0xray 4.0.11 → 4.0.13

package/dist/security/index.d.ts

@@ -1,13 +0,0 @@
-/**
- * 0xRay AI v1.22.60 - Security Module Index
- * Unified exports for the comprehensive security system
- */
-export { SecurityScanner, securityScanner } from "./security-scanner.js";
-export { PromptSecurityValidator, promptSecurityValidator, } from "./prompt-security-validator.js";
-export * from "./security-headers.js";
-export * from "./security-hardening-system.js";
-export * from "./security-hardener.js";
-export * from "./security-auditor.js";
-export { ComprehensiveSecurityAuditSystem, createSecurityAuditSystem, runQuickSecurityAudit, runDeepSecurityAudit, type Vulnerability, type VulnerabilityCategory, type SeverityLevel, type RemediationStep, type RemediationPlan, type SecurityAuditConfig, type SecurityAuditReport, type WeightedVote, type ArchitecturalDecision, type ComplianceResult, type ComplianceStandard, } from "./comprehensive-security-audit.js";
-export { SecurityOrchestrationLayer, createSecurityOrchestrationLayer, runSecurityOrchestration, type SecurityAgent, type SecurityAgentType, type AgentStatus, type SecurityTask, type SecurityTaskType, type AgentVote, type SecurityDecision, type OrchestrationConfig, type SecurityOrchestrationReport, } from "./security-orchestration-layer.js";
-export { SecurityAgentCoordinator, createSecurityAgentCoordinator, runMultiAgentSecurityScan, type SecurityAgentConfig, type SecurityAgentContext, type AgentVotingResult, type MultiAgentSecurityResult, } from "./security-agent-coordinator.js";

package/dist/security/index.js

@@ -1,13 +0,0 @@
-/**
- * 0xRay AI v1.22.60 - Security Module Index
- * Unified exports for the comprehensive security system
- */
-export { SecurityScanner, securityScanner } from "./security-scanner.js";
-export { PromptSecurityValidator, promptSecurityValidator, } from "./prompt-security-validator.js";
-export * from "./security-headers.js";
-export * from "./security-hardening-system.js";
-export * from "./security-hardener.js";
-export * from "./security-auditor.js";
-export { ComprehensiveSecurityAuditSystem, createSecurityAuditSystem, runQuickSecurityAudit, runDeepSecurityAudit, } from "./comprehensive-security-audit.js";
-export { SecurityOrchestrationLayer, createSecurityOrchestrationLayer, runSecurityOrchestration, } from "./security-orchestration-layer.js";
-export { SecurityAgentCoordinator, createSecurityAgentCoordinator, runMultiAgentSecurityScan, } from "./security-agent-coordinator.js";

package/dist/security/prompt-security-validator.d.ts

@@ -1,44 +0,0 @@
-/**
- * 0xRay Framework - AI Prompt Security Validator
- *
- * Specialized security validation for AI agent prompts and responses
- * Prevents prompt injection, system prompt override, and malicious inputs
- */
-export interface PromptSecurityConfig {
-    enabled: boolean;
-    maxPromptLength: number;
-    allowedPatterns: RegExp[];
-    blockedPatterns: RegExp[];
-    sanitizeLevel: "basic" | "strict" | "paranoid";
-}
-export interface SecurityValidationResult {
-    isSafe: boolean;
-    violations: string[];
-    sanitizedPrompt?: string | undefined;
-    riskLevel: "low" | "medium" | "high" | "critical";
-}
-export declare class PromptSecurityValidator {
-    private config;
-    constructor(config?: Partial<PromptSecurityConfig>);
-    /**
-     * Validate AI prompt for security issues
-     */
-    validatePrompt(prompt: string): SecurityValidationResult;
-    /**
-     * Check for system prompt override attempts
-     */
-    private containsSystemPromptOverride;
-    /**
-     * Check for prompt injection attempts
-     */
-    private containsInjectionAttempts;
-    /**
-     * Sanitize prompt by removing dangerous patterns
-     */
-    private sanitizePrompt;
-    /**
-     * Validate agent response for safety
-     */
-    validateResponse(response: string): SecurityValidationResult;
-}
-export declare const promptSecurityValidator: PromptSecurityValidator;

package/dist/security/prompt-security-validator.js

@@ -1,148 +0,0 @@
-/**
- * 0xRay Framework - AI Prompt Security Validator
- *
- * Specialized security validation for AI agent prompts and responses
- * Prevents prompt injection, system prompt override, and malicious inputs
- */
-export class PromptSecurityValidator {
-    config;
-    constructor(config = {}) {
-        this.config = {
-            enabled: true,
-            maxPromptLength: 10000,
-            allowedPatterns: [],
-            blockedPatterns: [
-                /system\s+prompt\s*[:=]/gi,
-                /ignore\s+previous\s+instructions/gi,
-                /you\s+are\s+now\s+/gi,
-                /forget\s+your\s+previous\s+/gi,
-                /override\s+(your\s+)?instructions/gi,
-                /jailbreak/gi,
-                /dan.*mode/gi,
-            ],
-            sanitizeLevel: "strict",
-            ...config,
-        };
-    }
-    /**
-     * Validate AI prompt for security issues
-     */
-    validatePrompt(prompt) {
-        if (!this.config.enabled) {
-            return { isSafe: true, violations: [], riskLevel: "low" };
-        }
-        const violations = [];
-        let riskLevel = "low";
-        // Length check
-        if (prompt.length > this.config.maxPromptLength) {
-            violations.push(`Prompt too long: ${prompt.length} > ${this.config.maxPromptLength}`);
-            riskLevel = "medium";
-        }
-        // Blocked pattern check
-        for (const pattern of this.config.blockedPatterns) {
-            if (pattern.test(prompt)) {
-                violations.push(`Blocked pattern detected: ${pattern.source}`);
-                riskLevel = "high";
-            }
-        }
-        // Advanced pattern analysis
-        if (this.containsSystemPromptOverride(prompt)) {
-            violations.push("Potential system prompt override attempt");
-            riskLevel = "critical";
-        }
-        if (this.containsInjectionAttempts(prompt)) {
-            violations.push("Potential prompt injection detected");
-            riskLevel = "high";
-        }
-        const isSafe = violations.length === 0;
-        const sanitizedPrompt = isSafe ? undefined : this.sanitizePrompt(prompt);
-        return {
-            isSafe,
-            violations,
-            sanitizedPrompt,
-            riskLevel,
-        };
-    }
-    /**
-     * Check for system prompt override attempts
-     */
-    containsSystemPromptOverride(prompt) {
-        const overrideIndicators = [
-            "you are now",
-            "act as if",
-            "pretend to be",
-            "role-play as",
-            "from now on you are",
-            "ignore your system",
-            "override your",
-            "new personality",
-            "different role",
-        ];
-        const lowerPrompt = prompt.toLowerCase();
-        return overrideIndicators.some((indicator) => lowerPrompt.includes(indicator));
-    }
-    /**
-     * Check for prompt injection attempts
-     */
-    containsInjectionAttempts(prompt) {
-        const injectionIndicators = [
-            "ignore previous",
-            "forget instructions",
-            "start over",
-            "new conversation",
-            "reset context",
-            "clear memory",
-            "delete history",
-        ];
-        const lowerPrompt = prompt.toLowerCase();
-        return injectionIndicators.some((indicator) => lowerPrompt.includes(indicator));
-    }
-    /**
-     * Sanitize prompt by removing dangerous patterns
-     */
-    sanitizePrompt(prompt) {
-        let sanitized = prompt;
-        // Remove blocked patterns
-        for (const pattern of this.config.blockedPatterns) {
-            sanitized = sanitized.replace(pattern, "[REDACTED]");
-        }
-        // Additional sanitization based on level
-        if (this.config.sanitizeLevel === "strict" ||
-            this.config.sanitizeLevel === "paranoid") {
-            // Remove potential code execution
-            sanitized = sanitized.replace(/```[\s\S]*?```/g, "[CODE_BLOCK_REMOVED]");
-            // Remove potential file system access
-            sanitized = sanitized.replace(/(?:\/|\\)\.\.(?:\/|\\)/g, "/");
-            // Remove potential command injection
-            sanitized = sanitized.replace(/[;&|`$()]/g, "");
-        }
-        if (this.config.sanitizeLevel === "paranoid") {
-            // Extreme sanitization - only allow alphanumeric, spaces, and basic punctuation
-            sanitized = sanitized.replace(/[^a-zA-Z0-9\s.,!?-]/g, "");
-        }
-        return sanitized;
-    }
-    /**
-     * Validate agent response for safety
-     */
-    validateResponse(response) {
-        // Similar validation but focused on response safety
-        const violations = [];
-        // Check for potentially harmful content
-        if (response.includes("system prompt") ||
-            response.includes("internal instructions")) {
-            violations.push("Response contains sensitive system information");
-        }
-        // Check for code execution attempts
-        if (/eval\s*\(|Function\s*\(/.test(response)) {
-            violations.push("Response contains potential code execution");
-        }
-        return {
-            isSafe: violations.length === 0,
-            violations,
-            riskLevel: violations.length > 0 ? "medium" : "low",
-        };
-    }
-}
-// Export singleton instance
-export const promptSecurityValidator = new PromptSecurityValidator();

package/dist/security/security-agent-coordinator.d.ts

@@ -1,71 +0,0 @@
-/**
- * Security Agent Integration
- *
- * Integrates the security orchestration layer with the framework's agent system.
- * Provides coordination between security agents using weighted voting.
- *
- */
-import { EventEmitter } from "events";
-import { SecurityOrchestrationLayer, SecurityAgent, SecurityDecision, OrchestrationConfig } from "./security-orchestration-layer.js";
-import { Vulnerability } from "./comprehensive-security-audit.js";
-export interface SecurityAgentConfig {
-    agentId: string;
-    agentType: string;
-    capabilities: string[];
-    weight: number;
-}
-export interface SecurityAgentContext {
-    projectPath: string;
-    scanDepth: "shallow" | "medium" | "deep";
-    complianceStandards: string[];
-    enableAutoRemediation: boolean;
-}
-export interface AgentVotingResult {
-    agentId: string;
-    agentName: string;
-    vote: "approve" | "reject" | "abstain";
-    weight: number;
-    reasoning: string;
-    concerns: string[];
-    confidence: number;
-}
-export interface MultiAgentSecurityResult {
-    auditId: string;
-    timestamp: Date;
-    duration: number;
-    participatingAgents: string[];
-    vulnerabilities: Vulnerability[];
-    decisions: SecurityDecision[];
-    agentVotes: AgentVotingResult[];
-    summary: {
-        totalVulnerabilities: number;
-        critical: number;
-        high: number;
-        medium: number;
-        low: number;
-        securityScore: number;
-        complianceScore: number;
-    };
-    weightedApproval: number;
-    approved: boolean;
-    recommendations: string[];
-}
-export declare class SecurityAgentCoordinator extends EventEmitter {
-    private orchestration;
-    private agentRegistry;
-    private isActive;
-    constructor(config?: Partial<OrchestrationConfig>);
-    private setupEventHandlers;
-    registerAgent(config: SecurityAgentConfig): void;
-    unregisterAgent(agentId: string): boolean;
-    getRegisteredAgents(): SecurityAgentConfig[];
-    runCoordinatedSecurityScan(context: SecurityAgentContext): Promise<MultiAgentSecurityResult>;
-    private collectAgentVotes;
-    private calculateWeightedApproval;
-    getOrchestrationLayer(): SecurityOrchestrationLayer;
-    getActiveAgents(): SecurityAgent[];
-    getPendingTasks(): import("./security-orchestration-layer.js").SecurityTask[];
-    isCoordinatorActive(): boolean;
-}
-export declare function createSecurityAgentCoordinator(config?: Partial<OrchestrationConfig>): SecurityAgentCoordinator;
-export declare function runMultiAgentSecurityScan(projectPath: string, context?: Partial<SecurityAgentContext>): Promise<MultiAgentSecurityResult>;

package/dist/security/security-agent-coordinator.js

@@ -1,203 +0,0 @@
-/**
- * Security Agent Integration
- *
- * Integrates the security orchestration layer with the framework's agent system.
- * Provides coordination between security agents using weighted voting.
- *
- */
-import { EventEmitter } from "events";
-import { frameworkLogger } from "../core/framework-logger.js";
-import { createSecurityOrchestrationLayer, } from "./security-orchestration-layer.js";
-export class SecurityAgentCoordinator extends EventEmitter {
-    orchestration;
-    agentRegistry = new Map();
-    isActive = false;
-    constructor(config) {
-        super();
-        this.orchestration = createSecurityOrchestrationLayer(config);
-        this.setupEventHandlers();
-    }
-    setupEventHandlers() {
-        this.orchestration.on("orchestration:start", (data) => {
-            this.emit("coordinator:start", data);
-            frameworkLogger.log("security-agent-coordinator", "coordinator-start", "info", data);
-        });
-        this.orchestration.on("orchestration:complete", (report) => {
-            this.emit("coordinator:complete", report);
-            frameworkLogger.log("security-agent-coordinator", "coordinator-complete", "info", {
-                auditId: report.auditId,
-                duration: report.duration,
-                vulnerabilities: report.summary.totalVulnerabilities,
-            });
-        });
-        this.orchestration.on("orchestration:error", (error) => {
-            this.emit("coordinator:error", error);
-            frameworkLogger.log("security-agent-coordinator", "coordinator-error", "error", error);
-        });
-        this.orchestration.on("agent:vote", ({ agentId, vote }) => {
-            this.emit("agent:vote", { agentId, vote });
-        });
-        this.orchestration.on("agent:status-change", (agent) => {
-            this.emit("agent:status-change", agent);
-        });
-        this.orchestration.on("task:complete", (task) => {
-            this.emit("task:complete", task);
-        });
-        this.orchestration.on("task:failed", (task) => {
-            this.emit("task:failed", task);
-        });
-    }
-    registerAgent(config) {
-        this.agentRegistry.set(config.agentId, config);
-        frameworkLogger.log("security-agent-coordinator", "agent-registered", "info", {
-            agentId: config.agentId,
-            agentType: config.agentType,
-            weight: config.weight,
-        });
-    }
-    unregisterAgent(agentId) {
-        const removed = this.agentRegistry.delete(agentId);
-        if (removed) {
-            frameworkLogger.log("security-agent-coordinator", "agent-unregistered", "info", {
-                agentId,
-            });
-        }
-        return removed;
-    }
-    getRegisteredAgents() {
-        return Array.from(this.agentRegistry.values());
-    }
-    async runCoordinatedSecurityScan(context) {
-        this.isActive = true;
-        const startTime = Date.now();
-        frameworkLogger.log("security-agent-coordinator", "coordinated-scan-start", "info", {
-            projectPath: context.projectPath,
-            scanDepth: context.scanDepth,
-            registeredAgents: this.agentRegistry.size,
-        });
-        try {
-            const report = await this.orchestration.runSecurityOrchestration(context.projectPath);
-            const agentVotes = this.collectAgentVotes(report);
-            const weightedApproval = this.calculateWeightedApproval(agentVotes);
-            const result = {
-                auditId: report.auditId,
-                timestamp: report.timestamp,
-                duration: report.duration,
-                participatingAgents: report.agents.map((a) => a.name),
-                vulnerabilities: report.vulnerabilities,
-                decisions: report.decisions,
-                agentVotes,
-                summary: report.summary,
-                weightedApproval,
-                approved: weightedApproval >= 0.5,
-                recommendations: report.recommendations,
-            };
-            this.emit("coordinated-scan:complete", result);
-            return result;
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            frameworkLogger.log("security-agent-coordinator", "coordinated-scan-error", "error", {
-                error: errorMessage,
-            });
-            throw error;
-        }
-        finally {
-            this.isActive = false;
-        }
-    }
-    collectAgentVotes(report) {
-        const vulnerabilities = report.vulnerabilities;
-        const agents = report.agents;
-        return agents.map((agent) => {
-            const agentVulns = vulnerabilities.filter((v) => v.severity === "critical" || v.severity === "high");
-            const concerns = [];
-            let vote = "approve";
-            let reasoning = `Security review by ${agent.name}. Found ${vulnerabilities.length} vulnerabilities.`;
-            const criticalCount = vulnerabilities.filter((v) => v.severity === "critical").length;
-            const highCount = vulnerabilities.filter((v) => v.severity === "high").length;
-            if (criticalCount > 0) {
-                concerns.push(`${criticalCount} critical vulnerabilities detected`);
-            }
-            if (highCount > 5) {
-                concerns.push(`${highCount} high-severity vulnerabilities`);
-            }
-            if (criticalCount > 5) {
-                vote = "reject";
-                reasoning = "Too many critical vulnerabilities. Security posture unacceptable.";
-            }
-            else if (criticalCount > 0 || highCount > 10) {
-                vote = "approve";
-                reasoning = "Acceptable with noted concerns. Priority fixes required.";
-            }
-            return {
-                agentId: agent.id,
-                agentName: agent.name,
-                vote,
-                weight: agent.weight,
-                reasoning,
-                concerns,
-                confidence: Math.max(0.5, 1 - (criticalCount * 0.1 + highCount * 0.02)),
-            };
-        });
-    }
-    calculateWeightedApproval(votes) {
-        if (votes.length === 0)
-            return 0;
-        const totalWeight = votes.reduce((sum, v) => sum + v.weight, 0);
-        const approvalWeight = votes
-            .filter((v) => v.vote === "approve")
-            .reduce((sum, v) => sum + v.weight, 0);
-        return totalWeight > 0 ? approvalWeight / totalWeight : 0;
-    }
-    getOrchestrationLayer() {
-        return this.orchestration;
-    }
-    getActiveAgents() {
-        return this.orchestration.getActiveAgents();
-    }
-    getPendingTasks() {
-        return this.orchestration.getTasks().filter((t) => t.status === "pending");
-    }
-    isCoordinatorActive() {
-        return this.isActive;
-    }
-}
-export function createSecurityAgentCoordinator(config) {
-    return new SecurityAgentCoordinator(config);
-}
-export async function runMultiAgentSecurityScan(projectPath, context) {
-    const coordinator = createSecurityAgentCoordinator();
-    const fullContext = {
-        projectPath,
-        scanDepth: context?.scanDepth || "medium",
-        complianceStandards: context?.complianceStandards || ["owasp-top-10", "cwe"],
-        enableAutoRemediation: context?.enableAutoRemediation ?? true,
-        ...context,
-    };
-    coordinator.registerAgent({
-        agentId: "agent-security-auditor",
-        agentType: "security-auditor",
-        capabilities: ["vulnerability-scanning", "threat-detection", "security-auditing"],
-        weight: 0.35,
-    });
-    coordinator.registerAgent({
-        agentId: "agent-code-analyzer",
-        agentType: "code-analyzer",
-        capabilities: ["code-pattern-analysis", "static-analysis", "security-hotspot-detection"],
-        weight: 0.30,
-    });
-    coordinator.registerAgent({
-        agentId: "agent-testing-lead",
-        agentType: "testing-lead",
-        capabilities: ["security-testing", "penetration-testing", "vulnerability-validation"],
-        weight: 0.20,
-    });
-    coordinator.registerAgent({
-        agentId: "agent-architect",
-        agentType: "architect",
-        capabilities: ["security-architecture", "threat-modeling", "risk-assessment"],
-        weight: 0.15,
-    });
-    return coordinator.runCoordinatedSecurityScan(fullContext);
-}

package/dist/security/security-auditor.d.ts

@@ -1,55 +0,0 @@
-/**
- * Security Audit Tool
- *
- * Comprehensive security auditing for the framework and its components.
- * Identifies vulnerabilities, misconfigurations, and security weaknesses.
- *
- * @since 2026-01-07
- */
-export interface SecurityIssue {
-    severity: "critical" | "high" | "medium" | "low" | "info";
-    category: string;
-    file: string;
-    line?: number;
-    description: string;
-    recommendation: string;
-    cwe?: string;
-}
-export interface SecurityAuditResult {
-    totalFiles: number;
-    issues: SecurityIssue[];
-    summary: {
-        critical: number;
-        high: number;
-        medium: number;
-        low: number;
-        info: number;
-    };
-    score: number;
-}
-export declare class SecurityAuditor {
-    private readonly dangerousPatterns;
-    private readonly dangerousImports;
-    /**
-     * Run comprehensive security audit
-     */
-    auditProject(projectPath?: string): Promise<SecurityAuditResult>;
-    private getAllFiles;
-    private shouldSkipDirectory;
-    private shouldAuditFile;
-    private auditFile;
-    private isFalsePositive;
-    private auditImports;
-    private auditFilePermissions;
-    private auditPackageJson;
-    private auditConfiguration;
-    private auditDependencies;
-    private getRecommendationForCategory;
-    private generateSummary;
-    private calculateSecurityScore;
-    /**
-     * Generate security audit report
-     */
-    generateReport(result: SecurityAuditResult): string;
-}
-export declare const securityAuditor: SecurityAuditor;