#!/usr/bin/env node
/**
 * Malicious Code Scanner
 * Detects obfuscated droppers, eval-based loaders, suspicious global assignments,
 * blockchain C2 patterns, high-entropy payload strings, and stealthy child processes.
 *
 * Exit codes: 0 = clean, 1 = threats found, 2 = scanner error
 */

"use strict";

const fs = require("fs");
const path = require("path");

// ─── Configuration ────────────────────────────────────────────────────────────

const EXTENSIONS_TO_SCAN = new Set([
	".js",
	".cjs",
	".mjs",
	".ts",
	".tsx",
	".jsx",
	".json",
	".html",
	".htm",
	".vue",
	".svelte",
]);

const ALWAYS_SKIP = new Set([
	"node_modules",
	".git",
	"dist",
	"build",
	".next",
	".nuxt",
	"coverage",
	".nyc_output",
	"__pycache__",
	"scan-malware.js",
	".turbo",
]);

const ENTROPY_THRESHOLD = 5.2; // Shannon bits/char – high = likely encoded payload
const ENTROPY_MIN_STRING_LEN = 64; // only test strings at least this long
const MAX_FILE_SIZE_BYTES = 2 * 1024 * 1024; // skip files > 2 MB

// ─── Detection Rules ──────────────────────────────────────────────────────────

/**
 * Each rule: { id, description, severity, test(content, filePath) }
 * test() returns null | { line, snippet }[]
 */
const RULES = [
	// ── 1. Global require/module hijacking ──────────────────────────────────────
	{
		id: "GLOBAL_REQUIRE_ASSIGN",
		severity: "CRITICAL",
		description:
			"Assigns require/module/process to a global slot to survive closure boundaries",
		test(src) {
			return matchAll(src, [
				// Quoted-key form:  global['literal'] = require
				/global\s*\[\s*['"][^'"]{0,40}['"]\s*\]\s*=\s*require\b/g,
				/global\s*\[\s*['"][^'"]{0,40}['"]\s*\]\s*=\s*module\b/g,
				/global\s*\[\s*['"][^'"]{0,40}['"]\s*\]\s*=\s*process\b/g,
				// Computed-key form: global[_$_1e42[0]] = require  (real sample pattern)
				/global\s*\[\s*[^\]]{1,60}\]\s*=\s*require\b/g,
				/global\s*\[\s*[^\]]{1,60}\]\s*=\s*module\b/g,
				/global\s*\[\s*[^\]]{1,60}\]\s*=\s*process\b/g,
				// Dot form: global.x = require
				/global\s*\.\s*\w+\s*=\s*require\b/g,
			]);
		},
	},

	// ── 2. Obfuscator fingerprints ───────────────────────────────────────────────
	{
		id: "OBFUSCATOR_VAR_NAMES",
		severity: "HIGH",
		description:
			"Variable names matching known obfuscator output patterns (_$_, _$af…, sfL…)",
		test(src) {
			return matchAll(
				src,
				[
					// _$_1e42 family — the exact dropper signature (minHits=1, one hit is definitive)
					/\b_\$_[0-9a-zA-Z]{4,}\b/g,
					// _$af163278 style
					/\b_\$[a-f0-9]{6,}\b/g,
					// sfL as a standalone identifier (the shuffler function name in this dropper family)
					/\bsfL\b/g,
					// sfLxxx variants
					/\bsfL[A-Za-z0-9]{2,}\b/g,
					// generic hex-suffix identifiers (broader catch for other obfuscators)
					/\b[a-zA-Z]{1,3}[0-9a-f]{8,}\b/g,
				],
				1,
			); // one strong match is enough — these patterns don't appear in legitimate code
		},
	},

	// ── 3. Function-constructor eval-by-constructor ──────────────────────────────
	{
		id: "FUNCTION_CONSTRUCTOR_EVAL",
		severity: "CRITICAL",
		description:
			"Dynamically constructs and executes code via the Function constructor",
		test(src) {
			return matchAll(src, [
				// Explicit new Function(...)
				/new\s+Function\s*\(\s*[^)]{40,}\)/g,
				/Function\s*\(\s*['"`][^'"`]{40,}['"`]\s*\)\s*\(\)/g,
				/\(\s*new\s+Function\s*\(/g,
				/\bFunction\b[^(]*\([^)]*\)\s*\(\s*\)/g,
				// ── Stolen-property pattern (the real sample's technique) ──
				// var x = fn[computed]  then  x('', decode(bigString))
				// Step 1: extract constructor via computed property on a function
				/var\s+\w+\s*=\s*\w+\s*\[\s*\w+\s*\]\s*;[\s\S]{0,120}var\s+\w+\s*=\s*\w+\s*\(\s*(?:''|""|``|\w+)\s*,\s*\w+\s*\(\s*\w+\s*\)\s*\)/g,
				// Step 2: direct two-arg call with empty first arg (how Function ctor is invoked)
				/\w+\s*\(\s*(?:''|""|``)\s*,\s*\w+\s*\(\s*\w+\s*\)\s*\)/g,
				// Step 3: fn[computed](empty, decoder(str)) in one expression
				/\w+\s*\[\s*\w+\s*\]\s*\(\s*(?:''|""|``|\w*)\s*,\s*\w+\s*\(\s*\w+\s*\)\s*\)/g,
			]);
		},
	},

	// ── 4. Encoded-string eval calls ────────────────────────────────────────────
	{
		id: "EVAL_ENCODED_STRING",
		severity: "CRITICAL",
		description: "Passes a large encoded/obfuscated literal directly to eval()",
		test(src) {
			return matchAll(src, [
				/\beval\s*\(\s*['"`][A-Za-z0-9+/=%\\]{80,}['"`]\s*\)/g,
				/\beval\s*\(\s*[A-Za-z_$][A-Za-z0-9_$]*\s*\(\s*[^)]{0,60}\)\s*\)/g, // eval(decode(...))
				/\beval\s*\(\s*atob\s*\(/g,
				/\beval\s*\(\s*Buffer\s*\.from\s*\(/g,
			]);
		},
	},

	// ── 5. Plain suspicious eval ────────────────────────────────────────────────
	{
		id: "SUSPICIOUS_EVAL",
		severity: "MEDIUM",
		description: "eval() used in a context that suggests dynamic code loading",
		test(src) {
			return matchAll(src, [
				/\beval\s*\(\s*(?!\/[\/*])(?!\s*['"`]\s*['"`])[^;)]{20,}\)/g,
			]);
		},
	},

	// ── 6. Stealthy child_process spawn ─────────────────────────────────────────
	{
		id: "DETACHED_CHILD_PROCESS",
		severity: "CRITICAL",
		description:
			"Spawns a detached, stdio-less child process — classic dropper persistence",
		test(src) {
			return matchAll(src, [
				/detached\s*:\s*true/g,
				/stdio\s*:\s*['"`]ignore['"`]/g,
				/windowsHide\s*:\s*true/g,
				/spawn\s*\(\s*['"`]node['"`]\s*,\s*\[\s*['"`]-e['"`]/g,
				/execFile\s*\([^)]+detached/g,
			]);
		},
	},

	// ── 7. Blockchain C2 endpoints ──────────────────────────────────────────────
	{
		id: "BLOCKCHAIN_C2",
		severity: "CRITICAL",
		description:
			"Contacts blockchain APIs (TronGrid, Aptos, etc.) to retrieve a payload",
		test(src) {
			return matchAll(src, [
				/trongrid\.io/gi,
				/tronscan\.org/gi,
				/fullnode\.mainnet\.aptoslabs\.com/gi,
				/aptos\.dev\/v1\/accounts/gi,
				/getTransactionInfo|getTransactionById/g,
				/\.resource\.data\.value\b/g, // Aptos on-chain data access pattern
				/wallet_address.*blockchain|blockchain.*wallet_address/gi,
			]);
		},
	},

	// ── 8. XOR-based decryption of a payload ────────────────────────────────────
	{
		id: "XOR_PAYLOAD_DECRYPT",
		severity: "HIGH",
		description:
			"XOR-decryption loop over a fetched or hardcoded payload buffer",
		test(src) {
			return matchAll(src, [
				/charCodeAt\s*\([^)]*\)\s*\^\s*\w+\.charCodeAt\s*\(/g,
				/\^\s*key\.charCodeAt\s*\(/g,
				/\.map\s*\(\s*\([^)]*\)\s*=>\s*[^.]+\.\s*charCodeAt[^)]*\s*\^/g,
				/fromCharCode\s*\([^)]*\^[^)]*\)/g,
			]);
		},
	},

	// ── 9. String.fromCharCode(127) split (known dropper separator) ───────────────
	{
		id: "FROMCHARCODE_SEPARATOR",
		severity: "HIGH",
		description:
			"Uses String.fromCharCode() as a string delimiter/split marker",
		test(src) {
			return matchAll(src, [
				/String\.fromCharCode\s*\(\s*1[0-2][0-9]\s*\)/g, // DEL, extended ctrl chars
				/\.split\s*\(\s*String\.fromCharCode\s*\(/g,
				/String\.fromCharCode\s*\(\s*0\s*\)/g, // null byte as delimiter
			]);
		},
	},

	// ── 10. Rate-limiting / re-execution guard (anti-detection) ──────────────────
	{
		id: "EXECUTION_RATE_LIMIT",
		severity: "MEDIUM",
		description:
			"Hardcoded timing gate (30 s window) used to avoid repeated execution",
		test(src) {
			return matchAll(src, [
				/Date\.now\s*\(\)\s*-\s*\w+\s*[<>]=?\s*3000[0-9]/g, // 30 000 ms
				/setTimeout[^)]+3[0-9]{4}/g,
				/lastRun|_lastExec|_rateLimit|__ts/g,
			]);
		},
	},

	// ── 11. High-entropy string literals ─────────────────────────────────────────
	{
		id: "HIGH_ENTROPY_STRING",
		severity: "HIGH",
		description:
			"Long string literal with entropy above threshold — likely encoded payload",
		test(src, filePath) {
			// Skip minified bundles and lockfiles
			if (/\.(min\.js|lock|map)$/.test(filePath)) return null;
			const hits = [];
			// Broader charset: the real dropper's joW/pYd blobs contain spaces, brackets,
			// semicolons, etc. — any non-newline, non-quote content of 100+ chars qualifies.
			// We use two regexes: one for tightly-packed base64-like strings, one for the
			// looser mixed-content payload strings this dropper family actually uses.
			const patterns = [
				// Tight: no spaces (base64, hex, classic obfuscation)
				/(['"`])([A-Za-z0-9+/=\\%^&*!@#$\-_.~]{64,})\1/g,
				// Loose: mixed printable chars including spaces — catches joW / pYd style blobs
				/(['"`])([^'"` \t\r\n]{50,}[^'"` \t\r\n])\1/g,
				// Single-quoted with internal spaces — the exact form used in this dropper
				/'([^'\r\n]{100,})'/g,
			];
			const seen = new Set();
			for (const strRe of patterns) {
				strRe.lastIndex = 0;
				let m;
				while ((m = strRe.exec(src)) !== null) {
					const s =
						m[1] !== undefined && m[1].length === 1 ? (m[2] ?? m[1]) : m[1];
					const payload = typeof s === "string" ? s : m[0].slice(1, -1);
					if (payload.length < 50) continue;
					const key = payload.slice(0, 32); // dedup by prefix
					if (seen.has(key)) continue;
					seen.add(key);
					if (shannonEntropy(payload) >= ENTROPY_THRESHOLD) {
						hits.push({
							line: lineOf(src, m.index),
							snippet: payload.slice(0, 80) + "…",
						});
					}
				}
			}
			return hits.length ? hits : null;
		},
	},

	// ── 15. Global nonce / infection marker ─────────────────────────────────────
	{
		id: "GLOBAL_NONCE_MARKER",
		severity: "CRITICAL",
		description:
			"Sets a short global marker string (e.g.
		test(src) {
			return matchAll(src, [
				// global['!'] = '8-3946'  or  global["x"] = "abc-123"
				/global\s*\[\s*['"][^'"]{0,5}['"]\s*\]\s*=\s*['"][0-9!@#$%^&*\-]{3,20}['"]/g,
				//
				/global\['[^']{0,5}'\]='[^']{2,20}'/g,
			]);
		},
	},

	// ── 16. String-shuffler IIFE ──────────────────────────────────────────────────
	{
		id: "STRING_SHUFFLER_IIFE",
		severity: "CRITICAL",
		description:
			"Self-invoking string-shuffler function (seeded character-swap loop) used to decode obfuscated identifiers and payloads",
		test(src) {
			return matchAll(src, [
				// The core pattern: (function(x,y){ ... charAt ... % bignum ... })(str, bigint)
				/\(function\s*\(\s*\w\s*,\s*\w\s*\)\s*\{[^}]{30,}charAt[^}]{10,}%\s*[0-9]{5,}/g,
				// Seeded arithmetic inside a loop: e = (s + w) % bignum
				/[a-z]\s*=\s*\(\s*[a-z]\s*\+\s*[a-z]\s*\)\s*%\s*[0-9]{6,}/g,
				// The characteristic swap: var y=g[t]; g[t]=g[p]; g[p]=y
				/var\s+\w\s*=\s*\w\s*\[\s*\w\s*\]\s*;\s*\w\s*\[\s*\w\s*\]\s*=\s*\w\s*\[\s*\w\s*\]\s*;\s*\w\s*\[\s*\w\s*\]\s*=\s*\w/g,
			]);
		},
	},

	// ── 17. Method-extraction constructor theft ───────────────────────────────────
	{
		id: "CONSTRUCTOR_THEFT",
		severity: "CRITICAL",
		description:
			"Extracts the Function constructor via a computed property on a function object (e.g. sfL['constructor']), bypassing direct 'Function' keyword detection",
		test(src) {
			return matchAll(
				src,
				[
					// var EKc = sfL('...').substr(0, N)  — computing the property name 'constructor'
					/\w+\s*\([^)]{5,50}\)\.substr\s*\(\s*0\s*,\s*\w+\s*\)/g,
					// var dgC = sfL[EKc]  — stealing the constructor via computed key
					/var\s+\w+\s*=\s*\w+\s*\[\s*\w+\s*\]/g,
					// multi-step: var x=fn[computed]; var y=x; var z=x(empty, decode(blob))
					/var\s+\w+\s*=\s*\w+;\s*var\s+\w+\s*=\s*\w+\s*\(\s*(?:\w+|''|"")\s*,\s*\w+\s*\(\s*\w+\s*\)\s*\)/g,
				],
				2,
			); // need ≥2: the substr alone can appear legitimately, but substr + bracket-access together is the tell
		},
	},

	// ── 18. Multi-step join/split decode chain ────────────────────────────────────
	{
		id: "JOIN_SPLIT_DECODE_CHAIN",
		severity: "HIGH",
		description:
			"Repeated join/split/join sequence used to reassemble an obfuscated string — characteristic of this dropper family",
		test(src) {
			return matchAll(src, [
				// .join(x).split(y).join(z)  — at least two chained steps
				/\.join\s*\([^)]{0,20}\)\s*\.split\s*\([^)]{0,20}\)\s*\.join\s*\([^)]{0,20}\)/g,
				// Three+ steps (the real sample has 4):  .join.split.join.split.join
				/(?:\.join\s*\([^)]{0,20}\)\s*\.split\s*\([^)]{0,20}\)\s*){2,}/g,
			]);
		},
	},

	// ── 19. typeof-against-dynamic-string ─────────────────────────────────────────
	{
		id: "TYPEOF_DYNAMIC_CHECK",
		severity: "HIGH",
		description:
			"Uses typeof x === decoded_var[n] instead of typeof x === 'object' to hide the string 'object' from static analysis",
		test(src) {
			return matchAll(src, [
				// typeof module === _$_1e42[1]
				/typeof\s+\w+\s*===\s*_\$_/g,
				// typeof x === anyVar[digit]
				/typeof\s+\w+\s*===\s*\w+\s*\[\s*\d+\s*\]/g,
				// typeof x === dynamicVar  (no bracket, just a variable holding the type string)
				/typeof\s+(?:module|require|process|exports)\s*===\s*[A-Za-z_$][A-Za-z0-9_$]*(?!\s*[[(])/g,
			]);
		},
	},

	// ── 20. IIFE with numeric seed + numeric return (dropper wrapper) ──────────────
	{
		id: "DROPPER_IIFE_WRAPPER",
		severity: "CRITICAL",
		description:
			"Top-level IIFE that calls the final compiled payload with a numeric seed and returns a fake numeric value — canonical dropper wrapper structure",
		test(src) {
			return matchAll(src, [
				// Tgw(2509); return 1358})()
				/\w+\s*\(\s*\d{4,5}\s*\)\s*;\s*return\s+\d{3,6}\s*\}\s*\)\s*\(\s*\)/g,
				// return NNNN})()  — the fake return at the end of the outer IIFE
				/return\s+\d{3,6}\s*\}\s*\)\s*\(\s*\)/g,
				// (function(){...})()  containing a numeric final call + numeric return
				/\w+\s*\(\s*[0-9]{4}\s*\)[^)]*return\s+[0-9]{4}/g,
			]);
		},
	},

	// ── 12. Dynamic property access on require/module ────────────────────────────
	{
		id: "DYNAMIC_REQUIRE",
		severity: "HIGH",
		description: "require() called with a computed or obfuscated argument",
		test(src) {
			return matchAll(src, [
				/require\s*\(\s*\w+\s*\[\s*\d+\s*\]\s*\)/g, // require(arr[0])
				/require\s*\(\s*[A-Za-z_$]+\s*\(\s*[^)]{20,}\)\s*\)/g, // require(decode(...))
				/\[['"`]require['"`]\]\s*\(/g, // ['require'](...)
			]);
		},
	},

	// ── 13. Self-deletion / evidence wiping ──────────────────────────────────────
	{
		id: "SELF_DELETE",
		severity: "CRITICAL",
		description: "File deletes itself or wipes evidence after running",
		test(src) {
			return matchAll(src, [
				/fs\.unlink.*__filename/g,
				/fs\.unlinkSync.*__filename/g,
				/rimraf.*__dirname/g,
				/process\.argv\[1\].*unlink/g,
			]);
		},
	},

	// ── 14. Exfiltration patterns ────────────────────────────────────────────────
	{
		id: "EXFILTRATION_PATTERN",
		severity: "HIGH",
		description:
			"Reads sensitive files or env vars and sends them over the network",
		test(src) {
			return matchAll(src, [
				/readFileSync.*\.ssh/g,
				/readFileSync.*\.aws/g,
				/readFileSync.*\.env/g,
				/process\.env\.[A-Z_]{4,}.*fetch|fetch.*process\.env\.[A-Z_]{4,}/g,
				/HOME.*\.npmrc.*post|post.*HOME.*\.npmrc/g,
			]);
		},
	},
];

// ─── Helpers ──────────────────────────────────────────────────────────────────

function shannonEntropy(str) {
	const freq = {};
	for (const c of str) freq[c] = (freq[c] || 0) + 1;
	const len = str.length;
	return -Object.values(freq).reduce((acc, f) => {
		const p = f / len;
		return acc + p * Math.log2(p);
	}, 0);
}

function lineOf(src, idx) {
	return src.slice(0, idx).split("\n").length;
}

/** Run one or more regexes; return hits if total unique-line matches >= minHits */
function matchAll(src, patterns, minHits = 1) {
	const hits = [];
	for (const re of patterns) {
		re.lastIndex = 0;
		let m;
		while ((m = re.exec(src)) !== null) {
			hits.push({ line: lineOf(src, m.index), snippet: m[0].slice(0, 120) });
			if (re.lastIndex === m.index) re.lastIndex++; // guard zero-width
		}
	}
	if (hits.length < minHits) return null;
	return hits;
}

// ─── File Walking ──────────────────────────────────────────────────────────────

function* walk(dir) {
	for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
		if (ALWAYS_SKIP.has(entry.name)) continue;
		const full = path.join(dir, entry.name);
		if (entry.isDirectory()) {
			yield* walk(full);
		} else if (
			entry.isFile() &&
			EXTENSIONS_TO_SCAN.has(path.extname(entry.name).toLowerCase())
		) {
			yield full;
		}
	}
}

// ─── Main Scanner ─────────────────────────────────────────────────────────────

function scan(rootDir) {
	const findings = []; // { file, rule, hits }
	let scanned = 0;
	let skipped = 0;

	for (const filePath of walk(rootDir)) {
		const stat = fs.statSync(filePath);
		if (stat.size > MAX_FILE_SIZE_BYTES) {
			skipped++;
			continue;
		}
		if (stat.size === 0) {
			continue;
		}

		let src;
		try {
			src = fs.readFileSync(filePath, "utf8");
		} catch {
			skipped++;
			continue;
		}

		scanned++;
		const relPath = path.relative(rootDir, filePath);

		for (const rule of RULES) {
			try {
				const hits = rule.test(src, filePath);
				if (hits && hits.length > 0) {
					findings.push({ file: relPath, rule, hits });
				}
			} catch (err) {
				// Never let a broken rule crash the whole scan
				process.stderr.write(
					`[WARN] Rule ${rule.id} threw on ${relPath}: ${err.message}\n`,
				);
			}
		}
	}

	return { findings, scanned, skipped };
}

// ─── Reporting ────────────────────────────────────────────────────────────────

const SEVERITY_ORDER = { CRITICAL: 0, HIGH: 1, MEDIUM: 2, LOW: 3 };
const SEVERITY_COLOR = {
	CRITICAL: "\x1b[31;1m", // bold red
	HIGH: "\x1b[33;1m", // bold yellow
	MEDIUM: "\x1b[36m", // cyan
	LOW: "\x1b[37m", // white
};
const RESET = "\x1b[0m";
const BOLD = "\x1b[1m";

function color(sev, text) {
	if (!process.stdout.isTTY) return text;
	return `${SEVERITY_COLOR[sev] || ""}${text}${RESET}`;
}

function report({ findings, scanned, skipped }) {
	const sorted = [...findings].sort(
		(a, b) =>
			(SEVERITY_ORDER[a.rule.severity] ?? 9) -
			(SEVERITY_ORDER[b.rule.severity] ?? 9),
	);

	console.log("\n" + "═".repeat(72));
	console.log(`${BOLD}  Malicious Code Scanner — Results${RESET}`);
	console.log("═".repeat(72));
	console.log(`  Files scanned : ${scanned}`);
	console.log(`  Files skipped : ${skipped}`);
	console.log(`  Findings      : ${sorted.length}`);
	console.log("─".repeat(72));

	if (sorted.length === 0) {
		console.log("\n  ✅  No suspicious patterns detected.\n");
		return 0;
	}

	// Group by severity
	const bySeverity = {};
	for (const f of sorted) {
		(bySeverity[f.rule.severity] ??= []).push(f);
	}

	for (const sev of ["CRITICAL", "HIGH", "MEDIUM", "LOW"]) {
		const group = bySeverity[sev];
		if (!group) continue;
		console.log(`\n  ${color(sev, `── ${sev} (${group.length})`)}`);
		for (const { file, rule, hits } of group) {
			console.log(`\n    ${BOLD}${file}${RESET}`);
			console.log(`    Rule    : ${rule.id}`);
			console.log(`    Detail  : ${rule.description}`);
			const shown = hits.slice(0, 3);
			for (const h of shown) {
				console.log(`    Line ~${h.line}: ${color(sev, h.snippet)}`);
			}
			if (hits.length > 3)
				console.log(`    … and ${hits.length - 3} more occurrences`);
		}
	}

	// Summary counts
	const counts = Object.fromEntries(
		["CRITICAL", "HIGH", "MEDIUM", "LOW"].map((s) => [
			s,
			(bySeverity[s] || []).length,
		]),
	);

	console.log("\n" + "─".repeat(72));
	console.log(
		`  Summary: ` +
			color("CRITICAL", `${counts.CRITICAL} CRITICAL`) +
			"  " +
			color("HIGH", `${counts.HIGH} HIGH`) +
			"  " +
			color("MEDIUM", `${counts.MEDIUM} MEDIUM`) +
			"  " +
			`${counts.LOW} LOW`,
	);
	console.log("═".repeat(72) + "\n");

	// Fail CI on CRITICAL or HIGH
	return counts.CRITICAL + counts.HIGH > 0 ? 1 : 0;
}

// ─── JSON output for upload-artifact / SARIF consumers ───────────────────────

function writeJsonReport(findings, outPath) {
	const out = findings.map(({ file, rule, hits }) => ({
		file,
		rule_id: rule.id,
		severity: rule.severity,
		description: rule.description,
		occurrences: hits,
	}));
	fs.writeFileSync(outPath, JSON.stringify(out, null, 2));
}

// ─── Entry point ─────────────────────────────────────────────────────────────

const targetArg = process.argv[2] || process.cwd();
const jsonOut = process.env.SCAN_JSON_OUT || "";

// Accept either a directory OR a single file as the scan target
let result;
try {
	const targetStat = fs.statSync(targetArg);
	if (targetStat.isFile()) {
		// Single-file mode: scan just that file regardless of extension
		const src = fs.readFileSync(targetArg, "utf8");
		const findings = [];
		for (const rule of RULES) {
			try {
				const hits = rule.test(src, targetArg);
				if (hits && hits.length > 0) {
					findings.push({ file: path.basename(targetArg), rule, hits });
				}
			} catch (err) {
				process.stderr.write(`[WARN] Rule ${rule.id} threw: ${err.message}\n`);
			}
		}
		result = { findings, scanned: 1, skipped: 0 };
	} else {
		result = scan(targetArg);
	}
} catch (err) {
	console.error(`Scanner internal error: ${err.message}`);
	process.exit(2);
}

const exitCode = report(result);

if (jsonOut) {
	try {
		writeJsonReport(result.findings, jsonOut);
		console.log(`JSON report written to: ${jsonOut}`);
	} catch (err) {
		console.error(`Failed to write JSON report: ${err.message}`);
	}
}

process.exit(exitCode);