vibe-checking 1.0.0

package/dist/scanners/deps.js

@@ -0,0 +1,73 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+const execFileAsync = promisify(execFile);
+export async function scanDeps(repoPath) {
+    const packageJson = join(repoPath, "package.json");
+    if (!existsSync(packageJson)) {
+        return {
+            findings: [],
+            available: false,
+            error: "no package.json found — skipping dependency audit",
+        };
+    }
+    try {
+        const { stdout } = await execFileAsync("npm", ["audit", "--json", "--omit=dev"], { cwd: repoPath, maxBuffer: 20 * 1024 * 1024, timeout: 60_000 });
+        return { findings: parseAudit(stdout), available: true };
+    }
+    catch (err) {
+        const e = err;
+        // npm audit exits non-zero when vulnerabilities are found
+        if (e.stdout) {
+            try {
+                return { findings: parseAudit(e.stdout), available: true };
+            }
+            catch {
+                /* fall through */
+            }
+        }
+        return {
+            findings: [],
+            available: true,
+            error: `npm audit error: ${e.stderr?.slice(0, 200) || String(err)}`,
+        };
+    }
+}
+function parseAudit(json) {
+    let result;
+    try {
+        result = JSON.parse(json);
+    }
+    catch {
+        return [];
+    }
+    if (!result.vulnerabilities)
+        return [];
+    const findings = [];
+    for (const [, vuln] of Object.entries(result.vulnerabilities)) {
+        const sev = vuln.severity?.toLowerCase();
+        if (sev === "low" || sev === "info")
+            continue;
+        let title = `Known vulnerability in ${vuln.name}`;
+        for (const v of vuln.via) {
+            if (typeof v === "object" && v.title) {
+                title = v.title;
+                break;
+            }
+        }
+        findings.push({
+            id: 0,
+            severity: sev === "critical" || sev === "high" ? "critical" : "medium",
+            path: `package.json · ${vuln.name}`,
+            title: title.length > 120 ? title.slice(0, 117) + "…" : title,
+            meta: `npm audit · ${sev} severity${vuln.fixAvailable ? " · fix available" : ""}`,
+            source: "deps",
+            trace: null,
+            fix: null,
+            manual: "Not a generation issue — a vulnerable dependency. Update or replace the package. No prompt rewrite applies.",
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=deps.js.map

package/dist/scanners/deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps.js","sourceRoot":"","sources":["../../src/scanners/deps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAuB1C,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAgB;IAK7C,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,mDAAmD;SAC3D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,KAAK,EACL,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,EACjC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAChE,CAAC;QAEF,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,GAA2C,CAAC;QACtD,0DAA0D;QAC1D,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,oBAAoB,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE;SACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,eAAe;QAAE,OAAO,EAAE,CAAC;IAEvC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;QACzC,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM;YAAE,SAAS;QAE9C,IAAI,KAAK,GAAG,0BAA0B,IAAI,CAAC,IAAI,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACrC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;gBAChB,MAAM;YACR,CAAC;QACH,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,CAAC;YACL,QAAQ,EAAE,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;YACtE,IAAI,EAAE,kBAAkB,IAAI,CAAC,IAAI,EAAE;YACnC,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK;YAC7D,IAAI,EAAE,eAAe,GAAG,YAAY,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,EAAE;YACjF,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,IAAI;YACX,GAAG,EAAE,IAAI;YACT,MAAM,EACJ,6GAA6G;SAChH,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/scanners/gitleaks.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../types.js";
+import { type OnProgress } from "./installer.js";
+export declare function scanSecrets(repoPath: string, onProgress?: OnProgress): Promise<{
+    findings: Finding[];
+    available: boolean;
+    error?: string;
+}>;

package/dist/scanners/gitleaks.js

@@ -0,0 +1,103 @@
+import { execFile, exec } from "node:child_process";
+import { promisify } from "node:util";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { autoInstallGitleaks } from "./installer.js";
+const execFileAsync = promisify(execFile);
+const execAsync = promisify(exec);
+async function findGitleaks() {
+    try {
+        const { stdout } = await execFileAsync("which", ["gitleaks"]);
+        return stdout.trim();
+    }
+    catch {
+        return null;
+    }
+}
+export async function scanSecrets(repoPath, onProgress) {
+    let bin = await findGitleaks();
+    if (!bin && onProgress) {
+        bin = await autoInstallGitleaks(onProgress);
+    }
+    if (!bin) {
+        return {
+            findings: [],
+            available: false,
+            error: "gitleaks not found — install it (brew install gitleaks) to scan for secrets in git history",
+        };
+    }
+    const isGitRepo = existsSync(join(repoPath, ".git"));
+    if (!isGitRepo) {
+        return {
+            findings: [],
+            available: true,
+            error: "not a git repository — skipping git history secret scan",
+        };
+    }
+    try {
+        let stdout;
+        const gitleaksArgs = ["detect", "--source", repoPath, "--report-format", "json", "--no-banner"];
+        if (bin === "npx-gitleaks") {
+            const result = await execAsync(`npx --yes @gitleaks/gitleaks ${gitleaksArgs.join(" ")}`, { maxBuffer: 50 * 1024 * 1024, timeout: 120_000 });
+            stdout = result.stdout;
+        }
+        else {
+            const result = await execFileAsync(bin, gitleaksArgs, {
+                maxBuffer: 50 * 1024 * 1024,
+                timeout: 120_000,
+            });
+            stdout = result.stdout;
+        }
+        const matches = JSON.parse(stdout || "[]");
+        return { findings: matchesToFindings(matches), available: true };
+    }
+    catch (err) {
+        const e = err;
+        // gitleaks exits 1 when findings are present
+        if (e.code === 1 && e.stdout) {
+            try {
+                const matches = JSON.parse(e.stdout);
+                return { findings: matchesToFindings(matches), available: true };
+            }
+            catch {
+                /* fall through */
+            }
+        }
+        // Exit code 0 means no findings
+        if (e.code === 0) {
+            return { findings: [], available: true };
+        }
+        return {
+            findings: [],
+            available: true,
+            error: `gitleaks error: ${e.stderr || String(err)}`,
+        };
+    }
+}
+function matchesToFindings(matches) {
+    const seen = new Set();
+    const findings = [];
+    for (const m of matches) {
+        const key = `${m.Rule}:${m.File}:${m.Commit}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        const isServiceRole = m.Description?.toLowerCase().includes("service_role") ||
+            m.Rule?.toLowerCase().includes("supabase") ||
+            m.Match?.includes("service_role");
+        const shortCommit = m.Commit?.slice(0, 7) || "unknown";
+        findings.push({
+            id: 0,
+            severity: isServiceRole ? "critical" : "critical",
+            path: `git history · commit ${shortCommit}`,
+            title: `${m.Description || m.Rule} committed${m.File ? ` in ${m.File}` : ""} — still live in history`,
+            meta: `gitleaks · ${isServiceRole ? "key bypasses RLS entirely · rotate immediately" : "rotate this credential immediately"}`,
+            source: "gitleaks",
+            trace: null,
+            fix: null,
+            manual: "Not a generation issue — a leaked credential. Rotate the key in the relevant service, then purge it from git history. No prompt rewrite applies.",
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=gitleaks.js.map

package/dist/scanners/gitleaks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitleaks.js","sourceRoot":"","sources":["../../src/scanners/gitleaks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,mBAAmB,EAAmB,MAAM,gBAAgB,CAAC;AAEtE,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AAWlC,KAAK,UAAU,YAAY;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,UAAuB;IAMvB,IAAI,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;IAC/B,IAAI,CAAC,GAAG,IAAI,UAAU,EAAE,CAAC;QACvB,GAAG,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,KAAK;YAChB,KAAK,EACH,4FAA4F;SAC/F,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,yDAAyD;SACjE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,IAAI,MAAc,CAAC;QACnB,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;QAEhG,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B,gCAAgC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EACxD,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAClD,CAAC;YACF,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,YAAY,EAAE;gBACpD,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;gBAC3B,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACzB,CAAC;QAED,MAAM,OAAO,GAAoB,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;QAC5D,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACnE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,GAA0D,CAAC;QACrE,6CAA6C;QAC7C,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAoB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACtD,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACnE,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC;QACD,gCAAgC;QAChC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,mBAAmB,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE;SACpD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAwB;IACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEd,MAAM,aAAa,GACjB,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;YACrD,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC1C,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;QAEpC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,SAAS,CAAC;QAEvD,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,CAAC;YACL,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;YACjD,IAAI,EAAE,wBAAwB,WAAW,EAAE;YAC3C,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,0BAA0B;YACrG,IAAI,EAAE,cAAc,aAAa,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,oCAAoC,EAAE;YAC7H,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,IAAI;YACX,GAAG,EAAE,IAAI;YACT,MAAM,EACJ,kJAAkJ;SACrJ,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/scanners/installer.d.ts

@@ -0,0 +1,3 @@
+export type OnProgress = (msg: string) => void;
+export declare function autoInstallGitleaks(onProgress: OnProgress): Promise<string | null>;
+export declare function autoInstallSemgrep(onProgress: OnProgress): Promise<string | null>;

package/dist/scanners/installer.js

@@ -0,0 +1,121 @@
+import { execFile, exec } from "node:child_process";
+import { promisify } from "node:util";
+import { platform } from "node:os";
+const execFileAsync = promisify(execFile);
+const execAsync = promisify(exec);
+async function hasBrew() {
+    try {
+        await execFileAsync("which", ["brew"]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function hasPip() {
+    for (const bin of ["pip3", "pip", "python3 -m pip", "python -m pip"]) {
+        try {
+            if (bin.includes(" ")) {
+                await execAsync(`${bin} --version`);
+            }
+            else {
+                await execFileAsync("which", [bin]);
+            }
+            return bin;
+        }
+        catch {
+            continue;
+        }
+    }
+    return null;
+}
+async function hasNpx() {
+    try {
+        await execFileAsync("which", ["npx"]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function autoInstallGitleaks(onProgress) {
+    onProgress("gitleaks not found — attempting auto-install…");
+    // macOS: try brew
+    if (platform() === "darwin" && (await hasBrew())) {
+        try {
+            onProgress("  → brew install gitleaks");
+            await execAsync("brew install gitleaks", { timeout: 120_000 });
+            const { stdout } = await execFileAsync("which", ["gitleaks"]);
+            onProgress("  ✓ gitleaks installed");
+            return stdout.trim();
+        }
+        catch (err) {
+            onProgress(`  ✗ brew install failed: ${err.message?.slice(0, 100)}`);
+        }
+    }
+    // Linux: try brew if available, otherwise try downloading the binary
+    if (platform() === "linux" && (await hasBrew())) {
+        try {
+            onProgress("  → brew install gitleaks");
+            await execAsync("brew install gitleaks", { timeout: 120_000 });
+            const { stdout } = await execFileAsync("which", ["gitleaks"]);
+            onProgress("  ✓ gitleaks installed");
+            return stdout.trim();
+        }
+        catch {
+            /* fall through */
+        }
+    }
+    // Try npx as a last resort (gitleaks has an npm wrapper)
+    if (await hasNpx()) {
+        try {
+            onProgress("  → checking npx @gitleaks/gitleaks");
+            await execAsync("npx --yes @gitleaks/gitleaks version", {
+                timeout: 60_000,
+            });
+            onProgress("  ✓ gitleaks available via npx");
+            return "npx-gitleaks";
+        }
+        catch {
+            /* fall through */
+        }
+    }
+    onProgress("  ✗ could not auto-install gitleaks — install manually: brew install gitleaks");
+    return null;
+}
+export async function autoInstallSemgrep(onProgress) {
+    onProgress("semgrep not found — attempting auto-install…");
+    // Try pip/pip3
+    const pip = await hasPip();
+    if (pip) {
+        try {
+            const cmd = pip.includes(" ")
+                ? `${pip} install semgrep`
+                : `${pip} install semgrep`;
+            onProgress(`  → ${cmd}`);
+            await execAsync(cmd, { timeout: 180_000 });
+            const { stdout } = await execFileAsync("which", ["semgrep"]);
+            onProgress("  ✓ semgrep installed");
+            return stdout.trim();
+        }
+        catch (err) {
+            onProgress(`  ✗ pip install failed: ${err.message?.slice(0, 100)}`);
+        }
+    }
+    // macOS: try brew
+    if (platform() === "darwin" && (await hasBrew())) {
+        try {
+            onProgress("  → brew install semgrep");
+            await execAsync("brew install semgrep", { timeout: 180_000 });
+            const { stdout } = await execFileAsync("which", ["semgrep"]);
+            onProgress("  ✓ semgrep installed");
+            return stdout.trim();
+        }
+        catch (err) {
+            onProgress(`  ✗ brew install failed: ${err.message?.slice(0, 100)}`);
+        }
+    }
+    onProgress("  ✗ could not auto-install semgrep — install manually: pip install semgrep");
+    return null;
+}
+//# sourceMappingURL=installer.js.map

package/dist/scanners/installer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installer.js","sourceRoot":"","sources":["../../src/scanners/installer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AAIlC,KAAK,UAAU,OAAO;IACpB,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM;IACnB,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,eAAe,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,SAAS,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,MAAM;IACnB,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAsB;IAEtB,UAAU,CAAC,+CAA+C,CAAC,CAAC;IAE5D,kBAAkB;IAClB,IAAI,QAAQ,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,OAAO,EAAE,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC;YACH,UAAU,CAAC,2BAA2B,CAAC,CAAC;YACxC,MAAM,SAAS,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAC9D,UAAU,CAAC,wBAAwB,CAAC,CAAC;YACrC,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CACR,4BAA6B,GAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,IAAI,QAAQ,EAAE,KAAK,OAAO,IAAI,CAAC,MAAM,OAAO,EAAE,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,UAAU,CAAC,2BAA2B,CAAC,CAAC;YACxC,MAAM,SAAS,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAC9D,UAAU,CAAC,wBAAwB,CAAC,CAAC;YACrC,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,IAAI,MAAM,MAAM,EAAE,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,UAAU,CAAC,qCAAqC,CAAC,CAAC;YAClD,MAAM,SAAS,CAAC,sCAAsC,EAAE;gBACtD,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,UAAU,CAAC,gCAAgC,CAAC,CAAC;YAC7C,OAAO,cAAc,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IAED,UAAU,CACR,+EAA+E,CAChF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAsB;IAEtB,UAAU,CAAC,8CAA8C,CAAC,CAAC;IAE3D,eAAe;IACf,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC;IAC3B,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC3B,CAAC,CAAC,GAAG,GAAG,kBAAkB;gBAC1B,CAAC,CAAC,GAAG,GAAG,kBAAkB,CAAC;YAC7B,UAAU,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;YACzB,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;YAC7D,UAAU,CAAC,uBAAuB,CAAC,CAAC;YACpC,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CACR,2BAA4B,GAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACnE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kBAAkB;IAClB,IAAI,QAAQ,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,OAAO,EAAE,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC;YACH,UAAU,CAAC,0BAA0B,CAAC,CAAC;YACvC,MAAM,SAAS,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;YAC7D,UAAU,CAAC,uBAAuB,CAAC,CAAC;YACpC,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CACR,4BAA6B,GAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,UAAU,CACR,4EAA4E,CAC7E,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/scanners/rls.d.ts

@@ -0,0 +1,6 @@
+import type { Finding } from "../types.js";
+export declare function scanRLS(repoPath: string, dbUrl?: string): Promise<{
+    findings: Finding[];
+    available: boolean;
+    error?: string;
+}>;

package/dist/scanners/rls.js

@@ -0,0 +1,177 @@
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { existsSync } from "node:fs";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+export async function scanRLS(repoPath, dbUrl) {
+    if (dbUrl) {
+        return scanRLSLive(dbUrl);
+    }
+    return scanRLSStatic(repoPath);
+}
+async function scanRLSStatic(repoPath) {
+    const migrationsDir = join(repoPath, "supabase", "migrations");
+    if (!existsSync(migrationsDir)) {
+        return {
+            findings: [],
+            available: false,
+            error: "no supabase/migrations directory found — skipping RLS scan",
+        };
+    }
+    let files;
+    try {
+        files = (await readdir(migrationsDir)).filter((f) => f.endsWith(".sql"));
+    }
+    catch {
+        return {
+            findings: [],
+            available: false,
+            error: "could not read supabase/migrations — skipping RLS scan",
+        };
+    }
+    if (files.length === 0) {
+        return {
+            findings: [],
+            available: true,
+            error: "no .sql files in supabase/migrations",
+        };
+    }
+    const tables = new Map();
+    for (const file of files) {
+        const filePath = join(migrationsDir, file);
+        const sql = await readFile(filePath, "utf-8");
+        const relPath = `supabase/migrations/${file}`;
+        parseMigration(sql, relPath, tables);
+    }
+    const findings = [];
+    for (const [, table] of tables) {
+        if (!table.hasRLS) {
+            findings.push({
+                id: 0,
+                severity: "critical",
+                path: table.file,
+                title: `Table ${table.name} has no RLS policy`,
+                meta: `anon key can read/write this table via the public API`,
+                source: "rls",
+                trace: null,
+                fix: null,
+                manual: null,
+            });
+        }
+        else if (table.isPermissive) {
+            findings.push({
+                id: 0,
+                severity: "medium",
+                path: table.file,
+                title: `Table ${table.name} has an overly permissive RLS policy`,
+                meta: `policy uses USING (true) or allows anon full access`,
+                source: "rls",
+                trace: null,
+                fix: null,
+                manual: null,
+            });
+        }
+    }
+    return { findings, available: true };
+}
+function parseMigration(sql, file, tables) {
+    const lines = sql.split("\n");
+    const lineCount = lines.length;
+    // Match CREATE TABLE statements
+    const createTableRe = /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:public\.)?["']?(\w+)["']?/gi;
+    let match;
+    while ((match = createTableRe.exec(sql)) !== null) {
+        const name = match[1].toLowerCase();
+        if (name.startsWith("_") ||
+            name === "schema_migrations" ||
+            name === "extensions") {
+            continue;
+        }
+        if (!tables.has(name)) {
+            tables.set(name, {
+                name,
+                file,
+                hasRLS: false,
+                policies: [],
+                isPermissive: false,
+                lineCount,
+            });
+        }
+    }
+    // Match ALTER TABLE ... ENABLE ROW LEVEL SECURITY
+    const enableRLSRe = /ALTER\s+TABLE\s+(?:public\.)?["']?(\w+)["']?\s+ENABLE\s+ROW\s+LEVEL\s+SECURITY/gi;
+    while ((match = enableRLSRe.exec(sql)) !== null) {
+        const name = match[1].toLowerCase();
+        const info = tables.get(name);
+        if (info)
+            info.hasRLS = true;
+    }
+    // Match CREATE POLICY
+    const policyRe = /CREATE\s+POLICY\s+["']?(\w+)["']?\s+ON\s+(?:public\.)?["']?(\w+)["']?/gi;
+    while ((match = policyRe.exec(sql)) !== null) {
+        const tableName = match[2].toLowerCase();
+        const info = tables.get(tableName);
+        if (info)
+            info.policies.push(match[1]);
+    }
+    // Check for overly permissive policies: USING (true) on tables with RLS
+    const permissiveRe = /CREATE\s+POLICY\s+\S+\s+ON\s+(?:public\.)?["']?(\w+)["']?[\s\S]*?USING\s*\(\s*true\s*\)/gi;
+    while ((match = permissiveRe.exec(sql)) !== null) {
+        const name = match[1].toLowerCase();
+        const info = tables.get(name);
+        if (info)
+            info.isPermissive = true;
+    }
+}
+async function scanRLSLive(dbUrl) {
+    let psqlBin;
+    try {
+        const { stdout } = await execFileAsync("which", ["psql"]);
+        psqlBin = stdout.trim();
+    }
+    catch {
+        return {
+            findings: [],
+            available: false,
+            error: "psql not found — cannot run live RLS check",
+        };
+    }
+    try {
+        const { stdout } = await execFileAsync(psqlBin, [
+            dbUrl,
+            "-t",
+            "-A",
+            "-c",
+            `SELECT tablename, rowsecurity FROM pg_tables WHERE schemaname = 'public';`,
+        ], { timeout: 15_000 });
+        const findings = [];
+        for (const line of stdout.trim().split("\n")) {
+            if (!line)
+                continue;
+            const [table, rls] = line.split("|");
+            if (rls === "f" || rls === "false") {
+                findings.push({
+                    id: 0,
+                    severity: "critical",
+                    path: `database · public.${table}`,
+                    title: `Table ${table} has no RLS policy (live check)`,
+                    meta: `pg_tables rowsecurity=false · anon key can access this table`,
+                    source: "rls",
+                    trace: null,
+                    fix: null,
+                    manual: null,
+                });
+            }
+        }
+        return { findings, available: true };
+    }
+    catch (err) {
+        return {
+            findings: [],
+            available: true,
+            error: `psql error: ${String(err)}`,
+        };
+    }
+}
+//# sourceMappingURL=rls.js.map

package/dist/scanners/rls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls.js","sourceRoot":"","sources":["../../src/scanners/rls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAW1C,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,QAAgB,EAChB,KAAc;IAMd,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAgB;IAK3C,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,4DAA4D;SACpE,CAAC;IACJ,CAAC;IAED,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,wDAAwD;SAChE,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,sCAAsC;SAC9C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAE5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,uBAAuB,IAAI,EAAE,CAAC;QAC9C,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,CAAC;gBACL,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,SAAS,KAAK,CAAC,IAAI,oBAAoB;gBAC9C,IAAI,EAAE,uDAAuD;gBAC7D,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,IAAI;gBACX,GAAG,EAAE,IAAI;gBACT,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,CAAC;gBACL,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,SAAS,KAAK,CAAC,IAAI,sCAAsC;gBAChE,IAAI,EAAE,qDAAqD;gBAC3D,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,IAAI;gBACX,GAAG,EAAE,IAAI;gBACT,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,cAAc,CACrB,GAAW,EACX,IAAY,EACZ,MAA8B;IAE9B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;IAE/B,gCAAgC;IAChC,MAAM,aAAa,GACjB,0EAA0E,CAAC;IAC7E,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,IACE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YACpB,IAAI,KAAK,mBAAmB;YAC5B,IAAI,KAAK,YAAY,EACrB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE;gBACf,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,KAAK;gBACb,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,KAAK;gBACnB,SAAS;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,MAAM,WAAW,GACf,kFAAkF,CAAC;IACrF,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,IAAI;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IAC/B,CAAC;IAED,sBAAsB;IACtB,MAAM,QAAQ,GACZ,yEAAyE,CAAC;IAC5E,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,IAAI;YAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,wEAAwE;IACxE,MAAM,YAAY,GAChB,2FAA2F,CAAC;IAC9F,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,IAAI;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IACrC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAAa;IAKtC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,4CAA4C;SACpD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,OAAO,EACP;YACE,KAAK;YACL,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,2EAA2E;SAC5E,EACD,EAAE,OAAO,EAAE,MAAM,EAAE,CACpB,CAAC;QAEF,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;gBACnC,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,CAAC;oBACL,QAAQ,EAAE,UAAU;oBACpB,IAAI,EAAE,qBAAqB,KAAK,EAAE;oBAClC,KAAK,EAAE,SAAS,KAAK,iCAAiC;oBACtD,IAAI,EAAE,8DAA8D;oBACpE,MAAM,EAAE,KAAK;oBACb,KAAK,EAAE,IAAI;oBACX,GAAG,EAAE,IAAI;oBACT,MAAM,EAAE,IAAI;iBACb,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,eAAe,MAAM,CAAC,GAAG,CAAC,EAAE;SACpC,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/scanners/semgrep.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../types.js";
+import { type OnProgress } from "./installer.js";
+export declare function scanSAST(repoPath: string, onProgress?: OnProgress): Promise<{
+    findings: Finding[];
+    available: boolean;
+    error?: string;
+}>;

package/dist/scanners/semgrep.js

@@ -0,0 +1,121 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { autoInstallSemgrep } from "./installer.js";
+const execFileAsync = promisify(execFile);
+async function findSemgrep() {
+    try {
+        const { stdout } = await execFileAsync("which", ["semgrep"]);
+        return stdout.trim();
+    }
+    catch {
+        return null;
+    }
+}
+const RELEVANT_CATEGORIES = new Set([
+    "security",
+    "correctness",
+    "owasp",
+]);
+function isRelevant(m) {
+    const sev = m.extra.severity?.toLowerCase();
+    if (sev === "info")
+        return false;
+    const cat = m.extra.metadata?.category?.toLowerCase() || "";
+    if (RELEVANT_CATEGORIES.has(cat))
+        return true;
+    const id = m.check_id.toLowerCase();
+    if (id.includes("injection") ||
+        id.includes("xss") ||
+        id.includes("auth") ||
+        id.includes("validation") ||
+        id.includes("webhook") ||
+        id.includes("upload") ||
+        id.includes("traversal") ||
+        id.includes("ssrf") ||
+        id.includes("csrf") ||
+        id.includes("rce") ||
+        id.includes("sql") ||
+        id.includes("crypto") ||
+        id.includes("secret") ||
+        id.includes("hardcoded") ||
+        id.includes("insecure")) {
+        return true;
+    }
+    if (sev === "error" || sev === "warning")
+        return true;
+    return false;
+}
+function mapSeverity(sev) {
+    return sev.toLowerCase() === "error" ? "critical" : "medium";
+}
+export async function scanSAST(repoPath, onProgress) {
+    let bin = await findSemgrep();
+    if (!bin && onProgress) {
+        bin = await autoInstallSemgrep(onProgress);
+    }
+    if (!bin) {
+        return {
+            findings: [],
+            available: false,
+            error: "semgrep not found — install it (pip install semgrep) to run SAST analysis",
+        };
+    }
+    try {
+        const { stdout } = await execFileAsync(bin, [
+            "scan",
+            "--config",
+            "auto",
+            "--json",
+            "--quiet",
+            "--no-git-ignore",
+            "--timeout",
+            "60",
+            repoPath,
+        ], { maxBuffer: 50 * 1024 * 1024, timeout: 300_000 });
+        const result = JSON.parse(stdout || '{"results":[]}');
+        return { findings: resultsToFindings(result.results), available: true };
+    }
+    catch (err) {
+        const e = err;
+        if (e.stdout) {
+            try {
+                const result = JSON.parse(e.stdout);
+                return { findings: resultsToFindings(result.results), available: true };
+            }
+            catch {
+                /* fall through */
+            }
+        }
+        return {
+            findings: [],
+            available: true,
+            error: `semgrep error: ${e.stderr?.slice(0, 200) || String(err)}`,
+        };
+    }
+}
+function resultsToFindings(results) {
+    const seen = new Set();
+    const findings = [];
+    const relevant = results.filter(isRelevant);
+    for (const m of relevant) {
+        const key = `${m.check_id}:${m.path}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        const shortId = m.check_id.split(".").pop() || m.check_id;
+        const message = m.extra.message || shortId;
+        findings.push({
+            id: 0,
+            severity: mapSeverity(m.extra.severity),
+            path: m.path,
+            title: message.length > 120 ? message.slice(0, 117) + "…" : message,
+            meta: `semgrep · ${shortId}`,
+            source: "semgrep",
+            trace: null,
+            fix: null,
+            manual: null,
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=semgrep.js.map

package/dist/scanners/semgrep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep.js","sourceRoot":"","sources":["../../src/scanners/semgrep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,kBAAkB,EAAmB,MAAM,gBAAgB,CAAC;AAErE,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAsB1C,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,UAAU;IACV,aAAa;IACb,OAAO;CACR,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,CAAe;IACjC,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IAC5C,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAEjC,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,IACE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QACxB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAClB,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnB,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;QACzB,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;QACtB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACrB,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QACxB,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnB,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAClB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAClB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACrB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACrB,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QACxB,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EACvB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,QAAgB,EAChB,UAAuB;IAMvB,IAAI,GAAG,GAAG,MAAM,WAAW,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,IAAI,UAAU,EAAE,CAAC;QACvB,GAAG,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,KAAK;YAChB,KAAK,EACH,2EAA2E;SAC9E,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,GAAG,EACH;YACE,MAAM;YACN,UAAU;YACV,MAAM;YACN,QAAQ;YACR,SAAS;YACT,iBAAiB;YACjB,WAAW;YACX,IAAI;YACJ,QAAQ;SACT,EACD,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAClD,CAAC;QAEF,MAAM,MAAM,GAAkB,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC,CAAC;QACrE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,GAA2C,CAAC;QACtD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,MAAM,GAAkB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACnD,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC1E,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,kBAAkB,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE;SAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuB;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAE5C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEd,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC;QAC1D,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC;QAE3C,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,CAAC;YACL,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;YACvC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO;YACnE,IAAI,EAAE,aAAa,OAAO,EAAE;YAC5B,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,IAAI;YACX,GAAG,EAAE,IAAI;YACT,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}