0xray 4.0.12 → 4.0.13

package/dist/security/comprehensive-security-audit.js

@@ -1,1004 +0,0 @@
-/**
- * 0xRay Comprehensive Security Audit System
- *
- * Multi-agent security audit system with vulnerability scanning,
- * automated remediation, compliance checking, and weighted voting
- * for architectural decisions.
- *
- */
-import { readFileSync, readdirSync, statSync, writeFileSync } from "fs";
-import { join } from "path";
-import { frameworkLogger } from "../core/framework-logger.js";
-export class ComprehensiveSecurityAuditSystem {
-    config;
-    vulnerabilities = [];
-    architecturalDecisions = [];
-    agentVotes = new Map();
-    severityWeights = {
-        critical: 20,
-        high: 10,
-        medium: 5,
-        low: 2,
-        info: 0,
-    };
-    defaultAgentWeights = {
-        "security-auditor": 0.35,
-        "code-analyzer": 0.30,
-        "testing-lead": 0.20,
-        "architect": 0.15,
-    };
-    dangerousPatterns = [
-        {
-            pattern: /eval\s*\(/g,
-            severity: "critical",
-            category: "injection",
-            cwe: "CWE-95",
-            owasp: "A03:2021-Injection",
-            title: "Code Injection via eval()",
-            impact: "Arbitrary code execution possible",
-            recommendation: "Avoid eval(). Use safer alternatives like JSON.parse() for data",
-            autoRemediation: {
-                action: "Replace eval() with safe alternative",
-                automated: false,
-                estimatedEffort: "medium",
-            },
-        },
-        {
-            pattern: /Function\s*\(/g,
-            severity: "critical",
-            category: "injection",
-            cwe: "CWE-95",
-            owasp: "A03:2021-Injection",
-            title: "Dynamic Function Creation",
-            impact: "Arbitrary code execution possible",
-            recommendation: "Use direct function calls instead of dynamic construction",
-            autoRemediation: {
-                action: "Replace Function() with named function",
-                automated: false,
-                estimatedEffort: "medium",
-            },
-        },
-        {
-            pattern: /child_process\.exec\s*\(/g,
-            severity: "critical",
-            category: "injection",
-            cwe: "CWE-78",
-            owasp: "A03:2021-Injection",
-            title: "Command Injection via exec()",
-            impact: "OS command injection possible",
-            recommendation: "Use execFile() with validated arguments or avoid shell commands",
-            autoRemediation: {
-                action: "Replace exec() with execFile()",
-                automated: false,
-                estimatedEffort: "low",
-            },
-        },
-        {
-            pattern: /child_process\.spawn\s*\(/g,
-            severity: "high",
-            category: "injection",
-            cwe: "CWE-78",
-            owasp: "A03:2021-Injection",
-            title: "Potential Command Injection via spawn()",
-            impact: "Shell injection possible with user input",
-            recommendation: "Validate all spawn arguments, avoid shell: true",
-            autoRemediation: {
-                action: "Add argument validation",
-                automated: false,
-                estimatedEffort: "low",
-            },
-        },
-        {
-            pattern: /execSync\s*\(/g,
-            severity: "high",
-            category: "injection",
-            cwe: "CWE-78",
-            owasp: "A03:2021-Injection",
-            title: "Command Injection via execSync()",
-            impact: "Synchronous OS command injection",
-            recommendation: "Use execFileSync() or avoid shell execution",
-            autoRemediation: {
-                action: "Replace execSync() with execFileSync()",
-                automated: false,
-                estimatedEffort: "low",
-            },
-        },
-        {
-            pattern: /password\s*[:=]\s*['"][^'"]+['"]/gi,
-            severity: "high",
-            category: "sensitive-data-exposure",
-            cwe: "CWE-798",
-            owasp: "A02:2021-Cryptographic Failures",
-            title: "Hardcoded Password Detected",
-            impact: "Credentials exposed in source code",
-            recommendation: "Use environment variables or secure secret management",
-            autoRemediation: {
-                action: "Move to environment variable",
-                automated: true,
-                estimatedEffort: "low",
-            },
-        },
-        {
-            pattern: /api[_-]?key\s*[:=]\s*['"][^'"]+['"]/gi,
-            severity: "high",
-            category: "sensitive-data-exposure",
-            cwe: "CWE-798",
-            owasp: "A02:2021-Cryptographic Failures",
-            title: "Hardcoded API Key Detected",
-            impact: "API keys exposed in source code",
-            recommendation: "Use environment variables or secure vault",
-            autoRemediation: {
-                action: "Move to environment variable",
-                automated: true,
-                estimatedEffort: "low",
-            },
-        },
-        {
-            pattern: /secret\s*[:=]\s*['"][^'"]+['"]/gi,
-            severity: "high",
-            category: "sensitive-data-exposure",
-            cwe: "CWE-798",
-            owasp: "A02:2021-Cryptographic Failures",
-            title: "Hardcoded Secret Detected",
-            impact: "Secrets exposed in source code",
-            recommendation: "Use secure secret management solution",
-            autoRemediation: {
-                action: "Move to secure vault",
-                automated: true,
-                estimatedEffort: "low",
-            },
-        },
-        {
-            pattern: /token\s*[:=]\s*['"][^'"]+['"]/gi,
-            severity: "medium",
-            category: "sensitive-data-exposure",
-            cwe: "CWE-798",
-            owasp: "A02:2021-Cryptographic Failures",
-            title: "Hardcoded Token Detected",
-            impact: "Tokens exposed in source code",
-            recommendation: "Use secure token storage or environment variables",
-            autoRemediation: {
-                action: "Move to environment variable",
-                automated: true,
-                estimatedEffort: "low",
-            },
-        },
-        {
-            pattern: /Math\.random\s*\(/g,
-            severity: "medium",
-            category: "cryptography",
-            cwe: "CWE-338",
-            owasp: "A02:2021-Cryptographic Failures",
-            title: "Weak Random Number Generation",
-            impact: "Predictable random values for security-sensitive operations",
-            recommendation: "Use crypto.randomBytes() or crypto.randomUUID()",
-            autoRemediation: {
-                action: "Replace with crypto.randomBytes()",
-                automated: true,
-                estimatedEffort: "low",
-            },
-        },
-        {
-            pattern: /md5\s*\(/gi,
-            severity: "high",
-            category: "cryptography",
-            cwe: "CWE-328",
-            owasp: "A02:2021-Cryptographic Failures",
-            title: "Weak Hashing Algorithm (MD5)",
-            impact: "MD5 is cryptographically broken",
-            recommendation: "Use SHA-256+ or bcrypt/argon2 for passwords",
-            autoRemediation: {
-                action: "Replace with SHA-256 or bcrypt",
-                automated: false,
-                estimatedEffort: "medium",
-            },
-        },
-        {
-            pattern: /sha1\s*\(/gi,
-            severity: "medium",
-            category: "cryptography",
-            cwe: "CWE-328",
-            owasp: "A02:2021-Cryptographic Failures",
-            title: "Weak Hashing Algorithm (SHA-1)",
-            impact: "SHA-1 is deprecated for security purposes",
-            recommendation: "Use SHA-256+ or bcrypt/argon2 for passwords",
-            autoRemediation: {
-                action: "Replace with SHA-256 or bcrypt",
-                automated: false,
-                estimatedEffort: "medium",
-            },
-        },
-        {
-            pattern: /console\.log\s*\([^)]*(password|secret|token|key)[^)]*\)/gi,
-            severity: "high",
-            category: "data-protection",
-            cwe: "CWE-532",
-            owasp: "A09:2021-Security Logging and Monitoring Failures",
-            title: "Sensitive Data Logging",
-            impact: "Credentials exposed in logs",
-            recommendation: "Never log sensitive data. Redact or mask sensitive values",
-            autoRemediation: {
-                action: "Remove sensitive data from log statement",
-                automated: false,
-                estimatedEffort: "low",
-            },
-        },
-        {
-            pattern: /http:\/\//g,
-            severity: "high",
-            category: "data-protection",
-            cwe: "CWE-319",
-            owasp: "A02:2021-Cryptographic Failures",
-            title: "Insecure HTTP Connection",
-            impact: "Data transmitted in plaintext",
-            recommendation: "Use HTTPS for all external connections",
-            autoRemediation: {
-                action: "Replace http:// with https://",
-                automated: true,
-                estimatedEffort: "low",
-            },
-        },
-        {
-            pattern: /cors.*\*|CORS.*\*|allow-all/gi,
-            severity: "medium",
-            category: "security-misconfiguration",
-            cwe: "CWE-942",
-            owasp: "A05:2021-Security Misconfiguration",
-            title: "Overly Permissive CORS Configuration",
-            impact: "Any origin can access resources",
-            recommendation: "Specify allowed origins explicitly",
-            autoRemediation: {
-                action: "Configure specific allowed origins",
-                automated: false,
-                estimatedEffort: "low",
-            },
-        },
-        {
-            pattern: /DEBUG\s*[:=]\s*true/gi,
-            severity: "medium",
-            category: "security-misconfiguration",
-            cwe: "CWE-489",
-            owasp: "A05:2021-Security Misconfiguration",
-            title: "Debug Mode Enabled",
-            impact: "Sensitive information may be exposed",
-            recommendation: "Disable debug mode in production",
-            autoRemediation: {
-                action: "Disable DEBUG in production",
-                automated: true,
-                estimatedEffort: "low",
-            },
-        },
-        {
-            pattern: /\.\.[/\\]/,
-            severity: "high",
-            category: "injection",
-            cwe: "CWE-22",
-            owasp: "A01:2021-Broken Access Control",
-            title: "Potential Path Traversal",
-            impact: "Unauthorized file access possible",
-            recommendation: "Validate and sanitize all file paths. Use path.resolve()",
-            autoRemediation: {
-                action: "Add path validation",
-                automated: false,
-                estimatedEffort: "medium",
-            },
-        },
-        {
-            pattern: /path\.join\s*\(\s*.*,\s*.*\.\./g,
-            severity: "high",
-            category: "injection",
-            cwe: "CWE-22",
-            owasp: "A01:2021-Broken Access Control",
-            title: "Path Traversal via path.join()",
-            impact: "Directory traversal attack possible",
-            recommendation: "Validate paths and use allowlists",
-            autoRemediation: {
-                action: "Add path validation and sanitization",
-                automated: false,
-                estimatedEffort: "medium",
-            },
-        },
-    ];
-    constructor(config) {
-        this.config = {
-            includeDependencies: true,
-            enableAutoRemediation: true,
-            enableWeightedVoting: true,
-            complianceStandards: ["owasp-top-10", "cwe"],
-            agentWeights: this.defaultAgentWeights,
-            ...config,
-            scanDepth: config.scanDepth ?? "medium",
-        };
-    }
-    async runAudit() {
-        const startTime = Date.now();
-        const auditId = `security-audit-${Date.now()}-${Math.random().toString(36).substring(2, 11)}`;
-        frameworkLogger.log("comprehensive-security-audit", "audit-start", "info", {
-            auditId,
-            projectPath: this.config.projectPath,
-            config: this.config,
-        });
-        const files = this.getProjectFiles();
-        this.vulnerabilities = [];
-        for (const file of files) {
-            const fileVulns = await this.auditFile(file);
-            this.vulnerabilities.push(...fileVulns);
-        }
-        if (this.config.includeDependencies) {
-            this.vulnerabilities.push(...this.auditDependencies());
-        }
-        const complianceResults = this.checkCompliance();
-        const remediation = this.generateRemediationPlan();
-        if (this.config.enableWeightedVoting) {
-            await this.collectAgentVotes();
-            this.resolveArchitecturalDecisions();
-        }
-        const report = {
-            metadata: {
-                auditId,
-                timestamp: new Date(),
-                projectPath: this.config.projectPath,
-                totalFilesScanned: files.length,
-                duration: Date.now() - startTime,
-            },
-            summary: this.calculateSummary(),
-            vulnerabilities: this.vulnerabilities,
-            compliance: complianceResults,
-            remediation,
-            architecturalDecisions: this.architecturalDecisions,
-            agentConsensus: this.config.enableWeightedVoting
-                ? this.calculateAgentConsensus()
-                : undefined,
-        };
-        if (this.config.outputPath) {
-            this.saveReport(report);
-        }
-        frameworkLogger.log("comprehensive-security-audit", "audit-complete", "info", {
-            auditId,
-            totalVulnerabilities: this.vulnerabilities.length,
-            securityScore: report.summary.securityScore,
-        });
-        return report;
-    }
-    getProjectFiles() {
-        const files = [];
-        const skipDirs = [
-            "node_modules",
-            ".git",
-            "dist",
-            "build",
-            ".next",
-            ".nuxt",
-            "coverage",
-            ".opencode",
-            "var",
-            "ci-test-env",
-        ];
-        const traverse = (dir) => {
-            try {
-                const items = readdirSync(dir);
-                for (const item of items) {
-                    const fullPath = join(dir, item);
-                    const stat = statSync(fullPath);
-                    if (stat.isDirectory()) {
-                        if (!skipDirs.includes(item) && !item.startsWith(".")) {
-                            traverse(fullPath);
-                        }
-                    }
-                    else if (stat.isFile()) {
-                        const ext = item.slice(item.lastIndexOf("."));
-                        if ([".ts", ".tsx", ".js", ".jsx", ".json"].includes(ext)) {
-                            files.push(fullPath);
-                        }
-                    }
-                }
-            }
-            catch {
-                // Skip inaccessible directories
-            }
-        };
-        traverse(this.config.projectPath);
-        return files;
-    }
-    async auditFile(filePath) {
-        const vulnerabilities = [];
-        try {
-            const content = readFileSync(filePath, "utf-8");
-            const lines = content.split("\n");
-            for (let i = 0; i < lines.length; i++) {
-                const line = lines[i];
-                if (!line)
-                    continue;
-                for (const rule of this.dangerousPatterns) {
-                    if (rule.pattern.test(line)) {
-                        const vuln = this.createVulnerability(rule, filePath, i + 1, line);
-                        if (!this.isFalsePositive(vuln, filePath)) {
-                            vulnerabilities.push(vuln);
-                        }
-                    }
-                }
-            }
-            vulnerabilities.push(...this.auditImports(content, filePath));
-        }
-        catch {
-            // Skip files that can't be read
-        }
-        return vulnerabilities;
-    }
-    createVulnerability(rule, filePath, line, codeSnippet) {
-        return {
-            id: `VULN-${rule.category}-${filePath}-${line}`,
-            title: rule.title,
-            severity: rule.severity,
-            category: rule.category,
-            cwe: rule.cwe,
-            owasp: rule.owasp,
-            file: filePath,
-            line,
-            description: `Pattern detected: ${rule.title}`,
-            impact: rule.impact,
-            recommendation: rule.recommendation,
-            codeSnippet: codeSnippet.trim(),
-            confidence: 85,
-            autoRemediation: rule.autoRemediation
-                ? [
-                    {
-                        step: 1,
-                        action: rule.autoRemediation.action,
-                        code: rule.autoRemediation.code,
-                        file: filePath,
-                        line,
-                        estimatedEffort: rule.autoRemediation.estimatedEffort,
-                        automated: rule.autoRemediation.automated,
-                    },
-                ]
-                : undefined,
-        };
-    }
-    isFalsePositive(vuln, filePath) {
-        if (filePath.includes("security-auditor") && vuln.category === "injection") {
-            return true;
-        }
-        if (filePath.includes("__tests__")) {
-            return true;
-        }
-        if (vuln.codeSnippet.includes("'eval(')") || vuln.codeSnippet.includes('"eval(')) {
-            return true;
-        }
-        return false;
-    }
-    auditImports(content, filePath) {
-        const vulnerabilities = [];
-        const dangerousImports = ["crypto", "tls", "cluster", "worker_threads", "vm"];
-        for (const imp of dangerousImports) {
-            const patterns = [
-                new RegExp(`import.*from.*['"]${imp}['"]`),
-                new RegExp(`require\\s*\\(\\s*['"]${imp}['"]\\s*\\)`),
-            ];
-            for (const pattern of patterns) {
-                if (pattern.test(content)) {
-                    vulnerabilities.push({
-                        id: `IMP-${imp}-${filePath}`,
-                        title: `Dangerous Import: ${imp}`,
-                        severity: "info",
-                        category: "security-misconfiguration",
-                        cwe: "CWE-350",
-                        file: filePath,
-                        line: 1,
-                        description: `Import of sensitive module: ${imp}`,
-                        impact: "Module usage should be reviewed for security implications",
-                        recommendation: "Ensure proper access controls and validation when using this module",
-                        codeSnippet: content.match(pattern)?.[0] || "",
-                        confidence: 70,
-                    });
-                    break;
-                }
-            }
-        }
-        return vulnerabilities;
-    }
-    auditDependencies() {
-        const vulnerabilities = [];
-        try {
-            const packagePath = join(this.config.projectPath, "package.json");
-            const packageJson = JSON.parse(readFileSync(packagePath, "utf-8"));
-            const allDeps = {
-                ...packageJson.dependencies,
-                ...packageJson.devDependencies,
-            };
-            for (const [dep, version] of Object.entries(allDeps)) {
-                if (typeof version === "string" && (version === "*" || version === "latest")) {
-                    vulnerabilities.push({
-                        id: `DEP-${dep}`,
-                        title: `Unpinned Dependency: ${dep}`,
-                        severity: "medium",
-                        category: "dependency-vulnerability",
-                        cwe: "CWE-1104",
-                        file: packagePath,
-                        line: 1,
-                        description: `Dependency version not pinned: ${dep}`,
-                        impact: "May receive vulnerable updates without review",
-                        recommendation: "Pin to specific version range for reproducibility",
-                        codeSnippet: `${dep}: "${version}"`,
-                        confidence: 90,
-                    });
-                }
-            }
-        }
-        catch {
-            // Skip if package.json not found
-        }
-        return vulnerabilities;
-    }
-    checkCompliance() {
-        const results = [];
-        const standards = this.config.complianceStandards ?? ["owasp-top-10", "cwe"];
-        for (const standard of standards) {
-            results.push(this.evaluateStandard(standard));
-        }
-        return results;
-    }
-    evaluateStandard(standard) {
-        const vulnsByCategory = this.groupByCategory();
-        switch (standard) {
-            case "owasp-top-10":
-                return this.evaluateOWASP(vulnsByCategory);
-            case "cwe":
-                return this.evaluateCWE();
-            case "nist":
-                return this.evaluateNIST();
-            case "iso-27001":
-                return this.evaluateISO27001();
-            case "pci-dss":
-                return this.evaluatePCIDSS();
-            default:
-                return {
-                    standard,
-                    passed: true,
-                    score: 100,
-                    findings: [],
-                    recommendations: [],
-                };
-        }
-    }
-    evaluateOWASP(vulnsByCategory) {
-        const owaspChecks = {
-            "A01:2021-Broken Access Control": ["authorization", "injection"],
-            "A02:2021-Cryptographic Failures": ["cryptography", "sensitive-data-exposure"],
-            "A03:2021-Injection": ["injection", "input-validation"],
-            "A04:2021-Insecure Design": ["configuration"],
-            "A05:2021-Security Misconfiguration": ["security-misconfiguration"],
-            "A06:2021-Vulnerable Components": ["dependency-vulnerability"],
-            "A07:2021-Authentication Failures": ["authentication"],
-            "A08:2021-Software Integrity Failures": ["dependency-vulnerability"],
-            "A09:2021-Security Logging Failures": ["data-protection"],
-            "A10:2021-SSRF": ["injection"],
-        };
-        const findings = [];
-        let totalChecks = Object.keys(owaspChecks).length;
-        let passedChecks = 0;
-        for (const [owaspId, categories] of Object.entries(owaspChecks)) {
-            const hasVulns = categories.some((cat) => vulnsByCategory[cat] && vulnsByCategory[cat].length > 0);
-            if (!hasVulns) {
-                passedChecks++;
-            }
-            else {
-                findings.push(...categories.flatMap((cat) => vulnsByCategory[cat] || []));
-            }
-        }
-        const score = Math.round((passedChecks / totalChecks) * 100);
-        const passed = score >= 80;
-        return {
-            standard: "owasp-top-10",
-            passed,
-            score,
-            findings: [...new Set(findings)],
-            recommendations: passed
-                ? []
-                : ["Address vulnerabilities to improve OWASP Top 10 compliance"],
-        };
-    }
-    evaluateCWE() {
-        const criticalCWEs = [
-            "CWE-78", // OS Command Injection
-            "CWE-89", // SQL Injection
-            "CWE-95", // Code Injection
-            "CWE-79", // XSS
-            "CWE-306", // Missing Authentication
-            "CWE-862", // Missing Authorization
-            "CWE-798", // Hardcoded Credentials
-        ];
-        const criticalVulns = this.vulnerabilities.filter((v) => v.severity === "critical" && criticalCWEs.includes(v.cwe));
-        const score = Math.max(0, 100 - criticalVulns.length * 20);
-        const passed = criticalVulns.length === 0;
-        return {
-            standard: "cwe",
-            passed,
-            score,
-            findings: criticalVulns,
-            recommendations: criticalVulns.length > 0
-                ? ["Address critical CWE vulnerabilities immediately"]
-                : [],
-        };
-    }
-    evaluateNIST() {
-        const findings = this.vulnerabilities.filter((v) => v.severity === "critical" || v.severity === "high");
-        const score = Math.max(0, 100 - findings.filter((v) => v.severity === "critical").length * 15 -
-            findings.filter((v) => v.severity === "high").length * 5);
-        return {
-            standard: "nist",
-            passed: score >= 70,
-            score,
-            findings,
-            recommendations: findings.length > 0
-                ? ["Prioritize critical and high severity issues for NIST compliance"]
-                : [],
-        };
-    }
-    evaluateISO27001() {
-        const securityControls = {
-            accessControl: this.vulnerabilities.filter((v) => v.category === "authentication" || v.category === "authorization"),
-            cryptography: this.vulnerabilities.filter((v) => v.category === "cryptography"),
-            dataProtection: this.vulnerabilities.filter((v) => v.category === "sensitive-data-exposure"),
-        };
-        const controlScores = Object.values(securityControls).map((vulns) => Math.max(0, 100 - vulns.length * 10));
-        const score = Math.round(controlScores.reduce((a, b) => a + b, 0) / controlScores.length);
-        return {
-            standard: "iso-27001",
-            passed: score >= 80,
-            score,
-            findings: Object.values(securityControls).flat(),
-            recommendations: score < 80
-                ? ["Strengthen security controls for ISO 27001 compliance"]
-                : [],
-        };
-    }
-    evaluatePCIDSS() {
-        const pciVulns = this.vulnerabilities.filter((v) => v.category === "cryptography" ||
-            v.category === "sensitive-data-exposure" ||
-            v.severity === "critical");
-        const score = Math.max(0, 100 - pciVulns.length * 10);
-        return {
-            standard: "pci-dss",
-            passed: score >= 90,
-            score,
-            findings: pciVulns,
-            recommendations: score < 90
-                ? [
-                    "Critical security issues must be resolved for PCI DSS compliance",
-                ]
-                : [],
-        };
-    }
-    groupByCategory() {
-        return this.vulnerabilities.reduce((acc, vuln) => {
-            if (!acc[vuln.category]) {
-                acc[vuln.category] = [];
-            }
-            acc[vuln.category].push(vuln);
-            return acc;
-        }, {});
-    }
-    generateRemediationPlan() {
-        const automatable = [];
-        const manualRequired = [];
-        for (const vuln of this.vulnerabilities) {
-            if (vuln.autoRemediation?.[0]?.automated) {
-                automatable.push(vuln);
-            }
-            else {
-                manualRequired.push(vuln);
-            }
-        }
-        const prioritizedFixes = this.prioritizeFixes([
-            ...automatable,
-            ...manualRequired,
-        ]);
-        const totalTime = this.estimateFixTime(prioritizedFixes);
-        return {
-            totalIssues: this.vulnerabilities.length,
-            automatable: automatable.length,
-            manualRequired: manualRequired.length,
-            estimatedFixTime: totalTime,
-            prioritizedFixes,
-        };
-    }
-    prioritizeFixes(vulnerabilities) {
-        const severityPriority = {
-            critical: 1,
-            high: 2,
-            medium: 3,
-            low: 4,
-            info: 5,
-        };
-        const plans = vulnerabilities.map((vuln) => ({
-            vulnerabilityId: vuln.id,
-            title: vuln.title,
-            severity: vuln.severity,
-            priority: severityPriority[vuln.severity],
-            steps: vuln.autoRemediation || [],
-            dependencies: [],
-            estimatedTime: this.estimateFixTimeForVuln(vuln),
-        }));
-        return plans.sort((a, b) => a.priority - b.priority);
-    }
-    estimateFixTime(vulnerabilities) {
-        let totalMinutes = 0;
-        for (const plan of vulnerabilities) {
-            switch (plan.estimatedTime) {
-                case "15 minutes":
-                    totalMinutes += 15;
-                    break;
-                case "1 hour":
-                    totalMinutes += 60;
-                    break;
-                case "4 hours":
-                    totalMinutes += 240;
-                    break;
-                default:
-                    totalMinutes += 30;
-            }
-        }
-        if (totalMinutes < 60) {
-            return `${totalMinutes} minutes`;
-        }
-        else if (totalMinutes < 480) {
-            return `${Math.round(totalMinutes / 60)} hours`;
-        }
-        else {
-            return `${Math.round(totalMinutes / 480)} days`;
-        }
-    }
-    estimateFixTimeForVuln(vuln) {
-        const effort = vuln.autoRemediation?.[0]?.estimatedEffort;
-        switch (effort) {
-            case "low":
-                return "15 minutes";
-            case "medium":
-                return "1 hour";
-            case "high":
-                return "4 hours";
-            default:
-                return "30 minutes";
-        }
-    }
-    calculateSummary() {
-        const bySeverity = {
-            critical: 0,
-            high: 0,
-            medium: 0,
-            low: 0,
-            info: 0,
-        };
-        const byCategory = {
-            injection: 0,
-            authentication: 0,
-            authorization: 0,
-            cryptography: 0,
-            configuration: 0,
-            "data-protection": 0,
-            "input-validation": 0,
-            "sensitive-data-exposure": 0,
-            "security-misconfiguration": 0,
-            "dependency-vulnerability": 0,
-        };
-        for (const vuln of this.vulnerabilities) {
-            bySeverity[vuln.severity]++;
-            byCategory[vuln.category]++;
-        }
-        let securityScore = 100;
-        for (const [severity, count] of Object.entries(bySeverity)) {
-            securityScore -= this.severityWeights[severity] * count;
-        }
-        securityScore = Math.max(0, Math.min(100, securityScore));
-        const complianceScore = this.vulnerabilities.length === 0
-            ? 100
-            : Math.max(0, 100 - this.vulnerabilities.filter((v) => v.severity === "critical").length * 15);
-        return {
-            totalVulnerabilities: this.vulnerabilities.length,
-            bySeverity,
-            byCategory,
-            securityScore,
-            complianceScore,
-        };
-    }
-    async collectAgentVotes() {
-        const agents = Object.keys(this.config.agentWeights || this.defaultAgentWeights);
-        for (const agent of agents) {
-            const vote = this.simulateAgentVote(agent);
-            this.agentVotes.set(agent, [vote]);
-        }
-    }
-    simulateAgentVote(agent) {
-        const highSevVulns = this.vulnerabilities.filter((v) => v.severity === "critical" || v.severity === "high");
-        const concerns = [];
-        for (const vuln of highSevVulns.slice(0, 3)) {
-            concerns.push(`Security concern: ${vuln.title}`);
-        }
-        const weight = this.config.agentWeights?.[agent] || this.defaultAgentWeights[agent] || 0.25;
-        let vote = "approve";
-        if (highSevVulns.length > 10) {
-            vote = "reject";
-        }
-        else if (highSevVulns.length > 5) {
-            vote = Math.random() > 0.5 ? "approve" : "abstain";
-        }
-        return {
-            agentId: `agent-${agent}`,
-            agentName: agent,
-            vote,
-            weight,
-            reasoning: `Security review by ${agent} with ${weight * 100}% weight`,
-            concerns: concerns.length > 0 ? concerns : undefined,
-        };
-    }
-    resolveArchitecturalDecisions() {
-        for (const [agent, votes] of this.agentVotes) {
-            const totalWeight = votes.reduce((sum, v) => sum + v.weight, 0);
-            const approvalWeight = votes
-                .filter((v) => v.vote === "approve")
-                .reduce((sum, v) => sum + v.weight, 0);
-            const decision = {
-                id: `decision-${agent}-${Date.now()}`,
-                title: `Security Architecture Decision for ${agent}`,
-                description: "Review of security measures and vulnerability handling",
-                proposedBy: agent,
-                votes,
-                finalDecision: approvalWeight / totalWeight >= 0.5 ? "approved" : "needs-revision",
-                approvedBy: votes.filter((v) => v.vote === "approve"),
-                rejectedBy: votes.filter((v) => v.vote === "reject"),
-                timestamp: new Date(),
-            };
-            this.architecturalDecisions.push(decision);
-        }
-    }
-    calculateAgentConsensus() {
-        const participatingAgents = Array.from(this.agentVotes.keys());
-        const allVotes = Array.from(this.agentVotes.values()).flat();
-        const approvalCount = allVotes.filter((v) => v.vote === "approve").length;
-        const totalVotes = allVotes.length;
-        const averageAgreement = totalVotes > 0 ? (approvalCount / totalVotes) * 100 : 0;
-        const contentiousVulns = this.vulnerabilities.filter((v) => v.severity === "critical" || v.severity === "high");
-        return {
-            participatingAgents,
-            averageAgreement: Math.round(averageAgreement),
-            contentiousIssues: contentiousVulns.slice(0, 10),
-        };
-    }
-    saveReport(report) {
-        const outputPath = this.config.outputPath || join(this.config.projectPath, "security-audit-report.json");
-        writeFileSync(outputPath, JSON.stringify(report, null, 2), "utf-8");
-        frameworkLogger.log("comprehensive-security-audit", "report-saved", "info", { outputPath });
-    }
-    generateMarkdownReport(report) {
-        let md = `# Security Audit Report
-
-## Executive Summary
-
-- **Audit ID**: ${report.metadata.auditId}
-- **Timestamp**: ${report.metadata.timestamp.toISOString()}
-- **Project Path**: ${report.metadata.projectPath}
-- **Files Scanned**: ${report.metadata.totalFilesScanned}
-- **Duration**: ${report.metadata.duration}ms
-
-## Security Score
-
-**${report.summary.securityScore}/100** ${this.getScoreEmoji(report.summary.securityScore)}
-
-## Vulnerability Summary
-
-| Severity | Count |
-|----------|-------|
-| Critical | ${report.summary.bySeverity.critical} |
-| High | ${report.summary.bySeverity.high} |
-| Medium | ${report.summary.bySeverity.medium} |
-| Low | ${report.summary.bySeverity.low} |
-| Info | ${report.summary.bySeverity.info} |
-
-## Compliance Results
-
-`;
-        for (const compliance of report.compliance) {
-            const status = compliance.passed ? "✅ PASS" : "❌ FAIL";
-            md += `### ${compliance.standard.toUpperCase()} - ${status}\n`;
-            md += `**Score**: ${compliance.score}/100\n\n`;
-        }
-        md += `## Detailed Findings\n\n`;
-        if (report.vulnerabilities.length === 0) {
-            md += "✅ No vulnerabilities found!\n\n";
-        }
-        else {
-            for (const vuln of report.vulnerabilities) {
-                md += `### ${this.getSeverityEmoji(vuln.severity)} ${vuln.title}\n\n`;
-                md += `- **Severity**: ${vuln.severity.toUpperCase()}\n`;
-                md += `- **File**: \`${vuln.file}:${vuln.line}\`\n`;
-                md += `- **CWE**: ${vuln.cwe}\n`;
-                if (vuln.owasp)
-                    md += `- **OWASP**: ${vuln.owasp}\n`;
-                md += `- **Description**: ${vuln.description}\n`;
-                md += `- **Impact**: ${vuln.impact}\n`;
-                md += `- **Recommendation**: ${vuln.recommendation}\n`;
-                md += `- **Confidence**: ${vuln.confidence}%\n\n`;
-                md += `\`\`\`\n${vuln.codeSnippet}\n\`\`\`\n\n`;
-                md += "---\n\n";
-            }
-        }
-        md += `## Remediation Plan\n\n`;
-        md += `- **Total Issues**: ${report.remediation.totalIssues}\n`;
-        md += `- **Automatable Fixes**: ${report.remediation.automatable}\n`;
-        md += `- **Manual Fixes Required**: ${report.remediation.manualRequired}\n`;
-        md += `- **Estimated Fix Time**: ${report.remediation.estimatedFixTime}\n\n`;
-        if (report.remediation.prioritizedFixes.length > 0) {
-            md += "### Prioritized Fixes\n\n";
-            md += "| Priority | Title | Severity | Est. Time |\n";
-            md += "|----------|-------|----------|----------|\n";
-            for (const fix of report.remediation.prioritizedFixes.slice(0, 20)) {
-                md += `| ${fix.priority} | ${fix.title} | ${fix.severity} | ${fix.estimatedTime} |\n`;
-            }
-            md += "\n";
-        }
-        if (report.agentConsensus) {
-            md += `## Agent Consensus\n\n`;
-            md += `- **Participating Agents**: ${report.agentConsensus.participatingAgents.join(", ")}\n`;
-            md += `- **Average Agreement**: ${report.agentConsensus.averageAgreement}%\n\n`;
-        }
-        md += `---\n*Generated by 0xRay Comprehensive Security Audit System v1.22.28*\n`;
-        return md;
-    }
-    getScoreEmoji(score) {
-        if (score >= 90)
-            return "🟢 Excellent";
-        if (score >= 70)
-            return "🟡 Good";
-        if (score >= 50)
-            return "🟠 Fair";
-        return "🔴 Poor";
-    }
-    getSeverityEmoji(severity) {
-        const emojis = {
-            critical: "🚨",
-            high: "🔴",
-            medium: "🟡",
-            low: "🟢",
-            info: "ℹ️",
-        };
-        return emojis[severity];
-    }
-    addVote(vote) {
-        const existing = this.agentVotes.get(vote.agentName) || [];
-        existing.push(vote);
-        this.agentVotes.set(vote.agentName, existing);
-    }
-    getVulnerabilities() {
-        return this.vulnerabilities;
-    }
-    getArchitecturalDecisions() {
-        return this.architecturalDecisions;
-    }
-}
-export function createSecurityAuditSystem(config) {
-    return new ComprehensiveSecurityAuditSystem(config);
-}
-export async function runQuickSecurityAudit(projectPath) {
-    const system = new ComprehensiveSecurityAuditSystem({
-        projectPath,
-        scanDepth: "shallow",
-        includeDependencies: true,
-        complianceStandards: ["owasp-top-10", "cwe"],
-        enableAutoRemediation: true,
-        enableWeightedVoting: true,
-    });
-    return system.runAudit();
-}
-export async function runDeepSecurityAudit(projectPath, outputPath) {
-    const system = new ComprehensiveSecurityAuditSystem({
-        projectPath,
-        scanDepth: "deep",
-        includeDependencies: true,
-        complianceStandards: ["owasp-top-10", "cwe", "nist", "iso-27001", "pci-dss"],
-        enableAutoRemediation: true,
-        enableWeightedVoting: true,
-        outputPath,
-    });
-    return system.runAudit();
-}