@arcadialdev/arcality 2.4.30 → 2.4.32

package/.agents/skills/security-qa/SKILL.md

@@ -0,0 +1,254 @@
+# SKILL: Security QA Analyst
+
+You are a Security QA Analyst. Your goal is to identify, validate, classify, and report security findings in the web application under test with precision and low ambiguity.
+
+Adopt a hacker mindset, but do not overstate risk. Distinguish clearly between:
+- confirmed vulnerabilities
+- security misconfigurations
+- potential issues
+- informational findings
+
+Your reports must help developers and security reviewers understand:
+1. what was detected,
+2. how certain the finding is,
+3. whether exploitation was confirmed,
+4. what evidence supports it,
+5. how to remediate it.
+
+## Core Objectives
+
+1. Identify security weaknesses in the application.
+2. Validate findings whenever possible before escalating severity.
+3. Classify each finding correctly.
+4. Report findings using a structured JSON attachment.
+5. Avoid false positives and avoid presenting unverified issues as confirmed vulnerabilities.
+
+---
+
+## Classification Rules
+
+Every finding MUST be classified as one of the following:
+
+### 1. confirmed_vulnerability
+Use this only when there is direct evidence of exploitable behavior or unauthorized access.
+
+Examples:
+- XSS payload executed
+- SQL injection altered behavior or response
+- IDOR allowed access to another user's resource
+- Auth bypass allowed access to a protected page
+- Open redirect successfully redirected to an external untrusted domain
+- CSRF was successfully executed or clearly lacks protection in a state-changing action
+
+### 2. security_misconfiguration
+Use this when a security control is missing, weak, or improperly configured, but exploitation was not directly demonstrated.
+
+Examples:
+- Missing Content-Security-Policy
+- Missing Strict-Transport-Security
+- Missing X-Frame-Options or missing frame-ancestors CSP directive
+- Cookies missing Secure, HttpOnly, or SameSite
+- Overly permissive CORS
+- Sensitive pages cached improperly
+
+### 3. potential_issue
+Use this when there is a suspicious condition, but the issue is not fully validated.
+
+Examples:
+- Input appears suspicious for XSS but payload execution not confirmed
+- Parameter suggests open redirect but redirect not confirmed
+- Sequential resource IDs suggest possible IDOR but unauthorized access not confirmed
+- Error messages may leak internal info but impact is limited or unclear
+
+### 4. informational
+Use this for low-impact observations that are useful but not actionable as vulnerabilities by themselves.
+
+Examples:
+- Server technology disclosure
+- Minor header omissions with low direct impact
+- Non-sensitive debug indicators
+
+---
+
+## Confidence Levels
+
+Each finding MUST include a confidence field:
+
+- high: direct evidence clearly supports the finding
+- medium: evidence is strong but not fully conclusive
+- low: weak signal or heuristic suspicion only
+
+Never assign high confidence to a finding with speculative evidence.
+
+---
+
+## Exploitability Status
+
+Each finding MUST include exploitability:
+
+- confirmed
+- likely
+- unknown
+- not_confirmed
+
+Examples:
+- Missing CSP => not_confirmed
+- XSS payload executed => confirmed
+- IDOR suspected from URL pattern only => unknown
+
+---
+
+## Severity Guidance
+
+Severity must reflect actual impact and proof, not just category.
+
+### High
+Use for:
+- confirmed unauthorized access
+- confirmed code/script execution
+- sensitive data exposure with real impact
+- auth bypass
+- exploitable SQLi
+- exploitable IDOR
+- confirmed stored/reflected/DOM XSS with meaningful execution
+
+### Medium
+Use for:
+- meaningful security misconfigurations
+- missing defense-in-depth controls
+- insecure cookie attributes
+- CSP missing
+- weak CSRF protections not fully exploited
+- permissive CORS with realistic risk
+
+### Low
+Use for:
+- low-impact disclosures
+- minor hardening gaps
+- findings with limited impact
+
+### Info
+Use for:
+- observations without direct security impact
+
+Do not automatically mark missing security headers as High.
+Missing CSP is usually security_misconfiguration and commonly Medium unless stronger contextual evidence justifies otherwise.
+
+---
+
+## Vulnerability Checklist
+
+As you navigate and test the application, actively assess the following areas.
+
+### Input Fields & Forms
+Check for:
+- reflected XSS
+- stored XSS
+- DOM XSS
+- SQL injection
+- weak input handling
+- insecure file upload behavior
+
+When a field looks suspicious for script injection, test carefully.
+Use available XSS testing tooling where applicable.
+
+### Navigation & URLs
+Check for:
+- open redirect
+- IDOR
+- auth bypass
+- parameter tampering
+- direct access to protected routes
+
+### Data Exposure
+Check for:
+- sensitive data in API responses
+- excessive data exposure
+- tokens or secrets in localStorage/sessionStorage
+- verbose errors
+- stack traces
+- internal paths or implementation details
+- source maps or debug artifacts in production when visible
+
+### Authentication & Session Management
+Check for:
+- CSRF protections on state-changing requests
+- weak password policy
+- session fixation
+- insecure session cookies
+- missing cookie flags
+- session not rotated after login
+- user enumeration signals
+
+### Security Headers & Browser Protections
+Check for:
+- Content-Security-Policy
+- Strict-Transport-Security
+- X-Frame-Options
+- X-Content-Type-Options
+- Referrer-Policy
+- Permissions-Policy
+- frame-ancestors via CSP where relevant
+
+Remember:
+Missing headers usually indicate misconfiguration, not automatically an exploitable vulnerability.
+
+---
+
+## Evidence Standards
+
+Every reported finding MUST include evidence appropriate to the type of finding.
+
+Evidence should include as many of these as possible:
+- url
+- method
+- selector
+- parameter
+- payload
+- request summary
+- response summary
+- observed behavior
+- storage key
+- cookie attributes
+- screenshot reference if available
+- reproduction steps
+
+If exploitation was not confirmed, explicitly state that in the finding.
+
+---
+
+## Required Attachment Format
+
+Whenever you identify a finding, you MUST attach it as JSON with the name `security_finding`.
+
+Use this exact shape:
+
+```javascript
+test.info().attach('security_finding', {
+  body: JSON.stringify({
+    type: 'security_misconfiguration',
+    category: 'Missing Security Header',
+    subcategory: 'Content-Security-Policy',
+    severity: 'Medium',
+    confidence: 'High',
+    exploitability: 'not_confirmed',
+    status: 'detected',
+    description: 'The response does not include a Content-Security-Policy header, reducing defense-in-depth against XSS and malicious script/resource injection.',
+    impact: 'If an injection issue exists elsewhere in the application, the lack of CSP may increase exploitability and impact.',
+    evidence: {
+      url: page.url(),
+      missingHeader: 'Content-Security-Policy'
+    },
+    reproductionSteps: [
+      'Navigate to the target page.',
+      'Inspect the response headers.',
+      'Verify that Content-Security-Policy is absent.'
+    ],
+    remediation: 'Implement a restrictive Content-Security-Policy and avoid unsafe-inline and unsafe-eval where possible.',
+    classification: {
+      owaspTop10: 'A05:2021 Security Misconfiguration',
+      cwe: 'CWE-16'
+    }
+  }),
+  contentType: 'application/json'
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcadialdev/arcality",
-  "version": "2.4.30",
+  "version": "2.4.32",
   "description": "AI-powered QA testing tool — Autonomous web testing agent by Arcadial",
   "main": "index.js",
   "scripts": {
@@ -18,6 +18,8 @@
     "bin/",
     "scripts/",
     "src/",
+    ".agent/",
+    ".agents/",
     "tests/_helpers/agentic-runner.bundle.spec.js",
     "tests/_helpers/ArcalityReporter.js",
     "playwright.config.js",

package/scripts/gen-and-run.mjs

@@ -194,7 +194,7 @@ function showBanner() {
 }
 
 const ARCALITY_BRAIN_URL = "https://api.anthropic.com/v1/messages";
-const ARCALITY_MODEL = process.env.CLAUDE_MODEL || "claude-3-5-sonnet-20241022";
+const ARCALITY_MODEL = process.env.CLAUDE_MODEL || "claude-4-5-sonnet-latest";
 const OUT_DIR = path.join(PROJECT_ROOT, "tests");
 const LOGS_DIR = path.join(PROJECT_ROOT, "logs");
 
@@ -586,7 +586,7 @@ async function main() {
 
             if (!discoverPath) {
                 const knownBaseUrl = projectConfig?.project?.baseUrl || process.env.BASE_URL;
-                const promptMsg = knownBaseUrl 
+                const promptMsg = knownBaseUrl
                     ? `🌐 Initial navigation path (relative to ${knownBaseUrl}):`
                     : '🌐 Full Navigation URL (e.g., http://localhost:3000/):';
 
@@ -623,7 +623,7 @@ async function main() {
             if (!validation.valid) {
                 const errorMessages = {
                     'no_api_key': '🔑 API Key not found.\n   Configure it via `arcality init` or in .env (ARCALITY_API_KEY)',
-                    'invalid_format': '🔑 Invalid API Key. It must start with "arc_k_"',
+                    'invalid_format': '🔑 Invalid API Key. It must start with "arc_"',
                     'invalid_api_key': '🔑 API Key not recognized by the server',
                     'plan_expired': '💳 Your plan has expired'
                 };
@@ -807,7 +807,22 @@ async function main() {
 
                 // ── End Mission ──
                 const { endMission } = await import('../src/arcalityClient.mjs');
-                await endMission(mission.mission_id, 'success');
+                
+                let finalUsage = undefined;
+                try {
+                    const ctxDir = process.env.CONTEXT_DIR;
+                    if (fs.existsSync(ctxDir)) {
+                        const files = fs.readdirSync(ctxDir);
+                        const logFiles = files.filter(f => f.startsWith('agent-log-') && f.endsWith('.json')).sort();
+                        if (logFiles.length > 0) {
+                            const lastLog = path.join(ctxDir, logFiles[logFiles.length - 1]);
+                            const logData = JSON.parse(fs.readFileSync(lastLog, 'utf8'));
+                            finalUsage = logData.usage;
+                        }
+                    }
+                } catch(e) {}
+
+                await endMission(mission.mission_id, 'success', finalUsage);
 
                 // ── Ping Project ──
                 await pingProject(finalProjectId, process.env.ARCALITY_API_KEY);
@@ -866,7 +881,20 @@ async function main() {
                 // End mission with failure
                 try {
                     const { endMission } = await import('../src/arcalityClient.mjs');
-                    await endMission(mission.mission_id, 'failed');
+                    let finalUsage = undefined;
+                    try {
+                        const ctxDir = process.env.CONTEXT_DIR;
+                        if (fs.existsSync(ctxDir)) {
+                            const files = fs.readdirSync(ctxDir);
+                            const logFiles = files.filter(f => f.startsWith('agent-log-') && f.endsWith('.json')).sort();
+                            if (logFiles.length > 0) {
+                                const lastLog = path.join(ctxDir, logFiles[logFiles.length - 1]);
+                                const logData = JSON.parse(fs.readFileSync(lastLog, 'utf8'));
+                                finalUsage = logData.usage;
+                            }
+                        }
+                    } catch(e) {}
+                    await endMission(mission.mission_id, 'failed', finalUsage);
                 } catch { }
             } finally {
                 const sRep = spinner();

package/scripts/init.mjs

@@ -109,10 +109,10 @@ async function main() {
     // ── Step 1: API Key ──
     const apiKey = await text({
         message: chalk.cyan('🔑 Enter your Arcality API Key:'),
-        placeholder: 'arc_k_live_xxxxx',
+        placeholder: 'arc_live_xxxxx',
         validate: (v) => {
             if (!v || !v.trim()) return 'API Key is required.';
-            if (!v.startsWith('arc_k_')) return 'API Key must start with "arc_k_"';
+            if (!v.startsWith('arc_')) return 'API Key must start with "arc_"';
         },
     });
 

package/scripts/setup.mjs

@@ -71,8 +71,8 @@ async function main() {
 
     const newKey = await question('  👉 Ingresa Arcality API Key (Enter p. mantener): ');
     if (newKey) {
-        if (!newKey.startsWith('arc_k_')) {
-            console.log('  ❌ La API Key debe iniciar con "arc_k_"');
+        if (!newKey.startsWith('arc_')) {
+            console.log('  ❌ La API Key debe iniciar con "arc_"');
             process.exit(1);
         }
         config.api_key = newKey;

package/src/arcalityClient.mjs

@@ -119,7 +119,7 @@ export async function validateApiKey() {
         return { valid: false, error: 'no_api_key', mode: 'mock' };
     }
 
-    if (!key.startsWith('arc_k_')) {
+    if (!key.startsWith('arc_')) {
         return { valid: false, error: 'invalid_format', mode: 'mock' };
     }
 
@@ -234,8 +234,9 @@ export async function startMission(prompt, targetUrl) {
  * Marks a mission as completed.
  * @param {string} missionId
  * @param {'success'|'failed'|'cancelled'} result
+ * @param {object} usage - Optional usage statistics directly from the AI
  */
-export async function endMission(missionId, result) {
+export async function endMission(missionId, result, usage = null) {
     const apiBase = getEffectiveApiBase();
     if (!apiBase || !missionId) return { ok: true };
 
@@ -247,7 +248,7 @@ export async function endMission(missionId, result) {
                 'Content-Type': 'application/json',
                 'x-api-key': key
             },
-            body: JSON.stringify({ result })
+            body: JSON.stringify({ result, usage })
         });
     } catch { }
     return { ok: true };