0xray 2.0.0 → 2.1.0

package/dist/security/comprehensive-security-audit.d.ts

@@ -0,0 +1,158 @@
+/**
+ * 0xRay Comprehensive Security Audit System
+ *
+ * Multi-agent security audit system with vulnerability scanning,
+ * automated remediation, compliance checking, and weighted voting
+ * for architectural decisions.
+ *
+ * @version 1.22.13
+ */
+export type SeverityLevel = "critical" | "high" | "medium" | "low" | "info";
+export type ComplianceStandard = "owasp-top-10" | "cwe" | "nist" | "iso-27001" | "pci-dss";
+export interface Vulnerability {
+    id: string;
+    title: string;
+    severity: SeverityLevel;
+    category: VulnerabilityCategory;
+    cwe: string;
+    owasp?: string | undefined;
+    file: string;
+    line: number;
+    column?: number | undefined;
+    description: string;
+    impact: string;
+    recommendation: string;
+    codeSnippet: string;
+    confidence: number;
+    autoRemediation?: RemediationStep[] | undefined;
+}
+export type VulnerabilityCategory = "injection" | "authentication" | "authorization" | "cryptography" | "configuration" | "data-protection" | "input-validation" | "sensitive-data-exposure" | "security-misconfiguration" | "dependency-vulnerability";
+export interface RemediationStep {
+    step: number;
+    action: string;
+    code?: string | undefined;
+    file?: string | undefined;
+    line?: number | undefined;
+    estimatedEffort: "low" | "medium" | "high";
+    automated: boolean;
+}
+export interface SecurityAuditConfig {
+    projectPath: string;
+    scanDepth?: "shallow" | "medium" | "deep";
+    includeDependencies?: boolean;
+    complianceStandards?: ComplianceStandard[];
+    enableAutoRemediation?: boolean;
+    enableWeightedVoting?: boolean;
+    agentWeights?: Record<string, number>;
+    outputPath?: string | undefined;
+}
+export interface WeightedVote {
+    agentId: string;
+    agentName: string;
+    vote: "approve" | "reject" | "abstain";
+    weight: number;
+    reasoning: string;
+    concerns?: string[] | undefined;
+}
+export interface ArchitecturalDecision {
+    id: string;
+    title: string;
+    description: string;
+    proposedBy: string;
+    votes: WeightedVote[];
+    finalDecision: "approved" | "rejected" | "needs-revision";
+    approvedBy: WeightedVote[];
+    rejectedBy: WeightedVote[];
+    timestamp: Date;
+}
+export interface ComplianceResult {
+    standard: ComplianceStandard;
+    passed: boolean;
+    score: number;
+    findings: Vulnerability[];
+    recommendations: string[];
+}
+export interface SecurityAuditReport {
+    metadata: {
+        auditId: string;
+        timestamp: Date;
+        projectPath: string;
+        totalFilesScanned: number;
+        duration: number;
+    };
+    summary: {
+        totalVulnerabilities: number;
+        bySeverity: Record<SeverityLevel, number>;
+        byCategory: Record<VulnerabilityCategory, number>;
+        securityScore: number;
+        complianceScore: number;
+    };
+    vulnerabilities: Vulnerability[];
+    compliance: ComplianceResult[];
+    remediation: {
+        totalIssues: number;
+        automatable: number;
+        manualRequired: number;
+        estimatedFixTime: string;
+        prioritizedFixes: RemediationPlan[];
+    };
+    architecturalDecisions: ArchitecturalDecision[];
+    agentConsensus: {
+        participatingAgents: string[];
+        averageAgreement: number;
+        contentiousIssues: Vulnerability[];
+    } | undefined;
+}
+export interface RemediationPlan {
+    vulnerabilityId: string;
+    title: string;
+    severity: SeverityLevel;
+    priority: number;
+    steps: RemediationStep[];
+    dependencies: string[];
+    estimatedTime: string;
+}
+export declare class ComprehensiveSecurityAuditSystem {
+    private config;
+    private vulnerabilities;
+    private architecturalDecisions;
+    private agentVotes;
+    private readonly severityWeights;
+    private readonly defaultAgentWeights;
+    private readonly dangerousPatterns;
+    constructor(config: SecurityAuditConfig);
+    runAudit(): Promise<SecurityAuditReport>;
+    private getProjectFiles;
+    private auditFile;
+    private createVulnerability;
+    private isFalsePositive;
+    private auditImports;
+    private auditDependencies;
+    private checkCompliance;
+    private evaluateStandard;
+    private evaluateOWASP;
+    private evaluateCWE;
+    private evaluateNIST;
+    private evaluateISO27001;
+    private evaluatePCIDSS;
+    private groupByCategory;
+    private generateRemediationPlan;
+    private prioritizeFixes;
+    private estimateFixTime;
+    private estimateFixTimeForVuln;
+    private calculateSummary;
+    private collectAgentVotes;
+    private simulateAgentVote;
+    private resolveArchitecturalDecisions;
+    private calculateAgentConsensus;
+    private saveReport;
+    generateMarkdownReport(report: SecurityAuditReport): string;
+    private getScoreEmoji;
+    private getSeverityEmoji;
+    addVote(vote: WeightedVote): void;
+    getVulnerabilities(): Vulnerability[];
+    getArchitecturalDecisions(): ArchitecturalDecision[];
+}
+export declare function createSecurityAuditSystem(config: SecurityAuditConfig): ComprehensiveSecurityAuditSystem;
+export declare function runQuickSecurityAudit(projectPath: string): Promise<SecurityAuditReport>;
+export declare function runDeepSecurityAudit(projectPath: string, outputPath?: string): Promise<SecurityAuditReport>;

package/dist/security/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * 0xRay AI v1.22.60 - Security Module Index
+ * Unified exports for the comprehensive security system
+ */
+export { SecurityScanner, securityScanner } from "./security-scanner.js";
+export { PromptSecurityValidator, promptSecurityValidator, } from "./prompt-security-validator.js";
+export * from "./security-headers.js";
+export * from "./security-hardening-system.js";
+export * from "./security-hardener.js";
+export * from "./security-auditor.js";
+export { ComprehensiveSecurityAuditSystem, createSecurityAuditSystem, runQuickSecurityAudit, runDeepSecurityAudit, type Vulnerability, type VulnerabilityCategory, type SeverityLevel, type RemediationStep, type RemediationPlan, type SecurityAuditConfig, type SecurityAuditReport, type WeightedVote, type ArchitecturalDecision, type ComplianceResult, type ComplianceStandard, } from "./comprehensive-security-audit.js";
+export { SecurityOrchestrationLayer, createSecurityOrchestrationLayer, runSecurityOrchestration, type SecurityAgent, type SecurityAgentType, type AgentStatus, type SecurityTask, type SecurityTaskType, type AgentVote, type SecurityDecision, type OrchestrationConfig, type SecurityOrchestrationReport, } from "./security-orchestration-layer.js";
+export { SecurityAgentCoordinator, createSecurityAgentCoordinator, runMultiAgentSecurityScan, type SecurityAgentConfig, type SecurityAgentContext, type AgentVotingResult, type MultiAgentSecurityResult, } from "./security-agent-coordinator.js";

package/dist/security/prompt-security-validator.d.ts

@@ -0,0 +1,44 @@
+/**
+ * 0xRay Framework - AI Prompt Security Validator
+ *
+ * Specialized security validation for AI agent prompts and responses
+ * Prevents prompt injection, system prompt override, and malicious inputs
+ */
+export interface PromptSecurityConfig {
+    enabled: boolean;
+    maxPromptLength: number;
+    allowedPatterns: RegExp[];
+    blockedPatterns: RegExp[];
+    sanitizeLevel: "basic" | "strict" | "paranoid";
+}
+export interface SecurityValidationResult {
+    isSafe: boolean;
+    violations: string[];
+    sanitizedPrompt?: string | undefined;
+    riskLevel: "low" | "medium" | "high" | "critical";
+}
+export declare class PromptSecurityValidator {
+    private config;
+    constructor(config?: Partial<PromptSecurityConfig>);
+    /**
+     * Validate AI prompt for security issues
+     */
+    validatePrompt(prompt: string): SecurityValidationResult;
+    /**
+     * Check for system prompt override attempts
+     */
+    private containsSystemPromptOverride;
+    /**
+     * Check for prompt injection attempts
+     */
+    private containsInjectionAttempts;
+    /**
+     * Sanitize prompt by removing dangerous patterns
+     */
+    private sanitizePrompt;
+    /**
+     * Validate agent response for safety
+     */
+    validateResponse(response: string): SecurityValidationResult;
+}
+export declare const promptSecurityValidator: PromptSecurityValidator;

package/dist/security/security-agent-coordinator.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Security Agent Integration
+ *
+ * Integrates the security orchestration layer with the framework's agent system.
+ * Provides coordination between security agents using weighted voting.
+ *
+ * @version 1.22.13
+ */
+import { EventEmitter } from "events";
+import { SecurityOrchestrationLayer, SecurityAgent, SecurityDecision, OrchestrationConfig } from "./security-orchestration-layer.js";
+import { Vulnerability } from "./comprehensive-security-audit.js";
+export interface SecurityAgentConfig {
+    agentId: string;
+    agentType: string;
+    capabilities: string[];
+    weight: number;
+}
+export interface SecurityAgentContext {
+    projectPath: string;
+    scanDepth: "shallow" | "medium" | "deep";
+    complianceStandards: string[];
+    enableAutoRemediation: boolean;
+}
+export interface AgentVotingResult {
+    agentId: string;
+    agentName: string;
+    vote: "approve" | "reject" | "abstain";
+    weight: number;
+    reasoning: string;
+    concerns: string[];
+    confidence: number;
+}
+export interface MultiAgentSecurityResult {
+    auditId: string;
+    timestamp: Date;
+    duration: number;
+    participatingAgents: string[];
+    vulnerabilities: Vulnerability[];
+    decisions: SecurityDecision[];
+    agentVotes: AgentVotingResult[];
+    summary: {
+        totalVulnerabilities: number;
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+        securityScore: number;
+        complianceScore: number;
+    };
+    weightedApproval: number;
+    approved: boolean;
+    recommendations: string[];
+}
+export declare class SecurityAgentCoordinator extends EventEmitter {
+    private orchestration;
+    private agentRegistry;
+    private isActive;
+    constructor(config?: Partial<OrchestrationConfig>);
+    private setupEventHandlers;
+    registerAgent(config: SecurityAgentConfig): void;
+    unregisterAgent(agentId: string): boolean;
+    getRegisteredAgents(): SecurityAgentConfig[];
+    runCoordinatedSecurityScan(context: SecurityAgentContext): Promise<MultiAgentSecurityResult>;
+    private collectAgentVotes;
+    private calculateWeightedApproval;
+    getOrchestrationLayer(): SecurityOrchestrationLayer;
+    getActiveAgents(): SecurityAgent[];
+    getPendingTasks(): import("./security-orchestration-layer.js").SecurityTask[];
+    isCoordinatorActive(): boolean;
+}
+export declare function createSecurityAgentCoordinator(config?: Partial<OrchestrationConfig>): SecurityAgentCoordinator;
+export declare function runMultiAgentSecurityScan(projectPath: string, context?: Partial<SecurityAgentContext>): Promise<MultiAgentSecurityResult>;

package/dist/security/security-auditor.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Security Audit Tool
+ *
+ * Comprehensive security auditing for the framework and its components.
+ * Identifies vulnerabilities, misconfigurations, and security weaknesses.
+ *
+ * @version 1.0.0
+ * @since 2026-01-07
+ */
+export interface SecurityIssue {
+    severity: "critical" | "high" | "medium" | "low" | "info";
+    category: string;
+    file: string;
+    line?: number;
+    description: string;
+    recommendation: string;
+    cwe?: string;
+}
+export interface SecurityAuditResult {
+    totalFiles: number;
+    issues: SecurityIssue[];
+    summary: {
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+        info: number;
+    };
+    score: number;
+}
+export declare class SecurityAuditor {
+    private readonly dangerousPatterns;
+    private readonly dangerousImports;
+    /**
+     * Run comprehensive security audit
+     */
+    auditProject(projectPath?: string): Promise<SecurityAuditResult>;
+    private getAllFiles;
+    private shouldSkipDirectory;
+    private shouldAuditFile;
+    private auditFile;
+    private isFalsePositive;
+    private auditImports;
+    private auditFilePermissions;
+    private auditPackageJson;
+    private auditConfiguration;
+    private auditDependencies;
+    private getRecommendationForCategory;
+    private generateSummary;
+    private calculateSecurityScore;
+    /**
+     * Generate security audit report
+     */
+    generateReport(result: SecurityAuditResult): string;
+}
+export declare const securityAuditor: SecurityAuditor;

package/dist/security/security-hardener.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Security Hardening Module
+ *
+ * Implements additional security measures and hardening for the framework.
+ * Addresses vulnerabilities identified during security audit.
+ *
+ * @version 1.0.0
+ * @since 2026-01-07
+ */
+import { SecurityIssue } from "./security-auditor.js";
+export interface SecurityHardeningConfig {
+    enableInputValidation: boolean;
+    enableRateLimiting: boolean;
+    enableAuditLogging: boolean;
+    enableSecureHeaders: boolean;
+    maxRequestSizeBytes: number;
+    rateLimitWindowMs: number;
+    rateLimitMaxRequests: number;
+}
+export declare class SecurityHardener {
+    private config;
+    constructor(config?: Partial<SecurityHardeningConfig>);
+    /**
+     * Apply security hardening based on audit results
+     */
+    hardenSecurity(auditResult: {
+        issues: SecurityIssue[];
+    }): Promise<{
+        appliedFixes: string[];
+        remainingIssues: SecurityIssue[];
+    }>;
+    private applyFixForIssue;
+    private fixHardcodedSecrets;
+    private fixFilePermissions;
+    private fixDependencyManagement;
+    private addInputValidation;
+    /**
+     * Add security headers to HTTP responses
+     */
+    addSecurityHeaders(headers: Record<string, string>): Record<string, string>;
+    /**
+     * Validate input data
+     */
+    validateInput(input: any, schema: any): {
+        valid: boolean;
+        errors: string[];
+    };
+    /**
+     * Check rate limiting
+     */
+    checkRateLimit(identifier: string, requests: Map<string, number[]>): boolean;
+    /**
+     * Log security events
+     */
+    logSecurityEvent(event: {
+        type: string;
+        severity: "low" | "medium" | "high" | "critical";
+        message: string;
+        metadata?: Record<string, any>;
+    }): void;
+}
+export declare const securityHardener: SecurityHardener;

package/dist/security/security-hardening-system.d.ts

@@ -0,0 +1,239 @@
+/**
+ * Security Hardening System
+ *
+ * Comprehensive security hardening implementation with OWASP compliance.
+ * Implements defense-in-depth security architecture for enterprise applications.
+ *
+ * @version 1.0.0
+ * @since 2026-01-08
+ */
+import { EventEmitter } from "events";
+import { IncomingMessage, ServerResponse } from "http";
+export declare const SECURITY_CONFIG: {
+    readonly headers: {
+        readonly "X-Content-Type-Options": "nosniff";
+        readonly "X-Frame-Options": "DENY";
+        readonly "X-XSS-Protection": "1; mode=block";
+        readonly "Strict-Transport-Security": "max-age=31536000; includeSubDomains";
+        readonly "Content-Security-Policy": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'";
+        readonly "Referrer-Policy": "strict-origin-when-cross-origin";
+        readonly "Permissions-Policy": "geolocation=(), microphone=(), camera=()";
+        readonly "Cross-Origin-Embedder-Policy": "require-corp";
+        readonly "Cross-Origin-Opener-Policy": "same-origin";
+        readonly "Cross-Origin-Resource-Policy": "same-origin";
+    };
+    readonly rateLimiting: {
+        readonly windowMs: number;
+        readonly maxRequests: 100;
+        readonly skipSuccessfulRequests: false;
+        readonly skipFailedRequests: false;
+    };
+    readonly inputValidation: {
+        readonly maxStringLength: 10000;
+        readonly maxArrayLength: 1000;
+        readonly maxObjectDepth: 10;
+        readonly allowedCharacters: RegExp;
+        readonly sqlInjectionPatterns: readonly [RegExp, RegExp];
+        readonly xssPatterns: readonly [RegExp, RegExp, RegExp, RegExp];
+    };
+    readonly encryption: {
+        readonly algorithm: "aes-256-gcm";
+        readonly keyLength: 32;
+        readonly ivLength: 16;
+        readonly saltRounds: 12;
+    };
+    readonly audit: {
+        readonly logLevel: "detailed";
+        readonly retentionDays: 90;
+        readonly sensitiveFields: readonly ["password", "token", "secret", "key", "authorization"];
+    };
+};
+export type SecurityEventType = "input_validation_failure" | "rate_limit_exceeded" | "authentication_failure" | "authorization_failure" | "suspicious_activity" | "sql_injection_attempt" | "xss_attempt" | "csrf_attempt" | "security_header_missing" | "encryption_failure" | "audit_log_failure";
+export type SecuritySeverity = "low" | "medium" | "high" | "critical";
+export interface SecurityEvent {
+    id: string;
+    type: SecurityEventType;
+    severity: SecuritySeverity;
+    message: string;
+    source: string;
+    userId?: string;
+    ipAddress?: string;
+    userAgent?: string;
+    timestamp: number;
+    metadata: Record<string, unknown>;
+    stackTrace?: string;
+}
+export interface ValidationResult {
+    isValid: boolean;
+    errors: string[];
+    sanitizedValue?: unknown;
+    securityEvents: SecurityEvent[];
+}
+export interface RateLimitEntry {
+    count: number;
+    resetTime: number;
+    lastRequest: number;
+}
+export interface SecurityMiddlewareOptions {
+    enableRateLimiting?: boolean;
+    enableInputValidation?: boolean;
+    enableSecurityHeaders?: boolean;
+    enableAuditLogging?: boolean;
+    enableCsrfProtection?: boolean;
+    enableHsts?: boolean;
+    customHeaders?: Record<string, string>;
+    trustedOrigins?: string[];
+    rateLimitOptions?: Partial<typeof SECURITY_CONFIG.rateLimiting>;
+}
+/**
+ * Core security hardening system
+ */
+export declare class SecurityHardeningSystem extends EventEmitter {
+    private rateLimitStore;
+    private securityEvents;
+    private encryptionKey;
+    private auditLogEnabled;
+    private started;
+    private pendingEncryptionKey;
+    private boundSecurityEvent;
+    private boundRateLimitExceeded;
+    private boundValidationFailure;
+    constructor(encryptionKey?: string);
+    start(): void;
+    /**
+     * Setup event handlers for security events
+     */
+    private setupEventHandlers;
+    destroy(): void;
+    /**
+     * Create security middleware for HTTP requests
+     */
+    createSecurityMiddleware(options?: SecurityMiddlewareOptions): (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
+    /**
+     * Check rate limiting for requests
+     */
+    private checkRateLimit;
+    /**
+     * Apply security headers to response
+     */
+    private applySecurityHeaders;
+    /**
+     * Validate CSRF token
+     */
+    private validateCsrfToken;
+    /**
+     * Validate and sanitize input data
+     */
+    validateInput(input: unknown, context?: string): ValidationResult;
+    /**
+     * Validate string input
+     */
+    private validateString;
+    /**
+     * Validate object input
+     */
+    private validateObject;
+    /**
+     * Validate array input
+     */
+    private validateArray;
+    /**
+     * Check for security patterns in input
+     */
+    private checkSecurityPatterns;
+    /**
+     * Encrypt sensitive data using AES-256-GCM
+     * SECURITY: Proper encryption with random IV and authentication tag (H-001 fix)
+     *
+     * @param data - Plaintext data to encrypt
+     * @returns Base64-encoded string containing encrypted data + IV + auth tag
+     */
+    encryptData(data: string): string;
+    /**
+     * Decrypt sensitive data using AES-256-GCM
+     * SECURITY: Proper decryption with IV and auth tag verification (H-001 fix)
+     *
+     * @param encryptedData - Base64-encoded string containing encrypted data + IV + auth tag
+     * @returns Decrypted plaintext data
+     * @throws Error if decryption fails or authentication tag doesn't match
+     */
+    decryptData(encryptedData: string): string | null;
+    /**
+     * Hash password securely with unique salt
+     * SECURITY: Generates unique random salt for each password (H-003 fix)
+     */
+    hashPassword(password: string): Promise<{
+        hash: string;
+        salt: string;
+    }>;
+    /**
+     * Verify password hash
+     */
+    verifyPassword(password: string, hash: string, salt: string): Promise<boolean>;
+    /**
+     * Generate secure random token
+     */
+    generateSecureToken(length?: number): string;
+    /**
+     * Log audit event
+     */
+    private logAuditEvent;
+    /**
+     * Sanitize headers for audit logging
+     */
+    private sanitizeHeadersForAudit;
+    /**
+     * Emit security event
+     */
+    private emitSecurityEvent;
+    /**
+     * Handle security events
+     */
+    private handleSecurityEvent;
+    /**
+     * Handle rate limit exceeded
+     */
+    private handleRateLimitExceeded;
+    /**
+     * Handle validation failure
+     */
+    private handleValidationFailure;
+    /**
+     * Get client IP address
+     */
+    private getClientIP;
+    /**
+     * Get rate limit info for IP
+     */
+    private getRateLimitInfo;
+    /**
+     * Get object depth
+     */
+    private getObjectDepth;
+    /**
+     * Cleanup old rate limit entries
+     */
+    private cleanupRateLimitStore;
+    /**
+     * Get security events
+     */
+    getSecurityEvents(limit?: number): SecurityEvent[];
+    /**
+     * Clear security events
+     */
+    clearSecurityEvents(): void;
+    /**
+     * Get security statistics
+     */
+    getSecurityStats(): {
+        totalEvents: number;
+        eventsByType: Record<SecurityEventType, number>;
+        eventsBySeverity: Record<SecuritySeverity, number>;
+        recentEvents: SecurityEvent[];
+    };
+    /**
+     * Enable/disable audit logging
+     */
+    setAuditLogging(enabled: boolean): void;
+}
+export declare const securityHardeningSystem: SecurityHardeningSystem;