sast

# sast ## Purpose Unified static analysis tool runner. While `sentinel` does regex-based security pattern matching and `verification` runs lint/type/test/build, SAST goes deeper — running dedicated static analysis tools that understand data flow, taint tracking, and language-specific vulnerability patterns. Sentinel catches obvious patterns (hardcoded secrets, SQL string concat). SAST catches subtle ones (tainted data flowing through 3 function calls to a sink, unsafe deserialization behind a wrapper). ## Triggers - Called by `sentinel` (L2) when deep analysis needed beyond pattern matching - Called by `audit` (L2) during security dimension assessment - Called by `cook` (L1) on security-sensitive code (auth, crypto, payments) - `/rune sast` — manual static analysis scan ## Calls (outbound) None — pure runner using Bash for all tools. ## Called By (inbound) - `sentinel` (L2): deep analysis beyond regex patterns - `audit` (L2): security dimension in full audit - `cook` (L1): security-sensitive code paths - `review` (L2): when security patterns detected in diff ## Execution ### Step 1 — Detect Language and Tools Use `Glob` to detect project language and available tools: | Indicator | Language | Primary Tool | Fallback | |---|---|---|---| | `package.json` | JavaScript/TypeScript | `npx eslint --ext .js,.ts,.tsx` | `npx oxlint` | | `tsconfig.json` | TypeScript | `npx tsc --noEmit` + ESLint | — | | `pyproject.toml` / `setup.py` | Python | `bandit -r . -f json` | `ruff ...