thuban 0.4.5 → 0.4.6

package/dist/packages/scanner/taint-tracker.js

@@ -1 +1 @@
-"use strict";const parser=require("@babel/parser"),path=require("path"),fs=require("fs"),{joinLogicalStatements:joinLogicalStatements,extractBalanced:extractBalanced,splitTopLevelArgs:splitTopLevelArgs,isDynamicPyString:isDynamicPyString}=require("./ast-analyzer")._internal,BABEL_PLUGINS=["estree","typescript","jsx","classProperties","decorators-legacy"],MAX_TAINT_FILE_SIZE=2e4,MAX_FIXPOINT_ITERATIONS=10;function walk(e,t){if(e&&"object"==typeof e&&"string"==typeof e.type){t(e);for(const n in e){if("loc"===n||"range"===n||"start"===n||"end"===n)continue;const i=e[n];if(Array.isArray(i))for(const e of i)e&&"object"==typeof e&&"string"==typeof e.type&&walk(e,t);else i&&"object"==typeof i&&"string"==typeof i.type&&walk(i,t)}}}function lineOf(e){return e&&e.loc?e.loc.start.line:0}function snippet(e,t){return!t||t<1||t>e.length?"":e[t-1].trim().substring(0,100)}function mkTaintIssue(e,t,n,i){const r={file:e,line:t,category:"security",type:i.type,severity:i.severity||"critical",id:i.id,name:i.name,message:i.message,code:snippet(n,t),source:"taint",taintPath:i.taintPath};return i.crossFile&&(r.crossFile=!0,r.sourceFile=i.sourceFile),r}function fileTooLargeIssue(e,t){return{file:e,line:0,category:"quality",type:"file_too_large",severity:"info",id:"TAINT003",name:"Taint Analysis Skipped",message:`File too large (${t} chars) - taint analysis skipped (cap: 20000 chars)`,code:"",source:"taint"}}const SANITIZER_FUNCS=new Set(["parseInt","parseFloat","Number","Boolean","encodeURIComponent","encodeURI","escape","sanitize","sanitizeHtml","stripTags"]),SANITIZER_MEMBER=new Set(["sanitize","escape","escapeHtml","stripTags","clean"]),SANITIZER_RECEIVER_NAMES=new Set(["dompurify","sanitizehtml","sanitize-html","html","xss","validator","bleach","markupsafe","purify","sqlstring","sanitizer","striptags","xssfilters","insane"]);function hasKnownSanitizerReceiver(e){let t=e,n=0;for(;t&&n++<20;){if("Identifier"===t.type)return SANITIZER_RECEIVER_NAMES.has(t.name.toLowerCase());if("MemberExpression"!==t.type)return!1;t=t.object}return!1}const JS_SOURCE_PATH_PATTERNS=[{re:/^req\.(params|query|body|headers)(\.|$)/,severity:"critical"},{re:/^request\.(params|query|body|headers)(\.|$)/,severity:"critical"},{re:/^process\.argv/,severity:"critical"},{re:/^process\.env/,severity:"warning"},{re:/^document\.location/,severity:"critical"},{re:/^window\.location/,severity:"critical"},{re:/^location\.(search|hash|href)/,severity:"critical"}];function memberChainToPath(e){const t=[];let n=e,i=0;for(;n&&i++<20;){if("Identifier"===n.type){t.unshift(n.name);break}if("ThisExpression"===n.type){t.unshift("this");break}if("MemberExpression"!==n.type)return null;n.computed||"Identifier"!==n.property.type?t.unshift("*"):t.unshift(n.property.name),n=n.object}return t.length?t.join("."):null}function jsSourceSeverity(e){if(!e)return null;if("CallExpression"===e.type&&"Identifier"===e.callee.type&&"prompt"===e.callee.name)return"critical";if("NewExpression"===e.type&&"Identifier"===e.callee.type&&("URLSearchParams"===e.callee.name||"FormData"===e.callee.name))return"critical";const t=memberChainToPath(e);if(t)for(const e of JS_SOURCE_PATH_PATTERNS)if(e.re.test(t))return e.severity;return null}function isJSSourceExpr(e){return null!==jsSourceSeverity(e)}function describeJSSource(e){return memberChainToPath(e)||("CallExpression"===e.type&&"Identifier"===e.callee.type&&"prompt"===e.callee.name?"prompt()":"NewExpression"===e.type&&"Identifier"===e.callee.type?`new ${e.callee.name}()`:"tainted source")}function isSanitizerCall(e){return!(!e||"CallExpression"!==e.type)&&(!("Identifier"!==e.callee.type||!SANITIZER_FUNCS.has(e.callee.name))||!("MemberExpression"!==e.callee.type||"Identifier"!==e.callee.property.type||!SANITIZER_MEMBER.has(e.callee.property.name))&&hasKnownSanitizerReceiver(e.callee.object))}function isTaintedExpr(e,t,n){if(n=n||0,!e||n>12)return!1;if("Identifier"===e.type)return t.has(e.name);if("CallExpression"===e.type){if(isSanitizerCall(e))return!1;if(isJSSourceExpr(e))return!0;if("MemberExpression"===e.callee.type&&isTaintedExpr(e.callee.object,t,n+1))return!0;for(const i of e.arguments)if(isTaintedExpr(i,t,n+1))return!0;return!1}return"MemberExpression"===e.type?!!isJSSourceExpr(e)||isTaintedExpr(e.object,t,n+1):"NewExpression"===e.type?isJSSourceExpr(e):"BinaryExpression"===e.type&&"+"===e.operator?isTaintedExpr(e.left,t,n+1)||isTaintedExpr(e.right,t,n+1):"TemplateLiteral"===e.type?(e.expressions||[]).some(e=>isTaintedExpr(e,t,n+1)):"AssignmentExpression"===e.type?isTaintedExpr(e.right,t,n+1):"ConditionalExpression"===e.type?isTaintedExpr(e.consequent,t,n+1)||isTaintedExpr(e.alternate,t,n+1):"LogicalExpression"===e.type?isTaintedExpr(e.left,t,n+1)||isTaintedExpr(e.right,t,n+1):!("SequenceExpression"!==e.type||!e.expressions.length)&&isTaintedExpr(e.expressions[e.expressions.length-1],t,n+1)}function isDynamicTaintedBuild(e,t){return!!e&&("TemplateLiteral"===e.type?(e.expressions||[]).some(e=>isTaintedExpr(e,t)):"BinaryExpression"===e.type&&"+"===e.operator&&(isTaintedExpr(e.left,t)||isTaintedExpr(e.right,t)))}function collectFunctionReturnNodes(e){const t=[];return e.body&&"BlockStatement"===e.body.type?function n(i){if(i&&"object"==typeof i&&"string"==typeof i.type&&(i===e||"FunctionDeclaration"!==i.type&&"FunctionExpression"!==i.type&&"ArrowFunctionExpression"!==i.type)){"ReturnStatement"===i.type&&i.argument&&t.push(i.argument);for(const e in i){if("loc"===e||"range"===e||"start"===e||"end"===e)continue;const t=i[e];if(Array.isArray(t))for(const e of t)e&&"object"==typeof e&&"string"==typeof e.type&&n(e);else t&&"object"==typeof t&&"string"==typeof t.type&&n(t)}}}(e.body):e.body&&t.push(e.body),t}function findTaintOrigin(e,t){let n=null;return walk(e,e=>{if(!n)if("Identifier"===e.type&&t.has(e.name))n=t.get(e.name);else{const t=jsSourceSeverity(e);t&&(n={desc:describeJSSource(e),line:lineOf(e),severity:t})}}),n}function collectTaintedVars(e,t){const n=new Set,i=new Map,r=new Set,a=new Map;if(t)for(const[e,r]of t)n.add(e),i.set(e,r);let s=!0,o=0;function l(e){return!(!e||"CallExpression"!==e.type||"Identifier"!==e.callee.type||!r.has(e.callee.name))}for(;s&&o<10;)s=!1,o++,walk(e,e=>{if("FunctionDeclaration"!==e.type&&"FunctionExpression"!==e.type&&"ArrowFunctionExpression"!==e.type)return;const t=e.id&&e.id.name;if(t&&!r.has(t))for(const o of collectFunctionReturnNodes(e))if(isTaintedExpr(o,n)||l(o)){r.add(t),a.set(t,findTaintOrigin(o,i)||(l(o)?a.get(o.callee.name):null)||{desc:describeJSSource(o),line:lineOf(o),severity:jsSourceSeverity(o)||"critical"}),s=!0;break}}),walk(e,e=>{let t=null,r=null;if("VariableDeclarator"===e.type&&e.init&&"Identifier"===e.id.type?(t=e.id.name,r=e.init):"AssignmentExpression"===e.type&&"="===e.operator&&"Identifier"===e.left.type&&(t=e.left.name,r=e.right),!t||n.has(t))return;const o=l(r);if(isTaintedExpr(r,n)||o){n.add(t),s=!0;const l=findTaintOrigin(r,i)||(o?a.get(r.callee.name):null)||{desc:describeJSSource(r),line:lineOf(e),severity:jsSourceSeverity(r)||"critical"};i.set(t,l)}});return{taintedVars:n,origins:i}}const SQL_METHODS=new Set(["query","execute","raw","where"]);function parseJS(e){try{return parser.parse(e,{sourceType:"unambiguous",plugins:BABEL_PLUGINS,allowReturnOutsideFunction:!0,allowImportExportEverywhere:!0,allowAwaitOutsideFunction:!0,allowSuperOutsideMethod:!0,allowUndeclaredExports:!0,errorRecovery:!1}).program}catch(e){return null}}function analyzeJSTaint(e,t,n){const i=[],r=t.split("\n"),a=parseJS(t);if(!a)return i;const{taintedVars:s,origins:o}=collectTaintedVars(a,n),l=new Set;function c(t,n){const a=lineOf(t),s=`${a}:${n.id}`;if(l.has(s))return;l.add(s);const c=findTaintOrigin(t,o);c&&(n=Object.assign({},n,{severity:c.severity||"critical"}),c.crossFile&&(n=Object.assign({},n,{crossFile:!0,sourceFile:c.sourceFile}))),i.push(mkTaintIssue(e,a,r,n))}function p(e){const t=findTaintOrigin(e,o);if(t)return`${t.crossFile?`${t.sourceFile}: `:""}${t.desc} (line ${t.line}) -> sink (line ${lineOf(e)})`}return walk(a,e=>{if("CallExpression"===e.type&&"MemberExpression"===e.callee.type&&"Identifier"===e.callee.property.type&&SQL_METHODS.has(e.callee.property.name)){const t=e.arguments[0];t&&(isDynamicTaintedBuild(t,s)||isTaintedExpr(t,s))&&c(e,{type:"sql_injection",id:"TAINT001",name:"Tainted SQL Injection",message:`Tainted user input flows into .${e.callee.property.name}() without sanitization - SQL injection risk`,taintPath:p(e)})}if("AssignmentExpression"!==e.type||"MemberExpression"!==e.left.type||"Identifier"!==e.left.property.type||"innerHTML"!==e.left.property.name&&"outerHTML"!==e.left.property.name||(isTaintedExpr(e.right,s)||isDynamicTaintedBuild(e.right,s))&&c(e,{type:"xss",id:"TAINT002",name:"Tainted XSS via "+e.left.property.name,message:`Tainted user input flows into ${e.left.property.name} without sanitization - XSS risk`,taintPath:p(e)}),"CallExpression"===e.type&&"MemberExpression"===e.callee.type&&"Identifier"===e.callee.object.type&&"document"===e.callee.object.name&&"Identifier"===e.callee.property.type&&("write"===e.callee.property.name||"writeln"===e.callee.property.name)){const t=e.arguments[0];t&&(isTaintedExpr(t,s)||isDynamicTaintedBuild(t,s))&&c(e,{type:"xss",id:"TAINT002",name:`Tainted XSS via document.${e.callee.property.name}()`,message:`Tainted user input flows into document.${e.callee.property.name}() without sanitization - XSS risk`,taintPath:p(e)})}if("JSXAttribute"===e.type&&e.name&&"dangerouslySetInnerHTML"===e.name.name&&e.value&&"JSXExpressionContainer"===e.value.type){const t=e.value.expression;if(t&&"ObjectExpression"===t.type){const n=t.properties.find(e=>e.key&&("__html"===e.key.name||"__html"===e.key.value));n&&(isTaintedExpr(n.value,s)||isDynamicTaintedBuild(n.value,s))&&c(e,{type:"xss",id:"TAINT002",name:"Tainted XSS via dangerouslySetInnerHTML",message:"Tainted user input flows into dangerouslySetInnerHTML without sanitization - XSS risk",taintPath:p(e)})}}if("CallExpression"===e.type&&"MemberExpression"===e.callee.type&&"Identifier"===e.callee.object.type&&/^res(ponse)?$/.test(e.callee.object.name)&&"Identifier"===e.callee.property.type&&("send"===e.callee.property.name||"write"===e.callee.property.name)){const t=e.arguments[0];t&&"ObjectExpression"!==t.type&&"ArrayExpression"!==t.type&&(isTaintedExpr(t,s)||isDynamicTaintedBuild(t,s))&&c(e,{type:"xss",id:"TAINT002",name:`Reflected XSS via ${e.callee.object.name}.${e.callee.property.name}()`,message:`Tainted user input is reflected via ${e.callee.object.name}.${e.callee.property.name}() without sanitization - reflected XSS risk`,taintPath:p(e)})}}),i}const PY_SOURCE_PATTERNS=[/\brequest\.args\b/,/\brequest\.form\b/,/\brequest\.json\b/,/\brequest\.data\b/,/\brequest\.GET\b/,/\brequest\.POST\b/,/\bsys\.argv\b/,/\bos\.environ\b/,/\binput\s*\(/],PY_SANITIZER_WRAP_RE=/^\s*(int|float|re\.escape|html\.escape|escape|markupsafe\.escape|bleach\.clean)\s*\(/;function describePySource(e){for(const t of PY_SOURCE_PATTERNS){const n=e.match(t);if(n)return n[0]}return"tainted source"}function isPySourceText(e){return PY_SOURCE_PATTERNS.some(t=>t.test(e))}function isDynamicPyText(e){return isDynamicPyString(e)}function collectPyTaintedVars(e){const t=new Set,n=new Map;let i=!0,r=0;const a=/^\s*([A-Za-z_]\w*)\s*=(?!=)\s*([\s\S]+?)\s*$/;for(;i&&r<10;){i=!1,r++;for(const r of e){const e=r.text.split("\n")[0].match(a)||r.text.match(a);if(!e)continue;const s=e[1],o=r.text.slice(r.text.indexOf("=")+1);if(PY_SANITIZER_WRAP_RE.test(o.trim())){t.has(s)&&(t.delete(s),n.delete(s),i=!0);continue}if(t.has(s))continue;let l=!1,c=null;if(isPySourceText(o))l=!0,c=describePySource(o);else for(const e of t)if(new RegExp("\\b"+e+"\\b").test(o)){l=!0,c=n.has(e)?n.get(e).desc:e;break}l&&(t.add(s),n.set(s,{desc:c,line:r.startLine}),i=!0)}}return{taintedVars:t,origins:n}}function textReferencesTaint(e,t){if(isPySourceText(e))return!0;for(const n of t)if(new RegExp("\\b"+n+"\\b").test(e))return!0;return!1}function analyzePythonTaint(e,t){const n=[],i=t.split("\n"),r=joinLogicalStatements(t),{taintedVars:a,origins:s}=collectPyTaintedVars(r),o=new Set;function l(t,r){const a=`${t}:${r.id}`;o.has(a)||(o.add(a),n.push(mkTaintIssue(e,t,i,r)))}function c(e,t){for(const n of a)if(new RegExp("\\b"+n+"\\b").test(e)&&s.has(n)){const e=s.get(n);return`${e.desc} (line ${e.line}) -> sink (line ${t})`}if(isPySourceText(e))return`${describePySource(e)} -> sink (line ${t})`}for(const e of r){const t=e.text,n=e.startLine,i=t.match(/\b(?:cursor|db|conn|connection)\.execute\s*\(/);if(i){const e=t.indexOf("(",i.index),r=extractBalanced(t,e),s=splitTopLevelArgs(r)[0]||"";isDynamicPyText(s)&&textReferencesTaint(s,a)&&l(n,{type:"sql_injection",id:"TAINT001",name:"Tainted SQL Injection",message:"Tainted user input flows into .execute() without sanitization - SQL injection risk",taintPath:c(s,n)})}const r=t.match(/\.(raw|extra)\s*\(|\bRawSQL\s*\(/);if(r){const e=t.indexOf("(",r.index),i=extractBalanced(t,e),s=splitTopLevelArgs(i)[0]||"";(isDynamicPyText(s)||isPySourceText(s))&&textReferencesTaint(s,a)&&l(n,{type:"sql_injection",id:"TAINT001",name:"Tainted SQL Injection (Django)",message:"Tainted user input flows into raw SQL construct without sanitization - SQL injection risk",taintPath:c(s,n)})}const s=t.match(/\btext\s*\(/);if(s){const e=t.indexOf("(",s.index),i=extractBalanced(t,e);isDynamicPyText(i)&&textReferencesTaint(i,a)&&l(n,{type:"sql_injection",id:"TAINT001",name:"Tainted SQL Injection (SQLAlchemy text())",message:"Tainted user input flows into SQLAlchemy text() without sanitization - SQL injection risk",taintPath:c(i,n)})}const o=t.match(/\bmark_safe\s*\(/);if(o){const e=t.indexOf("(",o.index),i=extractBalanced(t,e);textReferencesTaint(i,a)&&l(n,{type:"xss",id:"TAINT002",name:"Tainted XSS via mark_safe()",message:"Tainted user input flows into mark_safe() without sanitization - XSS risk",taintPath:c(i,n)})}const p=t.match(/\{\{\s*([A-Za-z_][\w.]*)[^}]*\|\s*safe\b/);p&&textReferencesTaint(p[1],a)&&l(n,{type:"xss",id:"TAINT002",name:"Tainted XSS via Jinja2 |safe filter",message:"Tainted user input is rendered with the |safe filter without sanitization - XSS risk",taintPath:c(p[1],n)})}return n}const JS_RESOLVE_EXTS=["",".js",".jsx",".ts",".tsx",".mjs",".cjs","/index.js","/index.ts","/index.jsx","/index.tsx"];function resolveImportPath(e,t,n){if(!t||!t.startsWith(".")&&!t.startsWith("/"))return null;const i=path.dirname(e),r=t.startsWith("/")?t:path.resolve(i,t);for(const e of JS_RESOLVE_EXTS){const t=r+e;if(n(t))return t}return null}function defaultFileExists(e){try{return fs.statSync(e).isFile()}catch(e){return!1}}function extractImportBindings(e){const t=[];return walk(e,e=>{if("ImportDeclaration"===e.type&&e.source&&"string"==typeof e.source.value){const n=e.source.value;for(const i of e.specifiers||[])if("ImportDefaultSpecifier"===i.type)t.push({localName:i.local.name,importedName:"default",source:n});else if("ImportNamespaceSpecifier"===i.type)t.push({localName:i.local.name,importedName:"*",source:n});else if("ImportSpecifier"===i.type){const e=i.imported&&(i.imported.name||i.imported.value);t.push({localName:i.local.name,importedName:e||i.local.name,source:n})}}if("VariableDeclarator"===e.type&&e.init){const n=unwrapRequireCall(e.init);if(n)if("Identifier"===e.id.type)t.push({localName:e.id.name,importedName:"*",source:n});else if("ObjectPattern"===e.id.type)for(const i of e.id.properties)if("ObjectProperty"===i.type||"Property"===i.type){const e=i.key&&(i.key.name||i.key.value),r=i.value&&"Identifier"===i.value.type?i.value.name:e;e&&r&&t.push({localName:r,importedName:e,source:n})}}if("AssignmentExpression"===e.type&&"="===e.operator&&"Identifier"===e.left.type){const n=unwrapRequireCall(e.right);n&&t.push({localName:e.left.name,importedName:"*",source:n})}if("CallExpression"===e.type&&"MemberExpression"===e.callee.type&&"Identifier"===e.callee.property.type&&"then"===e.callee.property.name&&"ImportExpression"===e.callee.object.type&&e.callee.object.source&&"string"==typeof e.callee.object.source.value){const n=e.callee.object.source.value,i=e.arguments[0];i&&("ArrowFunctionExpression"===i.type||"FunctionExpression"===i.type)&&i.params[0]&&"Identifier"===i.params[0].type&&t.push({localName:i.params[0].name,importedName:"*",source:n})}}),t}function unwrapRequireCall(e){if(!e||"CallExpression"!==e.type)return null;if("Identifier"!==e.callee.type||"require"!==e.callee.name)return null;const t=e.arguments[0];return t&&"string"==typeof t.value?t.value:null}function extractReExports(e){const t=[];return walk(e,e=>{if("ExportNamedDeclaration"===e.type&&e.source&&"string"==typeof e.source.value){const n=e.source.value;for(const i of e.specifiers||[]){const e=i.local&&(i.local.name||i.local.value),r=i.exported&&(i.exported.name||i.exported.value);e&&r&&t.push({importedName:e,exportedName:r,source:n})}}if("ExportAllDeclaration"===e.type&&e.source&&"string"==typeof e.source.value&&t.push({importedName:"*",exportedName:"*",source:e.source.value}),"AssignmentExpression"===e.type&&"="===e.operator&&"MemberExpression"===e.left.type&&"module.exports"===memberChainToPath(e.left)){const n=unwrapRequireCall(e.right);n&&t.push({importedName:"*",exportedName:"*",source:n})}}),t}function extractLocalExports(e){const t=[];return walk(e,e=>{if("AssignmentExpression"===e.type&&"="===e.operator&&"MemberExpression"===e.left.type&&!e.left.computed&&"Identifier"===e.left.property.type){const n=memberChainToPath(e.left.object);"module.exports"!==n&&"exports"!==n||t.push({exportedName:e.left.property.name,localName:null,inlineNode:e.right})}if("AssignmentExpression"===e.type&&"="===e.operator&&"MemberExpression"===e.left.type&&"module.exports"===memberChainToPath(e.left)&&"ObjectExpression"===e.right.type)for(const n of e.right.properties){if("ObjectProperty"!==n.type&&"Property"!==n.type)continue;const e=n.key&&(n.key.name||n.key.value);e&&(n.value&&"Identifier"===n.value.type?t.push({exportedName:e,localName:n.value.name,inlineNode:null}):t.push({exportedName:e,localName:null,inlineNode:n.value}))}if("ExportNamedDeclaration"===e.type&&e.declaration){const n=e.declaration;if("VariableDeclaration"===n.type)for(const e of n.declarations)"Identifier"===e.id.type&&t.push({exportedName:e.id.name,localName:e.id.name,inlineNode:e.init||null});else"FunctionDeclaration"!==n.type&&"ClassDeclaration"!==n.type||!n.id||t.push({exportedName:n.id.name,localName:n.id.name,inlineNode:null})}if("ExportNamedDeclaration"===e.type&&!e.source)for(const n of e.specifiers||[]){const e=n.local&&(n.local.name||n.local.value),i=n.exported&&(n.exported.name||n.exported.value);e&&i&&t.push({exportedName:i,localName:e,inlineNode:null})}if("ExportDefaultDeclaration"===e.type){const n=e.declaration;n&&("FunctionDeclaration"===n.type||"ClassDeclaration"===n.type)&&n.id?t.push({exportedName:"default",localName:n.id.name,inlineNode:null}):n&&"Identifier"===n.type?t.push({exportedName:"default",localName:n.name,inlineNode:null}):t.push({exportedName:"default",localName:null,inlineNode:n})}}),t}function buildExportTaintMap(e,t){const n=(t=t||{}).readFile||(e=>fs.readFileSync(e,"utf8")),i=t.fileExists||defaultFileExists,r=t.parsedCache||null,a=new Map;for(const t of e){const e=path.extname(t).toLowerCase();if(!JS_EXTS.has(e))continue;let i;try{i=n(t)}catch(e){continue}if(r&&r.set(t,{content:i,ast:null}),i.length>2e4)continue;const s=parseJS(i);r&&(r.get(t).ast=s),s&&a.set(t,{ast:s,content:i})}const s=new Map;for(const e of a.keys())s.set(e,new Map);const o=Math.max(10,a.size+1);let l=!0,c=0;for(;l&&c<o;){l=!1,c++;for(const[e,{ast:t}]of a){const n=s.get(e),r=extractImportBindings(t),a=new Map;for(const t of r){const n=resolveImportPath(e,t.source,i);if(!n||!s.has(n))continue;const r=s.get(n);if("*"===t.importedName)for(const[,e]of r)a.has(t.localName)||a.set(t.localName,e);else r.has(t.importedName)&&a.set(t.localName,r.get(t.importedName))}const{taintedVars:o,origins:c}=collectTaintedVars(t,a),p=extractLocalExports(t);for(const t of p){if(n.has(t.exportedName))continue;let i=null;if(t.localName&&o.has(t.localName)?i=c.get(t.localName)||{desc:t.localName,line:0}:t.inlineNode&&(isTaintedExpr(t.inlineNode,o)||isDynamicTaintedBuild(t.inlineNode,o))&&(i=findTaintOrigin(t.inlineNode,c)||{desc:describeJSSource(t.inlineNode),line:lineOf(t.inlineNode)}),i){const r=i.crossFile?i.sourceFile:e;n.set(t.exportedName,{desc:i.desc,line:i.line,sourceFile:r,crossFile:!0}),l=!0}}const u=extractReExports(t);for(const t of u){const r=resolveImportPath(e,t.source,i);if(!r||!s.has(r))continue;const a=s.get(r);if("*"===t.importedName)for(const[e,t]of a)n.has(e)||(n.set(e,t),l=!0);else a.has(t.importedName)&&!n.has(t.exportedName)&&(n.set(t.exportedName,a.get(t.importedName)),l=!0)}}}return s}function buildImportSeeds(e,t,n,i){const r=new Map,a=extractImportBindings(t);for(const t of a){const a=resolveImportPath(e,t.source,i);if(!a||!n.has(a))continue;const s=n.get(a);if("*"===t.importedName)for(const[,e]of s)r.has(t.localName)||r.set(t.localName,e);else s.has(t.importedName)&&r.set(t.localName,s.get(t.importedName))}return r}function analyzeProject(e,t){const n=(t=t||{}).readFile||(e=>fs.readFileSync(e,"utf8")),i=t.fileExists||defaultFileExists,r=new Map,a=buildExportTaintMap(e,{readFile:n,fileExists:i,parsedCache:r}),s=[];for(const t of e){const e=path.extname(t).toLowerCase(),o=r.get(t);let l;if(o)l=o.content;else try{l=n(t)}catch(e){continue}if(l.length>2e4)(JS_EXTS.has(e)||PY_EXTS.has(e))&&s.push(fileTooLargeIssue(t,l.length));else try{if(JS_EXTS.has(e)){const e=o?o.ast:parseJS(l);if(!e)continue;const n=buildImportSeeds(t,e,a,i);s.push(...analyzeJSTaint(t,l,n.size?n:void 0))}else PY_EXTS.has(e)&&s.push(...analyzePythonTaint(t,l))}catch(e){}}return s}const JS_EXTS=new Set([".js",".jsx",".ts",".tsx",".mjs",".cjs"]),PY_EXTS=new Set([".py",".pyw"]);function analyze(e,t){if(t.length>2e4)return[fileTooLargeIssue(e,t.length)];const n=path.extname(e).toLowerCase();try{if(JS_EXTS.has(n))return analyzeJSTaint(e,t);if(PY_EXTS.has(n))return analyzePythonTaint(e,t)}catch(e){return[]}return[]}module.exports={analyze:analyze,analyzeProject:analyzeProject,analyzeJSTaint:analyzeJSTaint,analyzePythonTaint:analyzePythonTaint,buildExportTaintMap:buildExportTaintMap,buildImportSeeds:buildImportSeeds,resolveImportPath:resolveImportPath,_internal:{walk:walk,isTaintedExpr:isTaintedExpr,isJSSourceExpr:isJSSourceExpr,isSanitizerCall:isSanitizerCall,collectTaintedVars:collectTaintedVars,memberChainToPath:memberChainToPath,isPySourceText:isPySourceText,isDynamicPyText:isDynamicPyText,collectPyTaintedVars:collectPyTaintedVars,resolveImportPath:resolveImportPath,extractImportBindings:extractImportBindings,extractReExports:extractReExports,extractLocalExports:extractLocalExports,parseJS:parseJS}};
+"use strict";const parser=require("@babel/parser"),path=require("path"),fs=require("fs"),{joinLogicalStatements:joinLogicalStatements,extractBalanced:extractBalanced,splitTopLevelArgs:splitTopLevelArgs,isDynamicPyString:isDynamicPyString}=require("./ast-analyzer")._internal,BABEL_PLUGINS=["estree","typescript","jsx","classProperties","decorators-legacy"],MAX_TAINT_FILE_SIZE=2e4,MAX_FIXPOINT_ITERATIONS=10;function walk(e,t){if(e&&"object"==typeof e&&"string"==typeof e.type){t(e);for(const n in e){if("loc"===n||"range"===n||"start"===n||"end"===n)continue;const i=e[n];if(Array.isArray(i))for(const e of i)e&&"object"==typeof e&&"string"==typeof e.type&&walk(e,t);else i&&"object"==typeof i&&"string"==typeof i.type&&walk(i,t)}}}function lineOf(e){return e&&e.loc?e.loc.start.line:0}function snippet(e,t){return!t||t<1||t>e.length?"":e[t-1].trim().substring(0,100)}function mkTaintIssue(e,t,n,i){const r={file:e,line:t,category:"security",type:i.type,severity:i.severity||"critical",id:i.id,name:i.name,message:i.message,code:snippet(n,t),source:"taint",taintPath:i.taintPath};return i.crossFile&&(r.crossFile=!0,r.sourceFile=i.sourceFile),r}function fileTooLargeIssue(e,t){return{file:e,line:0,category:"quality",type:"file_too_large",severity:"info",id:"TAINT003",name:"Taint Analysis Skipped",message:`File too large (${t} chars) - taint analysis skipped (cap: 20000 chars)`,code:"",source:"taint"}}const SANITIZER_FUNCS=new Set(["parseInt","parseFloat","Number","Boolean","encodeURIComponent","encodeURI","escape","sanitize","sanitizeHtml","stripTags"]),SANITIZER_MEMBER=new Set(["sanitize","escape","escapeHtml","stripTags","clean"]),SANITIZER_RECEIVER_NAMES=new Set(["dompurify","sanitizehtml","sanitize-html","html","xss","validator","bleach","markupsafe","purify","sqlstring","sanitizer","striptags","xssfilters","insane"]);function hasKnownSanitizerReceiver(e){let t=e,n=0;for(;t&&n++<20;){if("Identifier"===t.type)return SANITIZER_RECEIVER_NAMES.has(t.name.toLowerCase());if("MemberExpression"!==t.type)return!1;t=t.object}return!1}const JS_SOURCE_PATH_PATTERNS=[{re:/^req\.(params|query|body|headers)(\.|$)/,severity:"critical"},{re:/^request\.(params|query|body|headers)(\.|$)/,severity:"critical"},{re:/^process\.argv/,severity:"critical"},{re:/^process\.env/,severity:"warning"},{re:/^document\.location/,severity:"critical"},{re:/^window\.location/,severity:"critical"},{re:/^location\.(search|hash|href)/,severity:"critical"}];function memberChainToPath(e){const t=[];let n=e,i=0;for(;n&&i++<20;){if("Identifier"===n.type){t.unshift(n.name);break}if("ThisExpression"===n.type){t.unshift("this");break}if("MemberExpression"!==n.type)return null;n.computed||"Identifier"!==n.property.type?t.unshift("*"):t.unshift(n.property.name),n=n.object}return t.length?t.join("."):null}function jsSourceSeverity(e){if(!e)return null;if("CallExpression"===e.type&&"Identifier"===e.callee.type&&"prompt"===e.callee.name)return"critical";if("NewExpression"===e.type&&"Identifier"===e.callee.type&&("URLSearchParams"===e.callee.name||"FormData"===e.callee.name))return"critical";const t=memberChainToPath(e);if(t)for(const e of JS_SOURCE_PATH_PATTERNS)if(e.re.test(t))return e.severity;return null}function isJSSourceExpr(e){return null!==jsSourceSeverity(e)}function describeJSSource(e){return memberChainToPath(e)||("CallExpression"===e.type&&"Identifier"===e.callee.type&&"prompt"===e.callee.name?"prompt()":"NewExpression"===e.type&&"Identifier"===e.callee.type?`new ${e.callee.name}()`:"tainted source")}function isSanitizerCall(e){return!(!e||"CallExpression"!==e.type)&&(!("Identifier"!==e.callee.type||!SANITIZER_FUNCS.has(e.callee.name))||!("MemberExpression"!==e.callee.type||"Identifier"!==e.callee.property.type||!SANITIZER_MEMBER.has(e.callee.property.name))&&hasKnownSanitizerReceiver(e.callee.object))}function isTaintedExpr(e,t,n){if(n=n||0,!e||n>12)return!1;if("Identifier"===e.type)return t.has(e.name);if("CallExpression"===e.type){if(isSanitizerCall(e))return!1;if(isJSSourceExpr(e))return!0;if("MemberExpression"===e.callee.type&&isTaintedExpr(e.callee.object,t,n+1))return!0;for(const i of e.arguments)if(isTaintedExpr(i,t,n+1))return!0;return!1}return"MemberExpression"===e.type?!!isJSSourceExpr(e)||isTaintedExpr(e.object,t,n+1):"NewExpression"===e.type?isJSSourceExpr(e):"BinaryExpression"===e.type&&"+"===e.operator?isTaintedExpr(e.left,t,n+1)||isTaintedExpr(e.right,t,n+1):"TemplateLiteral"===e.type?(e.expressions||[]).some(e=>isTaintedExpr(e,t,n+1)):"AssignmentExpression"===e.type?isTaintedExpr(e.right,t,n+1):"ConditionalExpression"===e.type?isTaintedExpr(e.consequent,t,n+1)||isTaintedExpr(e.alternate,t,n+1):"LogicalExpression"===e.type?isTaintedExpr(e.left,t,n+1)||isTaintedExpr(e.right,t,n+1):!("SequenceExpression"!==e.type||!e.expressions.length)&&isTaintedExpr(e.expressions[e.expressions.length-1],t,n+1)}function isDynamicTaintedBuild(e,t){return!!e&&("TemplateLiteral"===e.type?(e.expressions||[]).some(e=>isTaintedExpr(e,t)):"BinaryExpression"===e.type&&"+"===e.operator&&(isTaintedExpr(e.left,t)||isTaintedExpr(e.right,t)))}function collectFunctionReturnNodes(e){const t=[];return e.body&&"BlockStatement"===e.body.type?function n(i){if(i&&"object"==typeof i&&"string"==typeof i.type&&(i===e||"FunctionDeclaration"!==i.type&&"FunctionExpression"!==i.type&&"ArrowFunctionExpression"!==i.type)){"ReturnStatement"===i.type&&i.argument&&t.push(i.argument);for(const e in i){if("loc"===e||"range"===e||"start"===e||"end"===e)continue;const t=i[e];if(Array.isArray(t))for(const e of t)e&&"object"==typeof e&&"string"==typeof e.type&&n(e);else t&&"object"==typeof t&&"string"==typeof t.type&&n(t)}}}(e.body):e.body&&t.push(e.body),t}function findTaintOrigin(e,t){let n=null;return walk(e,e=>{if(!n)if("Identifier"===e.type&&t.has(e.name))n=t.get(e.name);else{const t=jsSourceSeverity(e);t&&(n={desc:describeJSSource(e),line:lineOf(e),severity:t})}}),n}function collectTaintedVars(e,t){const n=new Set,i=new Map,r=new Set,a=new Map;if(t)for(const[e,r]of t)n.add(e),i.set(e,r);let s=!0,o=0;function l(e){return!(!e||"CallExpression"!==e.type||"Identifier"!==e.callee.type||!r.has(e.callee.name))}for(;s&&o<10;)s=!1,o++,walk(e,e=>{if("FunctionDeclaration"!==e.type&&"FunctionExpression"!==e.type&&"ArrowFunctionExpression"!==e.type)return;const t=e.id&&e.id.name;if(t&&!r.has(t))for(const o of collectFunctionReturnNodes(e))if(isTaintedExpr(o,n)||l(o)){r.add(t),a.set(t,findTaintOrigin(o,i)||(l(o)?a.get(o.callee.name):null)||{desc:describeJSSource(o),line:lineOf(o),severity:jsSourceSeverity(o)||"critical"}),s=!0;break}}),walk(e,e=>{let t=null,r=null;if("VariableDeclarator"===e.type&&e.init&&"Identifier"===e.id.type?(t=e.id.name,r=e.init):"AssignmentExpression"===e.type&&"="===e.operator&&"Identifier"===e.left.type&&(t=e.left.name,r=e.right),!t||n.has(t))return;const o=l(r);if(isTaintedExpr(r,n)||o){n.add(t),s=!0;const l=findTaintOrigin(r,i)||(o?a.get(r.callee.name):null)||{desc:describeJSSource(r),line:lineOf(e),severity:jsSourceSeverity(r)||"critical"};i.set(t,l)}});return{taintedVars:n,origins:i}}const SQL_METHODS=new Set(["query","execute","raw","where"]);function parseJS(e){try{return parser.parse(e,{sourceType:"unambiguous",plugins:BABEL_PLUGINS,allowReturnOutsideFunction:!0,allowImportExportEverywhere:!0,allowAwaitOutsideFunction:!0,allowSuperOutsideMethod:!0,allowUndeclaredExports:!0,errorRecovery:!1}).program}catch(e){return null}}function analyzeJSTaint(e,t,n){const i=[],r=t.split("\n"),a=parseJS(t);if(!a)return i;const{taintedVars:s,origins:o}=collectTaintedVars(a,n),l=new Set;function c(t,n){const a=lineOf(t),s=`${a}:${n.id}`;if(l.has(s))return;l.add(s);const c=findTaintOrigin(t,o);c&&(n=Object.assign({},n,{severity:c.severity||"critical"}),c.crossFile&&(n=Object.assign({},n,{crossFile:!0,sourceFile:c.sourceFile}))),i.push(mkTaintIssue(e,a,r,n))}function p(e){const t=findTaintOrigin(e,o);if(t)return`${t.crossFile?`${t.sourceFile}: `:""}${t.desc} (line ${t.line}) -> sink (line ${lineOf(e)})`}return walk(a,e=>{if("CallExpression"===e.type&&"MemberExpression"===e.callee.type&&"Identifier"===e.callee.property.type&&SQL_METHODS.has(e.callee.property.name)){const t=e.arguments[0];t&&(isDynamicTaintedBuild(t,s)||isTaintedExpr(t,s))&&c(e,{type:"sql_injection",id:"TAINT001",name:"Tainted SQL Injection",message:`Tainted user input flows into .${e.callee.property.name}() without sanitization - SQL injection risk`,taintPath:p(e)})}if("AssignmentExpression"!==e.type||"MemberExpression"!==e.left.type||"Identifier"!==e.left.property.type||"innerHTML"!==e.left.property.name&&"outerHTML"!==e.left.property.name||(isTaintedExpr(e.right,s)||isDynamicTaintedBuild(e.right,s))&&c(e,{type:"xss",id:"TAINT002",name:"Tainted XSS via "+e.left.property.name,message:`Tainted user input flows into ${e.left.property.name} without sanitization - XSS risk`,taintPath:p(e)}),"CallExpression"===e.type&&"MemberExpression"===e.callee.type&&"Identifier"===e.callee.object.type&&"document"===e.callee.object.name&&"Identifier"===e.callee.property.type&&("write"===e.callee.property.name||"writeln"===e.callee.property.name)){const t=e.arguments[0];t&&(isTaintedExpr(t,s)||isDynamicTaintedBuild(t,s))&&c(e,{type:"xss",id:"TAINT002",name:`Tainted XSS via document.${e.callee.property.name}()`,message:`Tainted user input flows into document.${e.callee.property.name}() without sanitization - XSS risk`,taintPath:p(e)})}if("JSXAttribute"===e.type&&e.name&&"dangerouslySetInnerHTML"===e.name.name&&e.value&&"JSXExpressionContainer"===e.value.type){const t=e.value.expression;if(t&&"ObjectExpression"===t.type){const n=t.properties.find(e=>e.key&&("__html"===e.key.name||"__html"===e.key.value));n&&(isTaintedExpr(n.value,s)||isDynamicTaintedBuild(n.value,s))&&c(e,{type:"xss",id:"TAINT002",name:"Tainted XSS via dangerouslySetInnerHTML",message:"Tainted user input flows into dangerouslySetInnerHTML without sanitization - XSS risk",taintPath:p(e)})}}if("CallExpression"===e.type&&"MemberExpression"===e.callee.type&&"Identifier"===e.callee.object.type&&/^res(ponse)?$/.test(e.callee.object.name)&&"Identifier"===e.callee.property.type&&("send"===e.callee.property.name||"write"===e.callee.property.name)){const t=e.arguments[0];t&&"ObjectExpression"!==t.type&&"ArrayExpression"!==t.type&&(isTaintedExpr(t,s)||isDynamicTaintedBuild(t,s))&&c(e,{type:"xss",id:"TAINT002",name:`Reflected XSS via ${e.callee.object.name}.${e.callee.property.name}()`,message:`Tainted user input is reflected via ${e.callee.object.name}.${e.callee.property.name}() without sanitization - reflected XSS risk`,taintPath:p(e)})}}),i}const PY_SOURCE_PATTERNS=[/\brequest\.args\b/,/\brequest\.form\b/,/\brequest\.json\b/,/\brequest\.data\b/,/\brequest\.GET\b/,/\brequest\.POST\b/,/\bsys\.argv\b/,/\bos\.environ\b/,/\binput\s*\(/],PY_SANITIZER_WRAP_RE=/^\s*(int|float|re\.escape|html\.escape|escape|markupsafe\.escape|bleach\.clean)\s*\(/;function describePySource(e){for(const t of PY_SOURCE_PATTERNS){const n=e.match(t);if(n)return n[0]}return"tainted source"}function isPySourceText(e){return PY_SOURCE_PATTERNS.some(t=>t.test(e))}function isDynamicPyText(e){return isDynamicPyString(e)}function collectPyTaintedVars(e){const t=new Set,n=new Map;let i=!0,r=0;const a=/^\s*([A-Za-z_]\w*)\s*=(?!=)\s*([\s\S]+?)\s*$/;for(;i&&r<10;){i=!1,r++;for(const r of e){const e=r.text.split("\n")[0].match(a)||r.text.match(a);if(!e)continue;const s=e[1],o=r.text.slice(r.text.indexOf("=")+1);if(PY_SANITIZER_WRAP_RE.test(o.trim())){t.has(s)&&(t.delete(s),n.delete(s),i=!0);continue}if(t.has(s))continue;let l=!1,c=null;if(isPySourceText(o))l=!0,c=describePySource(o);else for(const e of t)if(new RegExp("\\b"+e+"\\b").test(o)){l=!0,c=n.has(e)?n.get(e).desc:e;break}l&&(t.add(s),n.set(s,{desc:c,line:r.startLine}),i=!0)}}return{taintedVars:t,origins:n}}function textReferencesTaint(e,t){if(isPySourceText(e))return!0;for(const n of t)if(new RegExp("\\b"+n+"\\b").test(e))return!0;return!1}function analyzePythonTaint(e,t){const n=[],i=t.split("\n"),r=joinLogicalStatements(t),{taintedVars:a,origins:s}=collectPyTaintedVars(r),o=new Set;function l(t,r){const a=`${t}:${r.id}`;o.has(a)||(o.add(a),n.push(mkTaintIssue(e,t,i,r)))}function c(e,t){for(const n of a)if(new RegExp("\\b"+n+"\\b").test(e)&&s.has(n)){const e=s.get(n);return`${e.desc} (line ${e.line}) -> sink (line ${t})`}if(isPySourceText(e))return`${describePySource(e)} -> sink (line ${t})`}for(const e of r){const t=e.text,n=e.startLine,i=t.match(/\b(?:cursor|db|conn|connection)\.execute\s*\(/);if(i){const e=t.indexOf("(",i.index),r=extractBalanced(t,e),s=splitTopLevelArgs(r)[0]||"";isDynamicPyText(s)&&textReferencesTaint(s,a)&&l(n,{type:"sql_injection",id:"TAINT001",name:"Tainted SQL Injection",message:"Tainted user input flows into .execute() without sanitization - SQL injection risk",taintPath:c(s,n)})}const r=t.match(/\.(raw|extra)\s*\(|\bRawSQL\s*\(/);if(r){const e=t.indexOf("(",r.index),i=extractBalanced(t,e),s=splitTopLevelArgs(i)[0]||"";(isDynamicPyText(s)||isPySourceText(s))&&textReferencesTaint(s,a)&&l(n,{type:"sql_injection",id:"TAINT001",name:"Tainted SQL Injection (Django)",message:"Tainted user input flows into raw SQL construct without sanitization - SQL injection risk",taintPath:c(s,n)})}const s=t.match(/\btext\s*\(/);if(s){const e=t.indexOf("(",s.index),i=extractBalanced(t,e);isDynamicPyText(i)&&textReferencesTaint(i,a)&&l(n,{type:"sql_injection",id:"TAINT001",name:"Tainted SQL Injection (SQLAlchemy text())",message:"Tainted user input flows into SQLAlchemy text() without sanitization - SQL injection risk",taintPath:c(i,n)})}const o=t.match(/\bmark_safe\s*\(/);if(o){const e=t.indexOf("(",o.index),i=extractBalanced(t,e);textReferencesTaint(i,a)&&l(n,{type:"xss",id:"TAINT002",name:"Tainted XSS via mark_safe()",message:"Tainted user input flows into mark_safe() without sanitization - XSS risk",taintPath:c(i,n)})}const p=t.match(/\{\{\s*([A-Za-z_][\w.]*)[^}]*\|\s*safe\b/);p&&textReferencesTaint(p[1],a)&&l(n,{type:"xss",id:"TAINT002",name:"Tainted XSS via Jinja2 |safe filter",message:"Tainted user input is rendered with the |safe filter without sanitization - XSS risk",taintPath:c(p[1],n)})}return n}const JS_RESOLVE_EXTS=["",".js",".jsx",".ts",".tsx",".mjs",".cjs",path.sep+"index.js",path.sep+"index.ts",path.sep+"index.jsx",path.sep+"index.tsx"];function resolveImportPath(e,t,n){if(!t||!t.startsWith(".")&&!path.isAbsolute(t))return null;const i=path.dirname(e),r=path.isAbsolute(t)?t:path.resolve(i,t);for(const e of JS_RESOLVE_EXTS){const t=r+e;if(n(t))return t}return null}function defaultFileExists(e){try{return fs.statSync(e).isFile()}catch(e){return!1}}function extractImportBindings(e){const t=[];return walk(e,e=>{if("ImportDeclaration"===e.type&&e.source&&"string"==typeof e.source.value){const n=e.source.value;for(const i of e.specifiers||[])if("ImportDefaultSpecifier"===i.type)t.push({localName:i.local.name,importedName:"default",source:n});else if("ImportNamespaceSpecifier"===i.type)t.push({localName:i.local.name,importedName:"*",source:n});else if("ImportSpecifier"===i.type){const e=i.imported&&(i.imported.name||i.imported.value);t.push({localName:i.local.name,importedName:e||i.local.name,source:n})}}if("VariableDeclarator"===e.type&&e.init){const n=unwrapRequireCall(e.init);if(n)if("Identifier"===e.id.type)t.push({localName:e.id.name,importedName:"*",source:n});else if("ObjectPattern"===e.id.type)for(const i of e.id.properties)if("ObjectProperty"===i.type||"Property"===i.type){const e=i.key&&(i.key.name||i.key.value),r=i.value&&"Identifier"===i.value.type?i.value.name:e;e&&r&&t.push({localName:r,importedName:e,source:n})}}if("AssignmentExpression"===e.type&&"="===e.operator&&"Identifier"===e.left.type){const n=unwrapRequireCall(e.right);n&&t.push({localName:e.left.name,importedName:"*",source:n})}if("CallExpression"===e.type&&"MemberExpression"===e.callee.type&&"Identifier"===e.callee.property.type&&"then"===e.callee.property.name&&"ImportExpression"===e.callee.object.type&&e.callee.object.source&&"string"==typeof e.callee.object.source.value){const n=e.callee.object.source.value,i=e.arguments[0];i&&("ArrowFunctionExpression"===i.type||"FunctionExpression"===i.type)&&i.params[0]&&"Identifier"===i.params[0].type&&t.push({localName:i.params[0].name,importedName:"*",source:n})}}),t}function unwrapRequireCall(e){if(!e||"CallExpression"!==e.type)return null;if("Identifier"!==e.callee.type||"require"!==e.callee.name)return null;const t=e.arguments[0];return t&&"string"==typeof t.value?t.value:null}function extractReExports(e){const t=[];return walk(e,e=>{if("ExportNamedDeclaration"===e.type&&e.source&&"string"==typeof e.source.value){const n=e.source.value;for(const i of e.specifiers||[]){const e=i.local&&(i.local.name||i.local.value),r=i.exported&&(i.exported.name||i.exported.value);e&&r&&t.push({importedName:e,exportedName:r,source:n})}}if("ExportAllDeclaration"===e.type&&e.source&&"string"==typeof e.source.value&&t.push({importedName:"*",exportedName:"*",source:e.source.value}),"AssignmentExpression"===e.type&&"="===e.operator&&"MemberExpression"===e.left.type&&"module.exports"===memberChainToPath(e.left)){const n=unwrapRequireCall(e.right);n&&t.push({importedName:"*",exportedName:"*",source:n})}}),t}function extractLocalExports(e){const t=[];return walk(e,e=>{if("AssignmentExpression"===e.type&&"="===e.operator&&"MemberExpression"===e.left.type&&!e.left.computed&&"Identifier"===e.left.property.type){const n=memberChainToPath(e.left.object);"module.exports"!==n&&"exports"!==n||t.push({exportedName:e.left.property.name,localName:null,inlineNode:e.right})}if("AssignmentExpression"===e.type&&"="===e.operator&&"MemberExpression"===e.left.type&&"module.exports"===memberChainToPath(e.left)&&"ObjectExpression"===e.right.type)for(const n of e.right.properties){if("ObjectProperty"!==n.type&&"Property"!==n.type)continue;const e=n.key&&(n.key.name||n.key.value);e&&(n.value&&"Identifier"===n.value.type?t.push({exportedName:e,localName:n.value.name,inlineNode:null}):t.push({exportedName:e,localName:null,inlineNode:n.value}))}if("ExportNamedDeclaration"===e.type&&e.declaration){const n=e.declaration;if("VariableDeclaration"===n.type)for(const e of n.declarations)"Identifier"===e.id.type&&t.push({exportedName:e.id.name,localName:e.id.name,inlineNode:e.init||null});else"FunctionDeclaration"!==n.type&&"ClassDeclaration"!==n.type||!n.id||t.push({exportedName:n.id.name,localName:n.id.name,inlineNode:null})}if("ExportNamedDeclaration"===e.type&&!e.source)for(const n of e.specifiers||[]){const e=n.local&&(n.local.name||n.local.value),i=n.exported&&(n.exported.name||n.exported.value);e&&i&&t.push({exportedName:i,localName:e,inlineNode:null})}if("ExportDefaultDeclaration"===e.type){const n=e.declaration;n&&("FunctionDeclaration"===n.type||"ClassDeclaration"===n.type)&&n.id?t.push({exportedName:"default",localName:n.id.name,inlineNode:null}):n&&"Identifier"===n.type?t.push({exportedName:"default",localName:n.name,inlineNode:null}):t.push({exportedName:"default",localName:null,inlineNode:n})}}),t}function buildExportTaintMap(e,t){const n=(t=t||{}).readFile||(e=>fs.readFileSync(e,"utf8").replace(/\r\n/g,"\n")),i=t.fileExists||defaultFileExists,r=t.parsedCache||null,a=new Map;for(const t of e){const e=path.extname(t).toLowerCase();if(!JS_EXTS.has(e))continue;let i;try{i=n(t)}catch(e){continue}if(r&&r.set(t,{content:i,ast:null}),i.length>2e4)continue;const s=parseJS(i);r&&(r.get(t).ast=s),s&&a.set(t,{ast:s,content:i})}const s=new Map;for(const e of a.keys())s.set(e,new Map);const o=Math.max(10,a.size+1);let l=!0,c=0;for(;l&&c<o;){l=!1,c++;for(const[e,{ast:t}]of a){const n=s.get(e),r=extractImportBindings(t),a=new Map;for(const t of r){const n=resolveImportPath(e,t.source,i);if(!n||!s.has(n))continue;const r=s.get(n);if("*"===t.importedName)for(const[,e]of r)a.has(t.localName)||a.set(t.localName,e);else r.has(t.importedName)&&a.set(t.localName,r.get(t.importedName))}const{taintedVars:o,origins:c}=collectTaintedVars(t,a),p=extractLocalExports(t);for(const t of p){if(n.has(t.exportedName))continue;let i=null;if(t.localName&&o.has(t.localName)?i=c.get(t.localName)||{desc:t.localName,line:0}:t.inlineNode&&(isTaintedExpr(t.inlineNode,o)||isDynamicTaintedBuild(t.inlineNode,o))&&(i=findTaintOrigin(t.inlineNode,c)||{desc:describeJSSource(t.inlineNode),line:lineOf(t.inlineNode)}),i){const r=i.crossFile?i.sourceFile:e;n.set(t.exportedName,{desc:i.desc,line:i.line,sourceFile:r,crossFile:!0}),l=!0}}const u=extractReExports(t);for(const t of u){const r=resolveImportPath(e,t.source,i);if(!r||!s.has(r))continue;const a=s.get(r);if("*"===t.importedName)for(const[e,t]of a)n.has(e)||(n.set(e,t),l=!0);else a.has(t.importedName)&&!n.has(t.exportedName)&&(n.set(t.exportedName,a.get(t.importedName)),l=!0)}}}return s}function buildImportSeeds(e,t,n,i){const r=new Map,a=extractImportBindings(t);for(const t of a){const a=resolveImportPath(e,t.source,i);if(!a||!n.has(a))continue;const s=n.get(a);if("*"===t.importedName)for(const[,e]of s)r.has(t.localName)||r.set(t.localName,e);else s.has(t.importedName)&&r.set(t.localName,s.get(t.importedName))}return r}function analyzeProject(e,t){const n=(t=t||{}).readFile||(e=>fs.readFileSync(e,"utf8").replace(/\r\n/g,"\n")),i=t.fileExists||defaultFileExists,r=new Map,a=buildExportTaintMap(e,{readFile:n,fileExists:i,parsedCache:r}),s=[];for(const t of e){const e=path.extname(t).toLowerCase(),o=r.get(t);let l;if(o)l=o.content;else try{l=n(t)}catch(e){continue}if(l.length>2e4)(JS_EXTS.has(e)||PY_EXTS.has(e))&&s.push(fileTooLargeIssue(t,l.length));else try{if(JS_EXTS.has(e)){const e=o?o.ast:parseJS(l);if(!e)continue;const n=buildImportSeeds(t,e,a,i);s.push(...analyzeJSTaint(t,l,n.size?n:void 0))}else PY_EXTS.has(e)&&s.push(...analyzePythonTaint(t,l))}catch(e){}}return s}const JS_EXTS=new Set([".js",".jsx",".ts",".tsx",".mjs",".cjs"]),PY_EXTS=new Set([".py",".pyw"]);function analyze(e,t){if(t.length>2e4)return[fileTooLargeIssue(e,t.length)];const n=path.extname(e).toLowerCase();try{if(JS_EXTS.has(n))return analyzeJSTaint(e,t);if(PY_EXTS.has(n))return analyzePythonTaint(e,t)}catch(e){return[]}return[]}module.exports={analyze:analyze,analyzeProject:analyzeProject,analyzeJSTaint:analyzeJSTaint,analyzePythonTaint:analyzePythonTaint,buildExportTaintMap:buildExportTaintMap,buildImportSeeds:buildImportSeeds,resolveImportPath:resolveImportPath,_internal:{walk:walk,isTaintedExpr:isTaintedExpr,isJSSourceExpr:isJSSourceExpr,isSanitizerCall:isSanitizerCall,collectTaintedVars:collectTaintedVars,memberChainToPath:memberChainToPath,isPySourceText:isPySourceText,isDynamicPyText:isDynamicPyText,collectPyTaintedVars:collectPyTaintedVars,resolveImportPath:resolveImportPath,extractImportBindings:extractImportBindings,extractReExports:extractReExports,extractLocalExports:extractLocalExports,parseJS:parseJS}};

package/dist/packages/scanner/tech-debt-analyzer.js

@@ -1 +1 @@
-const fs=require("fs"),path=require("path"),CodeScanner=require("./code-scanner"),DependencyGraph=require("./dependency-graph"),DriftDetector=require("./drift-detector"),WidgetGenerator=require("./widget-generator"),SecretScanner=require("./secret-scanner");function formatWidgetComment(e,t){const s=path.extname(t).toLowerCase();return".py"===s?e.replace(/^\/\*\*\n/,"").replace(/\s*\*\/\s*$/,"").split("\n").map(e=>e.replace(/^\s*\*\s?/,"# ")).join("\n"):".go"===s?e.replace(/^\/\*\*\n/,"").replace(/\s*\*\/\s*$/,"").split("\n").map(e=>e.replace(/^\s*\*\s?/,"// ")).join("\n"):e}class TechDebtAnalyzer{constructor(e={}){this.config={rootPath:e.rootPath||process.cwd(),...e},this.scanner=new CodeScanner(this.config),this.depGraph=new DependencyGraph(this.config),this.driftDetector=new DriftDetector(this.config),this.widgetGen=new WidgetGenerator({...this.config,dryRun:!0}),this.secretScanner=new SecretScanner(this.config)}async analyze(e){const t=Date.now();await this.depGraph.build(e),this.widgetGen.dependencyGraph=this.depGraph;const s=await this.scanner.scanFiles(e);await this.driftDetector.detectAll();let i={issues:[]};try{i=await this.secretScanner.scanFiles(e)}catch(e){}const a={scores:{overall:100,security:100,architecture:100,codeQuality:100,documentation:100,dependencies:100,motherCode:100},fixable:[],manual:[],info:[],stats:{totalFiles:e.length,totalIssues:0,fixableCount:0,manualCount:0,estimatedFixTime:"0 minutes",scanTime:0},categories:{}},o=[];for(const e of s.issues||[])(e.id?.startsWith("SEC")||"security"===e.category)&&o.push({file:path.relative(this.config.rootPath,e.file),...e,fixable:"SEC001"===e.id||"SEC002"===e.id,fixAction:"SEC001"===e.id||"SEC002"===e.id?"extract_to_env":null});for(const e of i.issues||[])o.push({file:e.file?path.relative(this.config.rootPath,e.file):e.file||"unknown",id:e.id,category:"security",severity:e.severity||"critical",message:e.message||e.type,type:e.type,line:e.line,fixable:!1,fixAction:null});a.scores.security=Math.max(0,100-25*o.filter(e=>"critical"===e.severity).length-10*o.filter(e=>"high"===e.severity).length),a.categories.security={score:a.scores.security,issues:o,label:"Security",icon:"shield"};const r=[],n=this.depGraph.circularDeps||[],c=this.depGraph.getOrphanFiles()||[],l=this.depGraph.getMostCriticalFiles(5)||[];for(const e of n)r.push({type:"circular_dependency",severity:"high",files:Array.isArray(e)?e.map(e=>path.relative(this.config.rootPath,e)):[String(e)],message:"Circular dependency detected",fixable:!0,fixAction:"break_circular",suggestion:"Extract shared code into a new module to break the cycle"});for(const e of c){const t="string"==typeof e?e:e.file||e.path||String(e);r.push({type:"orphan_file",severity:"low",file:path.relative(this.config.rootPath,t),message:"File has no imports and no exports consumed — potential dead code",fixable:!0,fixAction:"flag_for_removal",suggestion:"Review and remove if truly unused"})}for(const e of l){const t="string"==typeof e?e:e.file||e.path||String(e),s="object"==typeof e&&(e.dependents||e.score||e.count)||0;s>10&&r.push({type:"god_file",severity:"medium",file:path.relative(this.config.rootPath,t),dependents:s,message:`${s} files depend on this — high blast radius if changed`,fixable:!1,suggestion:"Consider splitting into smaller, focused modules"})}a.scores.architecture=Math.max(0,100-15*n.length-1*c.length-5*r.filter(e=>"god_file"===e.type).length),a.categories.architecture={score:a.scores.architecture,issues:r,label:"Architecture",icon:"building"};const f=[],u=new(require("./hallucination-detector"))(this.config),d=await u.scan(e);for(const e of d.deprecatedAPIs||[])f.push({file:path.relative(this.config.rootPath,e.file),type:"deprecated_api",severity:"high",message:`${e.name} — deprecated since ${e.since}`,fixable:!0,fixAction:"update_deprecated_api",suggestion:e.fix});for(const e of d.aiSmells||[])e.message&&e.message.includes("localhost")&&f.push({file:path.relative(this.config.rootPath,e.file),type:"hardcoded_localhost",severity:"medium",message:e.message,fixable:!0,fixAction:"wrap_localhost_url",suggestion:"Use environment variable with localhost fallback"});for(const e of s.issues||[])(e.id?.startsWith("QUAL")||"quality"===e.category||"maintainability"===e.category)&&f.push({file:path.relative(this.config.rootPath,e.file),...e,fixable:["QUAL001","QUAL003","QUAL005"].includes(e.id),fixAction:"QUAL001"===e.id?"remove_console_log":null});a.scores.codeQuality=Math.max(0,100-5*f.filter(e=>"high"===e.severity).length-2*f.filter(e=>"medium"===e.severity).length),a.categories.codeQuality={score:a.scores.codeQuality,issues:f,label:"Code Quality",icon:"code"};const h=[];let p=0,g=0,m=0;for(const t of e)try{const e=fs.readFileSync(t,"utf-8");if(/\/\*\*[\s\S]*?@(purpose|module|layer)[\s\S]*?\*\//.test(e)){p++;const e=await this.driftDetector.analyzeFile(t);if(e.issues&&e.issues.length>0){m++;for(const s of e.issues)h.push({file:path.relative(this.config.rootPath,t),...s,fixable:!0,fixAction:"regenerate_widget"})}}else g++,h.push({file:path.relative(this.config.rootPath,t),type:"missing_mother_code",severity:"info",message:"No Mother Code DNA — file lacks contextual awareness",fixable:!0,fixAction:"inject_widget"})}catch(e){}const $=e.length>0?Math.round(p/e.length*100):0;a.scores.motherCode=Math.min(100,$+(m>0?-10:0)),a.scores.documentation=a.scores.motherCode,a.categories.motherCode={score:a.scores.motherCode,coverage:$,annotated:p,missing:g,drifted:m,issues:h,label:"Mother Code",icon:"dna"},this.depGraph.getModuleSummary&&this.depGraph.getModuleSummary(),a.scores.dependencies=Math.max(0,100-10*n.length-.5*c.length),a.categories.dependencies={score:a.scores.dependencies,issues:[],label:"Dependencies",icon:"link"};a.scores.overall=Math.round(.25*a.scores.security+.2*a.scores.architecture+.2*a.scores.codeQuality+.2*a.scores.motherCode+.15*a.scores.dependencies);for(const e of Object.values(a.categories))for(const t of e.issues||[])a.stats.totalIssues++,t.fixable?(a.fixable.push(t),a.stats.fixableCount++):"info"===t.severity?a.info.push(t):(a.manual.push(t),a.stats.manualCount++);const y=.5*a.stats.fixableCount+15*a.stats.manualCount;return a.stats.estimatedFixTime=y<60?`${Math.round(y)} minutes`:`${Math.round(y/60)} hours`,a.stats.scanTime=Date.now()-t,a}async fix(e,t={}){const s=await this.analyze(e),i=[],a=[],o=path.resolve(this.config.rootPath);for(const e of s.fixable)if(t.dryRun)i.push({...e,status:"would_fix"});else try{const t=path.resolve(this.config.rootPath,e.file);if(!t.startsWith(o+path.sep)&&t!==o){i.push({...e,status:"skipped",reason:"Path escapes project root — blocked for safety"});continue}switch(e.fixAction){case"inject_widget":{const t=path.resolve(this.config.rootPath,e.file),s=fs.readFileSync(t,"utf-8"),a=await this.widgetGen.generateWidget(t,s);if(a&&a.widgetString){const o=formatWidgetComment(a.widgetString,t);fs.writeFileSync(t,o+"\n\n"+s,"utf-8"),i.push({...e,status:"fixed"})}break}case"regenerate_widget":{const t=path.resolve(this.config.rootPath,e.file),s=fs.readFileSync(t,"utf-8").replace(/\/\*\*[\s\S]*?@(purpose|module|layer)[\s\S]*?\*\/\s*\n?\s*\n?/,""),a=await this.widgetGen.generateWidget(t,s);if(a&&a.widgetString){const o=formatWidgetComment(a.widgetString,t);fs.writeFileSync(t,o+"\n\n"+s,"utf-8"),i.push({...e,status:"fixed"})}break}case"remove_console_log":{const t=path.resolve(this.config.rootPath,e.file);let s=fs.readFileSync(t,"utf-8");const a=s;s=s.replace(/^\s*console\.log\(.*?\);\s*$/gm,""),s!==a&&(fs.writeFileSync(t,s,"utf-8"),i.push({...e,status:"fixed"}));break}case"update_deprecated_api":{const t=path.resolve(this.config.rootPath,e.file);let s=fs.readFileSync(t,"utf-8");const a=s;s=s.replace(/url\.parse\(([^)]+)\)/g,"new URL($1)"),s=s.replace(/new Buffer\(([^)]+)\)/g,(e,t)=>{const s=t.trim();return/\d/.test(s)&&/^[\d\s+\-*/%().]+$/.test(s)?`Buffer.alloc(${s})`:`Buffer.from(${t})`}),s=s.replace(/require\(['"]sys['"]\)/g,"require('util')"),s=s.replace(/util\.isArray\(/g,"Array.isArray("),s=s.replace(/fs\.exists\(([^,]+),\s*/g,"fs.access($1, "),s!==a?(fs.writeFileSync(t,s,"utf-8"),i.push({...e,status:"fixed",detail:"Replaced deprecated API with modern equivalent"})):i.push({...e,status:"skipped",reason:"Pattern not matched for auto-replacement"});break}case"wrap_localhost_url":{const t=path.resolve(this.config.rootPath,e.file);let s=fs.readFileSync(t,"utf-8");const a=s;s=s.replace(/(['"`])(https?:\/\/localhost:\d{2,5}(?:\/[^'"`]*)?)\1/g,(e,t,s)=>{const i=s.match(/:(\d+)/);return`(process.env.SERVICE_URL_${i?i[1]:"PORT"} || ${t}${s}${t})`}),s!==a?(fs.writeFileSync(t,s,"utf-8"),i.push({...e,status:"fixed",detail:"Wrapped localhost URL in env var fallback"})):i.push({...e,status:"skipped",reason:"Pattern not matched for auto-replacement"});break}case"extract_to_env":i.push({...e,status:"flagged_for_review",reason:"Secrets require manual extraction to .env"});break;case"flag_for_removal":i.push({...e,status:"confirmed_orphan",reason:"Verified no imports. Safe to remove manually."});break;default:i.push({...e,status:"skipped",reason:"No auto-fix available"})}}catch(t){a.push({...e,status:"failed",error:t.message})}return{totalFixable:s.fixable.length,fixed:i.filter(e=>"fixed"===e.status).length,flagged:i.filter(e=>"flagged_for_review"===e.status||"confirmed_orphan"===e.status).length,skipped:i.filter(e=>"skipped"===e.status).length,failed:a.length,fixes:i,failures:a,debtBefore:s.scores.overall,...t.dryRun?{}:{note:"Run thuban report again to see updated scores"}}}formatReport(e){const t="",s="",i="",a="",o="",r="",n="",c=e=>{const s=Math.round(e/5),r=20-s,c=e>=80?a:e>=60?o:i;return`${c}${"█".repeat(s)}${n}${"░".repeat(r)}${t} ${c}${e}%${t}`};let l="";var f;l+=`\n${r}  ╔══════════════════════════════════════════════╗${t}\n`,l+=`${r}  ║${s}         THUBAN TECH DEBT REPORT               ${t}${r}║${t}\n`,l+=`${r}  ╚══════════════════════════════════════════════╝${t}\n\n`,l+=`  ${s}Overall Health:${t}  ${c(e.scores.overall)}  Grade: ${f=e.scores.overall,f>=90?`${a}A${t}`:f>=80?`${a}B${t}`:f>=70?`${o}C${t}`:f>=60?`${o}D${t}`:`${i}F${t}`}\n\n`,l+=`  ${s}Category Breakdown:${t}\n\n`;const u=[["Security",e.scores.security,"shield"],["Architecture",e.scores.architecture,"building"],["Code Quality",e.scores.codeQuality,"code"],["Mother Code",e.scores.motherCode,"dna"],["Dependencies",e.scores.dependencies,"link"]];for(const[e,t]of u)l+=`  ${e.padEnd(18)} ${c(t)}\n`;if(l+="\n",e.categories.motherCode){const n=e.categories.motherCode;l+=`  ${s}Mother Code Coverage:${t}\n`,l+=`  Annotated: ${r}${n.annotated}${t}  |  Missing: ${o}${n.missing}${t}  |  Drifted: ${n.drifted>0?i:a}${n.drifted}${t}  |  Coverage: ${n.coverage>=80?a:n.coverage>=40?o:i}${n.coverage}%${t}\n\n`}if(l+=`  ${s}Tech Debt Summary:${t}\n`,l+=`  Total issues:     ${s}${e.stats.totalIssues}${t}\n`,l+=`  Auto-fixable:     ${a}${e.stats.fixableCount}${t}  ${n}← run 'thuban fix' to resolve${t}\n`,l+=`  Manual review:    ${o}${e.stats.manualCount}${t}\n`,l+=`  Est. manual time: ${n}${e.stats.estimatedFixTime}${t}\n`,l+=`  Scan time:        ${n}${e.stats.scanTime}ms${t}\n\n`,e.fixable.length>0){l+=`  ${s}Top Auto-Fixable Items:${t}\n`;const i={};for(const t of e.fixable){const e=t.fixAction||"unknown";i[e]||(i[e]={count:0,label:e}),i[e].count++}for(const[e,o]of Object.entries(i).sort((e,t)=>t[1].count-e[1].count))l+=`    ${a}→${t} ${{inject_widget:"Inject Mother Code DNA",regenerate_widget:"Update stale annotations",remove_console_log:"Remove debug console.logs",extract_to_env:"Extract hardcoded secrets to .env",flag_for_removal:"Remove orphan files",break_circular:"Break circular dependencies"}[e]||e}: ${s}${o.count}${t} items\n`;l+=`\n  ${r}Run 'thuban fix [path]' to auto-fix all ${e.stats.fixableCount} items${t}\n\n`}if(e.manual.length>0){l+=`  ${s}Manual Review Required:${t}\n`;for(const s of e.manual.slice(0,5))l+=`  ${"critical"===s.severity||"high"===s.severity?i:o}${(s.severity||"").toUpperCase().padEnd(8)}${t} ${r}${s.file||""}${t}\n`,l+=`  ${n}         ${s.message||s.suggestion||""}${t}\n`;e.manual.length>5&&(l+=`  ${n}  ... and ${e.manual.length-5} more${t}\n`),l+="\n"}return l}toJSON(e){return{timestamp:(new Date).toISOString(),scores:e.scores,categories:Object.fromEntries(Object.entries(e.categories).map(([e,t])=>[e,{score:t.score,label:t.label,issueCount:t.issues?.length||0,coverage:t.coverage}])),stats:e.stats,fixable:e.fixable.map(e=>({file:e.file,action:e.fixAction,severity:e.severity})),manual:e.manual.map(e=>({file:e.file,message:e.message,severity:e.severity}))}}}module.exports=TechDebtAnalyzer;
+const fs=require("fs"),path=require("path"),CodeScanner=require("./code-scanner"),DependencyGraph=require("./dependency-graph"),DriftDetector=require("./drift-detector"),WidgetGenerator=require("./widget-generator"),SecretScanner=require("./secret-scanner");function formatWidgetComment(e,t){const s=path.extname(t).toLowerCase();return".py"===s?e.replace(/^\/\*\*\r?\n/,"").replace(/\s*\*\/\s*$/,"").split(/\r?\n/).map(e=>e.replace(/^\s*\*\s?/,"# ")).join("\n"):".go"===s?e.replace(/^\/\*\*\r?\n/,"").replace(/\s*\*\/\s*$/,"").split(/\r?\n/).map(e=>e.replace(/^\s*\*\s?/,"// ")).join("\n"):e}class TechDebtAnalyzer{constructor(e={}){this.config={rootPath:e.rootPath||process.cwd(),...e},this.scanner=new CodeScanner(this.config),this.depGraph=new DependencyGraph(this.config),this.driftDetector=new DriftDetector(this.config),this.widgetGen=new WidgetGenerator({...this.config,dryRun:!0}),this.secretScanner=new SecretScanner(this.config)}async analyze(e){const t=Date.now();await this.depGraph.build(e),this.widgetGen.dependencyGraph=this.depGraph;const s=await this.scanner.scanFiles(e);await this.driftDetector.detectAll();let i={issues:[]};try{i=await this.secretScanner.scanFiles(e)}catch(e){}const a={scores:{overall:100,security:100,architecture:100,codeQuality:100,documentation:100,dependencies:100,motherCode:100},fixable:[],manual:[],info:[],stats:{totalFiles:e.length,totalIssues:0,fixableCount:0,manualCount:0,estimatedFixTime:"0 minutes",scanTime:0},categories:{}},r=[];for(const e of s.issues||[])(e.id?.startsWith("SEC")||"security"===e.category)&&r.push({file:path.relative(this.config.rootPath,e.file),...e,fixable:"SEC001"===e.id||"SEC002"===e.id,fixAction:"SEC001"===e.id||"SEC002"===e.id?"extract_to_env":null});for(const e of i.issues||[])r.push({file:e.file?path.relative(this.config.rootPath,e.file):e.file||"unknown",id:e.id,category:"security",severity:e.severity||"critical",message:e.message||e.type,type:e.type,line:e.line,fixable:!1,fixAction:null});a.scores.security=Math.max(0,100-25*r.filter(e=>"critical"===e.severity).length-10*r.filter(e=>"high"===e.severity).length),a.categories.security={score:a.scores.security,issues:r,label:"Security",icon:"shield"};const o=[],n=this.depGraph.circularDeps||[],c=this.depGraph.getOrphanFiles()||[],l=this.depGraph.getMostCriticalFiles(5)||[];for(const e of n)o.push({type:"circular_dependency",severity:"high",files:Array.isArray(e)?e.map(e=>path.relative(this.config.rootPath,e)):[String(e)],message:"Circular dependency detected",fixable:!0,fixAction:"break_circular",suggestion:"Extract shared code into a new module to break the cycle"});for(const e of c){const t="string"==typeof e?e:e.file||e.path||String(e);o.push({type:"orphan_file",severity:"low",file:path.relative(this.config.rootPath,t),message:"File has no imports and no exports consumed — potential dead code",fixable:!0,fixAction:"flag_for_removal",suggestion:"Review and remove if truly unused"})}for(const e of l){const t="string"==typeof e?e:e.file||e.path||String(e),s="object"==typeof e&&(e.dependents||e.score||e.count)||0;s>10&&o.push({type:"god_file",severity:"medium",file:path.relative(this.config.rootPath,t),dependents:s,message:`${s} files depend on this — high blast radius if changed`,fixable:!1,suggestion:"Consider splitting into smaller, focused modules"})}a.scores.architecture=Math.max(0,100-15*n.length-1*c.length-5*o.filter(e=>"god_file"===e.type).length),a.categories.architecture={score:a.scores.architecture,issues:o,label:"Architecture",icon:"building"};const f=[],u=new(require("./hallucination-detector"))(this.config),d=await u.scan(e);for(const e of d.deprecatedAPIs||[])f.push({file:path.relative(this.config.rootPath,e.file),type:"deprecated_api",severity:"high",message:`${e.name} — deprecated since ${e.since}`,fixable:!0,fixAction:"update_deprecated_api",suggestion:e.fix});for(const e of d.aiSmells||[])e.message&&e.message.includes("localhost")&&f.push({file:path.relative(this.config.rootPath,e.file),type:"hardcoded_localhost",severity:"medium",message:e.message,fixable:!0,fixAction:"wrap_localhost_url",suggestion:"Use environment variable with localhost fallback"});for(const e of s.issues||[])(e.id?.startsWith("QUAL")||"quality"===e.category||"maintainability"===e.category)&&f.push({file:path.relative(this.config.rootPath,e.file),...e,fixable:["QUAL001","QUAL003","QUAL005"].includes(e.id),fixAction:"QUAL001"===e.id?"remove_console_log":null});a.scores.codeQuality=Math.max(0,100-5*f.filter(e=>"high"===e.severity).length-2*f.filter(e=>"medium"===e.severity).length),a.categories.codeQuality={score:a.scores.codeQuality,issues:f,label:"Code Quality",icon:"code"};const h=[];let p=0,g=0,m=0;for(const t of e)try{const e=fs.readFileSync(t,"utf-8").replace(/\r\n/g,"\n");if(/\/\*\*[\s\S]*?@(purpose|module|layer)[\s\S]*?\*\//.test(e)){p++;const e=await this.driftDetector.analyzeFile(t);if(e.issues&&e.issues.length>0){m++;for(const s of e.issues)h.push({file:path.relative(this.config.rootPath,t),...s,fixable:!0,fixAction:"regenerate_widget"})}}else g++,h.push({file:path.relative(this.config.rootPath,t),type:"missing_mother_code",severity:"info",message:"No Mother Code DNA — file lacks contextual awareness",fixable:!0,fixAction:"inject_widget"})}catch(e){}const $=e.length>0?Math.round(p/e.length*100):0;a.scores.motherCode=Math.min(100,$+(m>0?-10:0)),a.scores.documentation=a.scores.motherCode,a.categories.motherCode={score:a.scores.motherCode,coverage:$,annotated:p,missing:g,drifted:m,issues:h,label:"Mother Code",icon:"dna"},this.depGraph.getModuleSummary&&this.depGraph.getModuleSummary(),a.scores.dependencies=Math.max(0,100-10*n.length-.5*c.length),a.categories.dependencies={score:a.scores.dependencies,issues:[],label:"Dependencies",icon:"link"};a.scores.overall=Math.round(.25*a.scores.security+.2*a.scores.architecture+.2*a.scores.codeQuality+.2*a.scores.motherCode+.15*a.scores.dependencies);for(const e of Object.values(a.categories))for(const t of e.issues||[])a.stats.totalIssues++,t.fixable?(a.fixable.push(t),a.stats.fixableCount++):"info"===t.severity?a.info.push(t):(a.manual.push(t),a.stats.manualCount++);const y=.5*a.stats.fixableCount+15*a.stats.manualCount;return a.stats.estimatedFixTime=y<60?`${Math.round(y)} minutes`:`${Math.round(y/60)} hours`,a.stats.scanTime=Date.now()-t,a}async fix(e,t={}){const s=await this.analyze(e),i=[],a=[],r=path.resolve(this.config.rootPath);for(const e of s.fixable)if(t.dryRun)i.push({...e,status:"would_fix"});else try{const t=path.resolve(this.config.rootPath,e.file);if(!t.startsWith(r+path.sep)&&t!==r){i.push({...e,status:"skipped",reason:"Path escapes project root — blocked for safety"});continue}switch(e.fixAction){case"inject_widget":{const t=path.resolve(this.config.rootPath,e.file),s=fs.readFileSync(t,"utf-8").replace(/\r\n/g,"\n"),a=await this.widgetGen.generateWidget(t,s);if(a&&a.widgetString){const r=formatWidgetComment(a.widgetString,t);fs.writeFileSync(t,r+"\n\n"+s,"utf-8"),i.push({...e,status:"fixed"})}break}case"regenerate_widget":{const t=path.resolve(this.config.rootPath,e.file),s=fs.readFileSync(t,"utf-8").replace(/\/\*\*[\s\S]*?@(purpose|module|layer)[\s\S]*?\*\/\s*\n?\s*\n?/,""),a=await this.widgetGen.generateWidget(t,s);if(a&&a.widgetString){const r=formatWidgetComment(a.widgetString,t);fs.writeFileSync(t,r+"\n\n"+s,"utf-8"),i.push({...e,status:"fixed"})}break}case"remove_console_log":{const t=path.resolve(this.config.rootPath,e.file);let s=fs.readFileSync(t,"utf-8").replace(/\r\n/g,"\n");const a=s;s=s.replace(/^\s*console\.log\(.*?\);\s*$/gm,""),s!==a&&(fs.writeFileSync(t,s,"utf-8"),i.push({...e,status:"fixed"}));break}case"update_deprecated_api":{const t=path.resolve(this.config.rootPath,e.file);let s=fs.readFileSync(t,"utf-8").replace(/\r\n/g,"\n");const a=s;s=s.replace(/url\.parse\(([^)]+)\)/g,"new URL($1)"),s=s.replace(/new Buffer\(([^)]+)\)/g,(e,t)=>{const s=t.trim();return/\d/.test(s)&&/^[\d\s+\-*/%().]+$/.test(s)?`Buffer.alloc(${s})`:`Buffer.from(${t})`}),s=s.replace(/require\(['"]sys['"]\)/g,"require('util')"),s=s.replace(/util\.isArray\(/g,"Array.isArray("),s=s.replace(/fs\.exists\(([^,]+),\s*/g,"fs.access($1, "),s!==a?(fs.writeFileSync(t,s,"utf-8"),i.push({...e,status:"fixed",detail:"Replaced deprecated API with modern equivalent"})):i.push({...e,status:"skipped",reason:"Pattern not matched for auto-replacement"});break}case"wrap_localhost_url":{const t=path.resolve(this.config.rootPath,e.file);let s=fs.readFileSync(t,"utf-8").replace(/\r\n/g,"\n");const a=s;s=s.replace(/(['"`])(https?:\/\/localhost:\d{2,5}(?:\/[^'"`]*)?)\1/g,(e,t,s)=>{const i=s.match(/:(\d+)/);return`(process.env.SERVICE_URL_${i?i[1]:"PORT"} || ${t}${s}${t})`}),s!==a?(fs.writeFileSync(t,s,"utf-8"),i.push({...e,status:"fixed",detail:"Wrapped localhost URL in env var fallback"})):i.push({...e,status:"skipped",reason:"Pattern not matched for auto-replacement"});break}case"extract_to_env":i.push({...e,status:"flagged_for_review",reason:"Secrets require manual extraction to .env"});break;case"flag_for_removal":i.push({...e,status:"confirmed_orphan",reason:"Verified no imports. Safe to remove manually."});break;default:i.push({...e,status:"skipped",reason:"No auto-fix available"})}}catch(t){a.push({...e,status:"failed",error:t.message})}return{totalFixable:s.fixable.length,fixed:i.filter(e=>"fixed"===e.status).length,flagged:i.filter(e=>"flagged_for_review"===e.status||"confirmed_orphan"===e.status).length,skipped:i.filter(e=>"skipped"===e.status).length,failed:a.length,fixes:i,failures:a,debtBefore:s.scores.overall,...t.dryRun?{}:{note:"Run thuban report again to see updated scores"}}}formatReport(e){const t="",s="",i="",a="",r="",o="",n="",c=e=>{const s=Math.round(e/5),o=20-s,c=e>=80?a:e>=60?r:i;return`${c}${"█".repeat(s)}${n}${"░".repeat(o)}${t} ${c}${e}%${t}`};let l="";var f;l+=`\n${o}  ╔══════════════════════════════════════════════╗${t}\n`,l+=`${o}  ║${s}         THUBAN TECH DEBT REPORT               ${t}${o}║${t}\n`,l+=`${o}  ╚══════════════════════════════════════════════╝${t}\n\n`,l+=`  ${s}Overall Health:${t}  ${c(e.scores.overall)}  Grade: ${f=e.scores.overall,f>=90?`${a}A${t}`:f>=80?`${a}B${t}`:f>=70?`${r}C${t}`:f>=60?`${r}D${t}`:`${i}F${t}`}\n\n`,l+=`  ${s}Category Breakdown:${t}\n\n`;const u=[["Security",e.scores.security,"shield"],["Architecture",e.scores.architecture,"building"],["Code Quality",e.scores.codeQuality,"code"],["Mother Code",e.scores.motherCode,"dna"],["Dependencies",e.scores.dependencies,"link"]];for(const[e,t]of u)l+=`  ${e.padEnd(18)} ${c(t)}\n`;if(l+="\n",e.categories.motherCode){const n=e.categories.motherCode;l+=`  ${s}Mother Code Coverage:${t}\n`,l+=`  Annotated: ${o}${n.annotated}${t}  |  Missing: ${r}${n.missing}${t}  |  Drifted: ${n.drifted>0?i:a}${n.drifted}${t}  |  Coverage: ${n.coverage>=80?a:n.coverage>=40?r:i}${n.coverage}%${t}\n\n`}if(l+=`  ${s}Tech Debt Summary:${t}\n`,l+=`  Total issues:     ${s}${e.stats.totalIssues}${t}\n`,l+=`  Auto-fixable:     ${a}${e.stats.fixableCount}${t}  ${n}← run 'thuban fix' to resolve${t}\n`,l+=`  Manual review:    ${r}${e.stats.manualCount}${t}\n`,l+=`  Est. manual time: ${n}${e.stats.estimatedFixTime}${t}\n`,l+=`  Scan time:        ${n}${e.stats.scanTime}ms${t}\n\n`,e.fixable.length>0){l+=`  ${s}Top Auto-Fixable Items:${t}\n`;const i={};for(const t of e.fixable){const e=t.fixAction||"unknown";i[e]||(i[e]={count:0,label:e}),i[e].count++}for(const[e,r]of Object.entries(i).sort((e,t)=>t[1].count-e[1].count))l+=`    ${a}→${t} ${{inject_widget:"Inject Mother Code DNA",regenerate_widget:"Update stale annotations",remove_console_log:"Remove debug console.logs",extract_to_env:"Extract hardcoded secrets to .env",flag_for_removal:"Remove orphan files",break_circular:"Break circular dependencies"}[e]||e}: ${s}${r.count}${t} items\n`;l+=`\n  ${o}Run 'thuban fix [path]' to auto-fix all ${e.stats.fixableCount} items${t}\n\n`}if(e.manual.length>0){l+=`  ${s}Manual Review Required:${t}\n`;for(const s of e.manual.slice(0,5))l+=`  ${"critical"===s.severity||"high"===s.severity?i:r}${(s.severity||"").toUpperCase().padEnd(8)}${t} ${o}${s.file||""}${t}\n`,l+=`  ${n}         ${s.message||s.suggestion||""}${t}\n`;e.manual.length>5&&(l+=`  ${n}  ... and ${e.manual.length-5} more${t}\n`),l+="\n"}return l}toJSON(e){return{timestamp:(new Date).toISOString(),scores:e.scores,categories:Object.fromEntries(Object.entries(e.categories).map(([e,t])=>[e,{score:t.score,label:t.label,issueCount:t.issues?.length||0,coverage:t.coverage}])),stats:e.stats,fixable:e.fixable.map(e=>({file:e.file,action:e.fixAction,severity:e.severity})),manual:e.manual.map(e=>({file:e.file,message:e.message,severity:e.severity}))}}}module.exports=TechDebtAnalyzer;

package/package.json

@@ -1,15 +1,17 @@
 {
   "name": "thuban",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "description": "The safety layer for AI-coded software. Detect hallucinated APIs, ghost code, tech debt, and architecture drift. One command. Minimal dependencies.",
   "bin": {
     "thuban": "./dist/cli.js"
   },
   "scripts": {
     "scan": "node cli.js scan",
-    "test": "node -e \"require('child_process').execSync('node cli.js scan . --json',{stdio:'pipe'})\"",
+    "test": "node build.js && node --test tests/build-integrity.test.js tests/crlf-safety.test.js tests/windows-paths.test.js tests/npm-publish-smoke.test.js",
+    "test:all": "node --test tests/*.test.js packages/scanner/*.test.js packages/crucible/*.test.js",
+    "test:build": "node build.js && node --test tests/build-integrity.test.js tests/npm-publish-smoke.test.js",
     "build": "node build.js",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build && node --test tests/build-integrity.test.js tests/npm-publish-smoke.test.js"
   },
   "keywords": [
     "code-quality",
@@ -54,7 +56,7 @@
     "dist/package.json"
   ],
   "dependencies": {
-    "@babel/parser": "^8.0.0"
+    "@babel/parser": "^7.29.7"
   },
   "devDependencies": {
     "terser": "^5.48.0"