0xray 3.4.1 → 3.4.3

package/dist/security/prompt-security-validator.d.ts

@@ -0,0 +1,44 @@
+/**
+ * 0xRay Framework - AI Prompt Security Validator
+ *
+ * Specialized security validation for AI agent prompts and responses
+ * Prevents prompt injection, system prompt override, and malicious inputs
+ */
+export interface PromptSecurityConfig {
+    enabled: boolean;
+    maxPromptLength: number;
+    allowedPatterns: RegExp[];
+    blockedPatterns: RegExp[];
+    sanitizeLevel: "basic" | "strict" | "paranoid";
+}
+export interface SecurityValidationResult {
+    isSafe: boolean;
+    violations: string[];
+    sanitizedPrompt?: string | undefined;
+    riskLevel: "low" | "medium" | "high" | "critical";
+}
+export declare class PromptSecurityValidator {
+    private config;
+    constructor(config?: Partial<PromptSecurityConfig>);
+    /**
+     * Validate AI prompt for security issues
+     */
+    validatePrompt(prompt: string): SecurityValidationResult;
+    /**
+     * Check for system prompt override attempts
+     */
+    private containsSystemPromptOverride;
+    /**
+     * Check for prompt injection attempts
+     */
+    private containsInjectionAttempts;
+    /**
+     * Sanitize prompt by removing dangerous patterns
+     */
+    private sanitizePrompt;
+    /**
+     * Validate agent response for safety
+     */
+    validateResponse(response: string): SecurityValidationResult;
+}
+export declare const promptSecurityValidator: PromptSecurityValidator;

package/dist/security/security-agent-coordinator.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Security Agent Integration
+ *
+ * Integrates the security orchestration layer with the framework's agent system.
+ * Provides coordination between security agents using weighted voting.
+ *
+ */
+import { EventEmitter } from "events";
+import { SecurityOrchestrationLayer, SecurityAgent, SecurityDecision, OrchestrationConfig } from "./security-orchestration-layer.js";
+import { Vulnerability } from "./comprehensive-security-audit.js";
+export interface SecurityAgentConfig {
+    agentId: string;
+    agentType: string;
+    capabilities: string[];
+    weight: number;
+}
+export interface SecurityAgentContext {
+    projectPath: string;
+    scanDepth: "shallow" | "medium" | "deep";
+    complianceStandards: string[];
+    enableAutoRemediation: boolean;
+}
+export interface AgentVotingResult {
+    agentId: string;
+    agentName: string;
+    vote: "approve" | "reject" | "abstain";
+    weight: number;
+    reasoning: string;
+    concerns: string[];
+    confidence: number;
+}
+export interface MultiAgentSecurityResult {
+    auditId: string;
+    timestamp: Date;
+    duration: number;
+    participatingAgents: string[];
+    vulnerabilities: Vulnerability[];
+    decisions: SecurityDecision[];
+    agentVotes: AgentVotingResult[];
+    summary: {
+        totalVulnerabilities: number;
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+        securityScore: number;
+        complianceScore: number;
+    };
+    weightedApproval: number;
+    approved: boolean;
+    recommendations: string[];
+}
+export declare class SecurityAgentCoordinator extends EventEmitter {
+    private orchestration;
+    private agentRegistry;
+    private isActive;
+    constructor(config?: Partial<OrchestrationConfig>);
+    private setupEventHandlers;
+    registerAgent(config: SecurityAgentConfig): void;
+    unregisterAgent(agentId: string): boolean;
+    getRegisteredAgents(): SecurityAgentConfig[];
+    runCoordinatedSecurityScan(context: SecurityAgentContext): Promise<MultiAgentSecurityResult>;
+    private collectAgentVotes;
+    private calculateWeightedApproval;
+    getOrchestrationLayer(): SecurityOrchestrationLayer;
+    getActiveAgents(): SecurityAgent[];
+    getPendingTasks(): import("./security-orchestration-layer.js").SecurityTask[];
+    isCoordinatorActive(): boolean;
+}
+export declare function createSecurityAgentCoordinator(config?: Partial<OrchestrationConfig>): SecurityAgentCoordinator;
+export declare function runMultiAgentSecurityScan(projectPath: string, context?: Partial<SecurityAgentContext>): Promise<MultiAgentSecurityResult>;

package/dist/security/security-auditor.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Security Audit Tool
+ *
+ * Comprehensive security auditing for the framework and its components.
+ * Identifies vulnerabilities, misconfigurations, and security weaknesses.
+ *
+ * @since 2026-01-07
+ */
+export interface SecurityIssue {
+    severity: "critical" | "high" | "medium" | "low" | "info";
+    category: string;
+    file: string;
+    line?: number;
+    description: string;
+    recommendation: string;
+    cwe?: string;
+}
+export interface SecurityAuditResult {
+    totalFiles: number;
+    issues: SecurityIssue[];
+    summary: {
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+        info: number;
+    };
+    score: number;
+}
+export declare class SecurityAuditor {
+    private readonly dangerousPatterns;
+    private readonly dangerousImports;
+    /**
+     * Run comprehensive security audit
+     */
+    auditProject(projectPath?: string): Promise<SecurityAuditResult>;
+    private getAllFiles;
+    private shouldSkipDirectory;
+    private shouldAuditFile;
+    private auditFile;
+    private isFalsePositive;
+    private auditImports;
+    private auditFilePermissions;
+    private auditPackageJson;
+    private auditConfiguration;
+    private auditDependencies;
+    private getRecommendationForCategory;
+    private generateSummary;
+    private calculateSecurityScore;
+    /**
+     * Generate security audit report
+     */
+    generateReport(result: SecurityAuditResult): string;
+}
+export declare const securityAuditor: SecurityAuditor;

package/dist/security/security-hardener.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Security Hardening Module
+ *
+ * Implements additional security measures and hardening for the framework.
+ * Addresses vulnerabilities identified during security audit.
+ *
+ * @since 2026-01-07
+ */
+import { SecurityIssue } from "./security-auditor.js";
+export interface SecurityHardeningConfig {
+    enableInputValidation: boolean;
+    enableRateLimiting: boolean;
+    enableAuditLogging: boolean;
+    enableSecureHeaders: boolean;
+    maxRequestSizeBytes: number;
+    rateLimitWindowMs: number;
+    rateLimitMaxRequests: number;
+}
+export declare class SecurityHardener {
+    private config;
+    constructor(config?: Partial<SecurityHardeningConfig>);
+    /**
+     * Apply security hardening based on audit results
+     */
+    hardenSecurity(auditResult: {
+        issues: SecurityIssue[];
+    }): Promise<{
+        appliedFixes: string[];
+        remainingIssues: SecurityIssue[];
+    }>;
+    private applyFixForIssue;
+    private fixHardcodedSecrets;
+    private fixFilePermissions;
+    private fixDependencyManagement;
+    private addInputValidation;
+    /**
+     * Add security headers to HTTP responses
+     */
+    addSecurityHeaders(headers: Record<string, string>): Record<string, string>;
+    /**
+     * Validate input data
+     */
+    validateInput(input: any, schema: any): {
+        valid: boolean;
+        errors: string[];
+    };
+    /**
+     * Check rate limiting
+     */
+    checkRateLimit(identifier: string, requests: Map<string, number[]>): boolean;
+    /**
+     * Log security events
+     */
+    logSecurityEvent(event: {
+        type: string;
+        severity: "low" | "medium" | "high" | "critical";
+        message: string;
+        metadata?: Record<string, any>;
+    }): void;
+}
+export declare const securityHardener: SecurityHardener;

package/dist/security/security-hardening-system.d.ts

@@ -0,0 +1,238 @@
+/**
+ * Security Hardening System
+ *
+ * Comprehensive security hardening implementation with OWASP compliance.
+ * Implements defense-in-depth security architecture for enterprise applications.
+ *
+ * @since 2026-01-08
+ */
+import { EventEmitter } from "events";
+import { IncomingMessage, ServerResponse } from "http";
+export declare const SECURITY_CONFIG: {
+    readonly headers: {
+        readonly "X-Content-Type-Options": "nosniff";
+        readonly "X-Frame-Options": "DENY";
+        readonly "X-XSS-Protection": "1; mode=block";
+        readonly "Strict-Transport-Security": "max-age=31536000; includeSubDomains";
+        readonly "Content-Security-Policy": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'";
+        readonly "Referrer-Policy": "strict-origin-when-cross-origin";
+        readonly "Permissions-Policy": "geolocation=(), microphone=(), camera=()";
+        readonly "Cross-Origin-Embedder-Policy": "require-corp";
+        readonly "Cross-Origin-Opener-Policy": "same-origin";
+        readonly "Cross-Origin-Resource-Policy": "same-origin";
+    };
+    readonly rateLimiting: {
+        readonly windowMs: number;
+        readonly maxRequests: 100;
+        readonly skipSuccessfulRequests: false;
+        readonly skipFailedRequests: false;
+    };
+    readonly inputValidation: {
+        readonly maxStringLength: 10000;
+        readonly maxArrayLength: 1000;
+        readonly maxObjectDepth: 10;
+        readonly allowedCharacters: RegExp;
+        readonly sqlInjectionPatterns: readonly [RegExp, RegExp];
+        readonly xssPatterns: readonly [RegExp, RegExp, RegExp, RegExp];
+    };
+    readonly encryption: {
+        readonly algorithm: "aes-256-gcm";
+        readonly keyLength: 32;
+        readonly ivLength: 16;
+        readonly saltRounds: 12;
+    };
+    readonly audit: {
+        readonly logLevel: "detailed";
+        readonly retentionDays: 90;
+        readonly sensitiveFields: readonly ["password", "token", "secret", "key", "authorization"];
+    };
+};
+export type SecurityEventType = "input_validation_failure" | "rate_limit_exceeded" | "authentication_failure" | "authorization_failure" | "suspicious_activity" | "sql_injection_attempt" | "xss_attempt" | "csrf_attempt" | "security_header_missing" | "encryption_failure" | "audit_log_failure";
+export type SecuritySeverity = "low" | "medium" | "high" | "critical";
+export interface SecurityEvent {
+    id: string;
+    type: SecurityEventType;
+    severity: SecuritySeverity;
+    message: string;
+    source: string;
+    userId?: string;
+    ipAddress?: string;
+    userAgent?: string;
+    timestamp: number;
+    metadata: Record<string, unknown>;
+    stackTrace?: string;
+}
+export interface ValidationResult {
+    isValid: boolean;
+    errors: string[];
+    sanitizedValue?: unknown;
+    securityEvents: SecurityEvent[];
+}
+export interface RateLimitEntry {
+    count: number;
+    resetTime: number;
+    lastRequest: number;
+}
+export interface SecurityMiddlewareOptions {
+    enableRateLimiting?: boolean;
+    enableInputValidation?: boolean;
+    enableSecurityHeaders?: boolean;
+    enableAuditLogging?: boolean;
+    enableCsrfProtection?: boolean;
+    enableHsts?: boolean;
+    customHeaders?: Record<string, string>;
+    trustedOrigins?: string[];
+    rateLimitOptions?: Partial<typeof SECURITY_CONFIG.rateLimiting>;
+}
+/**
+ * Core security hardening system
+ */
+export declare class SecurityHardeningSystem extends EventEmitter {
+    private rateLimitStore;
+    private securityEvents;
+    private encryptionKey;
+    private auditLogEnabled;
+    private started;
+    private pendingEncryptionKey;
+    private boundSecurityEvent;
+    private boundRateLimitExceeded;
+    private boundValidationFailure;
+    constructor(encryptionKey?: string);
+    start(): void;
+    /**
+     * Setup event handlers for security events
+     */
+    private setupEventHandlers;
+    destroy(): void;
+    /**
+     * Create security middleware for HTTP requests
+     */
+    createSecurityMiddleware(options?: SecurityMiddlewareOptions): (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
+    /**
+     * Check rate limiting for requests
+     */
+    private checkRateLimit;
+    /**
+     * Apply security headers to response
+     */
+    private applySecurityHeaders;
+    /**
+     * Validate CSRF token
+     */
+    private validateCsrfToken;
+    /**
+     * Validate and sanitize input data
+     */
+    validateInput(input: unknown, context?: string): ValidationResult;
+    /**
+     * Validate string input
+     */
+    private validateString;
+    /**
+     * Validate object input
+     */
+    private validateObject;
+    /**
+     * Validate array input
+     */
+    private validateArray;
+    /**
+     * Check for security patterns in input
+     */
+    private checkSecurityPatterns;
+    /**
+     * Encrypt sensitive data using AES-256-GCM
+     * SECURITY: Proper encryption with random IV and authentication tag (H-001 fix)
+     *
+     * @param data - Plaintext data to encrypt
+     * @returns Base64-encoded string containing encrypted data + IV + auth tag
+     */
+    encryptData(data: string): string;
+    /**
+     * Decrypt sensitive data using AES-256-GCM
+     * SECURITY: Proper decryption with IV and auth tag verification (H-001 fix)
+     *
+     * @param encryptedData - Base64-encoded string containing encrypted data + IV + auth tag
+     * @returns Decrypted plaintext data
+     * @throws Error if decryption fails or authentication tag doesn't match
+     */
+    decryptData(encryptedData: string): string | null;
+    /**
+     * Hash password securely with unique salt
+     * SECURITY: Generates unique random salt for each password (H-003 fix)
+     */
+    hashPassword(password: string): Promise<{
+        hash: string;
+        salt: string;
+    }>;
+    /**
+     * Verify password hash
+     */
+    verifyPassword(password: string, hash: string, salt: string): Promise<boolean>;
+    /**
+     * Generate secure random token
+     */
+    generateSecureToken(length?: number): string;
+    /**
+     * Log audit event
+     */
+    private logAuditEvent;
+    /**
+     * Sanitize headers for audit logging
+     */
+    private sanitizeHeadersForAudit;
+    /**
+     * Emit security event
+     */
+    private emitSecurityEvent;
+    /**
+     * Handle security events
+     */
+    private handleSecurityEvent;
+    /**
+     * Handle rate limit exceeded
+     */
+    private handleRateLimitExceeded;
+    /**
+     * Handle validation failure
+     */
+    private handleValidationFailure;
+    /**
+     * Get client IP address
+     */
+    private getClientIP;
+    /**
+     * Get rate limit info for IP
+     */
+    private getRateLimitInfo;
+    /**
+     * Get object depth
+     */
+    private getObjectDepth;
+    /**
+     * Cleanup old rate limit entries
+     */
+    private cleanupRateLimitStore;
+    /**
+     * Get security events
+     */
+    getSecurityEvents(limit?: number): SecurityEvent[];
+    /**
+     * Clear security events
+     */
+    clearSecurityEvents(): void;
+    /**
+     * Get security statistics
+     */
+    getSecurityStats(): {
+        totalEvents: number;
+        eventsByType: Record<SecurityEventType, number>;
+        eventsBySeverity: Record<SecuritySeverity, number>;
+        recentEvents: SecurityEvent[];
+    };
+    /**
+     * Enable/disable audit logging
+     */
+    setAuditLogging(enabled: boolean): void;
+}
+export declare const securityHardeningSystem: SecurityHardeningSystem;

package/dist/security/security-headers.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Security Headers Middleware
+ *
+ * Comprehensive security headers implementation for HTTP responses.
+ * Integrates with boot orchestrator and API endpoints.
+ *
+ * @since 2026-01-07
+ */
+export interface HttpResponse {
+    setHeader(name: string, value: string): void;
+}
+export interface ExpressMiddlewareParams {
+    req: unknown;
+    res: HttpResponse;
+    next: (err?: Error) => void;
+}
+export interface FastifyMiddlewareParams {
+    request: unknown;
+    reply: HttpResponse;
+    done: (err?: Error) => void;
+}
+export interface SecurityHeadersConfig {
+    enableCSP: boolean;
+    enableHSTS: boolean;
+    enableFrameOptions: boolean;
+    enableXSSProtection: boolean;
+    enableContentTypeOptions: boolean;
+    enableReferrerPolicy: boolean;
+    enablePermissionsPolicy: boolean;
+    customCSP?: string;
+    hstsMaxAge?: number;
+    hstsIncludeSubdomains?: boolean;
+    hstsPreload?: boolean;
+}
+export declare class SecurityHeadersMiddleware {
+    private config;
+    constructor(config?: Partial<SecurityHeadersConfig>);
+    /**
+     * Apply security headers to HTTP response
+     */
+    applySecurityHeaders(response: HttpResponse): void;
+    /**
+     * Express.js middleware function
+     */
+    getExpressMiddleware(): (req: unknown, res: HttpResponse, next: (err?: Error) => void) => void;
+    /**
+     * Fastify middleware function
+     */
+    getFastifyMiddleware(): (request: unknown, reply: HttpResponse, done: (err?: Error) => void) => void;
+    /**
+     * Generic middleware for any HTTP framework
+     */
+    getMiddleware(): (response: HttpResponse) => void;
+    /**
+     * Update configuration
+     */
+    updateConfig(newConfig: Partial<SecurityHeadersConfig>): void;
+    /**
+     * Get current configuration
+     */
+    getConfig(): SecurityHeadersConfig;
+}
+export declare const securityHeadersMiddleware: SecurityHeadersMiddleware;

package/dist/security/security-orchestration-layer.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Security Orchestration Layer
+ *
+ * Coordinates multiple security agents for comprehensive vulnerability scanning,
+ * automated remediation, and compliance validation using weighted voting
+ * for architectural decisions.
+ *
+ */
+import { EventEmitter } from "events";
+import { Vulnerability, RemediationPlan, ComplianceStandard } from "./comprehensive-security-audit.js";
+export interface SecurityAgent {
+    id: string;
+    name: string;
+    type: SecurityAgentType;
+    weight: number;
+    status: AgentStatus;
+    lastActive?: Date;
+    capabilities: string[];
+}
+export type SecurityAgentType = "security-auditor" | "code-analyzer" | "testing-lead" | "architect" | "vulnerability-scanner" | "compliance-validator" | "remediation-specialist";
+export type AgentStatus = "idle" | "scanning" | "analyzing" | "reporting" | "error";
+export interface OrchestrationConfig {
+    enableWeightedVoting: boolean;
+    enableAutoRemediation: boolean;
+    decisionThreshold: number;
+    agentWeights: Record<SecurityAgentType, number>;
+    scanDepth: "shallow" | "medium" | "deep";
+    complianceStandards: ComplianceStandard[];
+    maxConcurrentAgents: number;
+    timeout: number;
+}
+export interface SecurityTask {
+    id: string;
+    type: SecurityTaskType;
+    priority: "critical" | "high" | "medium" | "low";
+    assignedAgent?: SecurityAgent;
+    status: "pending" | "in-progress" | "completed" | "failed";
+    result?: unknown;
+    error?: string;
+    createdAt: Date;
+    completedAt?: Date;
+}
+export type SecurityTaskType = "vulnerability-scan" | "code-analysis" | "compliance-check" | "remediation" | "threat-detection" | "security-review";
+export interface AgentVote {
+    agentId: string;
+    agentName: string;
+    vote: "approve" | "reject" | "abstain";
+    weight: number;
+    reasoning: string;
+    concerns: string[] | undefined;
+    confidence: number;
+}
+export interface SecurityDecision {
+    id: string;
+    title: string;
+    description: string;
+    type: "approval" | "rejection" | "revision-required";
+    votes: AgentVote[];
+    weightedApproval: number;
+    threshold: number;
+    approved: boolean;
+    timestamp: Date;
+    relatedVulnerabilities: string[] | undefined;
+}
+export interface SecurityOrchestrationReport {
+    auditId: string;
+    timestamp: Date;
+    duration: number;
+    agents: SecurityAgent[];
+    tasks: SecurityTask[];
+    decisions: SecurityDecision[];
+    summary: {
+        totalVulnerabilities: number;
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+        securityScore: number;
+        complianceScore: number;
+    };
+    vulnerabilities: Vulnerability[];
+    prioritizedRemediation: RemediationPlan[];
+    recommendations: string[];
+}
+export declare class SecurityOrchestrationLayer extends EventEmitter {
+    private config;
+    private agents;
+    private tasks;
+    private decisions;
+    private auditSystem;
+    private isRunning;
+    constructor(config?: Partial<OrchestrationConfig>);
+    private initializeAgents;
+    runSecurityOrchestration(projectPath: string): Promise<SecurityOrchestrationReport>;
+    private createTask;
+    private executeVulnerabilityScan;
+    private executeComplianceCheck;
+    private executeRemediationPlanning;
+    private updateAgentStatus;
+    private collectAgentVotes;
+    private generateAgentVote;
+    private makeSecurityDecisions;
+    private createDecision;
+    private generateOrchestrationReport;
+    private calculateSecurityScore;
+    private calculateComplianceScore;
+    private prioritizeRemediation;
+    private estimateFixTime;
+    private generateRecommendations;
+    getAgents(): SecurityAgent[];
+    getAgent(agentId: string): SecurityAgent | undefined;
+    getTasks(): SecurityTask[];
+    getDecisions(): SecurityDecision[];
+    getActiveAgents(): SecurityAgent[];
+    getVulnerabilities(): Vulnerability[];
+}
+export declare function createSecurityOrchestrationLayer(config?: Partial<OrchestrationConfig>): SecurityOrchestrationLayer;
+export declare function runSecurityOrchestration(projectPath: string, config?: Partial<OrchestrationConfig>): Promise<SecurityOrchestrationReport>;