thuban 0.4.12 → 0.4.13

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thuban",
-  "version": "0.4.12",
+  "version": "0.4.13",
   "description": "The safety layer for AI-coded software. Detect hallucinated APIs, ghost code, tech debt, and architecture drift. One command. Minimal dependencies.",
   "bin": {
     "thuban": "cli.js"

package/dist/packages/crucible/rules/code-scanner-core.json

@@ -299,5 +299,16 @@
     "message": "SQL query built with PHP variable interpolation — use PDO prepared statements",
     "owasp": "A03:2021 Injection",
     "cwe": "CWE-89"
+  },
+  {
+    "id": "SEC022",
+    "name": "Rust Shell Command Injection (Command::new)",
+    "type": "command_injection",
+    "pattern": "Command::new\\s*\\(\\s*[\"'](?:/bin/)?(?:sh|bash|zsh)[\"']\\s*\\)",
+    "flags": "",
+    "severity": "critical",
+    "message": "Command::new spawns a shell (sh/bash) — arguments built with format!()/user input risk command injection; avoid shell invocation, pass args directly to Command",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-78"
   }
 ]

package/dist/packages/scanner/ghost-code-detector.js

@@ -1 +1 @@
-const fs=require("fs"),path=require("path");class GhostCodeDetector{constructor(e={}){this.rootPath=e.rootPath||process.cwd()}scan(e){const t=[],s={},n=new Map,i=new Map,o=new Map;for(const r of e){let e;try{if(fs.statSync(r).size>524288)continue;e=fs.readFileSync(r,"utf-8").replace(/\r\n/g,"\n")}catch(e){continue}const c=path.relative(this.rootPath,r);if(this._isSkippable(c)){o.set(c,e);continue}const a=e.split("\n");n.set(c,e),i.set(c,a);const l=path.extname(r).toLowerCase(),f=this._computeTemplateLiteralLines(e);for(let e=0;e<a.length;e++){if(f.has(e))continue;const n=a[e],i=this._extractFunction(n,e,a,l);if(i){i.file=c,i.line=e+1,i.lineCount=this._countFunctionLines(a,e,l),i.declKind="function",i.isExport&&this._isFrameworkEntryFile(c)&&(i.isLifecycle=!0),t.push(i),s[i.name]||(s[i.name]=0);continue}const o=this._extractClass(n);if(o){o.file=c,o.line=e+1,o.lineCount=this._countFunctionLines(a,e,l),o.declKind="class",t.push(o),s[o.name]||(s[o.name]=0);continue}const r=this._extractConstDeclaration(n);if(r){r.file=c,r.line=e+1,r.lineCount=1,r.declKind="const",t.push(r),s[r.name]||(s[r.name]=0);continue}const u=this._extractImports(n);for(const n of u)n.file=c,n.line=e+1,n.lineCount=1,n.declKind="import",t.push(n),s[n.name]||(s[n.name]=0)}}const r=new Map([...n,...o]);for(const[e,n]of r){const i=this._stripCommentsAndStrings(n);for(const n of t){const t=new RegExp(`\\b${this._escapeRegex(n.name)}\\b`,"g"),o=i.match(t);if(o){const t=e===n.file;s[n.name]+=o.length-(t?1:0)}}}const c=t.filter(e=>"function"===e.declKind).filter(e=>(s[e.name]||0)<=0&&!e.isLifecycle&&e.lineCount>=3).map(e=>({...e,references:s[e.name]||0,wastedLines:e.lineCount,category:"ghost",severity:e.isExport?"low":e.lineCount>30?"high":"medium",message:`${e.name}() — ${e.lineCount} lines, never called${e.isExport?" (exported — verify no external consumers)":""}`})),a=(e,n,i,o)=>t.filter(t=>t.declKind===e).filter(e=>(s[e.name]||0)<=0).map(e=>({...e,references:s[e.name]||0,wastedLines:e.lineCount,category:n,severity:i(e),message:o(e)})),l=a("class","ghost_class",e=>e.isExport?"low":"medium",e=>`class ${e.name} — ${e.lineCount} lines, never referenced${e.isExport?" (exported — verify no external consumers)":""}`),f=a("const","ghost_const",e=>e.isExport?"low":"medium",e=>`${e.kind} ${e.name} — declared but never used${e.isExport?" (exported — verify no external consumers)":""}`),u=a("import","ghost_import",()=>"low",e=>`import '${e.name}' from '${e.source}' — never used`),p=this._findDeadClusters(t.filter(e=>"function"===e.declKind),n,s),m=[...c,...l,...f,...u,...p].sort((e,t)=>t.wastedLines-e.wastedLines),h=m.reduce((e,t)=>e+t.wastedLines,0),d=e.reduce((e,t)=>{try{return e+fs.readFileSync(t,"utf-8").replace(/\r\n/g,"\n").split("\n").length}catch(t){return e}},0);return{ghosts:m,totalGhosts:m.length,totalWastedLines:h,wastedPercent:d>0?Math.min(100,Math.round(h/d*1e3)/10):0,totalLines:d,breakdown:{functions:c.length,classes:l.length,consts:f.length,imports:u.length,deadClusters:p.length}}}_extractFunction(e,t,s,n){const i=e.trim(),o=new Set([".py",".pyw",".pyi",".pyx"]),r=n&&o.has(n),c=i.replace(/^export\s+(?:default\s+)?/,"");let a=c.match(/^(?:async\s+)?function\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\(/);return a?{name:a[1],type:"function",isExport:this._isExported(e,t,s),isLifecycle:this._isLifecycle(a[1])}:(a=c.match(/^(?:const|let|var)\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*=\s*(?:async\s+)?function/),a?{name:a[1],type:"const-function",isExport:this._isExported(e,t,s),isLifecycle:this._isLifecycle(a[1])}:(a=c.match(/^(?:const|let|var)\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*=\s*(?:async\s+)?\(?/),a&&(c.includes("=>")||t+1<s.length&&s[t+1].includes("=>"))?{name:a[1],type:"arrow",isExport:this._isExported(e,t,s),isLifecycle:this._isLifecycle(a[1])}:r&&(a=i.match(/^(?:async\s+)?def\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*[(\[]/),a)?{name:a[1],type:"python-def",isExport:!/^_/.test(a[1]),isLifecycle:this._isLifecycle(a[1])}:(a=i.match(/^(?:private\s+|public\s+|internal\s+|protected\s+)?(?:suspend\s+)?fun\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*[(<]/),a?{name:a[1],type:"kotlin-fun",isExport:!i.startsWith("private"),isLifecycle:this._isLifecycle(a[1])}:(a=i.match(/^func\s+(?:\([^)]*\)\s+)?([a-zA-Z_][a-zA-Z0-9_]*)\s*\(/),a?{name:a[1],type:"go-func",isExport:/^[A-Z]/.test(a[1]),isLifecycle:this._isLifecycle(a[1])}:(a=i.match(/^(?:pub(?:\([^)]*\))?\s+)?(?:async\s+)?fn\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*[(<]/),a?{name:a[1],type:"rust-fn",isExport:/^pub/.test(i),isLifecycle:this._isLifecycle(a[1])}:(a=i.match(/^(?:(?:public|private|protected|static)\s+)*function\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*\(/),a?{name:a[1],type:"php-function",isExport:!/private/.test(i),isLifecycle:this._isLifecycle(a[1])}:(a=i.match(/^def\s+(?:self\.)?([a-zA-Z_][a-zA-Z0-9_?!]*)\s*[(\s]?/),a?{name:a[1],type:"ruby-def",isExport:/^def\s+self\./.test(i),isLifecycle:this._isLifecycle(a[1])}:(a=i.match(/^(?:async\s+)?([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\([^)]*\)\s*{/),a&&!["if","for","while","switch","catch","constructor","render","toString"].includes(a[1])?{name:a[1],type:"method",isExport:!1,isLifecycle:this._isLifecycle(a[1])}:null))))))))}_isExported(e,t,s){return!!/^export\s/.test(e.trim())||!!/module\.exports/.test(e)}_extractClass(e){const t=e.trim(),s=t.match(/^(?:export\s+(?:default\s+)?)?class\s+([a-zA-Z_$][a-zA-Z0-9_$]*)/);return s?{name:s[1],type:"class",isExport:/^export\s/.test(t),isLifecycle:!1}:null}_extractConstDeclaration(e){const t=e.trim().match(/^(export\s+)?(const|let|var)\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*=\s*(.+)$/);if(!t)return null;const[,s,n,i,o]=t;return/^(?:async\s+)?function\b/.test(o)||/=>/.test(o)||""===o.trim()||/^\(/.test(o.trim())&&/=>/.test(o)||/require\s*\(/.test(o)?null:{name:i,kind:n,type:"const-declaration",isExport:!!s,isLifecycle:!1}}_extractImports(e){const t=e.trim(),s=[];let n=t.match(/^import\s*\{([^}]+)\}\s*from\s*['"]([^'"]+)['"]/);if(n){const e=n[1].split(",").map(e=>e.trim()).filter(Boolean);for(const t of e){const e=t.split(/\s+as\s+/),i=(e[1]||e[0]).trim();i&&s.push({name:i,source:n[2],type:"import"})}return s}if(n=t.match(/^import\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*(?:,|from)/),n&&!/^import\s*\{/.test(t)){const e=t.match(/from\s*['"]([^'"]+)['"]/);return s.push({name:n[1],source:e?e[1]:"",type:"import"}),s}if(n=t.match(/^import\s*\*\s*as\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*from\s*['"]([^'"]+)['"]/),n)return s.push({name:n[1],source:n[2],type:"import"}),s;if(n=t.match(/^(?:const|let|var)\s*\{([^}]+)\}\s*=\s*require\s*\(\s*['"]([^'"]+)['"]\s*\)/),n){const e=n[1].split(",").map(e=>e.trim()).filter(Boolean);for(const t of e){const e=t.split(":").map(e=>e.trim()),i=(e[1]||e[0]).trim();i&&s.push({name:i,source:n[2],type:"import"})}return s}return n=t.match(/^(?:const|let|var)\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*=\s*require\s*\(\s*['"]([^'"]+)['"]\s*\)/),n?(s.push({name:n[1],source:n[2],type:"import"}),s):s}_findDeadClusters(e,t,s){const n=[],i=new Map;for(const t of e)t.isExport||t.isLifecycle||i.set(t.name,t);if(i.size<2)return n;const o=new Map;for(const[e,s]of i){const n=t.get(s.file);if(!n){o.set(e,new Set);continue}const r=n.split("\n").slice(s.line-1,s.line-1+s.lineCount),c=this._stripCommentsAndStrings(r.join("\n")),a=new Set;for(const[t]of i)t!==e&&new RegExp(`\\b${this._escapeRegex(t)}\\b`).test(c)&&a.add(t);o.set(e,a)}const r=new Map,c=e=>{r.has(e)||r.set(e,e);let t=e;for(;r.get(t)!==t;)t=r.get(t);let s=e;for(;r.get(s)!==t;){const e=r.get(s);r.set(s,t),s=e}return t},a=(e,t)=>{const s=c(e),n=c(t);s!==n&&r.set(s,n)};for(const[e,t]of o){c(e);for(const s of t)c(s),a(e,s)}const l=new Map;for(const e of i.keys()){const t=c(e);l.has(t)||l.set(t,[]),l.get(t).push(e)}for(const[,e]of l){if(e.length<2)continue;let t=!1;for(const s of e){for(const n of o.get(s)||[])if(e.includes(n)&&(o.get(n)||new Set).has(s)){t=!0;break}if(t)break}if(!t)continue;let r=!1;for(const t of e)if((s[t]||0)-e.reduce((e,s)=>s===t?e:e+((o.get(s)||new Set).has(t)?1:0),0)>0){r=!0;break}if(r)continue;const c=e.reduce((e,t)=>e+(i.get(t).lineCount||0),0);n.push({name:e.join(", "),file:i.get(e[0]).file,line:i.get(e[0]).line,lineCount:c,wastedLines:c,references:0,category:"dead_cluster",severity:"high",message:`Dead cluster: ${e.join(" ↔ ")} — mutually reference each other but nothing outside the cluster calls them`})}return n}_isLifecycle(e){return["constructor","render","componentDidMount","componentWillUnmount","componentDidUpdate","shouldComponentUpdate","getSnapshotBeforeUpdate","getDerivedStateFromProps","useEffect","useState","useMemo","toString","valueOf","toJSON","inspect","setup","teardown","beforeEach","afterEach","beforeAll","afterAll","init","destroy","configure","bootstrap","main","get","set","post","put","delete","patch","handle","onCreate","onStart","onResume","onPause","onStop","onDestroy","onCreateView","onViewCreated","onDestroyView","hashCode","equals","new","default","drop","fmt","from","into","clone","copy","initialize","to_s","to_str","inspect","freeze","dup","__construct","__destruct","__toString","__get","__set","__call","log_message","log_request","log_error"].includes(e)||/^__/.test(e)||/^on[A-Z]/.test(e)||/^visit_[A-Z]/.test(e)||"visit_comprehension"===e||/^do_[A-Z]/.test(e)||/^test_/.test(e)}_countFunctionLines(e,t,s){const n=(e[t]||"").trim(),i=new Set([".py",".pyw",".pyi",".pyx"]);if(s&&i.has(s)&&/^(?:async\s+)?def\s/.test(n)){const s=(e[t].match(/^[ \t]*/)||[""])[0].length;let n=1;for(let i=t+1;i<e.length&&i<t+200;i++){const t=e[i];if(""!==t.trim()){if((t.match(/^[ \t]*/)||[""])[0].length<=s)break;n++}else n++}return n}if(/^def\s/.test(n)){let s=1,n=1;for(let i=t+1;i<e.length&&i<t+200;i++){n++;const t=e[i].trim();if(/^(?:def|class|module|begin|case)\b/.test(t)&&s++,/^(?:if|unless|while|until|for)\b/.test(t)&&!/\bthen\b/.test(t)&&s++,/\bdo\s*(\|[^|]*\|)?\s*$/.test(t)&&s++,/^end\b/.test(t)&&s--,s<=0)break}return n}let o=0,r=!1,c=0;for(let s=t;s<e.length&&s<t+200;s++){const t=e[s];c++;for(const e of t)"{"===e&&(o++,r=!0),"}"===e&&o--;if(r&&o<=0)break}return c}_isSkippable(e){return[/\.test\./i,/\.spec\./i,/test[\/\\]/i,/spec[\/\\]/i,/__test__/i,/__mocks__/i,/\.config\./i,/\.d\.ts$/,/index\.(js|ts)$/,/server\.(js|ts)$/,/app\.(js|ts)$/,/routes?\.(js|ts)$/,/middleware/i,/crucible\//i,/kenny-mode/i,/thuban-videos\//i,/regression\/fixtures\//i].some(t=>t.test(e))}_isFrameworkEntryFile(e){return/(^|[\/\\])(page|layout|loading|error|not-found|template|default|route)\.(js|jsx|ts|tsx)$/i.test(e)||/(^|[\/\\])middleware\.(js|ts)$/i.test(e)}_escapeRegex(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}_computeTemplateLiteralLines(e){const t=new Set,s=e.length;let n=0,i=0;for(;n<s;){const o=e[n],r=e[n+1];if("\n"!==o)if("/"===o&&"/"===r||"#"===o)for(;n<s&&"\n"!==e[n];)n++;else if("/"!==o||"*"!==r){if('"'===o||"'"===o){const t=o;for(n++;n<s&&e[n]!==t&&"\n"!==e[n];)"\\"===e[n]&&n++,n++;n=Math.min(n+1,s);continue}if("`"===o){const o=i,r=this._findTemplateEnd(e,n);for(let t=n;t<r&&t<s;t++)"\n"===e[t]&&i++;const c=i;if(c>o+1)for(let e=o+1;e<c;e++)t.add(e);n=r;continue}n++}else{for(n+=2;n<s&&("*"!==e[n]||"/"!==e[n+1]);)"\n"===e[n]&&i++,n++;n=Math.min(n+2,s)}else i++,n++}return t}_findTemplateEnd(e,t){let s=t+1;const n=e.length;for(;s<n;){const t=e[s];if("\\"!==t){if("`"===t)return s+1;if("$"===t&&"{"===e[s+1]){let t=1,i=s+2;for(;i<n&&t>0;){const s=e[i];if("{"===s)t++,i++;else if("}"===s)t--,i++;else if("`"===s)i=this._findTemplateEnd(e,i);else if('"'===s||"'"===s){const t=s;for(i++;i<n&&e[i]!==t;)"\\"===e[i]&&i++,i++;i++}else i++}s=i;continue}s++}else s+=2}return n}_stripTemplateLiteral(e,t){let s=t+1;const n=e.length,i=[];for(;s<n;){const t=e[s];if("\\"!==t){if("`"===t){s++;break}if("$"===t&&"{"===e[s+1]){let t=1,o=s+2;const r=o;for(;o<n&&t>0;){const s=e[o];if("{"===s)t++,o++;else if("}"===s)t--,o++;else if("`"===s)o=this._findTemplateEnd(e,o);else if('"'===s||"'"===s){const t=s;for(o++;o<n&&e[o]!==t;)"\\"===e[o]&&o++,o++;o++}else o++}i.push(e.slice(r,o-1)),s=o;continue}s++}else s+=2}return[i.length>0?`"" ${i.map(e=>this._stripCommentsAndStrings(e)).join(" ")} ""`:'""',s]}_canStartRegex(e){return!e||!/[A-Za-z0-9_$)\]]/.test(e)}_findRegexEnd(e,t){let s=t+1,n=!1;const i=e.length;for(;s<i;){const t=e[s];if("\n"===t)return-1;if("\\"!==t)if("["!==t)if("]"!==t){if("/"===t&&!n){for(s++;s<i&&/[a-zA-Z]/.test(e[s]);)s++;return s}s++}else n=!1,s++;else n=!0,s++;else s+=2}return-1}_stripCommentsAndStrings(e){let t="",s=0;const n=e.length;let i="";for(;s<n;){const o=e[s],r=e[s+1];if("/"===o&&"/"===r){let i=s+2;for(;i<n&&"\n"!==e[i];)i++;t+=" ",s=i;continue}if("#"===o){let i=s+1;for(;i<n&&"\n"!==e[i];)i++;t+=" ",s=i;continue}if("/"===o&&"*"===r){let i=s+2;for(;i<n&&("*"!==e[i]||"/"!==e[i+1]);)i++;i=Math.min(i+2,n),t+=" ",s=i;continue}if('"'===o){let o=s+1;for(;o<n&&'"'!==e[o]&&"\n"!==e[o];)"\\"===e[o]&&o++,o++;o=Math.min(o+1,n),t+='""',s=o,i='"';continue}if("'"===o){let o=s+1;for(;o<n&&"'"!==e[o]&&"\n"!==e[o];)"\\"===e[o]&&o++,o++;o=Math.min(o+1,n),t+="''",s=o,i="'";continue}if("`"===o){const[n,o]=this._stripTemplateLiteral(e,s);t+=n,s=o,i="`";continue}if("/"===o&&this._canStartRegex(i)){const n=this._findRegexEnd(e,s);if(-1!==n){t+=" ",s=n,i="/";continue}}t+=o,/\s/.test(o)||(i=o),s++}return t}}module.exports=GhostCodeDetector;
+const fs=require("fs"),path=require("path");class GhostCodeDetector{constructor(e={}){this.rootPath=e.rootPath||process.cwd()}scan(e){const t=[],s={},n=new Map,i=new Map,o=new Map;for(const r of e){let e;try{if(fs.statSync(r).size>524288)continue;e=fs.readFileSync(r,"utf-8").replace(/\r\n/g,"\n")}catch(e){continue}const c=path.relative(this.rootPath,r);if(this._isSkippable(c)){o.set(c,e);continue}const a=e.split("\n");n.set(c,e),i.set(c,a);const l=path.extname(r).toLowerCase(),f=this._computeTemplateLiteralLines(e);for(let e=0;e<a.length;e++){if(f.has(e))continue;const n=a[e],i=this._extractFunction(n,e,a,l);if(i){i.file=c,i.line=e+1,i.lineCount=this._countFunctionLines(a,e,l),i.declKind="function",i.isExport&&this._isFrameworkEntryFile(c)&&(i.isLifecycle=!0),t.push(i),s[i.name]||(s[i.name]=0);continue}const o=this._extractClass(n);if(o){o.file=c,o.line=e+1,o.lineCount=this._countFunctionLines(a,e,l),o.declKind="class",t.push(o),s[o.name]||(s[o.name]=0);continue}const r=this._extractConstDeclaration(n);if(r){r.file=c,r.line=e+1,r.lineCount=1,r.declKind="const",t.push(r),s[r.name]||(s[r.name]=0);continue}const u=this._extractImports(n);for(const n of u)n.file=c,n.line=e+1,n.lineCount=1,n.declKind="import",t.push(n),s[n.name]||(s[n.name]=0)}}const r=new Map;for(const e of t){let t=r.get(e.file);t||(t=new Map,r.set(e.file,t)),t.set(e.name,(t.get(e.name)||0)+1)}const c=new Map([...n,...o]);for(const[e,n]of c){const i=this._stripCommentsAndStrings(n),o=r.get(e);for(const e of t){const t=new RegExp(`\\b${this._escapeRegex(e.name)}\\b`,"g"),n=i.match(t);if(n){const t=o&&o.get(e.name)||0;s[e.name]+=Math.max(0,n.length-t)}}}const a=t.filter(e=>"function"===e.declKind).filter(e=>(s[e.name]||0)<=0&&!e.isLifecycle&&e.lineCount>=3).map(e=>({...e,references:s[e.name]||0,wastedLines:e.lineCount,category:"ghost",severity:e.isExport?"low":e.lineCount>30?"high":"medium",message:`${e.name}() — ${e.lineCount} lines, never called${e.isExport?" (exported — verify no external consumers)":""}`})),l=(e,n,i,o)=>t.filter(t=>t.declKind===e).filter(e=>(s[e.name]||0)<=0).map(e=>({...e,references:s[e.name]||0,wastedLines:e.lineCount,category:n,severity:i(e),message:o(e)})),f=l("class","ghost_class",e=>e.isExport?"low":"medium",e=>`class ${e.name} — ${e.lineCount} lines, never referenced${e.isExport?" (exported — verify no external consumers)":""}`),u=l("const","ghost_const",e=>e.isExport?"low":"medium",e=>`${e.kind} ${e.name} — declared but never used${e.isExport?" (exported — verify no external consumers)":""}`),p=l("import","ghost_import",()=>"low",e=>`import '${e.name}' from '${e.source}' — never used`),m=this._findDeadClusters(t.filter(e=>"function"===e.declKind),n,s),h=[...a,...f,...u,...p,...m].sort((e,t)=>t.wastedLines-e.wastedLines),d=h.reduce((e,t)=>e+t.wastedLines,0),_=e.reduce((e,t)=>{try{return e+fs.readFileSync(t,"utf-8").replace(/\r\n/g,"\n").split("\n").length}catch(t){return e}},0);return{ghosts:h,totalGhosts:h.length,totalWastedLines:d,wastedPercent:_>0?Math.min(100,Math.round(d/_*1e3)/10):0,totalLines:_,breakdown:{functions:a.length,classes:f.length,consts:u.length,imports:p.length,deadClusters:m.length}}}_extractFunction(e,t,s,n){const i=e.trim(),o=new Set([".py",".pyw",".pyi",".pyx"]),r=n&&o.has(n),c=i.replace(/^export\s+(?:default\s+)?/,"");let a=c.match(/^(?:async\s+)?function\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\(/);return a?{name:a[1],type:"function",isExport:this._isExported(e,t,s),isLifecycle:this._isLifecycle(a[1])}:(a=c.match(/^(?:const|let|var)\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*=\s*(?:async\s+)?function/),a?{name:a[1],type:"const-function",isExport:this._isExported(e,t,s),isLifecycle:this._isLifecycle(a[1])}:(a=c.match(/^(?:const|let|var)\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*=\s*(?:async\s+)?\(?/),a&&(c.includes("=>")||t+1<s.length&&s[t+1].includes("=>"))?{name:a[1],type:"arrow",isExport:this._isExported(e,t,s),isLifecycle:this._isLifecycle(a[1])}:r&&(a=i.match(/^(?:async\s+)?def\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*[(\[]/),a)?{name:a[1],type:"python-def",isExport:!/^_/.test(a[1]),isLifecycle:this._isLifecycle(a[1])}:(a=i.match(/^(?:private\s+|public\s+|internal\s+|protected\s+)?(?:suspend\s+)?fun\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*[(<]/),a?{name:a[1],type:"kotlin-fun",isExport:!i.startsWith("private"),isLifecycle:this._isLifecycle(a[1])}:(a=i.match(/^func\s+(?:\([^)]*\)\s+)?([a-zA-Z_][a-zA-Z0-9_]*)\s*\(/),a?{name:a[1],type:"go-func",isExport:/^[A-Z]/.test(a[1]),isLifecycle:this._isLifecycle(a[1])}:(a=i.match(/^(?:pub(?:\([^)]*\))?\s+)?(?:async\s+)?fn\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*[(<]/),a?{name:a[1],type:"rust-fn",isExport:/^pub/.test(i),isLifecycle:this._isLifecycle(a[1])}:(a=i.match(/^(?:(?:public|private|protected|static)\s+)*function\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*\(/),a?{name:a[1],type:"php-function",isExport:!/private/.test(i),isLifecycle:this._isLifecycle(a[1])}:(a=i.match(/^def\s+(?:self\.)?([a-zA-Z_][a-zA-Z0-9_?!]*)\s*[(\s]?/),a?{name:a[1],type:"ruby-def",isExport:/^def\s+self\./.test(i),isLifecycle:this._isLifecycle(a[1])}:(a=i.match(/^(?:async\s+)?([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\([^)]*\)\s*{/),a&&!["if","for","while","switch","catch","constructor","render","toString"].includes(a[1])?{name:a[1],type:"method",isExport:!1,isLifecycle:this._isLifecycle(a[1])}:null))))))))}_isExported(e,t,s){return!!/^export\s/.test(e.trim())||!!/module\.exports/.test(e)}_extractClass(e){const t=e.trim(),s=t.match(/^(?:export\s+(?:default\s+)?)?class\s+([a-zA-Z_$][a-zA-Z0-9_$]*)/);return s?{name:s[1],type:"class",isExport:/^export\s/.test(t),isLifecycle:!1}:null}_extractConstDeclaration(e){const t=e.trim().match(/^(export\s+)?(const|let|var)\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*=\s*(.+)$/);if(!t)return null;const[,s,n,i,o]=t;return/^(?:async\s+)?function\b/.test(o)||/=>/.test(o)||""===o.trim()||/^\(/.test(o.trim())&&/=>/.test(o)||/require\s*\(/.test(o)?null:{name:i,kind:n,type:"const-declaration",isExport:!!s,isLifecycle:!1}}_extractImports(e){const t=e.trim(),s=[];let n=t.match(/^import\s*\{([^}]+)\}\s*from\s*['"]([^'"]+)['"]/);if(n){const e=n[1].split(",").map(e=>e.trim()).filter(Boolean);for(const t of e){const e=t.split(/\s+as\s+/),i=(e[1]||e[0]).trim();i&&s.push({name:i,source:n[2],type:"import"})}return s}if(n=t.match(/^import\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*(?:,|from)/),n&&!/^import\s*\{/.test(t)){const e=t.match(/from\s*['"]([^'"]+)['"]/);return s.push({name:n[1],source:e?e[1]:"",type:"import"}),s}if(n=t.match(/^import\s*\*\s*as\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*from\s*['"]([^'"]+)['"]/),n)return s.push({name:n[1],source:n[2],type:"import"}),s;if(n=t.match(/^(?:const|let|var)\s*\{([^}]+)\}\s*=\s*require\s*\(\s*['"]([^'"]+)['"]\s*\)/),n){const e=n[1].split(",").map(e=>e.trim()).filter(Boolean);for(const t of e){const e=t.split(":").map(e=>e.trim()),i=(e[1]||e[0]).trim();i&&s.push({name:i,source:n[2],type:"import"})}return s}return n=t.match(/^(?:const|let|var)\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*=\s*require\s*\(\s*['"]([^'"]+)['"]\s*\)/),n?(s.push({name:n[1],source:n[2],type:"import"}),s):s}_findDeadClusters(e,t,s){const n=[],i=new Map;for(const t of e)t.isExport||t.isLifecycle||i.set(t.name,t);if(i.size<2)return n;const o=new Map;for(const[e,s]of i){const n=t.get(s.file);if(!n){o.set(e,new Set);continue}const r=n.split("\n").slice(s.line-1,s.line-1+s.lineCount),c=this._stripCommentsAndStrings(r.join("\n")),a=new Set;for(const[t]of i)t!==e&&new RegExp(`\\b${this._escapeRegex(t)}\\b`).test(c)&&a.add(t);o.set(e,a)}let r=0;const c=new Map,a=new Map,l=new Set,f=[],u=[],p=e=>{c.set(e,r),a.set(e,r),r++,f.push(e),l.add(e);for(const t of o.get(e)||[])i.has(t)&&(c.has(t)?l.has(t)&&a.set(e,Math.min(a.get(e),c.get(t))):(p(t),a.set(e,Math.min(a.get(e),a.get(t)))));if(a.get(e)===c.get(e)){const t=[];let s;do{s=f.pop(),l.delete(s),t.push(s)}while(s!==e);u.push(t)}};for(const e of i.keys())c.has(e)||p(e);for(const e of u){if(e.length<2){const[t]=e;if(!(o.get(t)||new Set).has(t))continue}let t=!1;for(const n of e)if((s[n]||0)-e.reduce((e,t)=>t===n?e:e+((o.get(t)||new Set).has(n)?1:0),0)>0){t=!0;break}if(t)continue;const r=e.reduce((e,t)=>e+(i.get(t).lineCount||0),0);n.push({name:e.join(", "),file:i.get(e[0]).file,line:i.get(e[0]).line,lineCount:r,wastedLines:r,references:0,category:"dead_cluster",severity:"high",message:`Dead cluster: ${e.join(" ↔ ")} — mutually reference each other but nothing outside the cluster calls them`})}return n}_isLifecycle(e){return["constructor","render","componentDidMount","componentWillUnmount","componentDidUpdate","shouldComponentUpdate","getSnapshotBeforeUpdate","getDerivedStateFromProps","useEffect","useState","useMemo","toString","valueOf","toJSON","inspect","setup","teardown","beforeEach","afterEach","beforeAll","afterAll","init","destroy","configure","bootstrap","main","get","set","post","put","delete","patch","handle","onCreate","onStart","onResume","onPause","onStop","onDestroy","onCreateView","onViewCreated","onDestroyView","hashCode","equals","new","default","drop","fmt","from","into","clone","copy","initialize","to_s","to_str","inspect","freeze","dup","__construct","__destruct","__toString","__get","__set","__call","log_message","log_request","log_error"].includes(e)||/^__/.test(e)||/^on[A-Z]/.test(e)||/^visit_[A-Z]/.test(e)||"visit_comprehension"===e||/^do_[A-Z]/.test(e)||/^test_/.test(e)}_countFunctionLines(e,t,s){const n=(e[t]||"").trim(),i=new Set([".py",".pyw",".pyi",".pyx"]);if(s&&i.has(s)&&/^(?:async\s+)?def\s/.test(n)){const s=(e[t].match(/^[ \t]*/)||[""])[0].length;let n=1;for(let i=t+1;i<e.length&&i<t+200;i++){const t=e[i];if(""!==t.trim()){if((t.match(/^[ \t]*/)||[""])[0].length<=s)break;n++}else n++}return n}if(/^def\s/.test(n)){let s=1,n=1;for(let i=t+1;i<e.length&&i<t+200;i++){n++;const t=e[i].trim();if(/^(?:def|class|module|begin|case)\b/.test(t)&&s++,/^(?:if|unless|while|until|for)\b/.test(t)&&!/\bthen\b/.test(t)&&s++,/\bdo\s*(\|[^|]*\|)?\s*$/.test(t)&&s++,/^end\b/.test(t)&&s--,s<=0)break}return n}let o=0,r=!1,c=0;for(let s=t;s<e.length&&s<t+200;s++){const t=e[s];c++;for(const e of t)"{"===e&&(o++,r=!0),"}"===e&&o--;if(r&&o<=0)break}return c}_isSkippable(e){return[/\.test\./i,/\.spec\./i,/test[\/\\]/i,/spec[\/\\]/i,/__test__/i,/__mocks__/i,/\.config\./i,/\.d\.ts$/,/index\.(js|ts)$/,/server\.(js|ts)$/,/app\.(js|ts)$/,/routes?\.(js|ts)$/,/middleware/i,/crucible\//i,/kenny-mode/i,/thuban-videos\//i,/regression\/fixtures\//i].some(t=>t.test(e))}_isFrameworkEntryFile(e){return/(^|[\/\\])(page|layout|loading|error|not-found|template|default|route)\.(js|jsx|ts|tsx)$/i.test(e)||/(^|[\/\\])middleware\.(js|ts)$/i.test(e)}_escapeRegex(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}_computeTemplateLiteralLines(e){const t=new Set,s=e.length;let n=0,i=0;for(;n<s;){const o=e[n],r=e[n+1];if("\n"!==o)if("/"===o&&"/"===r||"#"===o)for(;n<s&&"\n"!==e[n];)n++;else if("/"!==o||"*"!==r){if('"'===o||"'"===o){const t=o;for(n++;n<s&&e[n]!==t&&"\n"!==e[n];)"\\"===e[n]&&n++,n++;n=Math.min(n+1,s);continue}if("`"===o){const o=i,r=this._findTemplateEnd(e,n);for(let t=n;t<r&&t<s;t++)"\n"===e[t]&&i++;const c=i;if(c>o+1)for(let e=o+1;e<c;e++)t.add(e);n=r;continue}n++}else{for(n+=2;n<s&&("*"!==e[n]||"/"!==e[n+1]);)"\n"===e[n]&&i++,n++;n=Math.min(n+2,s)}else i++,n++}return t}_findTemplateEnd(e,t){let s=t+1;const n=e.length;for(;s<n;){const t=e[s];if("\\"!==t){if("`"===t)return s+1;if("$"===t&&"{"===e[s+1]){let t=1,i=s+2;for(;i<n&&t>0;){const s=e[i];if("{"===s)t++,i++;else if("}"===s)t--,i++;else if("`"===s)i=this._findTemplateEnd(e,i);else if('"'===s||"'"===s){const t=s;for(i++;i<n&&e[i]!==t;)"\\"===e[i]&&i++,i++;i++}else i++}s=i;continue}s++}else s+=2}return n}_stripTemplateLiteral(e,t){let s=t+1;const n=e.length,i=[];for(;s<n;){const t=e[s];if("\\"!==t){if("`"===t){s++;break}if("$"===t&&"{"===e[s+1]){let t=1,o=s+2;const r=o;for(;o<n&&t>0;){const s=e[o];if("{"===s)t++,o++;else if("}"===s)t--,o++;else if("`"===s)o=this._findTemplateEnd(e,o);else if('"'===s||"'"===s){const t=s;for(o++;o<n&&e[o]!==t;)"\\"===e[o]&&o++,o++;o++}else o++}i.push(e.slice(r,o-1)),s=o;continue}s++}else s+=2}return[i.length>0?`"" ${i.map(e=>this._stripCommentsAndStrings(e)).join(" ")} ""`:'""',s]}_canStartRegex(e){return!e||!/[A-Za-z0-9_$)\]]/.test(e)}_findRegexEnd(e,t){let s=t+1,n=!1;const i=e.length;for(;s<i;){const t=e[s];if("\n"===t)return-1;if("\\"!==t)if("["!==t)if("]"!==t){if("/"===t&&!n){for(s++;s<i&&/[a-zA-Z]/.test(e[s]);)s++;return s}s++}else n=!1,s++;else n=!0,s++;else s+=2}return-1}_stripCommentsAndStrings(e){let t="",s=0;const n=e.length;let i="";for(;s<n;){const o=e[s],r=e[s+1];if("/"===o&&"/"===r){let i=s+2;for(;i<n&&"\n"!==e[i];)i++;t+=" ",s=i;continue}if("#"===o){let i=s+1;for(;i<n&&"\n"!==e[i];)i++;t+=" ",s=i;continue}if("/"===o&&"*"===r){let i=s+2;for(;i<n&&("*"!==e[i]||"/"!==e[i+1]);)i++;i=Math.min(i+2,n),t+=" ",s=i;continue}if('"'===o){let o=s+1;for(;o<n&&'"'!==e[o]&&"\n"!==e[o];)"\\"===e[o]&&o++,o++;o=Math.min(o+1,n),t+='""',s=o,i='"';continue}if("'"===o){let o=s+1;for(;o<n&&"'"!==e[o]&&"\n"!==e[o];)"\\"===e[o]&&o++,o++;o=Math.min(o+1,n),t+="''",s=o,i="'";continue}if("`"===o){const[n,o]=this._stripTemplateLiteral(e,s);t+=n,s=o,i="`";continue}if("/"===o&&this._canStartRegex(i)){const n=this._findRegexEnd(e,s);if(-1!==n){t+=" ",s=n,i="/";continue}}t+=o,/\s/.test(o)||(i=o),s++}return t}}module.exports=GhostCodeDetector;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thuban",
-  "version": "0.4.12",
+  "version": "0.4.13",
   "description": "The safety layer for AI-coded software. Detect hallucinated APIs, ghost code, tech debt, and architecture drift. One command. Minimal dependencies.",
   "bin": {
     "thuban": "dist/cli.js"

package/dist/packages/crucible/seeds/python/seed-021 2.py

@@ -1,37 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: high
-# language: python
-# expected: XSS via Jinja2 |safe filter applied to user-controlled content
-
-from flask import Flask, request, render_template_string
-
-app = Flask(__name__)
-
-ARTICLE_TEMPLATE = """
-<!DOCTYPE html>
-<html>
-<head><title>{{ title }}</title></head>
-<body>
-  <article>
-    <h1>{{ title }}</h1>
-    <!-- |safe disables Jinja2 autoescaping — XSS if content is user-controlled -->
-    <div class="content">{{ content | safe }}</div>
-    <footer>By: {{ author | safe }}</footer>
-  </article>
-</body>
-</html>
-"""
-
-
-@app.route("/articles/<int:article_id>")
-def view_article(article_id: int):
-    # In practice, content and author come from DB — but users control their own author field
-    from myapp.models import Article
-    article = Article.objects.get(pk=article_id)
-    return render_template_string(
-        ARTICLE_TEMPLATE,
-        title=article.title,
-        content=article.body,    # user-submitted rich text
-        author=article.author_bio,  # user-controlled bio
-    )

package/dist/packages/crucible/seeds/python/seed-022 2.py

@@ -1,34 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: medium
-# language: python
-# expected: XSS via FastAPI response with HTML and user-controlled query parameter
-
-from fastapi import FastAPI, Query
-from fastapi.responses import HTMLResponse
-
-app = FastAPI()
-
-
-@app.get("/welcome", response_class=HTMLResponse)
-async def welcome(name: str = Query(default="Guest")):
-    # name injected directly into HTML — no escaping applied
-    html = f"""
-    <!DOCTYPE html>
-    <html>
-      <head><title>Welcome</title></head>
-      <body>
-        <h1>Hello, {name}!</h1>
-        <p>Thanks for visiting.</p>
-      </body>
-    </html>
-    """
-    return HTMLResponse(content=html)
-
-
-@app.get("/redirect-info", response_class=HTMLResponse)
-async def redirect_info(from_url: str = Query(default="/")):
-    # from_url reflected in response — open redirect + XSS
-    return HTMLResponse(
-        f'<p>You were redirected from: <a href="{from_url}">{from_url}</a></p>'
-    )

package/dist/packages/crucible/seeds/python/seed-023 2.py

@@ -1,37 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: python
-# expected: command injection via os.system with user-controlled input
-
-import os
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/tools/ping")
-def ping():
-    host = request.args.get("host", "")
-    # Attacker: host = "8.8.8.8; cat /etc/passwd"
-    exit_code = os.system(f"ping -c 4 {host}")
-    return jsonify({"exit_code": exit_code})
-
-
-@app.route("/tools/convert", methods=["POST"])
-def convert_file():
-    data = request.get_json()
-    input_file = data.get("input", "")
-    output_format = data.get("format", "pdf")
-    # os.system executes in shell — injection via semicolons, backticks, etc.
-    os.system(f"convert {input_file} output.{output_format}")
-    return jsonify({"status": "done"})
-
-
-@app.route("/tools/compress", methods=["POST"])
-def compress():
-    data = request.get_json()
-    folder = data.get("folder", "")
-    name = data.get("archive_name", "archive")
-    os.system(f"tar -czf /tmp/{name}.tar.gz {folder}")
-    return jsonify({"archive": f"/tmp/{name}.tar.gz"})

package/dist/packages/crucible/seeds/python/seed-024 2.py

@@ -1,38 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: python
-# expected: command injection via subprocess.call with shell=True and user input
-
-import subprocess
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/git/clone", methods=["POST"])
-def git_clone():
-    data = request.get_json()
-    repo_url = data.get("url", "")
-    target_dir = data.get("dir", "/tmp/repo")
-    # shell=True means the full string is passed to /bin/sh
-    ret = subprocess.call(f"git clone {repo_url} {target_dir}", shell=True)
-    return jsonify({"return_code": ret})
-
-
-@app.route("/nmap", methods=["POST"])
-def nmap_scan():
-    target = request.get_json().get("target", "")
-    ports = request.get_json().get("ports", "1-1000")
-    # target and ports from user — shell injection via semicolons
-    result = subprocess.check_output(
-        f"nmap -p {ports} {target}", shell=True, text=True
-    )
-    return jsonify({"output": result})
-
-
-@app.route("/whois")
-def whois():
-    domain = request.args.get("domain", "")
-    output = subprocess.check_output(f"whois {domain}", shell=True, text=True)
-    return jsonify({"result": output})

package/dist/packages/crucible/seeds/python/seed-025 2.py

@@ -1,40 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: python
-# expected: command injection via subprocess.Popen with shell=True and f-string
-
-import subprocess
-from fastapi import FastAPI
-from pydantic import BaseModel
-
-app = FastAPI()
-
-
-class ImageRequest(BaseModel):
-    image_path: str   # user-controlled
-    width: int
-    height: int
-    quality: int = 85
-
-
-class ReportRequest(BaseModel):
-    format: str       # user-controlled
-    date_range: str   # user-controlled
-
-
-@app.post("/images/thumbnail")
-def generate_thumbnail(req: ImageRequest):
-    # image_path is user-controlled — injection via shell metacharacters
-    cmd = f"ffmpeg -i {req.image_path} -vf scale={req.width}:{req.height} -q:v {req.quality} out.jpg"
-    proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-    out, err = proc.communicate(timeout=30)
-    return {"output": out.decode(), "errors": err.decode()}
-
-
-@app.post("/reports/generate")
-def generate_report(req: ReportRequest):
-    cmd = f"python3 scripts/report.py --format {req.format} --range {req.date_range}"
-    proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE)
-    out, _ = proc.communicate()
-    return {"path": out.decode().strip()}

package/dist/packages/crucible/seeds/python/seed-026 2.py

@@ -1,35 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: high
-# language: python
-# expected: command injection via os.popen with user-controlled filename
-
-import os
-from flask import Flask, request, send_file
-import io
-
-app = Flask(__name__)
-
-
-@app.route("/export/csv")
-def export_csv():
-    table = request.args.get("table", "users")
-    date = request.args.get("date", "2024-01-01")
-    # table and date injected via shell — attacker: table = "users; id > /tmp/pwned"
-    output = os.popen(f"psql -c 'SELECT * FROM {table} WHERE date > \"{date}\"' -A -F, mydb").read()
-    return output, 200, {"Content-Type": "text/csv"}
-
-
-@app.route("/preview/pdf")
-def preview_pdf():
-    filename = request.args.get("file", "")
-    # filename from user — injection via backticks or semicolons
-    output = os.popen(f"pdftotext uploads/{filename} -").read()
-    return {"text": output}
-
-
-@app.route("/image/metadata")
-def image_metadata():
-    path = request.args.get("path", "")
-    result = os.popen(f"exiftool {path}").read()
-    return {"metadata": result}

package/dist/packages/crucible/seeds/python/seed-027 2.py

@@ -1,35 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: high
-# language: python
-# expected: command injection via paramiko exec_command with user-controlled command string
-
-import paramiko
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-def get_ssh_client(host: str) -> paramiko.SSHClient:
-    client = paramiko.SSHClient()
-    client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
-    client.connect(host, username="deploy", key_filename="/home/deploy/.ssh/id_rsa")
-    return client
-
-
-@app.route("/ssh/run", methods=["POST"])
-def run_remote_command():
-    data = request.get_json()
-    host = data.get("host", "")
-    # command from user — attacker appends malicious commands
-    command = data.get("command", "")
-    allowed_hosts = ["web-01.internal", "web-02.internal"]
-    if host not in allowed_hosts:
-        return jsonify({"error": "Host not allowed"}), 403
-
-    client = get_ssh_client(host)
-    # command not validated — attacker sends "ls; cat /etc/shadow"
-    stdin, stdout, stderr = client.exec_command(command)
-    output = stdout.read().decode()
-    client.close()
-    return jsonify({"output": output})

package/dist/packages/crucible/seeds/python/seed-028 2.py

@@ -1,42 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: python
-# expected: command injection via subprocess.run with shell=True and user-controlled git operation
-
-import subprocess
-from dataclasses import dataclass
-
-
-@dataclass
-class GitConfig:
-    repo_path: str
-    branch: str      # user-controlled
-    remote: str = "origin"
-
-
-class GitService:
-    def clone(self, repo_url: str, target: str) -> str:
-        # repo_url from user — injection possible
-        result = subprocess.run(
-            f"git clone {repo_url} {target}", shell=True, capture_output=True, text=True
-        )
-        return result.stdout
-
-    def checkout(self, cfg: GitConfig) -> str:
-        # cfg.branch from user — "main; cat /etc/passwd > /tmp/leak"
-        result = subprocess.run(
-            f"git -C {cfg.repo_path} checkout {cfg.branch}",
-            shell=True, capture_output=True, text=True
-        )
-        return result.stdout
-
-    def tag(self, repo: str, tag_name: str, message: str) -> str:
-        result = subprocess.run(
-            f'git -C {repo} tag -a {tag_name} -m "{message}"',
-            shell=True, capture_output=True, text=True
-        )
-        return result.stdout
-
-    def archive(self, repo: str, branch: str, output_file: str) -> None:
-        subprocess.run(f"git -C {repo} archive {branch} > {output_file}", shell=True)

package/dist/packages/crucible/seeds/python/seed-030 2.py

@@ -1,37 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: high
-# language: python
-# expected: path traversal in Django view via user-controlled filename parameter
-
-import os
-from django.http import FileResponse, Http404, HttpResponse
-from django.conf import settings
-
-
-def serve_user_file(request, user_id: str):
-    filename = request.GET.get("file", "")
-    # No normalization — filename can be "../../../etc/passwd"
-    file_path = os.path.join(settings.MEDIA_ROOT, user_id, filename)
-    try:
-        return FileResponse(open(file_path, "rb"))
-    except FileNotFoundError:
-        raise Http404("File not found")
-
-
-def export_report(request):
-    report_name = request.GET.get("report", "monthly")
-    locale = request.GET.get("locale", "en")
-    # Both report_name and locale inserted into path — traversal possible
-    path = os.path.join(settings.REPORTS_DIR, locale, f"{report_name}.pdf")
-    if not os.path.exists(path):
-        raise Http404
-    with open(path, "rb") as f:
-        return HttpResponse(f.read(), content_type="application/pdf")
-
-
-def read_template(request):
-    template = request.GET.get("template", "welcome")
-    path = f"{settings.TEMPLATES_DIR}/{template}.html"
-    with open(path) as f:
-        return HttpResponse(f.read())

package/dist/packages/crucible/seeds/python/seed-031 2.py

@@ -1,34 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: high
-# language: python
-# expected: path traversal via zipfile extraction without entry path validation (zip-slip)
-
-import os
-import zipfile
-
-
-EXTRACT_BASE = "/var/app/uploads/extracted"
-
-
-def extract_archive(zip_bytes: bytes, user_id: str) -> list:
-    import io
-    extracted = []
-    with zipfile.ZipFile(io.BytesIO(zip_bytes)) as zf:
-        for entry in zf.infolist():
-            # entry.filename can contain "../" — writes outside EXTRACT_BASE
-            output_path = os.path.join(EXTRACT_BASE, user_id, entry.filename)
-            if entry.is_dir():
-                os.makedirs(output_path, exist_ok=True)
-            else:
-                os.makedirs(os.path.dirname(output_path), exist_ok=True)
-                with zf.open(entry) as src, open(output_path, "wb") as dst:
-                    dst.write(src.read())
-                extracted.append(output_path)
-    return extracted
-
-
-def get_extracted_file(user_id: str, relative_path: str) -> bytes:
-    full_path = os.path.join(EXTRACT_BASE, user_id, relative_path)
-    with open(full_path, "rb") as f:
-        return f.read()

package/dist/packages/crucible/seeds/python/seed-036 2.py

@@ -1,33 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: high
-# language: python
-# expected: DES cipher usage and AES-ECB mode with static key
-
-from Crypto.Cipher import DES, AES
-import base64
-
-DES_KEY = b"weakkey!"  # 8 bytes — DES is broken
-AES_KEY = b"0123456789abcdef"  # 16 bytes
-
-
-def des_encrypt(data: str) -> str:
-    # DES has only 56-bit effective key length — trivially brute-forced
-    padded = data + " " * (8 - len(data) % 8)
-    cipher = DES.new(DES_KEY, DES.MODE_ECB)
-    return base64.b64encode(cipher.encrypt(padded.encode())).decode()
-
-
-def aes_ecb_encrypt(data: str) -> str:
-    # ECB mode: identical plaintext blocks produce identical ciphertext blocks
-    pad_len = 16 - len(data) % 16
-    padded = (data + chr(pad_len) * pad_len).encode()
-    cipher = AES.new(AES_KEY, AES.MODE_ECB)
-    return base64.b64encode(cipher.encrypt(padded)).decode()
-
-
-def aes_ecb_decrypt(ciphertext: str) -> str:
-    cipher = AES.new(AES_KEY, AES.MODE_ECB)
-    decrypted = cipher.decrypt(base64.b64decode(ciphertext))
-    pad_len = decrypted[-1]
-    return decrypted[:-pad_len].decode()

package/dist/packages/crucible/seeds/python/seed-037 2.py

@@ -1,41 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: medium
-# language: python
-# expected: timing attack via string comparison of HMAC signatures, low-iteration PBKDF2
-
-import hmac
-import hashlib
-
-
-WEBHOOK_SECRET = b"static-webhook-secret-2024"
-
-
-def compute_signature(payload: bytes) -> str:
-    return hmac.new(WEBHOOK_SECRET, payload, hashlib.sha256).hexdigest()
-
-
-def verify_signature(payload: bytes, received_sig: str) -> bool:
-    expected = compute_signature(payload)
-    # String comparison leaks timing info — use hmac.compare_digest instead
-    return expected == received_sig
-
-
-def verify_api_key(provided: str, stored: str) -> bool:
-    # Direct equality — timing side-channel attack possible
-    return provided == stored
-
-
-def derive_key(password: str) -> bytes:
-    # Only 1000 iterations — far below NIST recommendation of 600,000+
-    return hashlib.pbkdf2_hmac("sha1", password.encode(), b"static-salt", 1000)
-
-
-def check_token(token_a: str, token_b: str) -> bool:
-    # Char-by-char comparison leaks prefix matches
-    if len(token_a) != len(token_b):
-        return False
-    for a, b in zip(token_a, token_b):
-        if a != b:
-            return False
-    return True

package/dist/packages/crucible/seeds/python/seed-038 2.py

@@ -1,33 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: high
-# language: python
-# expected: MD5 used for file integrity and RSA with insufficient key size
-
-import hashlib
-from Crypto.PublicKey import RSA
-from Crypto.Signature import pkcs1_15
-from Crypto.Hash import MD5
-
-
-def checksum_file(filepath: str) -> str:
-    # MD5 is collision-prone — not suitable for integrity verification
-    with open(filepath, "rb") as f:
-        return hashlib.md5(f.read()).hexdigest()
-
-
-def verify_file_integrity(filepath: str, expected_md5: str) -> bool:
-    return checksum_file(filepath) == expected_md5
-
-
-def generate_rsa_keypair():
-    # 512-bit RSA key — trivially factorable in seconds
-    key = RSA.generate(512)
-    return key.export_key().decode(), key.publickey().export_key().decode()
-
-
-def sign_with_md5(private_key_pem: str, message: bytes) -> bytes:
-    key = RSA.import_key(private_key_pem)
-    # MD5 with RSA — known-weak combination
-    h = MD5.new(message)
-    return pkcs1_15.new(key).sign(h)

package/dist/packages/crucible/seeds/python/seed-039 2.py

@@ -1,39 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: critical
-# language: python
-# expected: eval() called with user-controlled expression string
-
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/calculate", methods=["POST"])
-def calculate():
-    data = request.get_json()
-    expression = data.get("expression", "")
-    try:
-        # Attacker sends: "__import__('os').system('id')"
-        result = eval(expression)
-        return jsonify({"result": result})
-    except Exception as e:
-        return jsonify({"error": str(e)}), 400
-
-
-@app.route("/filter", methods=["POST"])
-def filter_data():
-    data = request.get_json()
-    records = data.get("records", [])
-    condition = data.get("condition", "True")
-    # Attacker sends: "True or __import__('subprocess').check_output(['id'])"
-    filtered = [r for r in records if eval(condition, {"r": r})]
-    return jsonify({"results": filtered})
-
-
-@app.route("/transform", methods=["POST"])
-def transform():
-    expr = request.get_json().get("expr", "x")
-    items = request.get_json().get("items", [1, 2, 3])
-    result = list(map(lambda x: eval(expr), items))
-    return jsonify({"result": result})