expect(findings.some((f) => f.ruleId === "dangerous-exec")).toBe(false);

});

it("does not use full-line comments as source-rule context", () => {

const source = `

const env = process.env;

// fetch() can reach the endpoint later.

`;

const findings = scanSource(source, "plugin.ts");

expect(findings.some((f) => f.ruleId === "env-harvesting")).toBe(false);

});

it("returns empty array for clean plugin code", () => {

const source = `

export function greet(name: string): string {

return !/\b(?:cp|childProcess|child_process)\s*\.\s*exec\s*\(/.test(line);

}

function stripFullLineCommentsForHeuristics(source: string): string {

return source

.split("\n")

.map((line) => (line.trimStart().startsWith("//") ? "" : line))

.join("\n");

}

export function scanSource(source: string, filePath: string): SkillScanFinding[] {

const findings: SkillScanFinding[] = [];

const lines = source.split("\n");

const heuristicSource = stripFullLineCommentsForHeuristics(source);

const heuristicLines = heuristicSource.split("\n");

const matchedLineRules = new Set<string>();

// --- Line rules ---

continue;

}

if (!rule.pattern.test(source)) {

if (!rule.pattern.test(heuristicSource)) {

continue;

}

if (rule.requiresContext && !rule.requiresContext.test(source)) {

if (rule.requiresContext && !rule.requiresContext.test(heuristicSource)) {

continue;

}

// Find the first matching line for evidence + line number

let matchLine = 0;

let matchEvidence = "";

for (let i = 0; i < lines.length; i++) {

if (rule.pattern.test(lines[i])) {

if (rule.pattern.test(heuristicLines[i] ?? "")) {

matchLine = i + 1;

matchEvidence = lines[i].trim();

break;