@avi770/testteam 1.2.0 → 3.0.0

package/dist/agents/35-csrf-tester.d.ts

@@ -0,0 +1,11 @@
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+export declare class CsrfTesterAgent extends BaseAgent {
+    readonly agentId = 35;
+    readonly agentName = "CSRF Tester";
+    private baseUrl;
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private discoverEndpoints;
+}
+//# sourceMappingURL=35-csrf-tester.d.ts.map

package/dist/agents/35-csrf-tester.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"35-csrf-tester.d.ts","sourceRoot":"","sources":["../../agents/35-csrf-tester.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAYzC,qBAAa,eAAgB,SAAQ,SAAS;IAC5C,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,iBAAiB;IACnC,OAAO,CAAC,OAAO,CAAM;cAEL,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAK1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAmD7C,OAAO,CAAC,iBAAiB;CAO1B"}

package/dist/agents/35-csrf-tester.js

@@ -0,0 +1,70 @@
+import { BaseAgent } from './base-agent';
+import { resolveEnvironment } from '../helpers/env-resolver';
+/** Common POST endpoints to test for CSRF protection. */
+const DEFAULT_POST_ENDPOINTS = [
+    '/api/auth/login',
+    '/api/tasks',
+    '/api/clients',
+];
+const REQUEST_TIMEOUT_MS = 10_000;
+export class CsrfTesterAgent extends BaseAgent {
+    agentId = 35;
+    agentName = 'CSRF Tester';
+    baseUrl = '';
+    async preFlight() {
+        const { env } = await resolveEnvironment(this.config, this.phase);
+        this.baseUrl = env.baseUrl;
+    }
+    async execute() {
+        const findings = [];
+        const endpoints = this.discoverEndpoints();
+        for (const endpoint of endpoints) {
+            const url = `${this.baseUrl}${endpoint}`;
+            try {
+                const response = await Promise.race([
+                    fetch(url, {
+                        method: 'POST',
+                        headers: { 'Content-Type': 'application/json' },
+                        body: JSON.stringify({ test: 'csrf-probe' }),
+                        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+                    }),
+                    new Promise((_, reject) => setTimeout(() => reject(new Error('CSRF test timeout')), REQUEST_TIMEOUT_MS)),
+                ]);
+                if (response.status === 200 || response.status === 201) {
+                    findings.push({
+                        id: `${this.agentId}-no-csrf-${endpoint.replace(/\//g, '_')}`,
+                        type: 'code-bug-security',
+                        severity: 'high',
+                        agentId: this.agentId,
+                        module: 'csrf-tester',
+                        description: `Endpoint ${endpoint} accepts POST requests without CSRF protection (status ${response.status})`,
+                    });
+                }
+                this.addEvidence({
+                    type: 'log',
+                    path: `csrf-test-${endpoint.replace(/\//g, '_')}`,
+                    description: `POST ${endpoint} without auth/CSRF headers: status=${response.status}`,
+                });
+            }
+            catch (error) {
+                findings.push({
+                    id: `${this.agentId}-request-failed-${endpoint.replace(/\//g, '_')}`,
+                    type: 'infra-issue',
+                    severity: 'low',
+                    agentId: this.agentId,
+                    module: 'csrf-tester',
+                    description: `Failed to test endpoint ${endpoint}: ${error instanceof Error ? error.message : String(error)}`,
+                });
+            }
+        }
+        return findings;
+    }
+    discoverEndpoints() {
+        if (this.config.modules && this.config.modules.length > 0) {
+            const moduleEndpoints = this.config.modules.map(m => `/api${m.route}`);
+            return [...new Set([...DEFAULT_POST_ENDPOINTS, ...moduleEndpoints])];
+        }
+        return [...DEFAULT_POST_ENDPOINTS];
+    }
+}
+//# sourceMappingURL=35-csrf-tester.js.map

package/dist/agents/35-csrf-tester.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"35-csrf-tester.js","sourceRoot":"","sources":["../../agents/35-csrf-tester.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,yDAAyD;AACzD,MAAM,sBAAsB,GAAG;IAC7B,iBAAiB;IACjB,YAAY;IACZ,cAAc;CACN,CAAC;AAEX,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,OAAO,eAAgB,SAAQ,SAAS;IACnC,OAAO,GAAG,EAAE,CAAC;IACb,SAAS,GAAG,aAAa,CAAC;IAC3B,OAAO,GAAG,EAAE,CAAC;IAEX,KAAK,CAAC,SAAS;QACvB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC7B,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE3C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC;YAEzC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;oBAClC,KAAK,CAAC,GAAG,EAAE;wBACT,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;wBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;wBAC5C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;qBAChD,CAAC;oBACF,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAC7E;iBACF,CAAa,CAAC;gBAEf,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACvD,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,YAAY,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE;wBAC7D,IAAI,EAAE,mBAAmB;wBACzB,QAAQ,EAAE,MAAM;wBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,MAAM,EAAE,aAAa;wBACrB,WAAW,EAAE,YAAY,QAAQ,0DAA0D,QAAQ,CAAC,MAAM,GAAG;qBAC9G,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,WAAW,CAAC;oBACf,IAAI,EAAE,KAAK;oBACX,IAAI,EAAE,aAAa,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE;oBACjD,WAAW,EAAE,QAAQ,QAAQ,sCAAsC,QAAQ,CAAC,MAAM,EAAE;iBACrF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,mBAAmB,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE;oBACpE,IAAI,EAAE,aAAa;oBACnB,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,aAAa;oBACrB,WAAW,EAAE,2BAA2B,QAAQ,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;iBAC9G,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,iBAAiB;QACvB,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACvE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,sBAAsB,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,CAAC,GAAG,sBAAsB,CAAC,CAAC;IACrC,CAAC;CACF"}

package/dist/agents/36-auth-fuzzer.d.ts

@@ -0,0 +1,13 @@
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+export declare class AuthFuzzerAgent extends BaseAgent {
+    readonly agentId = 36;
+    readonly agentName = "Auth Fuzzer";
+    private baseUrl;
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private testSqlInjection;
+    private testAccountLockout;
+    private testJwtAlgNone;
+}
+//# sourceMappingURL=36-auth-fuzzer.d.ts.map

package/dist/agents/36-auth-fuzzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"36-auth-fuzzer.d.ts","sourceRoot":"","sources":["../../agents/36-auth-fuzzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAMzC,qBAAa,eAAgB,SAAQ,SAAS;IAC5C,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,iBAAiB;IACnC,OAAO,CAAC,OAAO,CAAM;cAEL,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAK1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAkB/B,gBAAgB;YAkDhB,kBAAkB;YAmDlB,cAAc;CAyD7B"}

package/dist/agents/36-auth-fuzzer.js

@@ -0,0 +1,163 @@
+import { BaseAgent } from './base-agent';
+import { resolveEnvironment } from '../helpers/env-resolver';
+const REQUEST_TIMEOUT_MS = 10_000;
+const LOCKOUT_ATTEMPTS = 10;
+export class AuthFuzzerAgent extends BaseAgent {
+    agentId = 36;
+    agentName = 'Auth Fuzzer';
+    baseUrl = '';
+    async preFlight() {
+        const { env } = await resolveEnvironment(this.config, this.phase);
+        this.baseUrl = env.baseUrl;
+    }
+    async execute() {
+        const findings = [];
+        // Test 1: SQL injection in login
+        const sqlInjectionFindings = await this.testSqlInjection();
+        findings.push(...sqlInjectionFindings);
+        // Test 2: Account lockout
+        const lockoutFindings = await this.testAccountLockout();
+        findings.push(...lockoutFindings);
+        // Test 3: JWT alg:none bypass
+        const jwtFindings = await this.testJwtAlgNone();
+        findings.push(...jwtFindings);
+        return findings;
+    }
+    async testSqlInjection() {
+        const findings = [];
+        const loginUrl = `${this.baseUrl}/api/auth/login`;
+        try {
+            const response = await Promise.race([
+                fetch(loginUrl, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({
+                        email: "' OR 1=1 --",
+                        password: 'anything',
+                    }),
+                    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+                }),
+                new Promise((_, reject) => setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS)),
+            ]);
+            if (response.status === 200 || response.status === 201) {
+                findings.push({
+                    id: `${this.agentId}-sql-injection-login`,
+                    type: 'code-bug-security',
+                    severity: 'critical',
+                    agentId: this.agentId,
+                    module: 'auth-fuzzer',
+                    description: `SQL injection in login succeeded — endpoint returned ${response.status} for malicious email input`,
+                });
+            }
+            this.addEvidence({
+                type: 'log',
+                path: 'sql-injection-test',
+                description: `SQL injection login test: status=${response.status}`,
+            });
+        }
+        catch (error) {
+            findings.push({
+                id: `${this.agentId}-sql-injection-error`,
+                type: 'infra-issue',
+                severity: 'low',
+                agentId: this.agentId,
+                module: 'auth-fuzzer',
+                description: `SQL injection test failed to execute: ${error instanceof Error ? error.message : String(error)}`,
+            });
+        }
+        return findings;
+    }
+    async testAccountLockout() {
+        const findings = [];
+        const loginUrl = `${this.baseUrl}/api/auth/login`;
+        let got429 = false;
+        for (let i = 0; i < LOCKOUT_ATTEMPTS; i++) {
+            try {
+                const response = await Promise.race([
+                    fetch(loginUrl, {
+                        method: 'POST',
+                        headers: { 'Content-Type': 'application/json' },
+                        body: JSON.stringify({
+                            email: 'lockout-test@example.com',
+                            password: `wrong-password-${i}`,
+                        }),
+                        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+                    }),
+                    new Promise((_, reject) => setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS)),
+                ]);
+                if (response.status === 429) {
+                    got429 = true;
+                    break;
+                }
+            }
+            catch {
+                // Request failed — continue testing
+            }
+        }
+        if (!got429) {
+            findings.push({
+                id: `${this.agentId}-no-lockout`,
+                type: 'code-bug-security',
+                severity: 'medium',
+                agentId: this.agentId,
+                module: 'auth-fuzzer',
+                description: `No account lockout after ${LOCKOUT_ATTEMPTS} failed login attempts — no 429 response received`,
+            });
+        }
+        this.addEvidence({
+            type: 'log',
+            path: 'lockout-test',
+            description: `Account lockout test: ${got429 ? 'lockout triggered' : 'no lockout detected'} after ${LOCKOUT_ATTEMPTS} attempts`,
+        });
+        return findings;
+    }
+    async testJwtAlgNone() {
+        const findings = [];
+        // Create a JWT with alg: "none"
+        const header = Buffer.from(JSON.stringify({ alg: 'none', typ: 'JWT' })).toString('base64url');
+        const payload = Buffer.from(JSON.stringify({ sub: '1', email: 'admin@test.com', role: 'admin', iat: Math.floor(Date.now() / 1000) })).toString('base64url');
+        const fakeJwt = `${header}.${payload}.`;
+        // Try accessing a protected endpoint
+        const protectedUrl = `${this.baseUrl}/api/tasks`;
+        try {
+            const response = await Promise.race([
+                fetch(protectedUrl, {
+                    method: 'GET',
+                    headers: {
+                        'Authorization': `Bearer ${fakeJwt}`,
+                        'Content-Type': 'application/json',
+                    },
+                    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+                }),
+                new Promise((_, reject) => setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS)),
+            ]);
+            if (response.status === 200) {
+                findings.push({
+                    id: `${this.agentId}-jwt-alg-none`,
+                    type: 'code-bug-security',
+                    severity: 'critical',
+                    agentId: this.agentId,
+                    module: 'auth-fuzzer',
+                    description: `Protected endpoint accepts JWT with alg:"none" — authentication bypass vulnerability`,
+                });
+            }
+            this.addEvidence({
+                type: 'log',
+                path: 'jwt-alg-none-test',
+                description: `JWT alg:none test: status=${response.status}`,
+            });
+        }
+        catch (error) {
+            findings.push({
+                id: `${this.agentId}-jwt-test-error`,
+                type: 'infra-issue',
+                severity: 'low',
+                agentId: this.agentId,
+                module: 'auth-fuzzer',
+                description: `JWT alg:none test failed to execute: ${error instanceof Error ? error.message : String(error)}`,
+            });
+        }
+        return findings;
+    }
+}
+//# sourceMappingURL=36-auth-fuzzer.js.map

package/dist/agents/36-auth-fuzzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"36-auth-fuzzer.js","sourceRoot":"","sources":["../../agents/36-auth-fuzzer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,MAAM,OAAO,eAAgB,SAAQ,SAAS;IACnC,OAAO,GAAG,EAAE,CAAC;IACb,SAAS,GAAG,aAAa,CAAC;IAC3B,OAAO,GAAG,EAAE,CAAC;IAEX,KAAK,CAAC,SAAS;QACvB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC7B,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,iCAAiC;QACjC,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,CAAC;QAEvC,0BAA0B;QAC1B,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;QAElC,8BAA8B;QAC9B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAChD,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;QAE9B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,OAAO,iBAAiB,CAAC;QAElD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAClC,KAAK,CAAC,QAAQ,EAAE;oBACd,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,KAAK,EAAE,aAAa;wBACpB,QAAQ,EAAE,UAAU;qBACrB,CAAC;oBACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;iBAChD,CAAC;gBACF,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,kBAAkB,CAAC,CACnE;aACF,CAAa,CAAC;YAEf,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvD,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,sBAAsB;oBACzC,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,UAAU;oBACpB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,aAAa;oBACrB,WAAW,EAAE,wDAAwD,QAAQ,CAAC,MAAM,4BAA4B;iBACjH,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,oBAAoB;gBAC1B,WAAW,EAAE,oCAAoC,QAAQ,CAAC,MAAM,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,sBAAsB;gBACzC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,aAAa;gBACrB,WAAW,EAAE,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC/G,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,OAAO,iBAAiB,CAAC;QAClD,IAAI,MAAM,GAAG,KAAK,CAAC;QAEnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,gBAAgB,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;oBAClC,KAAK,CAAC,QAAQ,EAAE;wBACd,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;wBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,0BAA0B;4BACjC,QAAQ,EAAE,kBAAkB,CAAC,EAAE;yBAChC,CAAC;wBACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;qBAChD,CAAC;oBACF,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,kBAAkB,CAAC,CACnE;iBACF,CAAa,CAAC;gBAEf,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC5B,MAAM,GAAG,IAAI,CAAC;oBACd,MAAM;gBACR,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oCAAoC;YACtC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,aAAa;gBAChC,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,aAAa;gBACrB,WAAW,EAAE,4BAA4B,gBAAgB,mDAAmD;aAC7G,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC;YACf,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,yBAAyB,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,qBAAqB,UAAU,gBAAgB,WAAW;SAChI,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,gCAAgC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CACzB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CACzG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,OAAO,GAAG,GAAG,MAAM,IAAI,OAAO,GAAG,CAAC;QAExC,qCAAqC;QACrC,MAAM,YAAY,GAAG,GAAG,IAAI,CAAC,OAAO,YAAY,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAClC,KAAK,CAAC,YAAY,EAAE;oBAClB,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE;wBACP,eAAe,EAAE,UAAU,OAAO,EAAE;wBACpC,cAAc,EAAE,kBAAkB;qBACnC;oBACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;iBAChD,CAAC;gBACF,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,kBAAkB,CAAC,CACnE;aACF,CAAa,CAAC;YAEf,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,eAAe;oBAClC,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,UAAU;oBACpB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,aAAa;oBACrB,WAAW,EAAE,sFAAsF;iBACpG,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,mBAAmB;gBACzB,WAAW,EAAE,6BAA6B,QAAQ,CAAC,MAAM,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,iBAAiB;gBACpC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,aAAa;gBACrB,WAAW,EAAE,wCAAwC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC9G,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/agents/37-dependency-scanner.d.ts

@@ -0,0 +1,11 @@
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+export declare class DependencyScannerAgent extends BaseAgent {
+    readonly agentId = 37;
+    readonly agentName = "Dependency Scanner";
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private runAudit;
+    private runOutdated;
+}
+//# sourceMappingURL=37-dependency-scanner.d.ts.map

package/dist/agents/37-dependency-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"37-dependency-scanner.d.ts","sourceRoot":"","sources":["../../agents/37-dependency-scanner.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAiCzC,qBAAa,sBAAuB,SAAQ,SAAS;IACnD,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,wBAAwB;cAE1B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAI1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAe/B,QAAQ;YAuDR,WAAW;CA6D1B"}

package/dist/agents/37-dependency-scanner.js

@@ -0,0 +1,139 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { BaseAgent } from './base-agent';
+const execFileAsync = promisify(execFile);
+const SEVERITY_MAP = {
+    critical: 'critical',
+    high: 'high',
+    moderate: 'medium',
+    low: 'low',
+    info: 'low',
+};
+export class DependencyScannerAgent extends BaseAgent {
+    agentId = 37;
+    agentName = 'Dependency Scanner';
+    async preFlight() {
+        // No special pre-conditions
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        // Run npm audit
+        const auditFindings = await this.runAudit(projectRoot);
+        findings.push(...auditFindings);
+        // Run npm outdated
+        const outdatedFindings = await this.runOutdated(projectRoot);
+        findings.push(...outdatedFindings);
+        return findings;
+    }
+    async runAudit(projectRoot) {
+        const findings = [];
+        try {
+            let stdout;
+            try {
+                const result = await execFileAsync('npm', ['audit', '--json'], {
+                    cwd: projectRoot,
+                    timeout: 60_000,
+                });
+                stdout = result.stdout;
+            }
+            catch (execError) {
+                // npm audit exits non-zero when vulnerabilities are found
+                const err = execError;
+                if (err.stdout) {
+                    stdout = err.stdout;
+                }
+                else {
+                    throw execError;
+                }
+            }
+            const report = JSON.parse(stdout);
+            const vulnerabilities = report.vulnerabilities ?? {};
+            for (const [name, vuln] of Object.entries(vulnerabilities)) {
+                const severity = SEVERITY_MAP[vuln.severity] ?? 'medium';
+                findings.push({
+                    id: `${this.agentId}-vuln-${name}`,
+                    type: 'code-bug-security',
+                    severity,
+                    agentId: this.agentId,
+                    module: 'dependency-scanner',
+                    description: `Vulnerability in ${name}: ${vuln.title ?? vuln.severity} (${vuln.url ?? 'no URL'})`,
+                });
+            }
+            this.addEvidence({
+                type: 'report',
+                path: 'npm-audit',
+                description: `npm audit found ${Object.keys(vulnerabilities).length} vulnerable packages`,
+            });
+        }
+        catch (error) {
+            findings.push({
+                id: `${this.agentId}-audit-error`,
+                type: 'infra-issue',
+                severity: 'medium',
+                agentId: this.agentId,
+                module: 'dependency-scanner',
+                description: `npm audit failed: ${error instanceof Error ? error.message : String(error)}`,
+            });
+        }
+        return findings;
+    }
+    async runOutdated(projectRoot) {
+        const findings = [];
+        try {
+            let stdout;
+            try {
+                const result = await execFileAsync('npm', ['outdated', '--json'], {
+                    cwd: projectRoot,
+                    timeout: 60_000,
+                });
+                stdout = result.stdout;
+            }
+            catch (execError) {
+                // npm outdated exits non-zero when there are outdated packages
+                const err = execError;
+                if (err.stdout) {
+                    stdout = err.stdout;
+                }
+                else {
+                    throw execError;
+                }
+            }
+            if (!stdout || stdout.trim() === '') {
+                return findings;
+            }
+            const outdated = JSON.parse(stdout);
+            for (const [name, info] of Object.entries(outdated)) {
+                const currentMajor = parseInt(info.current.split('.')[0], 10);
+                const latestMajor = parseInt(info.latest.split('.')[0], 10);
+                if (latestMajor - currentMajor >= 1) {
+                    findings.push({
+                        id: `${this.agentId}-outdated-${name}`,
+                        type: 'test-bug',
+                        severity: 'low',
+                        agentId: this.agentId,
+                        module: 'dependency-scanner',
+                        description: `Package ${name} is ${latestMajor - currentMajor} major version(s) behind: current=${info.current}, latest=${info.latest}`,
+                    });
+                }
+            }
+            this.addEvidence({
+                type: 'report',
+                path: 'npm-outdated',
+                description: `npm outdated found ${Object.keys(outdated).length} outdated packages`,
+            });
+        }
+        catch (error) {
+            findings.push({
+                id: `${this.agentId}-outdated-error`,
+                type: 'infra-issue',
+                severity: 'low',
+                agentId: this.agentId,
+                module: 'dependency-scanner',
+                description: `npm outdated failed: ${error instanceof Error ? error.message : String(error)}`,
+            });
+        }
+        return findings;
+    }
+}
+//# sourceMappingURL=37-dependency-scanner.js.map

package/dist/agents/37-dependency-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"37-dependency-scanner.js","sourceRoot":"","sources":["../../agents/37-dependency-scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAuB1C,MAAM,YAAY,GAAgB;IAChC,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,QAAQ;IAClB,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,KAAK;CACZ,CAAC;AAEF,MAAM,OAAO,sBAAuB,SAAQ,SAAS;IAC1C,OAAO,GAAG,EAAE,CAAC;IACb,SAAS,GAAG,oBAAoB,CAAC;IAEhC,KAAK,CAAC,SAAS;QACvB,4BAA4B;IAC9B,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7D,gBAAgB;QAChB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;QAEhC,mBAAmB;QACnB,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAC7D,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC;QAEnC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,WAAmB;QACxC,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;oBAC7D,GAAG,EAAE,WAAW;oBAChB,OAAO,EAAE,MAAM;iBAChB,CAAC,CAAC;gBACH,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YACzB,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACnB,0DAA0D;gBAC1D,MAAM,GAAG,GAAG,SAAiD,CAAC;gBAC9D,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;oBACf,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;gBACtB,CAAC;qBAAM,CAAC;oBACN,MAAM,SAAS,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAgB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;YAErD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC3D,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC;gBACzD,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,SAAS,IAAI,EAAE;oBAClC,IAAI,EAAE,mBAAmB;oBACzB,QAAQ;oBACR,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,oBAAoB;oBAC5B,WAAW,EAAE,oBAAoB,IAAI,KAAK,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,GAAG,IAAI,QAAQ,GAAG;iBAClG,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,WAAW;gBACjB,WAAW,EAAE,mBAAmB,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,sBAAsB;aAC1F,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,cAAc;gBACjC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,oBAAoB;gBAC5B,WAAW,EAAE,qBAAqB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC3F,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,WAAmB;QAC3C,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE;oBAChE,GAAG,EAAE,WAAW;oBAChB,OAAO,EAAE,MAAM;iBAChB,CAAC,CAAC;gBACH,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YACzB,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACnB,+DAA+D;gBAC/D,MAAM,GAAG,GAAG,SAAiD,CAAC;gBAC9D,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;oBACf,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;gBACtB,CAAC;qBAAM,CAAC;oBACN,MAAM,SAAS,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACpC,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,MAAM,QAAQ,GAAkC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAEnE,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9D,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAE5D,IAAI,WAAW,GAAG,YAAY,IAAI,CAAC,EAAE,CAAC;oBACpC,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,aAAa,IAAI,EAAE;wBACtC,IAAI,EAAE,UAAU;wBAChB,QAAQ,EAAE,KAAK;wBACf,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,MAAM,EAAE,oBAAoB;wBAC5B,WAAW,EAAE,WAAW,IAAI,OAAO,WAAW,GAAG,YAAY,qCAAqC,IAAI,CAAC,OAAO,YAAY,IAAI,CAAC,MAAM,EAAE;qBACxI,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,cAAc;gBACpB,WAAW,EAAE,sBAAsB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,oBAAoB;aACpF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,iBAAiB;gBACpC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,oBAAoB;gBAC5B,WAAW,EAAE,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC9F,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/agents/38-secrets-scanner.d.ts

@@ -0,0 +1,11 @@
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+export declare class SecretsScannerAgent extends BaseAgent {
+    readonly agentId = 38;
+    readonly agentName = "Secrets Scanner";
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private collectFiles;
+    private scanFile;
+}
+//# sourceMappingURL=38-secrets-scanner.d.ts.map

package/dist/agents/38-secrets-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"38-secrets-scanner.d.ts","sourceRoot":"","sources":["../../agents/38-secrets-scanner.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAuBzC,qBAAa,mBAAoB,SAAQ,SAAS;IAChD,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,qBAAqB;cAEvB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAI1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAoC/B,YAAY;YAkCZ,QAAQ;CAgCvB"}

package/dist/agents/38-secrets-scanner.js

@@ -0,0 +1,116 @@
+import { readdir, readFile, stat } from 'node:fs/promises';
+import { join, extname } from 'node:path';
+import { BaseAgent } from './base-agent';
+/** File extensions to scan for secrets. */
+const SCANNABLE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.json', '.env']);
+/** Maximum file size to scan (1MB). */
+const MAX_FILE_SIZE = 1024 * 1024;
+/** Directories to skip. */
+const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'out', 'coverage', '.next']);
+const SECRET_PATTERNS = [
+    { name: 'AWS Access Key', regex: /AKIA[0-9A-Z]{16}/g },
+    { name: 'Stripe Live Key', regex: /sk_live_[a-zA-Z0-9]+/g },
+    { name: 'Hardcoded Password', regex: /password\s*[:=]\s*['"][^'"]+/gi },
+    { name: 'Private Key', regex: /-----BEGIN.*PRIVATE KEY-----/g },
+];
+export class SecretsScannerAgent extends BaseAgent {
+    agentId = 38;
+    agentName = 'Secrets Scanner';
+    async preFlight() {
+        // No special pre-conditions
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        let scannedFiles = 0;
+        let totalMatches = 0;
+        try {
+            const files = await this.collectFiles(projectRoot);
+            scannedFiles = files.length;
+            for (const filePath of files) {
+                const fileFindings = await this.scanFile(filePath);
+                totalMatches += fileFindings.length;
+                findings.push(...fileFindings);
+            }
+        }
+        catch (error) {
+            findings.push({
+                id: `${this.agentId}-scan-error`,
+                type: 'infra-issue',
+                severity: 'medium',
+                agentId: this.agentId,
+                module: 'secrets-scanner',
+                description: `Failed to scan project files: ${error instanceof Error ? error.message : String(error)}`,
+            });
+        }
+        this.addEvidence({
+            type: 'report',
+            path: 'secrets-scan',
+            description: `Scanned ${scannedFiles} files, found ${totalMatches} potential secrets`,
+        });
+        return findings;
+    }
+    async collectFiles(dir, depth = 0) {
+        if (depth > 5)
+            return [];
+        const files = [];
+        try {
+            const entries = await readdir(dir, { withFileTypes: true });
+            for (const entry of entries) {
+                if (SKIP_DIRS.has(entry.name))
+                    continue;
+                const fullPath = join(dir, entry.name);
+                if (entry.isDirectory()) {
+                    const subFiles = await this.collectFiles(fullPath, depth + 1);
+                    files.push(...subFiles);
+                }
+                else if (entry.isFile() && SCANNABLE_EXTENSIONS.has(extname(entry.name))) {
+                    try {
+                        const fileStat = await stat(fullPath);
+                        if (fileStat.size <= MAX_FILE_SIZE) {
+                            files.push(fullPath);
+                        }
+                    }
+                    catch {
+                        // Skip inaccessible files
+                    }
+                }
+            }
+        }
+        catch {
+            // Skip inaccessible directories
+        }
+        return files;
+    }
+    async scanFile(filePath) {
+        const findings = [];
+        try {
+            const content = await readFile(filePath, 'utf-8');
+            const lines = content.split('\n');
+            for (const pattern of SECRET_PATTERNS) {
+                for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
+                    const line = lines[lineIdx];
+                    // Reset regex lastIndex for global patterns
+                    pattern.regex.lastIndex = 0;
+                    if (pattern.regex.test(line)) {
+                        findings.push({
+                            id: `${this.agentId}-secret-${pattern.name.replace(/\s/g, '-').toLowerCase()}-${filePath.replace(/[\\/]/g, '_')}-L${lineIdx + 1}`,
+                            type: 'code-bug-security',
+                            severity: 'high',
+                            agentId: this.agentId,
+                            module: 'secrets-scanner',
+                            file: filePath,
+                            line: lineIdx + 1,
+                            description: `Potential ${pattern.name} found in ${filePath} at line ${lineIdx + 1}`,
+                        });
+                    }
+                }
+            }
+        }
+        catch {
+            // Skip unreadable files
+        }
+        return findings;
+    }
+}
+//# sourceMappingURL=38-secrets-scanner.js.map

package/dist/agents/38-secrets-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"38-secrets-scanner.js","sourceRoot":"","sources":["../../agents/38-secrets-scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,2CAA2C;AAC3C,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAE9E,uCAAuC;AACvC,MAAM,aAAa,GAAG,IAAI,GAAG,IAAI,CAAC;AAElC,2BAA2B;AAC3B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAOxF,MAAM,eAAe,GAAoB;IACvC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,EAAE;IACtD,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,uBAAuB,EAAE;IAC3D,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,gCAAgC,EAAE;IACvE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,+BAA+B,EAAE;CAChE,CAAC;AAEF,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IACvC,OAAO,GAAG,EAAE,CAAC;IACb,SAAS,GAAG,iBAAiB,CAAC;IAE7B,KAAK,CAAC,SAAS;QACvB,4BAA4B;IAC9B,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7D,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACnD,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC;YAE5B,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;gBAC7B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACnD,YAAY,IAAI,YAAY,CAAC,MAAM,CAAC;gBACpC,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,aAAa;gBAChC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,iBAAiB;gBACzB,WAAW,EAAE,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aACvG,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,WAAW,YAAY,iBAAiB,YAAY,oBAAoB;SACtF,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,GAAW,EAAE,KAAK,GAAG,CAAC;QAC/C,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QAEzB,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAE5D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAExC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAEvC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;oBACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;oBAC9D,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;gBAC1B,CAAC;qBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBAC3E,IAAI,CAAC;wBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;wBACtC,IAAI,QAAQ,CAAC,IAAI,IAAI,aAAa,EAAE,CAAC;4BACnC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;wBACvB,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,0BAA0B;oBAC5B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,QAAgB;QACrC,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAElC,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;gBACtC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;oBACxD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC5B,4CAA4C;oBAC5C,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;oBAC5B,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC7B,QAAQ,CAAC,IAAI,CAAC;4BACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,WAAW,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,EAAE;4BACjI,IAAI,EAAE,mBAAmB;4BACzB,QAAQ,EAAE,MAAM;4BAChB,OAAO,EAAE,IAAI,CAAC,OAAO;4BACrB,MAAM,EAAE,iBAAiB;4BACzB,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,OAAO,GAAG,CAAC;4BACjB,WAAW,EAAE,aAAa,OAAO,CAAC,IAAI,aAAa,QAAQ,YAAY,OAAO,GAAG,CAAC,EAAE;yBACrF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/agents/39-api-contract-tester.d.ts

@@ -0,0 +1,12 @@
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+export declare class ApiContractTesterAgent extends BaseAgent {
+    readonly agentId = 39;
+    readonly agentName = "API Contract Tester";
+    private baseUrl;
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private testEndpoint;
+    private validateSchema;
+}
+//# sourceMappingURL=39-api-contract-tester.d.ts.map

package/dist/agents/39-api-contract-tester.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"39-api-contract-tester.d.ts","sourceRoot":"","sources":["../../agents/39-api-contract-tester.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AA0BzC,qBAAa,sBAAuB,SAAQ,SAAS;IACnD,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,yBAAyB;IAC3C,OAAO,CAAC,OAAO,CAAM;cAEL,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAK1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YA4D/B,YAAY;IAqD1B,OAAO,CAAC,cAAc;CA8CvB"}