0xray 4.0.34 → 4.0.36

package/dist/security/index.d.ts

@@ -1,13 +0,0 @@
-/**
- * 0xRay AI v1.22.60 - Security Module Index
- * Unified exports for the comprehensive security system
- */
-export { SecurityScanner, securityScanner } from "./security-scanner.js";
-export { PromptSecurityValidator, promptSecurityValidator, } from "./prompt-security-validator.js";
-export * from "./security-headers.js";
-export * from "./security-hardening-system.js";
-export * from "./security-hardener.js";
-export * from "./security-auditor.js";
-export { ComprehensiveSecurityAuditSystem, createSecurityAuditSystem, runQuickSecurityAudit, runDeepSecurityAudit, type Vulnerability, type VulnerabilityCategory, type SeverityLevel, type RemediationStep, type RemediationPlan, type SecurityAuditConfig, type SecurityAuditReport, type WeightedVote, type ArchitecturalDecision, type ComplianceResult, type ComplianceStandard, } from "./comprehensive-security-audit.js";
-export { SecurityOrchestrationLayer, createSecurityOrchestrationLayer, runSecurityOrchestration, type SecurityAgent, type SecurityAgentType, type AgentStatus, type SecurityTask, type SecurityTaskType, type AgentVote, type SecurityDecision, type OrchestrationConfig, type SecurityOrchestrationReport, } from "./security-orchestration-layer.js";
-export { SecurityAgentCoordinator, createSecurityAgentCoordinator, runMultiAgentSecurityScan, type SecurityAgentConfig, type SecurityAgentContext, type AgentVotingResult, type MultiAgentSecurityResult, } from "./security-agent-coordinator.js";

package/dist/security/index.js

@@ -1,13 +0,0 @@
-/**
- * 0xRay AI v1.22.60 - Security Module Index
- * Unified exports for the comprehensive security system
- */
-export { SecurityScanner, securityScanner } from "./security-scanner.js";
-export { PromptSecurityValidator, promptSecurityValidator, } from "./prompt-security-validator.js";
-export * from "./security-headers.js";
-export * from "./security-hardening-system.js";
-export * from "./security-hardener.js";
-export * from "./security-auditor.js";
-export { ComprehensiveSecurityAuditSystem, createSecurityAuditSystem, runQuickSecurityAudit, runDeepSecurityAudit, } from "./comprehensive-security-audit.js";
-export { SecurityOrchestrationLayer, createSecurityOrchestrationLayer, runSecurityOrchestration, } from "./security-orchestration-layer.js";
-export { SecurityAgentCoordinator, createSecurityAgentCoordinator, runMultiAgentSecurityScan, } from "./security-agent-coordinator.js";

package/dist/security/security-agent-coordinator.d.ts

@@ -1,71 +0,0 @@
-/**
- * Security Agent Integration
- *
- * Integrates the security orchestration layer with the framework's agent system.
- * Provides coordination between security agents using weighted voting.
- *
- */
-import { EventEmitter } from "events";
-import { SecurityOrchestrationLayer, SecurityAgent, SecurityDecision, OrchestrationConfig } from "./security-orchestration-layer.js";
-import { Vulnerability } from "./comprehensive-security-audit.js";
-export interface SecurityAgentConfig {
-    agentId: string;
-    agentType: string;
-    capabilities: string[];
-    weight: number;
-}
-export interface SecurityAgentContext {
-    projectPath: string;
-    scanDepth: "shallow" | "medium" | "deep";
-    complianceStandards: string[];
-    enableAutoRemediation: boolean;
-}
-export interface AgentVotingResult {
-    agentId: string;
-    agentName: string;
-    vote: "approve" | "reject" | "abstain";
-    weight: number;
-    reasoning: string;
-    concerns: string[];
-    confidence: number;
-}
-export interface MultiAgentSecurityResult {
-    auditId: string;
-    timestamp: Date;
-    duration: number;
-    participatingAgents: string[];
-    vulnerabilities: Vulnerability[];
-    decisions: SecurityDecision[];
-    agentVotes: AgentVotingResult[];
-    summary: {
-        totalVulnerabilities: number;
-        critical: number;
-        high: number;
-        medium: number;
-        low: number;
-        securityScore: number;
-        complianceScore: number;
-    };
-    weightedApproval: number;
-    approved: boolean;
-    recommendations: string[];
-}
-export declare class SecurityAgentCoordinator extends EventEmitter {
-    private orchestration;
-    private agentRegistry;
-    private isActive;
-    constructor(config?: Partial<OrchestrationConfig>);
-    private setupEventHandlers;
-    registerAgent(config: SecurityAgentConfig): void;
-    unregisterAgent(agentId: string): boolean;
-    getRegisteredAgents(): SecurityAgentConfig[];
-    runCoordinatedSecurityScan(context: SecurityAgentContext): Promise<MultiAgentSecurityResult>;
-    private collectAgentVotes;
-    private calculateWeightedApproval;
-    getOrchestrationLayer(): SecurityOrchestrationLayer;
-    getActiveAgents(): SecurityAgent[];
-    getPendingTasks(): import("./security-orchestration-layer.js").SecurityTask[];
-    isCoordinatorActive(): boolean;
-}
-export declare function createSecurityAgentCoordinator(config?: Partial<OrchestrationConfig>): SecurityAgentCoordinator;
-export declare function runMultiAgentSecurityScan(projectPath: string, context?: Partial<SecurityAgentContext>): Promise<MultiAgentSecurityResult>;

package/dist/security/security-agent-coordinator.js

@@ -1,203 +0,0 @@
-/**
- * Security Agent Integration
- *
- * Integrates the security orchestration layer with the framework's agent system.
- * Provides coordination between security agents using weighted voting.
- *
- */
-import { EventEmitter } from "events";
-import { frameworkLogger } from "../core/framework-logger.js";
-import { createSecurityOrchestrationLayer, } from "./security-orchestration-layer.js";
-export class SecurityAgentCoordinator extends EventEmitter {
-    orchestration;
-    agentRegistry = new Map();
-    isActive = false;
-    constructor(config) {
-        super();
-        this.orchestration = createSecurityOrchestrationLayer(config);
-        this.setupEventHandlers();
-    }
-    setupEventHandlers() {
-        this.orchestration.on("orchestration:start", (data) => {
-            this.emit("coordinator:start", data);
-            frameworkLogger.log("security-agent-coordinator", "coordinator-start", "info", data);
-        });
-        this.orchestration.on("orchestration:complete", (report) => {
-            this.emit("coordinator:complete", report);
-            frameworkLogger.log("security-agent-coordinator", "coordinator-complete", "info", {
-                auditId: report.auditId,
-                duration: report.duration,
-                vulnerabilities: report.summary.totalVulnerabilities,
-            });
-        });
-        this.orchestration.on("orchestration:error", (error) => {
-            this.emit("coordinator:error", error);
-            frameworkLogger.log("security-agent-coordinator", "coordinator-error", "error", error);
-        });
-        this.orchestration.on("agent:vote", ({ agentId, vote }) => {
-            this.emit("agent:vote", { agentId, vote });
-        });
-        this.orchestration.on("agent:status-change", (agent) => {
-            this.emit("agent:status-change", agent);
-        });
-        this.orchestration.on("task:complete", (task) => {
-            this.emit("task:complete", task);
-        });
-        this.orchestration.on("task:failed", (task) => {
-            this.emit("task:failed", task);
-        });
-    }
-    registerAgent(config) {
-        this.agentRegistry.set(config.agentId, config);
-        frameworkLogger.log("security-agent-coordinator", "agent-registered", "info", {
-            agentId: config.agentId,
-            agentType: config.agentType,
-            weight: config.weight,
-        });
-    }
-    unregisterAgent(agentId) {
-        const removed = this.agentRegistry.delete(agentId);
-        if (removed) {
-            frameworkLogger.log("security-agent-coordinator", "agent-unregistered", "info", {
-                agentId,
-            });
-        }
-        return removed;
-    }
-    getRegisteredAgents() {
-        return Array.from(this.agentRegistry.values());
-    }
-    async runCoordinatedSecurityScan(context) {
-        this.isActive = true;
-        const startTime = Date.now();
-        frameworkLogger.log("security-agent-coordinator", "coordinated-scan-start", "info", {
-            projectPath: context.projectPath,
-            scanDepth: context.scanDepth,
-            registeredAgents: this.agentRegistry.size,
-        });
-        try {
-            const report = await this.orchestration.runSecurityOrchestration(context.projectPath);
-            const agentVotes = this.collectAgentVotes(report);
-            const weightedApproval = this.calculateWeightedApproval(agentVotes);
-            const result = {
-                auditId: report.auditId,
-                timestamp: report.timestamp,
-                duration: report.duration,
-                participatingAgents: report.agents.map((a) => a.name),
-                vulnerabilities: report.vulnerabilities,
-                decisions: report.decisions,
-                agentVotes,
-                summary: report.summary,
-                weightedApproval,
-                approved: weightedApproval >= 0.5,
-                recommendations: report.recommendations,
-            };
-            this.emit("coordinated-scan:complete", result);
-            return result;
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            frameworkLogger.log("security-agent-coordinator", "coordinated-scan-error", "error", {
-                error: errorMessage,
-            });
-            throw error;
-        }
-        finally {
-            this.isActive = false;
-        }
-    }
-    collectAgentVotes(report) {
-        const vulnerabilities = report.vulnerabilities;
-        const agents = report.agents;
-        return agents.map((agent) => {
-            const agentVulns = vulnerabilities.filter((v) => v.severity === "critical" || v.severity === "high");
-            const concerns = [];
-            let vote = "approve";
-            let reasoning = `Security review by ${agent.name}. Found ${vulnerabilities.length} vulnerabilities.`;
-            const criticalCount = vulnerabilities.filter((v) => v.severity === "critical").length;
-            const highCount = vulnerabilities.filter((v) => v.severity === "high").length;
-            if (criticalCount > 0) {
-                concerns.push(`${criticalCount} critical vulnerabilities detected`);
-            }
-            if (highCount > 5) {
-                concerns.push(`${highCount} high-severity vulnerabilities`);
-            }
-            if (criticalCount > 5) {
-                vote = "reject";
-                reasoning = "Too many critical vulnerabilities. Security posture unacceptable.";
-            }
-            else if (criticalCount > 0 || highCount > 10) {
-                vote = "approve";
-                reasoning = "Acceptable with noted concerns. Priority fixes required.";
-            }
-            return {
-                agentId: agent.id,
-                agentName: agent.name,
-                vote,
-                weight: agent.weight,
-                reasoning,
-                concerns,
-                confidence: Math.max(0.5, 1 - (criticalCount * 0.1 + highCount * 0.02)),
-            };
-        });
-    }
-    calculateWeightedApproval(votes) {
-        if (votes.length === 0)
-            return 0;
-        const totalWeight = votes.reduce((sum, v) => sum + v.weight, 0);
-        const approvalWeight = votes
-            .filter((v) => v.vote === "approve")
-            .reduce((sum, v) => sum + v.weight, 0);
-        return totalWeight > 0 ? approvalWeight / totalWeight : 0;
-    }
-    getOrchestrationLayer() {
-        return this.orchestration;
-    }
-    getActiveAgents() {
-        return this.orchestration.getActiveAgents();
-    }
-    getPendingTasks() {
-        return this.orchestration.getTasks().filter((t) => t.status === "pending");
-    }
-    isCoordinatorActive() {
-        return this.isActive;
-    }
-}
-export function createSecurityAgentCoordinator(config) {
-    return new SecurityAgentCoordinator(config);
-}
-export async function runMultiAgentSecurityScan(projectPath, context) {
-    const coordinator = createSecurityAgentCoordinator();
-    const fullContext = {
-        projectPath,
-        scanDepth: context?.scanDepth || "medium",
-        complianceStandards: context?.complianceStandards || ["owasp-top-10", "cwe"],
-        enableAutoRemediation: context?.enableAutoRemediation ?? true,
-        ...context,
-    };
-    coordinator.registerAgent({
-        agentId: "agent-security-auditor",
-        agentType: "security-auditor",
-        capabilities: ["vulnerability-scanning", "threat-detection", "security-auditing"],
-        weight: 0.35,
-    });
-    coordinator.registerAgent({
-        agentId: "agent-code-analyzer",
-        agentType: "code-analyzer",
-        capabilities: ["code-pattern-analysis", "static-analysis", "security-hotspot-detection"],
-        weight: 0.30,
-    });
-    coordinator.registerAgent({
-        agentId: "agent-testing-lead",
-        agentType: "testing-lead",
-        capabilities: ["security-testing", "penetration-testing", "vulnerability-validation"],
-        weight: 0.20,
-    });
-    coordinator.registerAgent({
-        agentId: "agent-architect",
-        agentType: "architect",
-        capabilities: ["security-architecture", "threat-modeling", "risk-assessment"],
-        weight: 0.15,
-    });
-    return coordinator.runCoordinatedSecurityScan(fullContext);
-}

package/dist/security/security-hardening-system.d.ts

@@ -1,238 +0,0 @@
-/**
- * Security Hardening System
- *
- * Comprehensive security hardening implementation with OWASP compliance.
- * Implements defense-in-depth security architecture for enterprise applications.
- *
- * @since 2026-01-08
- */
-import { EventEmitter } from "events";
-import { IncomingMessage, ServerResponse } from "http";
-export declare const SECURITY_CONFIG: {
-    readonly headers: {
-        readonly "X-Content-Type-Options": "nosniff";
-        readonly "X-Frame-Options": "DENY";
-        readonly "X-XSS-Protection": "1; mode=block";
-        readonly "Strict-Transport-Security": "max-age=31536000; includeSubDomains";
-        readonly "Content-Security-Policy": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'";
-        readonly "Referrer-Policy": "strict-origin-when-cross-origin";
-        readonly "Permissions-Policy": "geolocation=(), microphone=(), camera=()";
-        readonly "Cross-Origin-Embedder-Policy": "require-corp";
-        readonly "Cross-Origin-Opener-Policy": "same-origin";
-        readonly "Cross-Origin-Resource-Policy": "same-origin";
-    };
-    readonly rateLimiting: {
-        readonly windowMs: number;
-        readonly maxRequests: 100;
-        readonly skipSuccessfulRequests: false;
-        readonly skipFailedRequests: false;
-    };
-    readonly inputValidation: {
-        readonly maxStringLength: 10000;
-        readonly maxArrayLength: 1000;
-        readonly maxObjectDepth: 10;
-        readonly allowedCharacters: RegExp;
-        readonly sqlInjectionPatterns: readonly [RegExp, RegExp];
-        readonly xssPatterns: readonly [RegExp, RegExp, RegExp, RegExp];
-    };
-    readonly encryption: {
-        readonly algorithm: "aes-256-gcm";
-        readonly keyLength: 32;
-        readonly ivLength: 16;
-        readonly saltRounds: 12;
-    };
-    readonly audit: {
-        readonly logLevel: "detailed";
-        readonly retentionDays: 90;
-        readonly sensitiveFields: readonly ["password", "token", "secret", "key", "authorization"];
-    };
-};
-export type SecurityEventType = "input_validation_failure" | "rate_limit_exceeded" | "authentication_failure" | "authorization_failure" | "suspicious_activity" | "sql_injection_attempt" | "xss_attempt" | "csrf_attempt" | "security_header_missing" | "encryption_failure" | "audit_log_failure";
-export type SecuritySeverity = "low" | "medium" | "high" | "critical";
-export interface SecurityEvent {
-    id: string;
-    type: SecurityEventType;
-    severity: SecuritySeverity;
-    message: string;
-    source: string;
-    userId?: string;
-    ipAddress?: string;
-    userAgent?: string;
-    timestamp: number;
-    metadata: Record<string, unknown>;
-    stackTrace?: string;
-}
-export interface ValidationResult {
-    isValid: boolean;
-    errors: string[];
-    sanitizedValue?: unknown;
-    securityEvents: SecurityEvent[];
-}
-export interface RateLimitEntry {
-    count: number;
-    resetTime: number;
-    lastRequest: number;
-}
-export interface SecurityMiddlewareOptions {
-    enableRateLimiting?: boolean;
-    enableInputValidation?: boolean;
-    enableSecurityHeaders?: boolean;
-    enableAuditLogging?: boolean;
-    enableCsrfProtection?: boolean;
-    enableHsts?: boolean;
-    customHeaders?: Record<string, string>;
-    trustedOrigins?: string[];
-    rateLimitOptions?: Partial<typeof SECURITY_CONFIG.rateLimiting>;
-}
-/**
- * Core security hardening system
- */
-export declare class SecurityHardeningSystem extends EventEmitter {
-    private rateLimitStore;
-    private securityEvents;
-    private encryptionKey;
-    private auditLogEnabled;
-    private started;
-    private pendingEncryptionKey;
-    private boundSecurityEvent;
-    private boundRateLimitExceeded;
-    private boundValidationFailure;
-    constructor(encryptionKey?: string);
-    start(): void;
-    /**
-     * Setup event handlers for security events
-     */
-    private setupEventHandlers;
-    destroy(): void;
-    /**
-     * Create security middleware for HTTP requests
-     */
-    createSecurityMiddleware(options?: SecurityMiddlewareOptions): (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
-    /**
-     * Check rate limiting for requests
-     */
-    private checkRateLimit;
-    /**
-     * Apply security headers to response
-     */
-    private applySecurityHeaders;
-    /**
-     * Validate CSRF token
-     */
-    private validateCsrfToken;
-    /**
-     * Validate and sanitize input data
-     */
-    validateInput(input: unknown, context?: string): ValidationResult;
-    /**
-     * Validate string input
-     */
-    private validateString;
-    /**
-     * Validate object input
-     */
-    private validateObject;
-    /**
-     * Validate array input
-     */
-    private validateArray;
-    /**
-     * Check for security patterns in input
-     */
-    private checkSecurityPatterns;
-    /**
-     * Encrypt sensitive data using AES-256-GCM
-     * SECURITY: Proper encryption with random IV and authentication tag (H-001 fix)
-     *
-     * @param data - Plaintext data to encrypt
-     * @returns Base64-encoded string containing encrypted data + IV + auth tag
-     */
-    encryptData(data: string): string;
-    /**
-     * Decrypt sensitive data using AES-256-GCM
-     * SECURITY: Proper decryption with IV and auth tag verification (H-001 fix)
-     *
-     * @param encryptedData - Base64-encoded string containing encrypted data + IV + auth tag
-     * @returns Decrypted plaintext data
-     * @throws Error if decryption fails or authentication tag doesn't match
-     */
-    decryptData(encryptedData: string): string | null;
-    /**
-     * Hash password securely with unique salt
-     * SECURITY: Generates unique random salt for each password (H-003 fix)
-     */
-    hashPassword(password: string): Promise<{
-        hash: string;
-        salt: string;
-    }>;
-    /**
-     * Verify password hash
-     */
-    verifyPassword(password: string, hash: string, salt: string): Promise<boolean>;
-    /**
-     * Generate secure random token
-     */
-    generateSecureToken(length?: number): string;
-    /**
-     * Log audit event
-     */
-    private logAuditEvent;
-    /**
-     * Sanitize headers for audit logging
-     */
-    private sanitizeHeadersForAudit;
-    /**
-     * Emit security event
-     */
-    private emitSecurityEvent;
-    /**
-     * Handle security events
-     */
-    private handleSecurityEvent;
-    /**
-     * Handle rate limit exceeded
-     */
-    private handleRateLimitExceeded;
-    /**
-     * Handle validation failure
-     */
-    private handleValidationFailure;
-    /**
-     * Get client IP address
-     */
-    private getClientIP;
-    /**
-     * Get rate limit info for IP
-     */
-    private getRateLimitInfo;
-    /**
-     * Get object depth
-     */
-    private getObjectDepth;
-    /**
-     * Cleanup old rate limit entries
-     */
-    private cleanupRateLimitStore;
-    /**
-     * Get security events
-     */
-    getSecurityEvents(limit?: number): SecurityEvent[];
-    /**
-     * Clear security events
-     */
-    clearSecurityEvents(): void;
-    /**
-     * Get security statistics
-     */
-    getSecurityStats(): {
-        totalEvents: number;
-        eventsByType: Record<SecurityEventType, number>;
-        eventsBySeverity: Record<SecuritySeverity, number>;
-        recentEvents: SecurityEvent[];
-    };
-    /**
-     * Enable/disable audit logging
-     */
-    setAuditLogging(enabled: boolean): void;
-}
-export declare const securityHardeningSystem: SecurityHardeningSystem;