  {
+    "id": "SEC002B",
+    "name": "Hardcoded Password (JSON key)",
+    "type": "hardcoded_secret",
+    "pattern": "[\"']password[\"']\\s*:\\s*[\"'][^\"']+[\"']",
+    "flags": "i",
+    "severity": "critical",
+    "message": "Hardcoded password detected",
+    "skipIfSafe": true,
+    "skipInTests": true
+  },
+  {
+    "id": "SEC003",
+    "name": "SQL Injection Risk",
+    "type": "sql_injection",
+    "pattern": "\\b(?:SELECT|INSERT\\s+INTO|UPDATE|DELETE\\s+FROM|WHERE)\\b.*(\\$\\{|\\+\\s*['\"]|\\+\\s*\\w+|f['\"].*\\{|%s|%d)",
+    "flags": "i",
+    "severity": "error",
+    "message": "Potential SQL injection - use parameterized queries"
+  },
+  {
+    "id": "SEC004",
+    "name": "eval() Usage",
+    "type": "eval_abuse",
+    "pattern": "\\beval\\s*\\(",
+    "flags": "",
+    "severity": "error",
+    "message": "eval() is dangerous and should be avoided"
+  },
+  {
+    "id": "SEC004B",
+    "name": "eval() Usage (unicode-escaped)",
+    "type": "eval_abuse",
+    "pattern": "\\\\u0065\\\\u0076\\\\u0061\\\\u006[cC]",
+    "flags": "",
+    "severity": "error",
+    "message": "Obfuscated eval() usage (unicode escapes) is dangerous and should be avoided"
+  },
+  {
+    "id": "SEC005",
+    "name": "innerHTML/document.write Assignment",
+    "type": "xss",
+    "pattern": "\\.innerHTML\\s*=|\\bdocument\\.write\\s*\\(",
+    "flags": "",
+    "severity": "warning",
+    "message": "innerHTML/document.write can cause XSS - consider using textContent or sanitization"
+  },
+  {
+    "id": "SEC006",
+    "name": "Disabled Security",
+    "type": "insecure_config",
+    "pattern": "rejectUnauthorized\\s*:\\s*false|verify\\s*=\\s*False|InsecureSkipVerify\\s*:\\s*true",
+    "flags": "",
+    "severity": "error",
+    "message": "SSL certificate validation disabled"
+  },
+  {
+    "id": "SEC007",
+    "name": "Exposed .env Reference",
+    "type": "insecure_config",
+    "pattern": "\\.env['\"]",
+    "flags": "",
+    "severity": "warning",
+    "message": "Direct .env file manipulation - ensure not exposed",
+    "context": "fs\\.(read|write)|path\\.join|open\\s*\\(|os\\.Open",
+    "contextFlags": "i"
+  },
+  {
+    "id": "SEC008",
+    "name": "Unsafe Block (Rust)",
+    "type": "memory_safety",
+    "pattern": "\\bunsafe\\s*\\{",
+    "flags": "",
+    "severity": "warning",
+    "message": "Rust unsafe block - verify memory safety guarantees"
+  },
+  {
+    "id": "SEC009",
+    "name": "Shell Execution (PHP/Ruby/Python)",
+    "type": "command_injection",
+    "pattern": "\\bshell_exec\\s*\\(|\\bpassthru\\s*\\(|`[^`]+`|\\bos\\.system\\s*\\(|\\bos\\.popen\\s*\\(|\\bsubprocess\\.(?:call|run|Popen|check_output)\\s*\\([^)]*shell\\s*=\\s*True",
+    "flags": "",
+    "severity": "error",
+    "message": "Shell/OS execution function — command injection risk if input unsanitized"
+  },
+  {
+    "id": "SEC010",
+    "name": "Prototype Pollution",
+    "type": "prototype_pollution",
+    "pattern": "\\[\\s*['\"]__proto__['\"]\\s*\\]|\\.__proto__\\s*(=|\\[)|constructor\\s*\\[\\s*['\"]prototype['\"]\\s*\\]|constructor\\.prototype\\s*(=|\\[)|['\"]__proto__['\"]\\s*:",
+    "flags": "",
+    "severity": "error",
+    "message": "Possible prototype pollution via __proto__/constructor.prototype"
+  },
+  {
+    "id": "SEC011",
+    "name": "PHP SQL Injection (dot concatenation)",
+    "type": "sql_injection",
+    "pattern": "\"SELECT[^\"]*WHERE[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\"UPDATE[^\"]*SET[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\"DELETE[^\"]*WHERE[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\\$(?:query|sql|qry)\\s*\\.=\\s*\\$(?:_GET|_POST|_REQUEST|_COOKIE)",
+    "flags": "i",
+    "severity": "critical",
+    "message": "PHP SQL injection: user input concatenated into SQL query with dot operator — use PDO prepared statements"
+  },
+  {
+    "id": "SEC012",
+    "name": "PHP XSS (echo with user input)",
+    "type": "xss",
+    "pattern": "echo\\s+(?!htmlspecialchars|htmlentities|strip_tags|esc_html).*\\$(?:_GET|_POST|_REQUEST|_COOKIE)|echo\\s+[\"'][^\"']*[\"']\\s*\\.\\s*\\$(?:_GET|_POST|_REQUEST|_COOKIE)|print\\s+\\$(?:_GET|_POST|_REQUEST|_COOKIE)",
+    "flags": "i",
+    "severity": "error",
+    "message": "PHP XSS: unescaped user input echoed to page — use htmlspecialchars()"
+  }
+]

package/dist/packages/crucible/rules/command-injection.json

@@ -0,0 +1,411 @@
+[
+  {
+    "id": "CMD001",
+    "pattern": "exec(?:Sync|FileSync)?\\s*\\([^)]*\\+|os\\.system\\s*\\(|exec\\.Command\\s*\\([^)]*\\+",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection (original)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD002",
+    "pattern": "spawn\\s*\\([^)]*shell\\s*:\\s*true",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — JS/TS: spawn with shell:true, execa",
+    "language": [
+      "js",
+      "ts"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD003",
+    "pattern": "execa(?:\\.command)?\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — JS/TS: spawn with shell:true, execa",
+    "language": [
+      "js",
+      "ts"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD004",
+    "pattern": "subprocess\\s*\\.\\s*(?:call|check_output|Popen|run)\\s*\\([^)]*shell\\s*=\\s*True",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Python: subprocess variants with shell=True, os.popen, paramiko",
+    "language": [
+      "python"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD005",
+    "pattern": "os\\s*\\.\\s*popen\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Python: subprocess variants with shell=True, os.popen, paramiko",
+    "language": [
+      "python"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD006",
+    "pattern": "\\.exec_command\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Python: subprocess variants with shell=True, os.popen, paramiko",
+    "language": [
+      "python"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD007",
+    "pattern": "`[^`]*#\\{[^}]+\\}[^`]*`",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Ruby: backtick with interpolation, system, exec, Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD008",
+    "pattern": "\\b(?:system|exec)\\s*\\(\\s*[\"'`]?[^\"'`\\n]*#\\{|\\b(?:system|exec)\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\+",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Ruby: backtick with interpolation, system, exec, Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD009",
+    "pattern": "\\bIO\\.popen\\s*\\(|Open3\\.\\w+\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Ruby: backtick with interpolation, system, exec, Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD010",
+    "pattern": "Runtime\\s*\\.\\s*getRuntime\\s*\\(\\s*\\)\\s*\\.\\s*exec\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Java/Kotlin: Runtime.exec, ProcessBuilder",
+    "language": [
+      "kotlin",
+      "java"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD011",
+    "pattern": "new\\s+ProcessBuilder\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Java/Kotlin: Runtime.exec, ProcessBuilder",
+    "language": [
+      "kotlin",
+      "java"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD012",
+    "pattern": "Process\\s*\\.\\s*Start\\s*\\(|new\\s+ProcessStartInfo\\s*[({]",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — C#: Process.Start / ProcessStartInfo",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD013",
+    "pattern": "Command\\s*::\\s*new\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Rust: Command::new",
+    "language": [
+      "rust"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD014",
+    "pattern": "\\bshell_exec\\s*\\(|\\bpassthru\\s*\\(|\\bpopen\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — PHP: shell_exec, system, passthru, popen, backtick with variable",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD015",
+    "pattern": "\\bsystem\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\.\\s*\\$|\\bsystem\\s*\\(\\s*\\$",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — PHP: shell_exec, system, passthru, popen, backtick with variable",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD016",
+    "pattern": "`[^`]*\\$(?:_GET|_POST|_REQUEST|_COOKIE|\\w+)[^`]*`",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — PHP: shell_exec, system, passthru, popen, backtick with variable",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD017",
+    "pattern": "exec\\s*\\.\\s*Command\\s*\\([^)]*fmt\\.Sprintf|exec\\s*\\.\\s*Command\\s*\\([^)]*parts\\b",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Go: exec.Command with fmt.Sprintf, user-split args, or /bin/sh -c pattern",
+    "language": [
+      "go"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD018",
+    "pattern": "exec\\s*\\.\\s*Command\\s*\\(\\s*[\"']\\/bin\\/(?:sh|bash)[\"']\\s*,\\s*[\"']-c[\"']",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Go: exec.Command with fmt.Sprintf, user-split args, or /bin/sh -c pattern",
+    "language": [
+      "go"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD019",
+    "pattern": "\\bexec\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\.\\s*\\$|\\bexec\\s*\\(\\s*\\$",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — PHP: exec() with user input",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD020",
+    "pattern": "ProcessStartInfo\\s*\\{[^}]*Arguments\\s*=\\s*\\$[\"']",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "C# command injection: ProcessStartInfo / Process.Start with user input",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD021",
+    "pattern": "Arguments\\s*=\\s*\\$[\"'][^\"']*\\{(?:host|cmd|args|input|filename|email|script)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "C# command injection: ProcessStartInfo / Process.Start with user input",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD022",
+    "pattern": "new ProcessStartInfo\\s*\\(\\s*[\"'][^\"']*(?:bash|sh|cmd)[\"']",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "C# command injection: ProcessStartInfo / Process.Start with user input",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD023",
+    "pattern": "`[^`]*#\\{[^`]*`",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD024",
+    "pattern": "\\bsystem\\s*\\([^)]*#\\{",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD025",
+    "pattern": "\\bexec\\s*\\([^)]*#\\{",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD026",
+    "pattern": "Open3\\.capture2\\s*\\(.*(?:#\\{|cmd)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD027",
+    "pattern": "IO\\.popen\\s*\\([^)]*#\\{",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD028",
+    "pattern": "\\bspawn\\s*\\([^)]*#\\{",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD029",
+    "pattern": "\\bexec\\s*\\(\\s*[\"'][^\"']*[\"']?\\s*\\.\\s*\\$(?:_GET|_POST|host|cmd|ip)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "PHP command injection",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD030",
+    "pattern": "shell_exec\\s*\\([^)]*\\$(?:_GET|_POST|domain|ip|host|cmd|server)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "PHP command injection",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD031",
+    "pattern": "\\bsystem\\s*\\([^)]*\\$(?:_GET|_POST|src|dest|format|file)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "PHP command injection",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD032",
+    "pattern": "passthru\\s*\\([^)]*\\$(?:_POST|_GET|archive|zip|dest)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "PHP command injection",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD033",
+    "pattern": "popen\\s*\\(\\s*[\"'][^\"']*[\"']?\\s*\\.\\s*\\$(?:_GET|pattern|logfile)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "PHP command injection",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD034",
+    "pattern": "exec\\.Command\\s*\\(\\s*[\"'][^\"']*(?:bash|sh)[\"'][^)]*\"-c\"",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Go command injection",
+    "language": [
+      "go"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD035",
+    "pattern": "exec\\.Command\\s*\\(\\s*[\"'][^\"']*(?:sh|bash)[\"'][^)]*cmdStr",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Go command injection",
+    "language": [
+      "go"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD036",
+    "pattern": "cmd\\s*:=\\s*exec\\.Command\\s*\\([^)]*\\+",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Go command injection",
+    "language": [
+      "go"
+    ],
+    "severity": "critical"
+  }
+]

package/dist/packages/crucible/rules/crypto-misuse.json

@@ -0,0 +1,35 @@
+[
+  {
+    "id": "CMISUSE001",
+    "pattern": "use\\s+md5\\b|md5::compute|ecb_encrypt|AesCipher|nonce\\s*=\\s*0\\b",
+    "flags": "i",
+    "category": "crypto_misuse",
+    "description": "crypto_misuse (Rust-specific)",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "CMISUSE002",
+    "pattern": "\\bxor_encrypt\\b|\\bxor_decrypt\\b|\\brot13\\b|\\bcaesar_cipher\\b",
+    "flags": "i",
+    "category": "crypto_misuse",
+    "description": "Rust: crypto misuse (homegrown ciphers)",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "CMISUSE003",
+    "pattern": "struct\\s+Rc4\\b|\\brc4\\b",
+    "flags": "i",
+    "category": "crypto_misuse",
+    "description": "Rust: crypto misuse (homegrown ciphers)",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  }
+]