tryassay 0.33.1 → 0.34.0

package/dist/hunt/__tests__/finding-to-template.test.js

@@ -0,0 +1,213 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdirSync, rmSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { findingToTemplate, saveLearnedTemplate, loadLearnedTemplates, extractFilePatterns, extractBypasses, } from '../finding-to-template.js';
+// ── Fixtures ─────────────────────────────────────────────────
+function makeFinding(overrides = {}) {
+    return {
+        hypothesisId: 1,
+        templateId: 'csrf-bypass',
+        file: 'packages/next/src/server/csrf-protection.ts',
+        line: 42,
+        cwe: 'CWE-352',
+        severity: 'high',
+        title: 'CSRF wildcard domain bypass via TLD-level wildcards',
+        attackScenario: `An attacker can bypass CSRF protection by exploiting TLD-level wildcard matching.
+1. Craft a request from evil.com with Origin header
+2. The matchWildcardDomain() function accepts *.com as a valid wildcard
+3. This bypasses the CSRF origin check for all .com domains`,
+        reproductionSteps: `1. Set allowedOrigins to ["*.com"]
+2. Send POST with Origin: https://evil.com
+3. Observe CSRF check passes when it should fail
+
+curl -X POST https://target.com/api/action \\
+  -H "Origin: https://evil.com" \\
+  -H "Content-Type: application/json" \\
+  -d '{"action": "delete"}'`,
+        evidence: `function matchWildcardDomain(origin: string, pattern: string): boolean {
+  // Should reject TLD-level wildcards like *.com but doesn't
+  const regex = new RegExp(pattern.replace('*', '.*'));
+  return regex.test(origin);
+}`,
+        recommendation: `Validate that wildcard patterns have at least two labels (e.g., *.example.com, not *.com).
+Check RFC 6454 Section 5 for origin comparison rules.
+See also OWASP CSRF Prevention Cheat Sheet.`,
+        confirmed: true,
+        ...overrides,
+    };
+}
+// ── Test setup ───────────────────────────────────────────────
+let testDir;
+beforeEach(() => {
+    testDir = join(tmpdir(), `assay-test-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+    mkdirSync(testDir, { recursive: true });
+});
+afterEach(() => {
+    try {
+        rmSync(testDir, { recursive: true, force: true });
+    }
+    catch {
+        // cleanup best-effort
+    }
+});
+// ── Tests ────────────────────────────────────────────────────
+describe('findingToTemplate', () => {
+    it('creates a learned template with correct structure', () => {
+        const finding = makeFinding();
+        const learned = findingToTemplate(finding);
+        expect(learned.source).toBe('bounty-finding');
+        expect(learned.sourceFinding).toBe(finding.title);
+        expect(learned.id).toMatch(/^learned-/);
+        expect(learned.createdAt).toBeTruthy();
+        const t = learned.template;
+        expect(t.id).toBe(learned.id);
+        expect(t.name).toContain('[Learned]');
+        expect(t.name).toContain(finding.title);
+        expect(t.cwe).toBe('CWE-352');
+        expect(t.filePatterns.length).toBeGreaterThanOrEqual(2);
+        expect(t.triagePrompt).toContain(finding.attackScenario);
+        expect(t.deepDivePrompt).toContain(finding.reproductionSteps);
+        expect(t.severityRange).toEqual(['medium', 'critical']); // high -> [medium, critical]
+        expect(t.knownBypasses.length).toBeGreaterThan(0);
+    });
+    it('generates unique IDs for different findings', () => {
+        const f1 = makeFinding({ title: 'Finding One' });
+        const f2 = makeFinding({ title: 'Finding Two' });
+        const t1 = findingToTemplate(f1);
+        const t2 = findingToTemplate(f2);
+        expect(t1.id).not.toBe(t2.id);
+    });
+    it('maps severity ranges correctly', () => {
+        const cases = [
+            ['critical', ['high', 'critical']],
+            ['high', ['medium', 'critical']],
+            ['medium', ['low', 'high']],
+            ['low', ['low', 'medium']],
+        ];
+        for (const [severity, expected] of cases) {
+            const t = findingToTemplate(makeFinding({ severity }));
+            expect(t.template.severityRange).toEqual(expected);
+        }
+    });
+});
+describe('extractFilePatterns', () => {
+    it('extracts path-derived keywords', () => {
+        const finding = makeFinding({ file: 'packages/next/src/server/csrf-protection.ts' });
+        const patterns = extractFilePatterns(finding);
+        expect(patterns).toContain('csrf-protection');
+        expect(patterns).toContain('server');
+        expect(patterns).toContain('next');
+    });
+    it('extracts technology keywords from attack scenario', () => {
+        const finding = makeFinding({
+            attackScenario: 'The attacker uses postMessage to send a crafted CSRF token via an iframe',
+        });
+        const patterns = extractFilePatterns(finding);
+        expect(patterns).toContain('postmessage');
+        expect(patterns).toContain('csrf');
+        expect(patterns).toContain('iframe');
+        expect(patterns).toContain('token');
+    });
+    it('extracts import names from evidence', () => {
+        const finding = makeFinding({
+            evidence: `import { validateOrigin } from '../utils/csrf-helpers';`,
+        });
+        const patterns = extractFilePatterns(finding);
+        expect(patterns).toContain('csrf-helpers');
+    });
+    it('returns at least 2 patterns', () => {
+        const finding = makeFinding({
+            file: 'a.ts',
+            attackScenario: '',
+            evidence: '',
+            title: '',
+            recommendation: '',
+        });
+        const patterns = extractFilePatterns(finding);
+        expect(patterns.length).toBeGreaterThanOrEqual(2);
+    });
+});
+describe('extractBypasses', () => {
+    it('extracts bypass steps from numbered list', () => {
+        const finding = makeFinding({
+            attackScenario: `The vulnerability allows:
+1. Bypass CSRF check by sending null Origin
+2. Exploit the wildcard matching to forge requests
+3. Normal request that is not a bypass`,
+        });
+        const bypasses = extractBypasses(finding);
+        expect(bypasses.length).toBeGreaterThanOrEqual(2);
+        expect(bypasses.some(b => b.toLowerCase().includes('bypass'))).toBe(true);
+        expect(bypasses.some(b => b.toLowerCase().includes('exploit'))).toBe(true);
+    });
+    it('falls back to first sentence when no structured bypasses', () => {
+        const finding = makeFinding({
+            attackScenario: 'The attacker sends a crafted request to bypass validation. This is a long explanation.',
+            reproductionSteps: 'Step one. Step two.',
+        });
+        const bypasses = extractBypasses(finding);
+        expect(bypasses.length).toBeGreaterThanOrEqual(1);
+        expect(bypasses[0]).toContain('crafted request');
+    });
+});
+describe('saveLearnedTemplate + loadLearnedTemplates', () => {
+    it('saves and loads a template (project-local)', () => {
+        const learned = findingToTemplate(makeFinding());
+        saveLearnedTemplate(learned, { projectRoot: testDir });
+        const storePath = join(testDir, '.assay', 'learned', 'templates.json');
+        expect(existsSync(storePath)).toBe(true);
+        const loaded = loadLearnedTemplates(testDir);
+        expect(loaded).toHaveLength(1);
+        expect(loaded[0].id).toBe(learned.id);
+        expect(loaded[0].cwe).toBe('CWE-352');
+    });
+    it('deduplicates by ID on save', () => {
+        const learned = findingToTemplate(makeFinding());
+        saveLearnedTemplate(learned, { projectRoot: testDir });
+        saveLearnedTemplate(learned, { projectRoot: testDir });
+        const loaded = loadLearnedTemplates(testDir);
+        expect(loaded).toHaveLength(1);
+    });
+    it('loads empty array when no store exists', () => {
+        const loaded = loadLearnedTemplates(testDir);
+        expect(loaded).toEqual([]);
+    });
+    it('handles corrupted store file gracefully', () => {
+        const storePath = join(testDir, '.assay', 'learned', 'templates.json');
+        mkdirSync(join(testDir, '.assay', 'learned'), { recursive: true });
+        const { writeFileSync } = require('node:fs');
+        writeFileSync(storePath, 'NOT JSON', 'utf-8');
+        const loaded = loadLearnedTemplates(testDir);
+        expect(loaded).toEqual([]);
+    });
+    it('multiple templates accumulate', () => {
+        const f1 = makeFinding({ title: 'Finding Alpha' });
+        const f2 = makeFinding({ title: 'Finding Beta' });
+        const t1 = findingToTemplate(f1);
+        const t2 = findingToTemplate(f2);
+        saveLearnedTemplate(t1, { projectRoot: testDir });
+        saveLearnedTemplate(t2, { projectRoot: testDir });
+        const loaded = loadLearnedTemplates(testDir);
+        expect(loaded).toHaveLength(2);
+    });
+});
+describe('template registry integration', () => {
+    it('getAllTemplates includes learned templates', async () => {
+        // Import getAllTemplates dynamically to avoid circular dependency issues
+        const { getAllTemplates } = await import('../templates/index.js');
+        // Without any learned templates in a non-existent dir, should just return built-ins
+        const builtIn = getAllTemplates('/non-existent-path-for-test');
+        expect(builtIn.length).toBeGreaterThanOrEqual(10); // 10 built-in templates
+        // Save a learned template
+        const learned = findingToTemplate(makeFinding());
+        saveLearnedTemplate(learned, { projectRoot: testDir });
+        // Now getAllTemplates should include the learned one
+        const withLearned = getAllTemplates(testDir);
+        expect(withLearned.length).toBe(builtIn.length + 1);
+        const learnedTemplate = withLearned.find(t => t.id === learned.id);
+        expect(learnedTemplate).toBeDefined();
+        expect(learnedTemplate.name).toContain('[Learned]');
+    });
+});
+//# sourceMappingURL=finding-to-template.test.js.map

package/dist/hunt/__tests__/finding-to-template.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding-to-template.test.js","sourceRoot":"","sources":["../../../src/hunt/__tests__/finding-to-template.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAgB,UAAU,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AAEnC,gEAAgE;AAEhE,SAAS,WAAW,CAAC,YAAkC,EAAE;IACvD,OAAO;QACL,YAAY,EAAE,CAAC;QACf,UAAU,EAAE,aAAa;QACzB,IAAI,EAAE,6CAA6C;QACnD,IAAI,EAAE,EAAE;QACR,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,qDAAqD;QAC5D,cAAc,EAAE;;;4DAGwC;QACxD,iBAAiB,EAAE;;;;;;;4BAOK;QACxB,QAAQ,EAAE;;;;EAIZ;QACE,cAAc,EAAE;;4CAEwB;QACxC,SAAS,EAAE,IAAI;QACf,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,gEAAgE;AAEhE,IAAI,OAAe,CAAC;AAEpB,UAAU,CAAC,GAAG,EAAE;IACd,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5F,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,IAAI,CAAC;QACH,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,gEAAgE;AAEhE,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAE3C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC9C,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,CAAC;QAEvC,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC9D,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,6BAA6B;QACtF,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QAEjD,MAAM,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAEjC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,KAAK,GAAuD;YAChE,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAClC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAChC,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3B,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;SAC3B,CAAC;QAEF,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,iBAAiB,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,6CAA6C,EAAE,CAAC,CAAC;QACrF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAE9C,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC9C,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,cAAc,EAAE,0EAA0E;SAC3F,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAE9C,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,QAAQ,EAAE,yDAAyD;SACpE,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAE9C,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,IAAI,EAAE,MAAM;YACZ,cAAc,EAAE,EAAE;YAClB,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,EAAE;YACT,cAAc,EAAE,EAAE;SACnB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,cAAc,EAAE;;;uCAGiB;SAClC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAE1C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,cAAc,EAAE,wFAAwF;YACxG,iBAAiB,EAAE,qBAAqB;SACzC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAE1C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC,CAAC;QAEjD,mBAAmB,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QAEvD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;QACvE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC,CAAC;QAEjD,mBAAmB,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,mBAAmB,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;QACvE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAE9C,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAElD,MAAM,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAEjC,mBAAmB,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QAClD,mBAAmB,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QAElD,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,yEAAyE;QACzE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAElE,oFAAoF;QACpF,MAAM,OAAO,GAAG,eAAe,CAAC,6BAA6B,CAAC,CAAC;QAC/D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB;QAE3E,0BAA0B;QAC1B,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC,CAAC;QACjD,mBAAmB,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QAEvD,qDAAqD;QACrD,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEpD,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,CAAC,eAAgB,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/hunt/__tests__/parse-utils.test.js

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import { stripCodeFences, safeParseJSON } from '../parse-utils.js';
+import { stripCodeFences, extractJSON, safeParseJSON } from '../parse-utils.js';
 describe('stripCodeFences', () => {
     it('strips markdown code fences', () => {
         expect(stripCodeFences('```json\n{"a":1}\n```')).toBe('{"a":1}');
@@ -11,6 +11,29 @@ describe('stripCodeFences', () => {
         expect(stripCodeFences('```typescript\ncode\n```')).toBe('code');
     });
 });
+describe('extractJSON', () => {
+    it('extracts JSON from code fences with trailing prose', () => {
+        const input = '```json\n{"vulnerable": false}\n```\n\n**Reasoning:**\n\nSome explanation...';
+        expect(extractJSON(input)).toBe('{"vulnerable": false}');
+    });
+    it('extracts JSON from code fences without trailing text', () => {
+        expect(extractJSON('```json\n{"a":1}\n```')).toBe('{"a":1}');
+    });
+    it('extracts plain JSON object', () => {
+        expect(extractJSON('{"a":1}')).toBe('{"a":1}');
+    });
+    it('extracts JSON with prefix text', () => {
+        const input = 'Here is my analysis:\n{"vulnerable": true}';
+        expect(extractJSON(input)).toBe('{"vulnerable": true}');
+    });
+    it('handles nested objects', () => {
+        const input = 'Result: {"a": {"b": 1}, "c": 2} done';
+        expect(extractJSON(input)).toBe('{"a": {"b": 1}, "c": 2}');
+    });
+    it('returns trimmed text when no JSON found', () => {
+        expect(extractJSON('  no json here  ')).toBe('no json here');
+    });
+});
 describe('safeParseJSON', () => {
     it('parses valid JSON', () => {
         expect(safeParseJSON('{"a":1}')).toEqual({ a: 1 });
@@ -18,6 +41,10 @@ describe('safeParseJSON', () => {
     it('parses JSON inside code fences', () => {
         expect(safeParseJSON('```json\n{"a":1}\n```')).toEqual({ a: 1 });
     });
+    it('parses JSON from code fences with trailing reasoning', () => {
+        const input = '```json\n{"vulnerable": false, "confidence": "high"}\n```\n\n**Reasoning:**\n\nLong explanation here...';
+        expect(safeParseJSON(input)).toEqual({ vulnerable: false, confidence: 'high' });
+    });
     it('returns null for invalid JSON', () => {
         expect(safeParseJSON('not json')).toBeNull();
     });

package/dist/hunt/__tests__/parse-utils.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"parse-utils.test.js","sourceRoot":"","sources":["../../../src/hunt/__tests__/parse-utils.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEnE,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,eAAe,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,eAAe,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"parse-utils.test.js","sourceRoot":"","sources":["../../../src/hunt/__tests__/parse-utils.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEhF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,eAAe,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,eAAe,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,KAAK,GAAG,8EAA8E,CAAC;QAC7F,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,KAAK,GAAG,4CAA4C,CAAC;QAC3D,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,KAAK,GAAG,sCAAsC,CAAC;QACrD,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,KAAK,GAAG,yGAAyG,CAAC;QACxH,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/hunt/__tests__/taint-analysis.test.d.ts

@@ -0,0 +1 @@
+export {};