0sec-cli 0.15.0 → 0.18.0

package/chunks/chunk-QI233I24.js

@@ -0,0 +1,333 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+
+// packages/core/dist/stages/appsec-catalog.js
+import { createHash } from "node:crypto";
+import { existsSync, lstatSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// packages/core/dist/stages/data/appsec-archetypes.json
+var appsec_archetypes_default = {
+  provenance: "0sec-authored appsec bug-class registry, 2026-07-21. Mirrors the SCHEMA of kernel-archetypes.json but is a SEPARATE, cross-language application-security pack (domain: appsec), NOT ported from 0verse (0verse's registry is Linux-kernel-only). Grounded in OWASP Top-10 / CWE and in the concrete misses these lenses were built to close: the Swiss engagement's gever OS-command-injection CRITICAL and the sibling-route authz / template-XSS / SSO-trust / resource-exhaustion classes the four generic finder lenses (memory-safety, input-validation, auth-logic, secrets-crypto) under-weighted. Unlike the kernel pack there is NO build/boot/sanitizer lane for these \u2014 every entry is route 'appsec-source-static': a grep/read hit is a hypothesis for the skeptic + multi-lens verify quorum, never an auto-confirmed finding. The load-bearing field for the finder surface is 'challenge_hint' (the cross-language, sink-shape-citing hunt angle), which the loader maps directly onto FinderLens.challengeHint; 'detection_signature' is the human/skeptic-facing grep evidence. 'engine_lens' is null for every entry (no pre-existing engine lens implements these \u2014 this registry IS their implementation).",
+  archetypes: [
+    {
+      id: "os-command-injection",
+      name: "OS command injection via attacker-influenced process/shell exec",
+      cwe: "CWE-78",
+      domain: "appsec",
+      subsystem: "process / shell execution (any runtime)",
+      pattern: "Attacker-controlled data (a request param, header, filename, upload name, DB value, config field) is concatenated or interpolated into a command line, a shell string, or a process argument that is then handed to an OS command/shell interpreter. The sink executes with the app's privileges; even when the base command is fixed, an unescaped argument, a shell metacharacter (; | & $() ` > <), or argument-injection (a value beginning with -) subverts it. The tell is DATA (not developer-authored code) reaching an exec sink without an allow-list, tokenized argv, or a proven-safe escaper.",
+      detection_signature: 'Language-agnostic sink hunt. Node: child_process exec/execSync/spawn/spawnSync/execFile with a shell:true option or a string-built command, template literals inside exec(`...${x}...`). .NET: System.Diagnostics.Process.Start / ProcessStartInfo where FileName is cmd.exe/powershell/bash or Arguments is string-concatenated, UseShellExecute=true. Java: Runtime.getRuntime().exec(String), ProcessBuilder(command) built from concatenation, especially exec("sh", "-c", cmd). Python: subprocess.run/Popen/call with shell=True, os.system, os.popen, commands.getoutput. PHP: system/exec/shell_exec/passthru/proc_open/backticks. Ruby: system/`backticks`/%x/Open3 with interpolation. Perl: system/open with a pipe. Trace the taint from the entry point to the argv/shell string; a fixed argv array with no shell and no attacker-controlled flag is safe.',
+      challenge_hint: "Hunt OS COMMAND INJECTION only, ACROSS ALL LANGUAGES: attacker-influenced data reaching a process/shell exec sink. Look for \u2014 Node child_process exec/execSync/spawn(..., {shell:true})/execFile and backtick-built commands; .NET Process.Start / ProcessStartInfo.FileName=cmd.exe|powershell with a concatenated Arguments (or UseShellExecute=true); Java Runtime.exec(String) / ProcessBuilder built by string concatenation (esp. sh -c); Python subprocess(..., shell=True) / os.system / os.popen; PHP system/exec/shell_exec/passthru/proc_open/backticks; Ruby system/%x/backticks; any string-built shell command. Cite the exact sink (file:line) and the concrete taint path from the entry point (route param, header, filename, upload, config, DB value) to the command string or argv. A fixed argv array with NO shell and NO attacker-controlled leading-dash flag is safe \u2014 do not flag it. This is the class that missed the gever CRITICAL.",
+      grounding: [
+        "CWE-78: Improper Neutralization of Special Elements used in an OS Command",
+        "OWASP Top 10 A03:2021 Injection",
+        "0sec Swiss engagement: gever OS-command-injection CRITICAL (missed by the generic input-validation lens)"
+      ],
+      confirmable: "Source-static hypothesis. A grep/read hit needs the skeptic + multi-lens verify quorum to confirm the argument is genuinely attacker-reachable and not escaped/tokenized upstream; no build/exec lane proves it in this repo.",
+      uid: "appsec/os-command-injection",
+      engine_lens: null,
+      route: "appsec-source-static"
+    },
+    {
+      id: "method-authz-differential",
+      name: "Method-level authorization differential (sibling route/handler missing its siblings' authz + IDOR-by-id)",
+      cwe: "CWE-862",
+      domain: "appsec",
+      subsystem: "web routing / controllers / service layer (any framework)",
+      pattern: "Two or more handlers act on the SAME resource, but one is missing the authorization guard its siblings carry: a controller action without the [Authorize]/policy/role attribute its neighbors have; a service-layer method that mutates or reads an object WITHOUT the ownership/tenant/scope check its Update/Delete siblings enforce; a route that trusts a caller-supplied id and fetches by id alone (IDOR) instead of scoping to the authenticated principal. The vulnerability is the DIFFERENCE between siblings, not the absence of auth everywhere \u2014 the guard exists and is proven necessary on one path and simply omitted on another.",
+      detection_signature: "Compare sibling handlers on one resource. .NET: an action lacking [Authorize]/[Authorize(Policy=...)]/[Authorize(Roles=...)] present on peer actions in the same controller, or a controller relying on a global filter that a specific action opts out of with [AllowAnonymous]. Spring: a @GetMapping/@PostMapping without the @PreAuthorize/@Secured its siblings have, or a SecurityConfig antMatcher that omits one path. Express/Koa/Fastify: a route registered without the requireAuth/authorize middleware its siblings chain. Rails: a controller action skipped in before_action :authorize, or skip_before_action. Service layer (any language): an Update/Delete method that checks resource.ownerId == currentUser before mutating, next to a sibling (e.g. GetById, Export, a bulk op) that fetches/mutates by id with NO such check. Also flag repository calls keyed only by a request-supplied id with no tenant/owner predicate.",
+      challenge_hint: "Hunt METHOD-LEVEL AUTHORIZATION DIFFERENTIALS and IDOR only. Find sibling routes/handlers/methods on the SAME resource where ONE lacks the guard its siblings carry: a controller action missing the [Authorize]/@PreAuthorize/policy/role attribute or requireAuth middleware its peers have; a service method that mutates/reads by id WITHOUT the ownership/tenant/scope check its Update/Delete siblings enforce; a repository/query keyed only on a caller-supplied id with no owner/tenant predicate (IDOR-by-id). The signal is the DIFFERENCE between siblings \u2014 prove the guard is present and necessary on one path and genuinely absent or mis-scoped on the reachable one, not merely that an auth keyword appears somewhere in the file. Cite both the guarded sibling and the unguarded reachable handler (file:line each).",
+      grounding: [
+        "CWE-862: Missing Authorization",
+        "CWE-639: Authorization Bypass Through User-Controlled Key (IDOR)",
+        "OWASP Top 10 A01:2021 Broken Access Control"
+      ],
+      confirmable: "Source-static hypothesis. The skeptic must confirm the sibling truly shares the resource, the guard is genuinely absent (not enforced by a global filter/middleware or an earlier check), and the unguarded path is reachable by a lower-privileged principal.",
+      uid: "appsec/method-authz-differential",
+      engine_lens: null,
+      route: "appsec-source-static"
+    },
+    {
+      id: "template-xss-ssti",
+      name: "Template / HTML-render XSS and server-side template injection (SSTI)",
+      cwe: "CWE-79",
+      domain: "appsec",
+      subsystem: "view / template rendering (client and server frameworks)",
+      pattern: "User- or controller-supplied input reaches an HTML or template render context WITHOUT context-correct escaping \u2014 either interpolated into markup that the browser parses as HTML/JS (XSS), or concatenated into the TEMPLATE SOURCE itself so the engine evaluates attacker text as template code (SSTI, which can reach RCE). This is DATA crossing into a code/markup context, distinct from a template engine legitimately compiling a developer-authored template (that is by-design and NOT a finding).",
+      detection_signature: "Client: Angular bypassSecurityTrustHtml/bypassSecurityTrustScript/bypassSecurityTrustResourceUrl and [innerHTML]=userValue; React dangerouslySetInnerHTML={{__html: userValue}}; Vue v-html=userValue; raw DOM innerHTML/outerHTML/insertAdjacentHTML/document.write with tainted data. Server-side templates: Handlebars triple-mustache {{{x}}} / Handlebars.SafeString(userInput); Velocity/Freemarker/Thymeleaf where user input is spliced into the template STRING (not the model) \u2014 e.g. new Template(userStr) or th:utext with tainted data; JSP <%= %> without <c:out>; Jinja2/Django render_template_string(userStr) / Template(userStr); ERB/Liquid built from user input; EJS/Pug/Mustache raw-output helpers fed tainted data; string concatenation building the template passed to a compile()/render() call. Trace user input to the render/interpolation sink and check for a context-correct escaper on the path.",
+      challenge_hint: "Hunt TEMPLATE/HTML XSS and SERVER-SIDE TEMPLATE INJECTION (SSTI) only. Find user/controller input reaching an HTML or template render without context-correct escaping: Angular bypassSecurityTrustHtml/[innerHTML]; React dangerouslySetInnerHTML; Vue v-html; raw innerHTML/document.write; Handlebars {{{triple}}}/SafeString; Velocity/Freemarker/Thymeleaf(th:utext)/JSP(<%= %>)/Jinja2 render_template_string / Template(userStr) where DATA is spliced into the template SOURCE (SSTI \u2192 possible RCE); EJS/Pug/Mustache raw helpers fed tainted data. Trace the taint from entry point to the render sink and cite the missing/incorrect escaper (file:line). IMPORTANT: a template engine compiling a DEVELOPER-authored template is by-design \u2014 the finding is untrusted DATA reaching the markup/template-code context. Do NOT let the intended-use gate talk you out of hunting this class; hunt it and report the precondition explicitly.",
+      grounding: [
+        "CWE-79: Improper Neutralization of Input During Web Page Generation (XSS)",
+        "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine (SSTI)",
+        "OWASP Top 10 A03:2021 Injection"
+      ],
+      confirmable: "Source-static hypothesis. The skeptic must confirm the sink renders into a browser/template-code context, the escaper is absent or context-wrong, and the input is genuinely untrusted DATA rather than a developer-authored template (the intended-use gate distinguishes these).",
+      uid: "appsec/template-xss-ssti",
+      engine_lens: null,
+      route: "appsec-source-static"
+    },
+    {
+      id: "sso-trust",
+      name: "SSO / identity-federation trust flaw (SAML / OIDC / JWT assertion validation)",
+      cwe: "CWE-347",
+      domain: "appsec",
+      subsystem: "authentication / identity federation (SAML, OIDC, OAuth2, JWT)",
+      pattern: "A relying party accepts a federated identity assertion without fully verifying its authenticity, integrity, or provenance: an unverified or forged SAML assertion/response signature, XML signature wrapping (XSW) where the signed element and the consumed element differ, the IdP\u2194RP allowlist (issuer / audience / entityID / redirect_uri) not enforced SERVER-SIDE, RelayState/redirect_uri reflected or validated with a loose prefix/substring match, or a JWT accepted with alg:none, an unverified signature, or algorithm-confusion (RS256 verified as HS256 with the public key as the HMAC secret). The trust boundary is the assertion \u2014 any gap lets an attacker mint or replay an identity.",
+      detection_signature: "SAML: assertion consumed before/without signature validation, validateSignature disabled or wrapped in try/catch that continues, response parsed with an XML lib vulnerable to XSW, Assertion vs Response signature scope not pinned, audience/issuer/NotOnOrAfter/InResponseTo unchecked. OIDC/OAuth2: id_token accepted without verifying iss/aud/exp/nonce, redirect_uri matched by startsWith/contains instead of exact registered value, state/PKCE absent, IdP discovery/JWKS fetched over an attacker-influenceable URL. JWT: jwt.decode without verify, algorithms allowing 'none', a verify call that trusts the token's own alg header, or an HMAC verify keyed with a public key. Look for the MISSING or bypassable check on the assertion path, not just the presence of a SAML/OIDC library.",
+      challenge_hint: "Hunt SSO / IDENTITY-FEDERATION TRUST flaws only (SAML, OIDC, OAuth2, JWT). Find where a relying party trusts a federated assertion without full server-side verification: unverified/forged SAML signature or signature-validation that continues on failure; XML signature wrapping (signed element \u2260 consumed element); issuer/audience/entityID or redirect_uri allowlist NOT enforced server-side (or matched by startsWith/substring); RelayState/redirect_uri reflection; missing state/nonce/PKCE; JWT with alg:none, unverified signature, or RS256\u2194HS256 algorithm-confusion (public key used as HMAC secret). Prove the specific check on the assertion path is absent or bypassable and cite it (file:line) \u2014 the mere presence of a SAML/OIDC/JWT library is not the finding.",
+      grounding: [
+        "CWE-347: Improper Verification of Cryptographic Signature",
+        "CWE-287: Improper Authentication",
+        "CWE-290: Authentication Bypass by Spoofing",
+        "OWASP Top 10 A07:2021 Identification and Authentication Failures"
+      ],
+      confirmable: "Source-static hypothesis. The skeptic must confirm the assertion is consumed on a path where the specific verification (signature, issuer/audience, redirect_uri exact-match, JWT alg pinning) is genuinely missing or bypassable and reachable by an unauthenticated attacker.",
+      uid: "appsec/sso-trust",
+      engine_lens: null,
+      route: "appsec-source-static"
+    },
+    {
+      id: "resource-exhaustion-dos",
+      name: "Resource-exhaustion / algorithmic DoS from attacker-controlled loop, sleep, or allocation",
+      cwe: "CWE-400",
+      domain: "appsec",
+      subsystem: "request handling / parsing / scheduling (any runtime)",
+      pattern: "An attacker-controlled value drives an unbounded loop, sleep/delay, allocation, decompression, fan-out, or backtracking, with no cap, timeout, or ratio check \u2014 letting a single cheap request consume disproportionate CPU, memory, threads, or time. Includes a header/param fed into a sleep (Retry-After \u2192 Thread.sleep), a decompression ratio / zip-bomb (inflate without a size/ratio limit), catastrophic-backtracking regex (ReDoS) on user input, an unbounded fan-out (N sub-requests from a user-supplied N), and mass-assignment / unbounded collection sizing driven by request data.",
+      detection_signature: "A loop bound, sleep duration, allocation size, or recursion depth read from request data without a clamp: Thread.sleep/setTimeout/time.sleep/Task.Delay whose argument is a parsed header/param (e.g. Retry-After); GZIP/Zip/Inflater/gunzip/zlib reading into an unbounded buffer with no maxSize/ratio guard; new byte[n]/Array(n)/malloc(n)/list * n where n is attacker-supplied; regexes with nested quantifiers ((a+)+, (.*)*, (\\d+)+) matched against user input; a for/while whose iteration count is a request field; JSON/XML/YAML parsed with no depth/size limit; a paginated/batch endpoint taking a user-supplied count/limit with no server cap; ORM/mass-assignment binding an entire request body to a model. Trace the attacker-controlled magnitude to the unbounded consumer.",
+      challenge_hint: "Hunt RESOURCE-EXHAUSTION / ALGORITHMIC DoS only: an attacker-controlled value driving an unbounded loop, sleep, allocation, decompression, fan-out, or regex backtracking with no cap/timeout/ratio. Look for \u2014 a header/param fed into Thread.sleep/setTimeout/time.sleep/Task.Delay (e.g. Retry-After \u2192 sleep); decompression without a size/ratio limit (zip-bomb, Inflater/gunzip/zlib into an unbounded buffer); ReDoS (nested quantifiers on user input); new byte[n]/Array(n)/malloc(n) with attacker-supplied n; a loop whose count is a request field; JSON/XML/YAML parsed with no depth/size limit; an endpoint honoring a user-supplied count/limit with no server cap; mass-assignment binding a whole request body. Cite the attacker-controlled magnitude and the unbounded consumer (file:line) and show there is no clamp on the path.",
+      grounding: [
+        "CWE-400: Uncontrolled Resource Consumption",
+        "CWE-1333: Inefficient Regular Expression Complexity (ReDoS)",
+        "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification / zip-bomb)",
+        "OWASP Top 10 A04:2021 Insecure Design / A05:2021 Security Misconfiguration"
+      ],
+      confirmable: "Source-static hypothesis. The skeptic must confirm the magnitude is genuinely attacker-controlled, the consumer is genuinely unbounded on the reachable path, and the impact is disproportionate (a single request \u2192 outsized CPU/memory/time), not a trivially bounded operation.",
+      uid: "appsec/resource-exhaustion-dos",
+      engine_lens: null,
+      route: "appsec-source-static"
+    }
+  ]
+};
+
+// packages/core/dist/stages/appsec-catalog.js
+function mapRawAppsecArchetypes(raw) {
+  return raw.map((a) => ({
+    uid: a.uid,
+    versionDigest: appsecArchetypeDigest(a),
+    id: a.id,
+    name: a.name,
+    cwe: a.cwe,
+    domain: a.domain,
+    subsystem: a.subsystem,
+    pattern: a.pattern,
+    detectionSignature: a.detection_signature,
+    challengeHint: a.challenge_hint,
+    grounding: [...a.grounding],
+    confirmableNote: a.confirmable,
+    engineLens: a.engine_lens,
+    route: a.route,
+    ...a.source ? { source: a.source } : {},
+    ...a.validated_at ? { validatedAt: a.validated_at } : {},
+    ...a.miss_refs ? { missRefs: [...a.miss_refs] } : {}
+  }));
+}
+var _cache = null;
+function appsecArchetypesPath() {
+  return fileURLToPath(new URL("./data/appsec-archetypes.json", import.meta.url));
+}
+function appsecUserArchetypesPath(homeDir = homedir()) {
+  return join(homeDir, ".0sec", "lenses", "appsec-archetypes.json");
+}
+function activeAppsecLensRegistryPath() {
+  const configured = process.env["0SEC_APPSEC_LENS_REGISTRY"]?.trim();
+  return configured ? resolve(configured) : appsecUserArchetypesPath();
+}
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object")
+    return JSON.stringify(value);
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  const record = value;
+  return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
+}
+function digest(value) {
+  return `sha256:${createHash("sha256").update(canonicalJson(value)).digest("hex")}`;
+}
+function appsecArchetypeDigest(archetype) {
+  return digest(archetype);
+}
+function appsecLensLedgerEntryDigest(entry) {
+  return digest(entry);
+}
+function readAppsecArchetypes() {
+  try {
+    return JSON.parse(readFileSync(appsecArchetypesPath(), "utf8"));
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      throw error;
+    return appsec_archetypes_default;
+  }
+}
+function loadAppsecArchetypes() {
+  if (_cache)
+    return _cache;
+  const raw = readAppsecArchetypes();
+  _cache = mapRawAppsecArchetypes(raw.archetypes);
+  return _cache;
+}
+function appsecArchetypeToFinderLens(a) {
+  return { id: a.id, challengeHint: a.challengeHint, ...a.versionDigest ? { versionDigest: a.versionDigest } : {} };
+}
+var RUNTIME_LENSES_FLAG = "0SEC_RUNTIME_LENSES_ENABLED";
+var RUNTIME_LENSES_ENV = "0SEC_RUNTIME_LENSES";
+var SHA256_DIGEST = /^sha256:[a-f0-9]{64}$/;
+var LENS_ID = /^[a-z0-9][a-z0-9-]{1,63}$/;
+function runtimeLensesEnabled() {
+  return !["", "0", "false", "no"].includes((process.env[RUNTIME_LENSES_FLAG] ?? "").toLowerCase());
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+function isRawAppsecArchetype(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const archetype = value;
+  const isNonEmptyString = (field) => typeof field === "string" && field.trim().length > 0;
+  return isNonEmptyString(archetype.id) && isNonEmptyString(archetype.challenge_hint) && typeof archetype.uid === "string" && typeof archetype.domain === "string" && typeof archetype.name === "string" && typeof archetype.cwe === "string" && typeof archetype.subsystem === "string" && typeof archetype.pattern === "string" && typeof archetype.detection_signature === "string" && typeof archetype.confirmable === "string" && typeof archetype.route === "string" && (archetype.engine_lens === null || typeof archetype.engine_lens === "string") && isStringArray(archetype.grounding);
+}
+function isDurablyValidatedArchetype(value) {
+  if (!isRawAppsecArchetype(value))
+    return false;
+  return LENS_ID.test(value.id) && value.uid === `appsec/${value.id}` && value.domain === "appsec" && value.engine_lens === null && value.route === "appsec-source-static" && value.source === "synthesized" && typeof value.validated_at === "string" && Number.isFinite(Date.parse(value.validated_at)) && value.grounding.length > 0 && value.grounding.every((entry) => entry.trim().length > 0) && Array.isArray(value.miss_refs) && value.miss_refs.length > 0 && value.miss_refs.every((entry) => typeof entry === "string" && entry.trim().length > 0);
+}
+function isAppsecLensLedgerEntry(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const entry = value;
+  return entry.schemaVersion === 1 && Number.isInteger(entry.sequence) && entry.sequence > 0 && typeof entry.occurredAt === "string" && Number.isFinite(Date.parse(entry.occurredAt)) && (entry.type === "promoted" || entry.type === "retired") && typeof entry.lensId === "string" && LENS_ID.test(entry.lensId) && typeof entry.archetypeDigest === "string" && SHA256_DIGEST.test(entry.archetypeDigest) && (entry.previousDigest === null || typeof entry.previousDigest === "string" && SHA256_DIGEST.test(entry.previousDigest)) && typeof entry.entryDigest === "string" && SHA256_DIGEST.test(entry.entryDigest);
+}
+function loadDurableAppsecArchetypes() {
+  const registryPath = activeAppsecLensRegistryPath();
+  if (!existsSync(registryPath))
+    return [];
+  try {
+    const metadata = lstatSync(registryPath);
+    if (!metadata.isFile())
+      throw new Error("registry must be a regular file");
+    if ((metadata.mode & 18) !== 0) {
+      throw new Error("registry must not be group- or world-writable");
+    }
+    const parsed = JSON.parse(readFileSync(registryPath, "utf8"));
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      throw new Error("registry must be a JSON object");
+    }
+    const registry = parsed;
+    if (registry.schemaVersion !== 1 || typeof registry.provenance !== "string" || registry.provenance.trim().length === 0 || !Array.isArray(registry.archetypes) || !Array.isArray(registry.ledger)) {
+      throw new Error("registry must carry schemaVersion 1, provenance, archetypes, and ledger");
+    }
+    const active = /* @__PURE__ */ new Map();
+    let previousDigest = null;
+    for (const [index, rawEntry] of registry.ledger.entries()) {
+      if (!isAppsecLensLedgerEntry(rawEntry))
+        throw new Error(`ledger entry ${index} is malformed`);
+      const entry = rawEntry;
+      if (entry.sequence !== index + 1 || entry.previousDigest !== previousDigest) {
+        throw new Error(`ledger entry ${index} breaks sequence or hash linkage`);
+      }
+      const expectedDigest = appsecLensLedgerEntryDigest({
+        schemaVersion: entry.schemaVersion,
+        sequence: entry.sequence,
+        occurredAt: entry.occurredAt,
+        type: entry.type,
+        lensId: entry.lensId,
+        archetypeDigest: entry.archetypeDigest,
+        previousDigest: entry.previousDigest
+      });
+      if (entry.entryDigest !== expectedDigest)
+        throw new Error(`ledger entry ${index} digest does not match`);
+      if (entry.type === "promoted") {
+        if (active.has(entry.lensId))
+          throw new Error(`ledger promotes active lens '${entry.lensId}' twice`);
+        active.set(entry.lensId, entry.archetypeDigest);
+      } else {
+        if (active.get(entry.lensId) !== entry.archetypeDigest) {
+          throw new Error(`ledger retires unknown or mismatched lens '${entry.lensId}'`);
+        }
+        active.delete(entry.lensId);
+      }
+      previousDigest = entry.entryDigest;
+    }
+    const archetypes = [];
+    for (const rawArchetype of registry.archetypes) {
+      if (!isDurablyValidatedArchetype(rawArchetype)) {
+        throw new Error("registry contains an unvalidated synthesized lens");
+      }
+      if (active.get(rawArchetype.id) !== appsecArchetypeDigest(rawArchetype)) {
+        throw new Error(`registry lens '${rawArchetype.id}' is not bound by its ledger`);
+      }
+      archetypes.push(rawArchetype);
+    }
+    if (active.size !== archetypes.length) {
+      throw new Error("registry ledger and active archetype set disagree");
+    }
+    return archetypes;
+  } catch (error) {
+    console.warn(`[appsec-lens-registry] ignoring ${registryPath}: ${error instanceof Error ? error.message : String(error)}`);
+    return [];
+  }
+}
+function loadRuntimeAppsecLenses() {
+  if (!runtimeLensesEnabled())
+    return [];
+  const blob = process.env[RUNTIME_LENSES_ENV];
+  if (!blob || blob.trim().length === 0)
+    return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(blob);
+  } catch {
+    console.warn(`[appsec-runtime-lenses] ${RUNTIME_LENSES_ENV} is not valid JSON \u2014 falling back to durable lenses`);
+    return [];
+  }
+  if (!Array.isArray(parsed)) {
+    console.warn(`[appsec-runtime-lenses] ${RUNTIME_LENSES_ENV} must be a JSON array \u2014 falling back to durable lenses`);
+    return [];
+  }
+  const valid = [];
+  for (const entry of parsed) {
+    if (isRawAppsecArchetype(entry))
+      valid.push(entry);
+    else
+      console.warn("[appsec-runtime-lenses] skipping malformed runtime lens entry");
+  }
+  return mapRawAppsecArchetypes(valid).map(appsecArchetypeToFinderLens);
+}
+function loadAppsecFinderLenses() {
+  const baked = loadAppsecArchetypes().map(appsecArchetypeToFinderLens);
+  const durable = mapRawAppsecArchetypes(loadDurableAppsecArchetypes()).map(appsecArchetypeToFinderLens);
+  const runtime = loadRuntimeAppsecLenses();
+  const seen = new Set(baked.map((lens) => lens.id));
+  const merged = [...baked];
+  for (const lens of [...durable, ...runtime]) {
+    if (seen.has(lens.id))
+      continue;
+    seen.add(lens.id);
+    merged.push(lens);
+  }
+  return merged;
+}
+
+export {
+  appsecArchetypesPath,
+  appsecUserArchetypesPath,
+  activeAppsecLensRegistryPath,
+  appsecArchetypeDigest,
+  appsecLensLedgerEntryDigest,
+  loadAppsecArchetypes,
+  appsecArchetypeToFinderLens,
+  loadAppsecFinderLenses
+};

package/chunks/chunk-RJWOYEOG.js

@@ -0,0 +1,271 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+
+// packages/core/dist/kernel/exploit/recipes.js
+var RECIPE_LIBRARY = [
+  {
+    id: "dirtyCred",
+    title: "DirtyCred \u2014 privileged-object swap via heap reuse (data-only)",
+    // A UAF (or a refcount bug collapsing to one) on a file/cred object is the
+    // canonical DirtyCred entry; a page-UAF can also be funnelled here.
+    appliesTo: ["uaf", "refcount"],
+    ceiling: "root",
+    preconditions: [
+      "UAF (or refcount-to-UAF) on a `struct file` or `struct cred` \u2014 or any freeable object that can be made to alias one via same-cache reuse",
+      "ability to free the victim object while a dangling reference is still usable (the swap window)",
+      "an unprivileged path that allocates the privileged replacement (e.g. open(/etc/passwd) for a write-capable file, or a setuid exec for a privileged cred)"
+    ],
+    sprayObjects: ["file", "cred"],
+    steps: [
+      "free the unprivileged victim object through the bug, keeping the dangling reference",
+      "spray the privileged counterpart into the freed slot via same-cache reuse (open a write-protected file / trigger a privileged cred alloc)",
+      "use the dangling reference to operate on the now-privileged object (write through the privileged file / run with the swapped cred)"
+    ],
+    finalStep: "file-swap",
+    reliability: "high",
+    // Data-only: no leak, no KASLR/SMEP/SMAP dependence — the whole point.
+    caveats: [
+      "defeated by cred/file slab isolation (vendor DirtyCred mitigation, SLAB_VIRTUAL-era dedicated caches) \u2014 verify the victim shares a cache with the privileged object",
+      "needs a same-cache privileged allocation primitive reachable unprivileged"
+    ],
+    citation: "Lin, Wu, Xing \u2014 DirtyCred (CCS 2022 / Black Hat USA 2022); CVE-2021-4154, CVE-2022-2588"
+  },
+  {
+    id: "dirtyPagetable",
+    title: "Dirty Pagetable \u2014 page-UAF \u2192 PTE poison \u2192 arbitrary physical R/W",
+    appliesTo: ["page-uaf", "uaf"],
+    ceiling: "root",
+    preconditions: [
+      "page-granularity UAF: a freed page (order-0+) returned to the page allocator and reusable across caches",
+      "a dangling write into the freed page after it is reclaimed",
+      "ability to fault in a fresh page-table page (mmap + touch) so the freed page is reused as a PTE-bearing page table"
+    ],
+    sprayObjects: ["pte"],
+    steps: [
+      "free the victim page through the bug (cross-cache it back to the buddy allocator if the bug is slab-granularity \u2014 see crossCacheSlubStick)",
+      "fault in a user page table so the kernel reclaims the freed page as a page-table page",
+      "use the dangling write to forge a PTE pointing at an attacker-chosen physical frame \u2192 arbitrary physical read/write",
+      "locate kernel physmap and overwrite `core_pattern` (or `modprobe_path`) via the physical R/W"
+    ],
+    finalStep: "core_pattern",
+    reliability: "high",
+    caveats: [
+      "needs page-granularity reuse \u2014 a pure slab UAF must be widened with a cross-cache free first (crossCacheSlubStick)",
+      "physmap base discovery still wants a coarse KASLR defeat (EntryBleed prefetch in kctf.h) unless KASLR is off"
+    ],
+    citation: "Nicolas Wu \u2014 Dirty Pagetable writeup; kernelCTF LTS page-UAF winners"
+  },
+  {
+    id: "crossCacheSlubStick",
+    title: "Cross-cache SLUB stick \u2014 slab-UAF \u2192 page reuse bridge",
+    // The bridge: turns a slab-granularity bug into page-granularity reuse so a
+    // downstream recipe (Dirty Pagetable, or an unlike-cache reclaim) applies.
+    appliesTo: ["uaf", "oob-write", "page-uaf"],
+    ceiling: "arb-write",
+    preconditions: [
+      "a slab-cache UAF/OOB whose victim slab can be drained so the whole slab page is freed back to the buddy allocator",
+      "control over allocation/free timing to empty the victim slab"
+    ],
+    sprayObjects: ["msg_msg", "pipe_buffer"],
+    steps: [
+      "groom the victim slab so the bug's object is the last live one",
+      "free the remaining objects so the empty slab page returns to the buddy allocator (the cross-cache free)",
+      "immediately allocate the target page in a DIFFERENT cache (or a page-table page) so it reclaims the freed slab page",
+      "drive the dangling slab-relative write into the reclaimed cross-cache object \u2014 hand off to dirtyPagetable / dirtyCred for the root tail"
+    ],
+    finalStep: "modprobe_path",
+    reliability: "medium",
+    caveats: [
+      "RANDOM_KMALLOC_CACHES and freelist randomization raise the grooming cost (more sprays, lower landing rate)",
+      "a bridge, not a complete chain \u2014 pair it with a root-tail recipe"
+    ],
+    citation: "kernelCTF LTS cross-cache (SLUB) technique; kctf.h sprays"
+  },
+  {
+    id: "msgMsgArbRW",
+    title: "msg_msg / pipe_buffer spray \u2192 arbitrary R/W \u2192 modprobe_path",
+    appliesTo: ["uaf", "oob-write"],
+    ceiling: "root",
+    preconditions: [
+      "UAF or OOB-write in a generic `kmalloc-N` bucket reachable unprivileged",
+      "the victim cache is not bucket-isolated from the spray (SLAB_BUCKETS off, or an accounted spray for a `-cg-` victim)"
+    ],
+    sprayObjects: ["msg_msg", "pipe_buffer", "setxattr"],
+    steps: [
+      "spray msg_msg (or pipe_buffer) to reclaim the freed/adjacent slot",
+      "corrupt the reclaiming object's length/next field to widen into an out-of-bounds read (leak) and then an arbitrary write",
+      "overwrite `modprobe_path` (or `core_pattern`) and trigger it for root"
+    ],
+    finalStep: "modprobe_path",
+    reliability: "medium",
+    caveats: [
+      "SLAB_BUCKETS isolates msg_msg from a plain victim \u2014 see spray-selector.ts",
+      "setxattr is a transient (race) reclaim window; prefer the persistent sprays"
+    ],
+    citation: "kernelCTF LTS msg_msg/pipe_buffer winners; kctf.h sprays"
+  },
+  {
+    id: "fdTableSpray",
+    title: "fd-table spray \u2014 open()-flood grooms `struct file *` fd-arrays",
+    // The bridge/grooming vector: an open() flood expands a task's fdtable so
+    // the kernel allocates fresh `struct file *[]` arrays in a target kmalloc
+    // bucket — a controllable, persistent reclaim object for a slab UAF/OOB, and
+    // the layout target that feeds the fileOpsVtableConfusion tail.
+    appliesTo: ["uaf", "oob-write"],
+    ceiling: "arb-write",
+    preconditions: [
+      "a slab UAF/OOB in a `kmalloc-N` bucket the `struct fdtable` fd-array (`struct file *[]`) can be steered to reclaim",
+      "an unprivileged path to open() many descriptors so `files_struct` grows its `fdtable` and reallocates the fd-array into the victim bucket"
+    ],
+    sprayObjects: ["fdtable", "files_struct", "file"],
+    steps: [
+      "open() a flood of descriptors so the task's `files_struct` expands its `fdtable` and allocates a fresh `struct file *[]` fd-array in the target kmalloc bucket (dup2/dup to size the array precisely)",
+      "free the victim object through the bug, then trigger another fdtable grow so the `struct file *` fd-array reclaims the freed slot",
+      "drive the dangling/OOB write to corrupt a `struct file *` entry in the reclaimed fd-array so a live fd aliases an attacker-shaped `struct file`",
+      "operate through the confused fd \u2014 hand off to fileOpsVtableConfusion for the control-flow / privileged-object tail"
+    ],
+    finalStep: "file-swap",
+    reliability: "medium",
+    caveats: [
+      "the fd-array shares generic `kmalloc-N` \u2014 SLAB_BUCKETS / RANDOM_KMALLOC_CACHES isolate it from a plain victim (groom same-call-site instead)",
+      "a bridge, not a complete chain \u2014 pair it with fileOpsVtableConfusion or a DirtyCred file swap for the root tail"
+    ],
+    citation: "kernelCTF fd-array (files_struct/fdtable) grooming; classic `struct file *` reclaim vector"
+  },
+  {
+    id: "fakeCredOneShot",
+    title: "fake-cred one-shot \u2014 timer/ops UAF \u2192 forged cred + commit_creds hijack (data-only root)",
+    // A UAF (or a refcount bug collapsing to one) on an object that owns an
+    // embedded `timer_list` / callback the kernel re-arms and fires after free.
+    appliesTo: ["uaf", "refcount"],
+    ceiling: "root",
+    preconditions: [
+      "UAF (or refcount-to-UAF) on an object that owns an embedded `timer_list` (or a work/tasklet/ops callback) which the kernel re-arms (mod_timer) and fires AFTER the free",
+      "a same-cache spray that lands in the freed object's kmalloc bucket with fully attacker-controlled bytes (msg_msg via msgsnd is the canonical one \u2014 persists until msgrcv, header 48B)",
+      "the freed object's layout overlaps a forgeable `struct cred`: the callback pointer aliases `cred.euid/egid` (== the indirect-call target) and the object's slack covers cred caps + user/user_ns/ucounts/group_info",
+      "an unprivileged child that can busy-spin so the timer softirq fires in ITS task context (commit_creds escalates `current`)"
+    ],
+    sprayObjects: ["msg_msg"],
+    steps: [
+      "free the victim object through the bug while its timer is still re-armable",
+      "spray a forged `msg_msg` into the freed slot: inject ONLY the `timer_list.function = commit_creds` (leave entry.next/pprev/expires zeroed so detach is safe and timer_pending()==false), and lay a forged cred in the slack (caps=~0, user/user_ns/ucounts/group_info=&init_*)",
+      "let the kernel re-arm the timer (mod_timer on the reclaimed object) \u2014 the re-arm leaves the timer base/flags intact and takes .function from the forged bytes",
+      "the busy-spinning unprivileged child receives the timer softirq: call_timer_fn runs commit_creds(&obj) \u2192 the child is root; normalize euid/fsuid via CAP_SETUID from the forged cap_effective and drop a shell"
+    ],
+    finalStep: "cred-forge",
+    reliability: "high",
+    caveats: [
+      "CFI_CLANG / FineIBT rejects an indirect call to commit_creds from call_timer_fn \u2014 the forward-edge check requires a type-matching target; this one-shot assumes CFI is OFF (as on the proven hid-sony target)",
+      "hardened / KASLR-ON root needs a companion kernel-TEXT infoleak: the physmap leak (MODE_LEAK) recovers page_offset_base (defeats RANDOMIZE_MEMORY) but NOT .text, so commit_creds's slid address is still unknown without a paired text leak",
+      "needs the spray to share a cache with the victim (MEMCG off, or an accounted spray for a -cg- victim) \u2014 verify the bucket match"
+    ],
+    citation: "0sec hid-sony ghl_poke_timer UAF \u2192 LPE (fake-cred one-shot, 9/9 root); DirtyCred-family credential forge without arbitrary R/W"
+  },
+  {
+    id: "workqueueBounceRoot",
+    title: "timer-UAF \u2192 forge-pwq \u2192 kworker process-context bounce \u2192 WWW \u2192 modprobe_path",
+    // The GuitarZero full clean chain (0sec#1215): the poison-tolerant, no-arb-
+    // read sibling of fakeCredOneShot. Where the one-shot fires commit_creds in a
+    // softirq (fatal-fault on any miss), this bounces into PROCESS context via a
+    // real kworker, so a survivable WWW gadget can overwrite modprobe_path and a
+    // miss leaves the box ALIVE. See guitarzero-primitives.ts for the primitives.
+    appliesTo: ["uaf", "refcount"],
+    ceiling: "root",
+    preconditions: [
+      "UAF on an object owning an embedded `timer_list` the kernel re-arms after free (as fakeCredOneShot), reclaimed via a self-address-leakable object (user_key_payload \u2014 keyctl_read exposes the reclaimed bytes)",
+      "a self-address leak (N-object same-bucket timer linkage \u2192 chunk = leaked\u2212344) and the leaked timer-bucket per-CPU pointer",
+      "a kernel-text base (EntryBleed unprivileged, or a companion leak on a virtualized-TSC box) to slide cpu_worker_pools/delayed_work_timer_fn/gadget",
+      "CFI off: the forged work->func indirect call is not forward-edge-checked"
+    ],
+    sprayObjects: ["user_key", "msg_msg"],
+    steps: [
+      "free the timer-owning victim; reclaim with a user_key_payload carrying the forged timer/work layout (leak-then-reoccupy bakes the self-address in)",
+      "leak the chunk self-address + timer-bucket pointer; recover __per_cpu_offset[0] from the bucket + read-back expires",
+      "forge workqueue_struct+pool_workqueue at chunk+256 (256-aligned; get_work_pwq masks the low 8 bits) and point pwq->pool at the computed real cpu_worker_pools[0][0] \u2014 no arbitrary read",
+      "timer.function=delayed_work_timer_fn \u2192 __queue_work \u2192 process_one_work runs work->func in a real kworker (PROCESS context); the self-address-baked work->entry passes the workqueue.c list_empty gate",
+      'work->func = perf_swevent_del (survivable unlink-WWW) writes *(modprobe_path)="/tmp/x"; socket() over an unregistered family fires request_module \u2192 /tmp/x runs as root'
+    ],
+    finalStep: "modprobe_path",
+    reliability: "high",
+    caveats: [
+      "CFI_CLANG / FineIBT forward-edge-checks the work->func indirect call \u2014 the WWW gadget must be a type-matching signed target; the proven chain assumes CFI OFF (kCFI \u21D2 a data-only tail is needed)",
+      "EntryBleed (CVE-2022-4543) supplies the text base bare-metal; it is marginal on a virtualized-TSC (KVM) box (rdtscp buries the prefetch delta) \u2014 supply the base via a companion leak there",
+      "one probabilistic reoccupy race per boot (~2/3; ~96% within 3 boots); a miss bakes clockevents_handle_noop (endbr64;ret) so the box stays ALIVE for retry"
+    ],
+    citation: "0sec hid-sony ghl_poke_timer UAF \u2192 clean unprivileged LPE (/root/ghl-clean/ghl_lpe_clean.c, uid=0 5/7 boots; /root/ghl-full FULL-ROOT); EntryBleed CVE-2022-4543"
+  },
+  {
+    id: "fileOpsVtableConfusion",
+    title: "pipe_buffer/file \u2192 fake file_operations vtable \u2192 fileops hijack (control transfer)",
+    // Type-confusion tail: with an arb-write or UAF over a `struct file` (or a
+    // `pipe_buffer` aliased onto one), overwrite `f_op` / the fd-array's
+    // `fde_file[0]` to point at an attacker-shaped `file_operations`, then invoke
+    // a fileop (->unlocked_ioctl / ->release) to hijack the slot and transfer
+    // control (commit_creds(prepare_kernel_cred(0)) or a stack pivot).
+    appliesTo: ["uaf", "oob-write"],
+    ceiling: "root",
+    preconditions: [
+      "an arbitrary write, or a UAF/OOB, over a `struct file` (or a `pipe_buffer` that can be aliased onto one \u2014 see fdTableSpray)",
+      "a kernel-readable location holding an attacker-shaped `file_operations` (sprayed pipe_buffer/msg_msg payload, or a known writable global)",
+      "an unprivileged path to invoke a fileop on the confused fd (ioctl/read/close) so the hijacked slot is called"
+    ],
+    sprayObjects: ["file", "pipe_buffer", "fdtable"],
+    steps: [
+      "overwrite the victim `struct file`'s `f_op` (or the fd-array's `fde_file[0]` \u2192 its `f_op`) with a pointer to a fake `file_operations`",
+      "populate the fake `file_operations` so the targeted slot (`->unlocked_ioctl` / `->release`) points at the control-transfer gadget",
+      "invoke the fileop on the confused fd (ioctl / close) to call the hijacked slot \u2014 transfer control to the gadget",
+      "run `commit_creds(prepare_kernel_cred(0))` (or pivot) from the hijacked fileop to overwrite the current task's creds \u2192 root"
+    ],
+    finalStep: "cred-overwrite",
+    reliability: "medium",
+    caveats: [
+      "CFI / FineIBT rejects an arbitrary indirect call target \u2014 the fake `->ioctl` must land on a type-matching signed gadget, not raw shellcode",
+      "KASLR requires a text/heap leak first to place the fake vtable + gadget (pair with a leak primitive in library.ts)",
+      "read-only `struct file.f_op` in some builds \u2014 confuse via a controllable `pipe_buffer`/fd-array alias rather than an in-place `f_op` write"
+    ],
+    citation: "classic fake-file_operations / vtable hijack; pipe_buffer & fd-array type-confusion (kernelCTF fileops slot hijack)"
+  }
+];
+function getRecipe(id) {
+  return RECIPE_LIBRARY.find((r) => r.id === id);
+}
+
+// packages/core/dist/kernel/exploit/strategy.js
+var ESCALATION_LADDER = [
+  "none",
+  "attempted",
+  "triggered",
+  "reclaim",
+  "arb-read",
+  "arb-write",
+  "root"
+];
+function rungRank(rung) {
+  const rank = ESCALATION_LADDER.indexOf(rung);
+  return rank < 0 ? 0 : rank;
+}
+function maxRung(a, b) {
+  return rungRank(a) >= rungRank(b) ? a : b;
+}
+function ratchet(current, observed) {
+  return maxRung(current, observed);
+}
+function rungAtLeast(rung, floor) {
+  return rungRank(rung) >= rungRank(floor);
+}
+function ladderUpTo(ceiling) {
+  const ceil = rungRank(ceiling);
+  return ESCALATION_LADDER.filter((rung) => rung !== "none" && rungRank(rung) <= ceil);
+}
+
+export {
+  ESCALATION_LADDER,
+  rungRank,
+  maxRung,
+  ratchet,
+  rungAtLeast,
+  ladderUpTo,
+  RECIPE_LIBRARY,
+  getRecipe
+};