rules:
  # ────────────────────────────────────────────────────────────────────────
  # Exfiltration: sending secrets to remote servers
  # ────────────────────────────────────────────────────────────────────────

  - id: pi-extension-data-exfiltration-fetch
    patterns:
      - pattern: fetch($URL, ...)
    message: >
      Data exfiltration risk: sending data to $URL via fetch.
      Verify the destination is not an attacker-controlled server.
    severity: ERROR
    languages: [javascript, typescript]
    paths:
      include:
        - "**/*.ts"
        - "**/index.ts"
    focus-metavariable: $URL

  - id: pi-extension-data-exfiltration-xmlhttprequest
    pattern: new XMLHttpRequest()
    message: >
      Suspicious XMLHttpRequest usage in provider code.
      Could exfiltrate data to external servers.
    severity: WARNING
    languages: [javascript, typescript]
    paths:
      include:
        - "**/*.ts"

  # ────────────────────────────────────────────────────────────────────────
  # Secret leakage: logging / sending API keys
  # ────────────────────────────────────────────────────────────────────────

  - id: pi-extension-logging-secrets
    patterns:
      - pattern-either:
          - pattern: console.log(...)
          - pattern: console.error(...)
          - pattern: console.warn(...)
      - pattern-regex: "api[kK]ey|API_KEY|COMMANDCODE|Bearer|authPath"
    message: >
      Potential secret logging: log statement includes an API key, auth token,
      or auth file path pattern. Do not log secrets.
    severity: ERROR
    languages: [javascript, typescript]
    paths:
      include:
        - "**/*.ts"
        - "**/index.ts"

  - id: pi-extension-secret-in-error-message
    patterns:
      - pattern: Error($MSG)
      - pattern-regex: "api[kK]ey|API_KEY|COMMANDCODE|Bearer"
    message: >
      Possible secret leak in error message: $MSG.
      Error messages surfaced to pi may leak credentials.
      Use generic messages instead.
    severity: WARNING
    languages: [javascript, typescript]
    paths:
      include:
        - "**/*.ts"
        - "**/index.ts"

  # ────────────────────────────────────────────────────────────────────────
  # URL hijacking: changing API base endpoints
  # ────────────────────────────────────────────────────────────────────────

  - id: pi-extension-api-base-override
    patterns:
      - pattern-either:
          - pattern: $VAR = "..."
          - pattern: $VAR = process.env.$ENV_VAR ?? "..."
      - metavariable-regex:
          metavariable: $VAR
          regex: "(?i).*(api_?base|api_base_url|base_url|host|endpoint|models_url).*"
      - metavariable-regex:
          metavariable: $ENV_VAR
          regex: "(?i).*API.*BASE.*"
    message: >
      API base URL override: $ENV_VAR can redirect all requests including auth
      headers to any server. Review any change to how this variable is set.
    severity: ERROR
    languages: [javascript, typescript]
    paths:
      include:
        - "**/*.ts"
        - "**/index.ts"

  # ────────────────────────────────────────────────────────────────────────
  # Supply chain: dependency injection
  # ────────────────────────────────────────────────────────────────────────

  - id: pi-extension-untrusted-dynamic-require
    patterns:
      - pattern: require($MODULE)
      - metavariable-regex:
          metavariable: $MODULE
          regex: "^(?!['\"](\\.[/\\\\]|node:?|@earendil-works/))['\"]"
    message: >
      Dynamic require() of non-local, non-standard-library module: $MODULE.
      External contributors could introduce malicious packages this way.
    severity: ERROR
    languages: [javascript, typescript]
    paths:
      include:
        - "**/*.ts"
        - "**/index.ts"

  - id: pi-extension-postinstall-script
    patterns:
      - pattern: '"postinstall": "$SCRIPT"'
    message: >
      postinstall script detected: $SCRIPT. Install-time scripts can execute
      arbitrary code on user machines. Must be reviewed with extreme care.
    severity: ERROR
    languages: [json]
    paths:
      include:
        - "package.json"

  # ────────────────────────────────────────────────────────────────────────
  # File system: reading auth files / ~/.pi
  # ────────────────────────────────────────────────────────────────────────

  - id: pi-extension-auth-path-traversal
    patterns:
      - pattern: join($HOME, $PATH)
      - metavariable-regex:
          metavariable: $HOME
          regex: "homedir|homeDir|HOME|process\\.env\\.HOME"
      - metavariable-regex:
          metavariable: $PATH
          regex: "['\"].*\\.\\./.*['\"]"
    message: >
      Auth path traversal: $HOME / $PATH could read outside the intended auth
      directory. Path must stay within ~/.commandcode, ~/.pi/agent, ~/.omp/agent.
    severity: ERROR
    languages: [javascript, typescript]
    paths:
      include:
        - "**/*.ts"

  - id: pi-extension-readfile-sensitive-paths
    patterns:
      - pattern: readFileSync($PATH, ...)
      - pattern-not: readFileSync($PATH, "utf-8")
      - metavariable-regex:
          metavariable: $PATH
          regex: "(auth\\.json|credentials|\\.env|id_rsa|ssh|\\.netrc|netrc|\\.npmrc)"
    message: >
      Suspicious file read: $PATH. Auth files or credentials being read with
      potentially unsafe encoding. Review carefully.
    severity: WARNING
    languages: [javascript, typescript]
    paths:
      include:
        - "**/*.ts"

  # ────────────────────────────────────────────────────────────────────────
  # Network: unexpected fetch calls
  # ────────────────────────────────────────────────────────────────────────

  - id: pi-extension-unexpected-fetch
    pattern: fetch(...)
    message: >
      Direct fetch() call detected. Provider code should use injected
      fetchImpl for testability and security. If this is intentional,
      add a // nosemgrep comment on the line above.
    severity: WARNING
    languages: [javascript, typescript]
    paths:
      include:
        - "**/*.ts"
        - "**/index.ts"

  # ────────────────────────────────────────────────────────────────────────
  # Shell execution
  # ────────────────────────────────────────────────────────────────────────

  - id: pi-extension-shell-execution
    patterns:
      - pattern-either:
          - pattern: child_process.exec(...)
          - pattern: child_process.execSync(...)
          - pattern: child_process.spawn(...)
          - pattern: child_process.spawnSync(...)
          - pattern: child_process.fork(...)
          - pattern: exec($SCRIPT)
          - pattern: execSync($SCRIPT)
    message: >
      Shell execution: $SCRIPT. External contributors should not add
      child_process calls to provider source code.
    severity: ERROR
    languages: [javascript, typescript]
    paths:
      include:
        - "**/*.ts"
        - "**/index.ts"

  # ────────────────────────────────────────────────────────────────────────
  # Malicious import patterns
  # ────────────────────────────────────────────────────────────────────────

  - id: pi-extension-unusual-import
    patterns:
      - pattern-either:
          - pattern: 'import $X from "..."'
          - pattern: 'const $X = require("...")'
      - metavariable-regex:
          metavariable: $X
          regex: "(compression|pako|zlib|tar|stream|archiver|request|axios|needle|got|superagent|node-fetch|undici)"
    message: >
      Suspicious import of $X in provider source. Network or compression
      libraries could be used for data exfiltration.
    severity: WARNING
    languages: [javascript, typescript]
    paths:
      include:
        - "**/*.ts"
        - "**/index.ts"

  - id: pi-extension-eval-like
    patterns:
      - pattern-either:
          - pattern: eval(...)
          - pattern: new Function(...)
          - pattern: setTimeout($X, ...)
          - pattern: setInterval($X, ...)
      - pattern-not: setTimeout(() => ..., ...)
      - pattern-not: setTimeout(function(...) {...}, ...)
      - pattern-not: setTimeout(function $F(...) {...}, ...)
      - pattern-not: setInterval(() => ..., ...)
      - pattern-not: setInterval(function(...) {...}, ...)
      - pattern-not: setInterval(function $F(...) {...}, ...)
    message: >
      Code injection risk: eval, Function constructor, or eval-like setTimeout
      detected. These can execute arbitrary code.
    severity: ERROR
    languages: [javascript, typescript]
    paths:
      include:
        - "**/*.ts"
        - "**/index.ts"

  # ────────────────────────────────────────────────────────────────────────
  # Process environment: reading secrets
  # ────────────────────────────────────────────────────────────────────────

  - id: pi-extension-env-leak
    patterns:
      - pattern: process.env.$VAR
      - metavariable-regex:
          metavariable: $VAR
          regex: "(?!COMMANDCODE_|COMMAND_CODE_|CMD_ZDR|NODE_|PATH|HOME|SHELL|USER|LANG|LC_|TERM|TMPDIR|NIX_).*"
    message: >
      Reading unexpected environment variable $VAR. Provider should only
      read documented Command Code or standard runtime variables.
    severity: WARNING
    languages: [javascript, typescript]
    paths:
      include:
        - "**/*.ts"
        - "**/index.ts"

  # ────────────────────────────────────────────────────────────────────────
  # OAuth flow manipulation
  # ────────────────────────────────────────────────────────────────────────