thuban 0.4.2 → 0.4.5

package/dist/packages/crucible/banner.js

@@ -1 +1 @@
-"use strict";const NO_COLOR=void 0!==process.env.NO_COLOR,IS_TTY=!!process.stdout.isTTY,COLORTERM=(process.env.COLORTERM||"").toLowerCase(),TERM=(process.env.TERM||"").toLowerCase(),HAS_TRUECOLOR=!NO_COLOR&&IS_TTY&&("truecolor"===COLORTERM||"24bit"===COLORTERM),HAS_256=!NO_COLOR&&IS_TTY&&(HAS_TRUECOLOR||TERM.includes("256color")||"256color"===COLORTERM),HAS_COLOR=!NO_COLOR&&IS_TTY&&(HAS_TRUECOLOR||HAS_256||""!==TERM||""!==COLORTERM);function _c(E,e,r){return HAS_COLOR?HAS_TRUECOLOR&&E?E:HAS_256&&e?e:r||"":""}const RESET=HAS_COLOR?"":"",BOLD=HAS_COLOR?"":"",DIM=HAS_COLOR?"":"",UNDER=HAS_COLOR?"":"",BLUE=_c("","",""),PURPLE=_c("","",""),RED=_c("","",""),GREEN=_c("","",""),AMBER=_c("","",""),WHITE=HAS_COLOR?"":"",DBLUE=HAS_COLOR?HAS_256?DIM+BLUE:DIM+"":"",GRAY=HAS_COLOR?"":"",YELLOW=AMBER,ORANGE=AMBER,CYAN=BLUE,SEP_WIDTH=58,SEP_CHAR="─";function _sep(){return DBLUE+" "+"─".repeat(58)+RESET}function statusTag(E,e){return GRAY+"[ "+RESET+(e||WHITE)+BOLD+E+RESET+GRAY+" ]"+RESET}const TAG_DONE=statusTag("DONE",GREEN),TAG_ACTIVE=statusTag("ACTIVE",AMBER),TAG_RUNNING=statusTag("RUNNING",PURPLE),TAG_WAITING=statusTag("WAITING",GRAY+DIM),TAG_DEFLECTED=statusTag("DEFLECTED",GREEN),TAG_MUTATED=statusTag("MUTATED",RED),TAG_PASS=statusTag("PASS",GREEN),TAG_FAIL=statusTag("FAIL",RED),TAG_BREACH=statusTag("BREACH",RED),TAG_SURVIVED=statusTag("SURVIVED",GREEN),TAG_SKIP=statusTag("SKIP",GRAY+DIM);function renderInit(E={}){const e=E.version||"0.4.0",r=E.target||".",T=E.mode||"standard",n=null!=E.seed?"0x"+Number(E.seed).toString(16).toUpperCase().padStart(9,"0"):"0x000000000",R=[];return R.push(""),R.push(" "+WHITE+BOLD+"🛡️  THUBAN CRUCIBLE"+RESET+DBLUE+" // "+RESET+WHITE+"v"+e+RESET),R.push(_sep()),R.push(" "+BLUE+BOLD+"[INIT]"+RESET+WHITE+" Target: "+RESET+WHITE+r+RESET),R.push(" "+BLUE+BOLD+"[INIT]"+RESET+WHITE+" Mode:   "+RESET+WHITE+T+RESET),R.push(" "+BLUE+BOLD+"[INIT]"+RESET+WHITE+" Seed:   "+RESET+WHITE+n+RESET+GRAY+" (Deterministic)"+RESET),R.push(""),R.join("\n")}function renderPhaseHeader(E){return"\n 🔨 "+WHITE+BOLD+(E||"THE CRUCIBLE IS BURNING...")+RESET+"\n"}function renderProgress(E,e,r={}){const T=_resolveTag(e),n=r.sub,R=r.last,t=(n||_padPhase(E),r.detail||"");if(n){const E=void 0!==r.emoji?r.emoji:"🧪";return DBLUE+" │  └─ "+RESET+GRAY+E+" "+RESET+WHITE+(r.subLabel||t)+RESET+(T?"  "+_rightAlign(T,t?"":t):"")}const s=t?GRAY+t+RESET:"",A=T?"  "+T:"";return(R?DBLUE+" └─ "+RESET:DBLUE+" ├─ "+RESET)+_padPhase(BLUE+BOLD+"["+E+"]"+RESET,E.length)+"  "+s+A}function renderVerdict(E={}){const e=!1!==E.survived,r=_fmt(E.mutationsAttempted),T=_fmt(E.deflections),n=null!=E.breaches?E.breaches:0,R=E.reportPath||"",t=E.selfHeal||"",s=E.seedHex||"",A=null!=E.score?E.score:null,a=e?GREEN+BOLD+"CODEBASE SURVIVED THE CRUCIBLE."+RESET:RED+BOLD+"CODEBASE BREACHED — CRITICAL FAILURES DETECTED."+RESET,u=[];u.push(""),u.push(" 🏁 "+WHITE+BOLD+"[VERDICT]"+RESET+" "+a),u.push(_sep()),null!==r&&u.push(" 📦 "+WHITE+"Mutations Attempted: "+RESET+WHITE+BOLD+r+RESET),null!==T&&u.push(" 🛡️  "+WHITE+"Deflections:         "+RESET+GREEN+BOLD+T+RESET);const o=n>0?RED+BOLD+String(n)+RESET+(t?GRAY+" ("+t+")"+RESET:""):GREEN+BOLD+"0"+RESET;if(u.push(" 💥 "+WHITE+"Critical Breaches:   "+RESET+o),null!==A){const E=A>=90?GREEN:A>=70?AMBER:RED;u.push(" 🌟 "+WHITE+"Crucible Score:      "+RESET+E+BOLD+A+"/100"+RESET)}return R&&u.push(" 📄 "+WHITE+"Report Generated:    "+RESET+BLUE+UNDER+R+RESET),s&&u.push(" "+GRAY+"Seed: "+s+RESET),u.push(""),u.join("\n")}function fullBanner(E={}){return renderInit({version:E.version,target:E.targetPath||".",mode:E.level?"--level "+E.level:"standard",seed:E.seed})}function compactBanner(E){return"\n 🔥 "+WHITE+BOLD+"CRUCIBLE"+RESET+(E?" "+GRAY+"["+RESET+AMBER+E+RESET+GRAY+"]"+RESET:"")+"\n"}function scoreBanner(E,e){const r=scoreColor(E),T=e||scoreLabel(E),n=buildProgressBar(E,40);return["","  "+WHITE+BOLD+"Crucible Score"+RESET,"  "+r+n+RESET+" "+r+BOLD+E+"/100"+RESET+" "+GRAY+T+RESET,""].join("\n")}function sectionHeader(E,e){return"\n"+AMBER+"  "+(e?e+" ":"")+BOLD+E+RESET+"\n"+GRAY+"  "+"─".repeat(Math.min(60,E.length+4))+RESET+"\n"}function statusLine(E,e,r){return`  ${E?GREEN+"✓"+RESET:RED+"✗"+RESET}  ${DIM+e+RESET}${r?GRAY+"  "+r+RESET:""}`}function summaryLine(E,e,r){const T=scoreColor(r),n=e-E;return["",`  ${BOLD}Results:${RESET}  ${GREEN}${E} passed${RESET}  `+(n>0?RED+n+" failed"+RESET:DIM+"0 failed"+RESET)+"  "+`${GRAY}(${e} total)${RESET}`,`  ${BOLD}Score:${RESET}    ${T}${BOLD}${r}/100${RESET}`,""].join("\n")}function plainBanner(){return["","  THUBAN CRUCIBLE","  "+"─".repeat(58),"  The Fire Test for Security Scanners",""].join("\n")}const PHASE_WIDTH=12;function _padPhase(E,e){const r=null!=e?e:_stripAnsi(E).length,T=Math.max(0,PHASE_WIDTH-r);return E+" ".repeat(T)}function _stripAnsi(E){return E.replace(/\x1b\[[0-9;]*m/g,"")}function _resolveTag(E){switch((E||"").toUpperCase()){case"DONE":return TAG_DONE;case"ACTIVE":return TAG_ACTIVE;case"RUNNING":return TAG_RUNNING;case"WAITING":return TAG_WAITING;case"DEFLECTED":return TAG_DEFLECTED;case"MUTATED":return TAG_MUTATED;case"PASS":return TAG_PASS;case"FAIL":return TAG_FAIL;case"BREACH":return TAG_BREACH;case"SURVIVED":return TAG_SURVIVED;case"SKIP":return TAG_SKIP;default:return statusTag(E||"?",GRAY)}}function _rightAlign(E,e){return E}function _fmt(E){return null==E?null:Number(E).toLocaleString("en-US")}function buildProgressBar(E,e){const r=Math.round(E/100*e),T=e-r;return"["+"█".repeat(r)+"░".repeat(T)+"]"}function scoreColor(E){return HAS_COLOR?E>=90?GREEN:E>=70||E>=50?AMBER:RED:""}function scoreLabel(E){return E>=90?"Excellent":E>=70?"Good":E>=50?"Fair":E>=30?"Poor":"Critical"}function levelColor(E){if(!HAS_COLOR)return"";switch((E||"").toLowerCase()){case"gentle":return GREEN;case"medium":return AMBER;case"hell":return RED;default:return GRAY}}module.exports={renderInit:renderInit,renderPhaseHeader:renderPhaseHeader,renderProgress:renderProgress,renderVerdict:renderVerdict,statusTag:statusTag,fullBanner:fullBanner,compactBanner:compactBanner,scoreBanner:scoreBanner,sectionHeader:sectionHeader,statusLine:statusLine,summaryLine:summaryLine,plainBanner:plainBanner,scoreColor:scoreColor,scoreLabel:scoreLabel,TAG_DONE:TAG_DONE,TAG_ACTIVE:TAG_ACTIVE,TAG_RUNNING:TAG_RUNNING,TAG_WAITING:TAG_WAITING,TAG_DEFLECTED:TAG_DEFLECTED,TAG_MUTATED:TAG_MUTATED,TAG_PASS:TAG_PASS,TAG_FAIL:TAG_FAIL,TAG_BREACH:TAG_BREACH,TAG_SURVIVED:TAG_SURVIVED,TAG_SKIP:TAG_SKIP,colors:{RESET:RESET,BOLD:BOLD,DIM:DIM,UNDER:UNDER,BLUE:BLUE,PURPLE:PURPLE,RED:RED,GREEN:GREEN,AMBER:AMBER,WHITE:WHITE,GRAY:GRAY,DBLUE:DBLUE,YELLOW:AMBER,ORANGE:AMBER,CYAN:BLUE}};
+"use strict";const _fs=require("fs"),_path=require("path");let _PKG_VERSION;try{_PKG_VERSION=JSON.parse(_fs.readFileSync(_path.join(__dirname,"..","..","package.json"),"utf-8")).version}catch(E){_PKG_VERSION="0.4.3"}const NO_COLOR=void 0!==process.env.NO_COLOR,IS_TTY=!!process.stdout.isTTY,COLORTERM=(process.env.COLORTERM||"").toLowerCase(),TERM=(process.env.TERM||"").toLowerCase(),HAS_TRUECOLOR=!NO_COLOR&&IS_TTY&&("truecolor"===COLORTERM||"24bit"===COLORTERM),HAS_256=!NO_COLOR&&IS_TTY&&(HAS_TRUECOLOR||TERM.includes("256color")||"256color"===COLORTERM),HAS_COLOR=!NO_COLOR&&IS_TTY&&(HAS_TRUECOLOR||HAS_256||""!==TERM||""!==COLORTERM);function _c(E,e,r){return HAS_COLOR?HAS_TRUECOLOR&&E?E:HAS_256&&e?e:r||"":""}const RESET=HAS_COLOR?"":"",BOLD=HAS_COLOR?"":"",DIM=HAS_COLOR?"":"",UNDER=HAS_COLOR?"":"",BLUE=_c("","",""),PURPLE=_c("","",""),RED=_c("","",""),GREEN=_c("","",""),AMBER=_c("","",""),WHITE=HAS_COLOR?"":"",DBLUE=HAS_COLOR?HAS_256?DIM+BLUE:DIM+"":"",GRAY=HAS_COLOR?"":"",YELLOW=AMBER,ORANGE=AMBER,CYAN=BLUE,SEP_WIDTH=58,SEP_CHAR="─";function _sep(){return DBLUE+" "+"─".repeat(58)+RESET}function statusTag(E,e){return GRAY+"[ "+RESET+(e||WHITE)+BOLD+E+RESET+GRAY+" ]"+RESET}const TAG_DONE=statusTag("DONE",GREEN),TAG_ACTIVE=statusTag("ACTIVE",AMBER),TAG_RUNNING=statusTag("RUNNING",PURPLE),TAG_WAITING=statusTag("WAITING",GRAY+DIM),TAG_DEFLECTED=statusTag("DEFLECTED",GREEN),TAG_MUTATED=statusTag("MUTATED",RED),TAG_PASS=statusTag("PASS",GREEN),TAG_FAIL=statusTag("FAIL",RED),TAG_BREACH=statusTag("BREACH",RED),TAG_SURVIVED=statusTag("SURVIVED",GREEN),TAG_SKIP=statusTag("SKIP",GRAY+DIM);function renderInit(E={}){const e=E.version||_PKG_VERSION,r=E.target||".",T=E.mode||"standard",n=null!=E.seed?"0x"+Number(E.seed).toString(16).toUpperCase().padStart(9,"0"):"0x000000000",t=[];return t.push(""),t.push(" "+WHITE+BOLD+"🛡️  THUBAN CRUCIBLE"+RESET+DBLUE+" // "+RESET+WHITE+"v"+e+RESET),t.push(_sep()),t.push(" "+BLUE+BOLD+"[INIT]"+RESET+WHITE+" Target: "+RESET+WHITE+r+RESET),t.push(" "+BLUE+BOLD+"[INIT]"+RESET+WHITE+" Mode:   "+RESET+WHITE+T+RESET),t.push(" "+BLUE+BOLD+"[INIT]"+RESET+WHITE+" Seed:   "+RESET+WHITE+n+RESET+GRAY+" (Deterministic)"+RESET),t.push(""),t.join("\n")}function renderPhaseHeader(E){return"\n 🔨 "+WHITE+BOLD+(E||"THE CRUCIBLE IS BURNING...")+RESET+"\n"}function renderProgress(E,e,r={}){const T=_resolveTag(e),n=r.sub,t=r.last,R=(n||_padPhase(E),r.detail||"");if(n){const E=void 0!==r.emoji?r.emoji:"🧪";return DBLUE+" │  └─ "+RESET+GRAY+E+" "+RESET+WHITE+(r.subLabel||R)+RESET+(T?"  "+_rightAlign(T,R?"":R):"")}const s=R?GRAY+R+RESET:"",A=T?"  "+T:"";return(t?DBLUE+" └─ "+RESET:DBLUE+" ├─ "+RESET)+_padPhase(BLUE+BOLD+"["+E+"]"+RESET,E.length)+"  "+s+A}function renderVerdict(E={}){const e=!1!==E.survived,r=_fmt(E.mutationsAttempted),T=_fmt(E.deflections),n=null!=E.breaches?E.breaches:0,t=E.reportPath||"",R=E.selfHeal||"",s=E.seedHex||"",A=null!=E.score?E.score:null,a=e?GREEN+BOLD+"CODEBASE SURVIVED THE CRUCIBLE."+RESET:RED+BOLD+"CODEBASE BREACHED — CRITICAL FAILURES DETECTED."+RESET,S=[];S.push(""),S.push(" 🏁 "+WHITE+BOLD+"[VERDICT]"+RESET+" "+a),S.push(_sep()),null!==r&&S.push(" 📦 "+WHITE+"Mutations Attempted: "+RESET+WHITE+BOLD+r+RESET),null!==T&&S.push(" 🛡️  "+WHITE+"Deflections:         "+RESET+GREEN+BOLD+T+RESET);const o=n>0?RED+BOLD+String(n)+RESET+(R?GRAY+" ("+R+")"+RESET:""):GREEN+BOLD+"0"+RESET;if(S.push(" 💥 "+WHITE+"Critical Breaches:   "+RESET+o),null!==A){const E=A>=90?GREEN:A>=70?AMBER:RED;S.push(" 🌟 "+WHITE+"Crucible Score:      "+RESET+E+BOLD+A+"/100"+RESET)}return t&&S.push(" 📄 "+WHITE+"Report Generated:    "+RESET+BLUE+UNDER+t+RESET),s&&S.push(" "+GRAY+"Seed: "+s+RESET),S.push(""),S.join("\n")}function fullBanner(E={}){return renderInit({version:E.version,target:E.targetPath||".",mode:E.level?"--level "+E.level:"standard",seed:E.seed})}function compactBanner(E){return"\n 🔥 "+WHITE+BOLD+"CRUCIBLE"+RESET+(E?" "+GRAY+"["+RESET+AMBER+E+RESET+GRAY+"]"+RESET:"")+"\n"}function scoreBanner(E,e){const r=scoreColor(E),T=e||scoreLabel(E),n=buildProgressBar(E,40);return["","  "+WHITE+BOLD+"Crucible Score"+RESET,"  "+r+n+RESET+" "+r+BOLD+E+"/100"+RESET+" "+GRAY+T+RESET,""].join("\n")}function sectionHeader(E,e){return"\n"+AMBER+"  "+(e?e+" ":"")+BOLD+E+RESET+"\n"+GRAY+"  "+"─".repeat(Math.min(60,E.length+4))+RESET+"\n"}function statusLine(E,e,r){return`  ${E?GREEN+"✓"+RESET:RED+"✗"+RESET}  ${DIM+e+RESET}${r?GRAY+"  "+r+RESET:""}`}function summaryLine(E,e,r){const T=scoreColor(r),n=e-E;return["",`  ${BOLD}Results:${RESET}  ${GREEN}${E} passed${RESET}  `+(n>0?RED+n+" failed"+RESET:DIM+"0 failed"+RESET)+"  "+`${GRAY}(${e} total)${RESET}`,`  ${BOLD}Score:${RESET}    ${T}${BOLD}${r}/100${RESET}`,""].join("\n")}function plainBanner(){return["","  THUBAN CRUCIBLE","  "+"─".repeat(58),"  The Fire Test for Security Scanners",""].join("\n")}const PHASE_WIDTH=12;function _padPhase(E,e){const r=null!=e?e:_stripAnsi(E).length,T=Math.max(0,PHASE_WIDTH-r);return E+" ".repeat(T)}function _stripAnsi(E){return E.replace(/\x1b\[[0-9;]*m/g,"")}function _resolveTag(E){switch((E||"").toUpperCase()){case"DONE":return TAG_DONE;case"ACTIVE":return TAG_ACTIVE;case"RUNNING":return TAG_RUNNING;case"WAITING":return TAG_WAITING;case"DEFLECTED":return TAG_DEFLECTED;case"MUTATED":return TAG_MUTATED;case"PASS":return TAG_PASS;case"FAIL":return TAG_FAIL;case"BREACH":return TAG_BREACH;case"SURVIVED":return TAG_SURVIVED;case"SKIP":return TAG_SKIP;default:return statusTag(E||"?",GRAY)}}function _rightAlign(E,e){return E}function _fmt(E){return null==E?null:Number(E).toLocaleString("en-US")}function buildProgressBar(E,e){const r=Math.round(E/100*e),T=e-r;return"["+"█".repeat(r)+"░".repeat(T)+"]"}function scoreColor(E){return HAS_COLOR?E>=90?GREEN:E>=70||E>=50?AMBER:RED:""}function scoreLabel(E){return E>=90?"Excellent":E>=70?"Good":E>=50?"Fair":E>=30?"Poor":"Critical"}function levelColor(E){if(!HAS_COLOR)return"";switch((E||"").toLowerCase()){case"gentle":return GREEN;case"medium":return AMBER;case"hell":return RED;default:return GRAY}}module.exports={renderInit:renderInit,renderPhaseHeader:renderPhaseHeader,renderProgress:renderProgress,renderVerdict:renderVerdict,statusTag:statusTag,fullBanner:fullBanner,compactBanner:compactBanner,scoreBanner:scoreBanner,sectionHeader:sectionHeader,statusLine:statusLine,summaryLine:summaryLine,plainBanner:plainBanner,scoreColor:scoreColor,scoreLabel:scoreLabel,TAG_DONE:TAG_DONE,TAG_ACTIVE:TAG_ACTIVE,TAG_RUNNING:TAG_RUNNING,TAG_WAITING:TAG_WAITING,TAG_DEFLECTED:TAG_DEFLECTED,TAG_MUTATED:TAG_MUTATED,TAG_PASS:TAG_PASS,TAG_FAIL:TAG_FAIL,TAG_BREACH:TAG_BREACH,TAG_SURVIVED:TAG_SURVIVED,TAG_SKIP:TAG_SKIP,colors:{RESET:RESET,BOLD:BOLD,DIM:DIM,UNDER:UNDER,BLUE:BLUE,PURPLE:PURPLE,RED:RED,GREEN:GREEN,AMBER:AMBER,WHITE:WHITE,GRAY:GRAY,DBLUE:DBLUE,YELLOW:AMBER,ORANGE:AMBER,CYAN:BLUE}};

package/dist/packages/crucible/rule-loader.js

@@ -1 +1 @@
-"use strict";const fs=require("fs"),path=require("path"),RULES_DIR=path.join(__dirname,"rules"),MAX_PATTERN_LENGTH=500,MAX_QUANTIFIERS=20,MAX_ALTERNATIONS=30;function _checkRegexComplexity(e){if("string"!=typeof e||!e)return{safe:!1,reason:"pattern must be a non-empty string"};if(e.length>500)return{safe:!1,reason:"pattern exceeds max length of 500"};let t=0,n=0;const r=[];for(let a=0;a<e.length;a++){const s=e[a];if("\\"!==s)if("("!==s){if(")"===s){const n=r.pop();if(!n)continue;const s=/^\{\d+(,\d*)?\}/.exec(e.slice(a+1)),i=e[a+1];if("+"===i||"*"===i||"?"===i||s){if(t++,n.hasQuantifier||n.hasAlternation)return{safe:!1,reason:"nested quantifier detected (potential catastrophic backtracking)"};r.length>0&&(r[r.length-1].hasQuantifier=!0)}continue}if("+"!==s&&"*"!==s&&"?"!==s){if("{"===s){/^\{\d+(,\d*)?\}/.exec(e.slice(a))&&(t++,r.length>0&&(r[r.length-1].hasQuantifier=!0));continue}"|"!==s||(n++,r.length>0&&(r[r.length-1].hasAlternation=!0))}else t++,r.length>0&&(r[r.length-1].hasQuantifier=!0)}else r.push({hasQuantifier:!1,hasAlternation:!1});else a++}return t>20?{safe:!1,reason:`pattern has ${t} quantifiers, exceeding max of 20`}:n>30?{safe:!1,reason:`pattern has ${n} alternations, exceeding max of 30`}:{safe:!0,reason:null}}let _compiledPatterns=null;function getPatterns(){if(_compiledPatterns)return _compiledPatterns;const e=fs.readdirSync(RULES_DIR).filter(e=>e.endsWith(".json")).sort(),t=[];for(const n of e){const e=path.join(RULES_DIR,n);let r;try{const t=fs.readFileSync(e,"utf-8");r=JSON.parse(t)}catch(e){throw new Error(`[rule-loader] Failed to read/parse rule file "${n}": ${e.message}`)}if(!Array.isArray(r))throw new Error(`[rule-loader] Rule file "${n}" must export a JSON array, got: ${typeof r}`);for(const e of r){if(e.pattern){const t=_checkRegexComplexity(e.pattern);if(!t.safe){console.warn(`[rule-loader] WARNING: Skipping rule "${e.id}" in "${n}" — ${t.reason}`);continue}}let r,a;try{r=new RegExp(e.pattern,e.flags||"")}catch(t){throw new Error(`[rule-loader] Failed to compile rule "${e&&e.id}" in file "${n}": ${t.message}\n  pattern: ${e&&e.pattern}\n  flags:   ${e&&e.flags}`)}if(e.context)try{a=new RegExp(e.context,e.contextFlags||"")}catch(t){throw new Error(`[rule-loader] Failed to compile context for rule "${e&&e.id}" in file "${n}": ${t.message}`)}t.push({regex:r,category:e.category,id:e.id,description:e.description,language:e.language,severity:e.severity,name:e.name,type:e.type,message:e.message,context:a,skipIfSafe:e.skipIfSafe,skipInTests:e.skipInTests,sourceFile:n})}}return _compiledPatterns=t,_compiledPatterns}function getCodeScannerPatterns(){return getPatterns().filter(e=>"code-scanner-core.json"===e.sourceFile).map(e=>{const t={id:e.id,name:e.name,type:e.type,pattern:e.regex,severity:e.severity,message:e.message};return e.context&&(t.context=e.context),e.skipIfSafe&&(t.skipIfSafe=!0),e.skipInTests&&(t.skipInTests=!0),t})}module.exports={getPatterns:getPatterns,getCodeScannerPatterns:getCodeScannerPatterns};
+"use strict";const fs=require("fs"),path=require("path"),RULES_DIR=path.join(__dirname,"rules"),MAX_PATTERN_LENGTH=500,MAX_QUANTIFIERS=20,MAX_ALTERNATIONS=30;function _checkRegexComplexity(e){if("string"!=typeof e||!e)return{safe:!1,reason:"pattern must be a non-empty string"};if(e.length>500)return{safe:!1,reason:"pattern exceeds max length of 500"};let t=0,n=0;const r=[];for(let s=0;s<e.length;s++){const a=e[s];if("\\"!==a)if("("!==a){if(")"===a){const n=r.pop();if(!n)continue;const a=/^\{\d+(,\d*)?\}/.exec(e.slice(s+1)),i=e[s+1];if("+"===i||"*"===i||"?"===i||a){if(t++,n.hasQuantifier)return{safe:!1,reason:"nested quantifier detected (potential catastrophic backtracking)"};r.length>0&&(r[r.length-1].hasQuantifier=!0)}continue}if("+"!==a&&"*"!==a&&"?"!==a){if("{"===a){/^\{\d+(,\d*)?\}/.exec(e.slice(s))&&(t++,r.length>0&&(r[r.length-1].hasQuantifier=!0));continue}"|"!==a||(n++,r.length>0&&(r[r.length-1].hasAlternation=!0))}else t++,r.length>0&&(r[r.length-1].hasQuantifier=!0)}else{if("?"===e[s+1]){const t=e[s+2];":"===t||"="===t||"!"===t?s+=2:"<"===t&&(s+=3)}r.push({hasQuantifier:!1,hasAlternation:!1})}else s++}return t>20?{safe:!1,reason:`pattern has ${t} quantifiers, exceeding max of 20`}:n>30?{safe:!1,reason:`pattern has ${n} alternations, exceeding max of 30`}:{safe:!0,reason:null}}let _compiledPatterns=null;function getPatterns(){if(_compiledPatterns)return _compiledPatterns;const e=fs.readdirSync(RULES_DIR).filter(e=>e.endsWith(".json")).sort(),t=[];for(const n of e){const e=path.join(RULES_DIR,n);let r;try{const t=fs.readFileSync(e,"utf-8");r=JSON.parse(t)}catch(e){throw new Error(`[rule-loader] Failed to read/parse rule file "${n}": ${e.message}`)}if(!Array.isArray(r))throw new Error(`[rule-loader] Rule file "${n}" must export a JSON array, got: ${typeof r}`);for(const e of r){if(e.pattern){const t=_checkRegexComplexity(e.pattern);if(!t.safe){console.warn(`[rule-loader] WARNING: Skipping rule "${e.id}" in "${n}" — ${t.reason}`);continue}}let r,s;try{r=new RegExp(e.pattern,e.flags||"")}catch(t){throw new Error(`[rule-loader] Failed to compile rule "${e&&e.id}" in file "${n}": ${t.message}\n  pattern: ${e&&e.pattern}\n  flags:   ${e&&e.flags}`)}if(e.context)try{s=new RegExp(e.context,e.contextFlags||"")}catch(t){throw new Error(`[rule-loader] Failed to compile context for rule "${e&&e.id}" in file "${n}": ${t.message}`)}t.push({regex:r,category:e.category,id:e.id,description:e.description,language:e.language,severity:e.severity,name:e.name,type:e.type,message:e.message,context:s,skipIfSafe:e.skipIfSafe,skipInTests:e.skipInTests,excludeExtensions:e.excludeExtensions,sourceFile:n})}}return _compiledPatterns=t,_compiledPatterns}function getCodeScannerPatterns(){return getPatterns().filter(e=>"code-scanner-core.json"===e.sourceFile).map(e=>{const t={id:e.id,name:e.name,type:e.type,pattern:e.regex,severity:e.severity,message:e.message};return e.context&&(t.context=e.context),e.skipIfSafe&&(t.skipIfSafe=!0),e.skipInTests&&(t.skipInTests=!0),e.excludeExtensions&&(t.excludeExtensions=e.excludeExtensions),t})}module.exports={getPatterns:getPatterns,getCodeScannerPatterns:getCodeScannerPatterns};

package/dist/packages/crucible/rules/code-scanner-core.json

@@ -1,129 +1,233 @@
-[
-  {
-    "id": "SEC001",
-    "name": "Hardcoded API Key",
-    "type": "hardcoded_secret",
-    "pattern": "['\"](?:sk-|pk-|xox[pboa]-|AKIA|ghp_|gho_|github_pat_)[a-zA-Z0-9_-]{10,}['\"]|['\"][a-zA-Z0-9]{32,}['\"]",
-    "flags": "",
-    "severity": "critical",
-    "message": "Possible hardcoded API key or secret detected",
-    "context": "(api[_-]?key|apikey|secret[_\\s]*key|token|credential|bearer)",
-    "contextFlags": "i",
-    "skipIfSafe": true
-  },
-  {
-    "id": "SEC001B",
-    "name": "Hardcoded API Key (bare)",
-    "type": "hardcoded_secret",
-    "pattern": "['\"](?:sk-|pk-|xox[pboa]-|AKIA|ghp_|gho_|github_pat_)[a-zA-Z0-9_-]{10,}['\"]",
-    "flags": "",
-    "severity": "critical",
-    "message": "Possible hardcoded API key or secret detected",
-    "skipIfSafe": true
-  },
-  {
-    "id": "SEC002",
-    "name": "Hardcoded Password",
-    "type": "hardcoded_secret",
-    "pattern": "password\\s*[:=]\\s*['\"][^'\"]+['\"]",
-    "flags": "i",
-    "severity": "critical",
-    "message": "Hardcoded password detected",
-    "skipIfSafe": true,
-    "skipInTests": true
-  },
-  {
-    "id": "SEC002B",
-    "name": "Hardcoded Password (JSON key)",
-    "type": "hardcoded_secret",
-    "pattern": "[\"']password[\"']\\s*:\\s*[\"'][^\"']+[\"']",
-    "flags": "i",
-    "severity": "critical",
-    "message": "Hardcoded password detected",
-    "skipIfSafe": true,
-    "skipInTests": true
-  },
-  {
-    "id": "SEC003",
-    "name": "SQL Injection Risk",
-    "type": "sql_injection",
-    "pattern": "\\b(?:SELECT|INSERT\\s+INTO|UPDATE|DELETE\\s+FROM|WHERE)\\b.*(\\$\\{|\\+\\s*['\"]|\\+\\s*\\w+|f['\"].*\\{|%s|%d)",
-    "flags": "i",
-    "severity": "error",
-    "message": "Potential SQL injection - use parameterized queries"
-  },
-  {
-    "id": "SEC004",
-    "name": "eval() Usage",
-    "type": "eval_abuse",
-    "pattern": "\\beval\\s*\\(",
-    "flags": "",
-    "severity": "error",
-    "message": "eval() is dangerous and should be avoided"
-  },
-  {
-    "id": "SEC004B",
-    "name": "eval() Usage (unicode-escaped)",
-    "type": "eval_abuse",
-    "pattern": "\\\\u0065\\\\u0076\\\\u0061\\\\u006[cC]",
-    "flags": "",
-    "severity": "error",
-    "message": "Obfuscated eval() usage (unicode escapes) is dangerous and should be avoided"
-  },
-  {
-    "id": "SEC005",
-    "name": "innerHTML/document.write Assignment",
-    "type": "xss",
-    "pattern": "\\.innerHTML\\s*=|\\bdocument\\.write\\s*\\(",
-    "flags": "",
-    "severity": "warning",
-    "message": "innerHTML/document.write can cause XSS - consider using textContent or sanitization"
-  },
-  {
-    "id": "SEC006",
-    "name": "Disabled Security",
-    "type": "insecure_config",
-    "pattern": "rejectUnauthorized\\s*:\\s*false|verify\\s*=\\s*False|InsecureSkipVerify\\s*:\\s*true",
-    "flags": "",
-    "severity": "error",
-    "message": "SSL certificate validation disabled"
-  },
-  {
-    "id": "SEC007",
-    "name": "Exposed .env Reference",
-    "type": "insecure_config",
-    "pattern": "\\.env['\"]",
-    "flags": "",
-    "severity": "warning",
-    "message": "Direct .env file manipulation - ensure not exposed",
-    "context": "fs\\.(read|write)|path\\.join|open\\s*\\(|os\\.Open",
-    "contextFlags": "i"
-  },
-  {
-    "id": "SEC008",
-    "name": "Unsafe Block (Rust)",
-    "type": "memory_safety",
-    "pattern": "\\bunsafe\\s*\\{",
-    "flags": "",
-    "severity": "warning",
-    "message": "Rust unsafe block - verify memory safety guarantees"
-  },
-  {
-    "id": "SEC009",
-    "name": "Shell Execution (PHP/Ruby)",
-    "type": "command_injection",
-    "pattern": "\\bshell_exec\\s*\\(|\\bpassthru\\s*\\(|`[^`]+`",
-    "flags": "",
-    "severity": "error",
-    "message": "Shell execution function - command injection risk if input unsanitized"
-  },
-  {
-    "id": "SEC010",
-    "name": "Prototype Pollution",
-    "type": "prototype_pollution",
-    "pattern": "\\[\\s*['\"]__proto__['\"]\\s*\\]|\\.__proto__\\s*(=|\\[)|constructor\\s*\\[\\s*['\"]prototype['\"]\\s*\\]|constructor\\.prototype\\s*(=|\\[)|['\"]__proto__['\"]\\s*:",
-    "flags": "",
-    "severity": "error",
-    "message": "Possible prototype pollution via __proto__/constructor.prototype"
-  }
-]
+[
+  {
+    "id": "SEC001",
+    "name": "Hardcoded API Key",
+    "type": "hardcoded_secret",
+    "pattern": "['\"](?:sk-|pk-|xox[pboa]-|AKIA|ghp_|gho_|github_pat_)[a-zA-Z0-9_-]{10,}['\"]|['\"][a-zA-Z0-9]{32,}['\"]",
+    "flags": "",
+    "severity": "critical",
+    "message": "Possible hardcoded API key or secret detected",
+    "context": "(api[_-]?key|apikey|secret[_\\s]*key|token|credential|bearer)",
+    "contextFlags": "i",
+    "skipIfSafe": true
+  },
+  {
+    "id": "SEC001B",
+    "name": "Hardcoded API Key (bare)",
+    "type": "hardcoded_secret",
+    "pattern": "['\"](?:sk-|pk-|xox[pboa]-|AKIA|ghp_|gho_|github_pat_)[a-zA-Z0-9_-]{10,}['\"]",
+    "flags": "",
+    "severity": "critical",
+    "message": "Possible hardcoded API key or secret detected",
+    "skipIfSafe": true
+  },
+  {
+    "id": "SEC002",
+    "name": "Hardcoded Password",
+    "type": "hardcoded_secret",
+    "pattern": "password\\s*[:=]\\s*['\"][^'\"]+['\"]",
+    "flags": "i",
+    "severity": "critical",
+    "message": "Hardcoded password detected",
+    "skipIfSafe": true,
+    "skipInTests": true
+  },
+  {
+    "id": "SEC002B",
+    "name": "Hardcoded Password (JSON key)",
+    "type": "hardcoded_secret",
+    "pattern": "[\"']password[\"']\\s*:\\s*[\"'][^\"']+[\"']",
+    "flags": "i",
+    "severity": "critical",
+    "message": "Hardcoded password detected",
+    "skipIfSafe": true,
+    "skipInTests": true
+  },
+  {
+    "id": "SEC003",
+    "name": "SQL Injection Risk",
+    "type": "sql_injection",
+    "pattern": "\\b(?:SELECT|INSERT\\s+INTO|UPDATE|DELETE\\s+FROM|WHERE)\\b.*(\\$\\{|\\+\\s*['\"]|\\+\\s*\\w+|f['\"].*\\{|%s|%d)",
+    "flags": "i",
+    "severity": "error",
+    "message": "Potential SQL injection - use parameterized queries"
+  },
+  {
+    "id": "SEC004",
+    "name": "eval() Usage",
+    "type": "eval_abuse",
+    "pattern": "\\beval\\s*\\(",
+    "flags": "",
+    "severity": "error",
+    "message": "eval() is dangerous and should be avoided"
+  },
+  {
+    "id": "SEC004B",
+    "name": "eval() Usage (unicode-escaped)",
+    "type": "eval_abuse",
+    "pattern": "\\\\u0065\\\\u0076\\\\u0061\\\\u006[cC]",
+    "flags": "",
+    "severity": "error",
+    "message": "Obfuscated eval() usage (unicode escapes) is dangerous and should be avoided"
+  },
+  {
+    "id": "SEC005",
+    "name": "innerHTML/document.write Assignment",
+    "type": "xss",
+    "pattern": "\\.innerHTML\\s*=|\\bdocument\\.write\\s*\\(",
+    "flags": "",
+    "severity": "warning",
+    "message": "innerHTML/document.write can cause XSS - consider using textContent or sanitization"
+  },
+  {
+    "id": "SEC006",
+    "name": "Disabled Security",
+    "type": "insecure_config",
+    "pattern": "rejectUnauthorized\\s*:\\s*false|verify\\s*=\\s*False|InsecureSkipVerify\\s*:\\s*true",
+    "flags": "",
+    "severity": "error",
+    "message": "SSL certificate validation disabled"
+  },
+  {
+    "id": "SEC007",
+    "name": "Exposed .env Reference",
+    "type": "insecure_config",
+    "pattern": "\\.env['\"]",
+    "flags": "",
+    "severity": "warning",
+    "message": "Direct .env file manipulation - ensure not exposed",
+    "context": "fs\\.(read|write)|path\\.join|open\\s*\\(|os\\.Open",
+    "contextFlags": "i"
+  },
+  {
+    "id": "SEC008",
+    "name": "Unsafe Block (Rust)",
+    "type": "memory_safety",
+    "pattern": "\\bunsafe\\s*\\{",
+    "flags": "",
+    "severity": "warning",
+    "message": "Rust unsafe block - verify memory safety guarantees"
+  },
+  {
+    "id": "SEC009",
+    "name": "Shell Execution (PHP/Ruby/Python)",
+    "type": "command_injection",
+    "pattern": "\\bshell_exec\\s*\\(|\\bpassthru\\s*\\(|\\bos\\.system\\s*\\(|\\bos\\.popen\\s*\\(|\\bsubprocess\\.(?:call|run|Popen|check_output)\\s*\\([^)]*shell\\s*=\\s*True|\\bexec\\s*\\(\\s*[\"']|\\bsystem\\s*\\(\\s*[\"']",
+    "flags": "",
+    "severity": "error",
+    "message": "Shell/OS execution function — command injection risk if input unsanitized",
+    "excludeExtensions": [".js", ".ts", ".jsx", ".tsx", ".mjs", ".cjs"]
+  },
+  {
+    "id": "SEC010",
+    "name": "Prototype Pollution",
+    "type": "prototype_pollution",
+    "pattern": "\\[\\s*['\"]__proto__['\"]\\s*\\]|\\.__proto__\\s*(=|\\[)|constructor\\s*\\[\\s*['\"]prototype['\"]\\s*\\]|constructor\\.prototype\\s*(=|\\[)|['\"]__proto__['\"]\\s*:",
+    "flags": "",
+    "severity": "error",
+    "message": "Possible prototype pollution via __proto__/constructor.prototype"
+  },
+  {
+    "id": "SEC011",
+    "name": "PHP SQL Injection (dot concatenation)",
+    "type": "sql_injection",
+    "pattern": "\"SELECT[^\"]*WHERE[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\"UPDATE[^\"]*SET[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\"DELETE[^\"]*WHERE[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\\$(?:query|sql|qry)\\s*\\.=\\s*\\$(?:_GET|_POST|_REQUEST|_COOKIE)",
+    "flags": "i",
+    "severity": "critical",
+    "message": "PHP SQL injection: user input concatenated into SQL query with dot operator — use PDO prepared statements"
+  },
+  {
+    "id": "SEC012",
+    "name": "PHP XSS (echo with user input)",
+    "type": "xss",
+    "pattern": "echo\\s+(?!htmlspecialchars|htmlentities|strip_tags|esc_html).*\\$(?:_GET|_POST|_REQUEST|_COOKIE)|echo\\s+[\"'][^\"']*[\"']\\s*\\.\\s*\\$(?:_GET|_POST|_REQUEST|_COOKIE)|print\\s+\\$(?:_GET|_POST|_REQUEST|_COOKIE)",
+    "flags": "i",
+    "severity": "error",
+    "message": "PHP XSS: unescaped user input echoed to page — use htmlspecialchars()"
+  },
+  {
+    "id": "SEC013",
+    "name": "Hardcoded JWT Token",
+    "type": "hardcoded_secret",
+    "pattern": "['\"]eyJ[A-Za-z0-9_-]{20,}\\.[A-Za-z0-9_-]{20,}\\.[A-Za-z0-9_-]{20,}['\"]",
+    "flags": "",
+    "severity": "critical",
+    "message": "Hardcoded JWT token detected — rotate immediately and use environment variables",
+    "skipIfSafe": true,
+    "skipInTests": true
+  },
+  {
+    "id": "SEC014",
+    "name": "Hardcoded PEM Private Key",
+    "type": "hardcoded_secret",
+    "pattern": "-----BEGIN (?:RSA |EC )?PRIVATE KEY-----",
+    "flags": "",
+    "severity": "critical",
+    "message": "Private key embedded in source code — move to secure key store or environment variable"
+  },
+  {
+    "id": "SEC015",
+    "name": "Hardcoded AWS Secret Access Key",
+    "type": "hardcoded_secret",
+    "pattern": "(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY|SecretAccessKey)\\s*[:=]\\s*['\"][A-Za-z0-9/+=]{40}['\"]",
+    "flags": "",
+    "severity": "critical",
+    "message": "AWS Secret Access Key hardcoded — use IAM roles or environment variables",
+    "skipIfSafe": true
+  },
+  {
+    "id": "SEC016",
+    "name": "Rust Hardcoded Secret (const &str)",
+    "type": "hardcoded_secret",
+    "pattern": "const\\s+(?:PASSWORD|SECRET|API_KEY|TOKEN|PRIVATE_KEY|DB_PASS)\\s*:\\s*&str\\s*=\\s*\"[^\"]+\"",
+    "flags": "i",
+    "severity": "critical",
+    "message": "Hardcoded secret in Rust const — use environment variables at runtime",
+    "skipInTests": true
+  },
+  {
+    "id": "SEC017",
+    "name": "Rust format! SQL Injection",
+    "type": "sql_injection",
+    "pattern": "format!\\s*\\(\\s*\"(?:SELECT|INSERT|UPDATE|DELETE|WHERE)[^\"]*\\{",
+    "flags": "i",
+    "severity": "error",
+    "message": "SQL query built with format!() macro — use parameterized queries (sqlx::query! or bind)"
+  },
+  {
+    "id": "SEC018",
+    "name": "Ruby String Interpolation XSS/Injection",
+    "type": "xss",
+    "pattern": "[\"'](?:SELECT|INSERT|UPDATE|DELETE|WHERE|<)[^\"']*#\\{[^}]*(?:params|request|input|user|cookies|session)[^}]*\\}",
+    "flags": "i",
+    "severity": "error",
+    "message": "User input interpolated via Ruby #{} into SQL/HTML — use parameterized queries or sanitize"
+  },
+  {
+    "id": "SEC019",
+    "name": "Go format SQL Injection",
+    "type": "sql_injection",
+    "pattern": "fmt\\.Sprintf\\s*\\(\\s*\"(?:SELECT|INSERT|UPDATE|DELETE|WHERE)[^\"]*%[sv]",
+    "flags": "i",
+    "severity": "error",
+    "message": "SQL query built with fmt.Sprintf — use parameterized queries (db.Query with $1/? placeholders)"
+  },
+  {
+    "id": "RUST001",
+    "name": "Rust Deprecated API (mem::uninitialized)",
+    "type": "deprecated_api",
+    "pattern": "mem::uninitialized\\s*\\(|MaybeUninit::uninit\\(\\)\\.assume_init\\(\\)",
+    "flags": "",
+    "severity": "error",
+    "message": "mem::uninitialized is UB since Rust 1.39 — use MaybeUninit::zeroed() or MaybeUninit with proper init"
+  },
+  {
+    "id": "RUST002",
+    "name": "Rust Deprecated trim_left/trim_right",
+    "type": "deprecated_api",
+    "pattern": "\\.trim_left\\(\\)|\\.trim_right\\(\\)|\\.trim_left_matches\\(|\\.trim_right_matches\\(",
+    "flags": "",
+    "severity": "warning",
+    "message": "trim_left/trim_right deprecated since Rust 1.33 — use trim_start/trim_end"
+  }
+]