@avi770/testteam 3.0.0 → 3.2.0

package/dist/agents/11-fixer.d.ts

@@ -1,5 +1,5 @@
-import { BaseAgent } from './base-agent';
-import type { Finding, FindingType } from '../core/types';
+import { BaseAgent } from './base-agent.js';
+import type { Finding, FindingType } from '../core/types.js';
 /** Extended finding with resolution metadata. */
 export interface ResolvedFinding extends Finding {
     autoCommit: boolean;
@@ -21,6 +21,8 @@ export declare class FixerAgent extends BaseAgent {
     protected preFlight(): Promise<void>;
     protected execute(): Promise<Finding[]>;
     private processFinding;
+    private assertSafeFindingPath;
+    private writeResolvedFindingSecurely;
     private ensureFixBranch;
 }
 //# sourceMappingURL=11-fixer.d.ts.map

package/dist/agents/11-fixer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"11-fixer.d.ts","sourceRoot":"","sources":["../../agents/11-fixer.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAQ1D,iDAAiD;AACjD,MAAM,WAAW,eAAgB,SAAQ,OAAO;IAC9C,UAAU,EAAE,OAAO,CAAC;IACpB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,gBAAgB,EAAE,UAAU,GAAG,WAAW,GAAG,gBAAgB,CAAC;IAC9D,YAAY,EAAE,MAAM,CAAC;CACtB;AA+BD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,GAAG,MAAM,CA8B1F;AAED,qBAAa,UAAW,SAAQ,SAAS;IACvC,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,WAAW;IAE7B,mFAAmF;IACnF,OAAO,CAAC,UAAU,CAAS;cAEX,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cA2B1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAqC/B,cAAc;YA6Dd,eAAe;CAoB9B"}
+{"version":3,"file":"11-fixer.d.ts","sourceRoot":"","sources":["../../agents/11-fixer.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAQ1D,iDAAiD;AACjD,MAAM,WAAW,eAAgB,SAAQ,OAAO;IAC9C,UAAU,EAAE,OAAO,CAAC;IACpB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,gBAAgB,EAAE,UAAU,GAAG,WAAW,GAAG,gBAAgB,CAAC;IAC9D,YAAY,EAAE,MAAM,CAAC;CACtB;AA+BD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,GAAG,MAAM,CA8B1F;AAED,qBAAa,UAAW,SAAQ,SAAS;IACvC,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,WAAW;IAE7B,mFAAmF;IACnF,OAAO,CAAC,UAAU,CAAS;cAEX,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cA8B1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAqC/B,cAAc;YA8Dd,qBAAqB;YAWrB,4BAA4B;YAiB5B,eAAe;CAkC9B"}

package/dist/agents/11-fixer.js

@@ -1,9 +1,9 @@
 import * as fs from 'fs/promises';
 import * as path from 'path';
 import { execFile } from 'child_process';
-import { BaseAgent } from './base-agent';
-import { classifyFinding, shouldAutoCommit, shouldRequireHumanReview } from '../core/fix-loop';
-import { validateCodeQuality } from '../helpers/quality-gate';
+import { BaseAgent } from './base-agent.js';
+import { classifyFinding, shouldAutoCommit, shouldRequireHumanReview } from '../core/fix-loop.js';
+import { validateCodeQuality } from '../helpers/quality-gate.js';
 /** Maximum number of quality-gate retry attempts per finding. */
 const MAX_ATTEMPTS = 3;
 /** The date-stamped fix branch name prefix. */
@@ -80,12 +80,15 @@ export class FixerAgent extends BaseAgent {
             this.noFindings = true;
             return;
         }
-        // Verify we are on a fix branch, or that git is available so we can create one
-        try {
-            await execFilePromise('git', ['--version']);
-        }
-        catch {
-            throw new Error('[Fixer] preFlight failed: git is not available — cannot create fix branch');
+        // git is only needed when branch creation is opted in (OBS-4: off by default
+        // so a run never switches the user's working branch).
+        if (this.config.autoFix?.createBranch === true) {
+            try {
+                await execFilePromise('git', ['--version']);
+            }
+            catch {
+                throw new Error('[Fixer] preFlight failed: git is not available — cannot create fix branch');
+            }
         }
     }
     async execute() {
@@ -165,11 +168,49 @@ export class FixerAgent extends BaseAgent {
                 `autoCommit=${autoCommit} humanReview=${requiresHumanReview} ` +
                 `status=${resolutionStatus} attempts=${attemptCount}`,
         });
-        // Write updated finding back to disk
-        await fs.writeFile(filePath, JSON.stringify(resolvedFinding, null, 2), 'utf-8');
+        // Write updated finding back to disk using a safe, atomic write path.
+        await this.assertSafeFindingPath(filePath);
+        await this.writeResolvedFindingSecurely(filePath, resolvedFinding);
         return resolvedFinding;
     }
+    async assertSafeFindingPath(filePath) {
+        const allowedDir = path.resolve(this.runDir, 'findings', 'code-bugs');
+        const resolvedPath = path.resolve(filePath);
+        const relative = path.relative(allowedDir, resolvedPath);
+        // Reject paths outside the expected findings directory.
+        if (relative.startsWith('..') || path.isAbsolute(relative)) {
+            throw new Error(`Unsafe finding path outside allowed directory: ${filePath}`);
+        }
+    }
+    async writeResolvedFindingSecurely(filePath, resolvedFinding) {
+        const targetDir = path.dirname(filePath);
+        const tempPrefix = path.join(targetDir, '.fixer-tmp-');
+        const tempDir = await fs.mkdtemp(tempPrefix);
+        const tempFile = path.join(tempDir, `finding-${Date.now()}.json`);
+        try {
+            await fs.writeFile(tempFile, JSON.stringify(resolvedFinding, null, 2), {
+                encoding: 'utf-8',
+                mode: 0o600,
+            });
+            await fs.rename(tempFile, filePath);
+        }
+        finally {
+            await fs.rm(tempDir, { recursive: true, force: true }).catch(() => { });
+        }
+    }
     async ensureFixBranch() {
+        // OBS-4: branch creation is opt-in. By default the Fixer never switches the
+        // host repo's branch — it only emits patch suggestions. Enable via
+        // `autoFix.createBranch: true` (ideally on a dedicated checkout/worktree).
+        if (this.config.autoFix?.createBranch !== true) {
+            this.addEvidence({
+                type: 'log',
+                path: this.runDir,
+                description: 'Fixer: git branch creation disabled (set autoFix.createBranch:true to enable); ' +
+                    'emitting patch suggestions without touching git.',
+            });
+            return;
+        }
         try {
             const onFix = await isOnFixBranch();
             if (onFix)

package/dist/agents/11-fixer.js.map

@@ -1 +1 @@
-{"version":3,"file":"11-fixer.js","sourceRoot":"","sources":["../../agents/11-fixer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAG9D,iEAAiE;AACjE,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,+CAA+C;AAC/C,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAU1C,SAAS,eAAe,CACtB,IAAY,EACZ,IAAc;IAEd,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC9D,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gBAAgB;IAC7B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAgB,EAAE,WAAwB;IAChF,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,mBAAmB;YACtB,OAAO,CACL,+BAA+B,OAAO,CAAC,MAAM,KAAK;gBAClD,GAAG,OAAO,CAAC,YAAY,IAAI,yFAAyF,EAAE,CACvH,CAAC;QAEJ,KAAK,mBAAmB;YACtB,OAAO,CACL,+BAA+B,OAAO,CAAC,MAAM,KAAK;gBAClD,GAAG,OAAO,CAAC,YAAY,IAAI,yDAAyD;oBACpF,4EAA4E;oBAC5E,2CAA2C,EAAE,CAC9C,CAAC;QAEJ,KAAK,gBAAgB;YACnB,OAAO,CACL,4BAA4B,OAAO,CAAC,MAAM,KAAK;gBAC/C,GAAG,OAAO,CAAC,YAAY,IAAI,wDAAwD;oBACnF,2DAA2D;oBAC3D,2CAA2C,EAAE,CAC9C,CAAC;QAEJ;YACE,OAAO,CACL,sBAAsB,OAAO,CAAC,MAAM,KAAK;gBACzC,GAAG,OAAO,CAAC,YAAY,IAAI,gCAAgC,EAAE,CAC9D,CAAC;IACN,CAAC;AACH,CAAC;AAED,MAAM,OAAO,UAAW,SAAQ,SAAS;IAC9B,OAAO,GAAG,EAAE,CAAC;IACb,SAAS,GAAG,OAAO,CAAC;IAE7B,mFAAmF;IAC3E,UAAU,GAAG,KAAK,CAAC;IAEjB,KAAK,CAAC,SAAS;QACvB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QACpE,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACvB,OAAO;QACT,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QAEpE,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAc,EAAE,CAAC;QAErC,2DAA2D;QAC3D,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAE7B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAClD,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBACjD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC9D,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,cAAc,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,OAAgB,EAAE,QAAgB;QAC7D,8FAA8F;QAC9F,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAE9E,IAAI,eAAe,GAAG,uBAAuB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpE,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,aAAa,GAAG,KAAK,CAAC;QAE1B,OAAO,YAAY,GAAG,YAAY,EAAE,CAAC;YACnC,YAAY,IAAI,CAAC,CAAC;YAClB,MAAM,UAAU,GAAG,mBAAmB,CAAC,eAAe,EAAE,eAAe,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;YACxF,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;YAEjE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,aAAa,GAAG,IAAI,CAAC;gBACrB,MAAM;YACR,CAAC;YAED,uEAAuE;YACvE,IAAI,YAAY,GAAG,YAAY,EAAE,CAAC;gBAChC,eAAe;oBACb,GAAG,eAAe,IAAI;wBACtB,qCAAqC,YAAY,KAAK;wBACtD,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAwC,CAAC,aAAa;YAC1E,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,mBAAmB;gBACnB,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,UAAU,CAAC;QAEjB,MAAM,eAAe,GAAoB;YACvC,GAAG,OAAO;YACV,YAAY,EAAE,aAAa;gBACzB,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,2BAA2B,YAAY,kDAAkD;YAC7F,UAAU;YACV,mBAAmB;YACnB,gBAAgB;YAChB,YAAY;SACb,CAAC;QAEF,IAAI,CAAC,WAAW,CAAC;YACf,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,QAAQ;YACd,WAAW,EACT,oBAAoB,OAAO,CAAC,EAAE,WAAW,WAAW,IAAI;gBACxD,cAAc,UAAU,gBAAgB,mBAAmB,GAAG;gBAC9D,UAAU,gBAAgB,aAAa,YAAY,EAAE;SACxD,CAAC,CAAC;QAEH,qCAAqC;QACrC,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAEhF,OAAO,eAAe,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,eAAe;QAC3B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAC;YACpC,IAAI,KAAK;gBAAE,OAAO;YAElB,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa;YACjE,MAAM,UAAU,GAAG,GAAG,iBAAiB,GAAG,IAAI,EAAE,CAAC;YAEjD,MAAM,eAAe,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;YAE7D,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,IAAI,CAAC,MAAM;gBACjB,WAAW,EAAE,6BAA6B,UAAU,EAAE;aACvD,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,mFAAmF;YACnF,wEAAwE;QAC1E,CAAC;IACH,CAAC;CACF;AAUD,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAO,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"11-fixer.js","sourceRoot":"","sources":["../../agents/11-fixer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAG9D,iEAAiE;AACjE,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,+CAA+C;AAC/C,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAU1C,SAAS,eAAe,CACtB,IAAY,EACZ,IAAc;IAEd,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC9D,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gBAAgB;IAC7B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAgB,EAAE,WAAwB;IAChF,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,mBAAmB;YACtB,OAAO,CACL,+BAA+B,OAAO,CAAC,MAAM,KAAK;gBAClD,GAAG,OAAO,CAAC,YAAY,IAAI,yFAAyF,EAAE,CACvH,CAAC;QAEJ,KAAK,mBAAmB;YACtB,OAAO,CACL,+BAA+B,OAAO,CAAC,MAAM,KAAK;gBAClD,GAAG,OAAO,CAAC,YAAY,IAAI,yDAAyD;oBACpF,4EAA4E;oBAC5E,2CAA2C,EAAE,CAC9C,CAAC;QAEJ,KAAK,gBAAgB;YACnB,OAAO,CACL,4BAA4B,OAAO,CAAC,MAAM,KAAK;gBAC/C,GAAG,OAAO,CAAC,YAAY,IAAI,wDAAwD;oBACnF,2DAA2D;oBAC3D,2CAA2C,EAAE,CAC9C,CAAC;QAEJ;YACE,OAAO,CACL,sBAAsB,OAAO,CAAC,MAAM,KAAK;gBACzC,GAAG,OAAO,CAAC,YAAY,IAAI,gCAAgC,EAAE,CAC9D,CAAC;IACN,CAAC;AACH,CAAC;AAED,MAAM,OAAO,UAAW,SAAQ,SAAS;IAC9B,OAAO,GAAG,EAAE,CAAC;IACb,SAAS,GAAG,OAAO,CAAC;IAE7B,mFAAmF;IAC3E,UAAU,GAAG,KAAK,CAAC;IAEjB,KAAK,CAAC,SAAS;QACvB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QACpE,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACvB,OAAO;QACT,CAAC;QAED,6EAA6E;QAC7E,sDAAsD;QACtD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,KAAK,IAAI,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QAEpE,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAc,EAAE,CAAC;QAErC,2DAA2D;QAC3D,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAE7B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAClD,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBACjD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC9D,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,cAAc,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,OAAgB,EAAE,QAAgB;QAC7D,8FAA8F;QAC9F,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAE9E,IAAI,eAAe,GAAG,uBAAuB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpE,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,aAAa,GAAG,KAAK,CAAC;QAE1B,OAAO,YAAY,GAAG,YAAY,EAAE,CAAC;YACnC,YAAY,IAAI,CAAC,CAAC;YAClB,MAAM,UAAU,GAAG,mBAAmB,CAAC,eAAe,EAAE,eAAe,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;YACxF,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;YAEjE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,aAAa,GAAG,IAAI,CAAC;gBACrB,MAAM;YACR,CAAC;YAED,uEAAuE;YACvE,IAAI,YAAY,GAAG,YAAY,EAAE,CAAC;gBAChC,eAAe;oBACb,GAAG,eAAe,IAAI;wBACtB,qCAAqC,YAAY,KAAK;wBACtD,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAwC,CAAC,aAAa;YAC1E,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,mBAAmB;gBACnB,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,UAAU,CAAC;QAEjB,MAAM,eAAe,GAAoB;YACvC,GAAG,OAAO;YACV,YAAY,EAAE,aAAa;gBACzB,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,2BAA2B,YAAY,kDAAkD;YAC7F,UAAU;YACV,mBAAmB;YACnB,gBAAgB;YAChB,YAAY;SACb,CAAC;QAEF,IAAI,CAAC,WAAW,CAAC;YACf,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,QAAQ;YACd,WAAW,EACT,oBAAoB,OAAO,CAAC,EAAE,WAAW,WAAW,IAAI;gBACxD,cAAc,UAAU,gBAAgB,mBAAmB,GAAG;gBAC9D,UAAU,gBAAgB,aAAa,YAAY,EAAE;SACxD,CAAC,CAAC;QAEH,sEAAsE;QACtE,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,4BAA4B,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAEnE,OAAO,eAAe,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,QAAgB;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QACtE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAEzD,wDAAwD;QACxD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,kDAAkD,QAAQ,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,4BAA4B,CAAC,QAAgB,EAAE,eAAgC;QAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;gBACrE,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe;QAC3B,4EAA4E;QAC5E,mEAAmE;QACnE,2EAA2E;QAC3E,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,KAAK,IAAI,EAAE,CAAC;YAC/C,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,IAAI,CAAC,MAAM;gBACjB,WAAW,EACT,iFAAiF;oBACjF,kDAAkD;aACrD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAC;YACpC,IAAI,KAAK;gBAAE,OAAO;YAElB,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa;YACjE,MAAM,UAAU,GAAG,GAAG,iBAAiB,GAAG,IAAI,EAAE,CAAC;YAEjD,MAAM,eAAe,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;YAE7D,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,IAAI,CAAC,MAAM;gBACjB,WAAW,EAAE,6BAA6B,UAAU,EAAE;aACvD,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,mFAAmF;YACnF,wEAAwE;QAC1E,CAAC;IACH,CAAC;CACF;AAUD,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAO,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,CAAC;AAC/C,CAAC"}

package/dist/agents/110-mass-assignment-detector.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Mass-Assignment Detector — static scan for request bodies passed
+ * wholesale into a persistence call. If `prisma.user.update({ data:
+ * req.body })` trusts the whole body, an attacker adds `"isAdmin": true`
+ * (or `role`, `balance`, `verified`) to the request and sets fields the
+ * UI never exposed. OWASP "Mass Assignment" / over-posting. Completes the
+ * request-input-trust family with #107 (open-redirect), #108 (SQLi),
+ * #109 (path-traversal).
+ *
+ * Flagged (req.body / request.body used WHOLE — not a `.field` access):
+ *   - data: req.body                      (Prisma create/update)
+ *   - create(req.body) / update(req.body) / save(req.body) /
+ *     insert(req.body) / insertOne(req.body)    (Sequelize/Mongoose/TypeORM)
+ *   - Object.assign(entity, req.body)
+ *   - new Model(req.body)                 (Mongoose document)
+ *   - { ...req.body }                     (spread into a write object)
+ *
+ * NOT flagged: field-picked access like `{ name: req.body.name }` —
+ * that's the safe allowlist pattern.
+ *
+ * Findings:
+ *   - 110-mass-assignment   high  code-bug-security
+ *   - 110-clean / 110-summary  info
+ *
+ * Persists `evidence/mass-assignment-audit.json`. Read-only,
+ * parallel-safe, static analysis only.
+ */
+import type { Finding } from '../core/types.js';
+import { BaseAgent } from './base-agent.js';
+export interface MassAssignmentHit {
+    file: string;
+    line: number;
+    pattern: string;
+    snippet: string;
+}
+export interface MassAssignmentAudit {
+    version: 1;
+    generatedAt: string;
+    projectRoot: string;
+    filesScanned: number;
+    hits: MassAssignmentHit[];
+}
+/** Scan a file (line by line) for wholesale request-body writes. */
+export declare function scanMassAssignment(content: string): Array<Omit<MassAssignmentHit, 'file'>>;
+export declare class MassAssignmentDetectorAgent extends BaseAgent {
+    readonly agentId = 110;
+    readonly agentName = "Mass-Assignment Detector";
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private persistAudit;
+}
+//# sourceMappingURL=110-mass-assignment-detector.d.ts.map

package/dist/agents/110-mass-assignment-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"110-mass-assignment-detector.d.ts","sourceRoot":"","sources":["../../agents/110-mass-assignment-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAwBzC,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,iBAAiB,EAAE,CAAC;CAC3B;AA8BD,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAkB1F;AAED,qBAAa,2BAA4B,SAAQ,SAAS;IACxD,QAAQ,CAAC,OAAO,OAAO;IACvB,QAAQ,CAAC,SAAS,8BAA8B;cAEhC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAO1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAwE7C,OAAO,CAAC,YAAY;CAyBrB"}

package/dist/agents/110-mass-assignment-detector.js

@@ -0,0 +1,199 @@
+/**
+ * Mass-Assignment Detector — static scan for request bodies passed
+ * wholesale into a persistence call. If `prisma.user.update({ data:
+ * req.body })` trusts the whole body, an attacker adds `"isAdmin": true`
+ * (or `role`, `balance`, `verified`) to the request and sets fields the
+ * UI never exposed. OWASP "Mass Assignment" / over-posting. Completes the
+ * request-input-trust family with #107 (open-redirect), #108 (SQLi),
+ * #109 (path-traversal).
+ *
+ * Flagged (req.body / request.body used WHOLE — not a `.field` access):
+ *   - data: req.body                      (Prisma create/update)
+ *   - create(req.body) / update(req.body) / save(req.body) /
+ *     insert(req.body) / insertOne(req.body)    (Sequelize/Mongoose/TypeORM)
+ *   - Object.assign(entity, req.body)
+ *   - new Model(req.body)                 (Mongoose document)
+ *   - { ...req.body }                     (spread into a write object)
+ *
+ * NOT flagged: field-picked access like `{ name: req.body.name }` —
+ * that's the safe allowlist pattern.
+ *
+ * Findings:
+ *   - 110-mass-assignment   high  code-bug-security
+ *   - 110-clean / 110-summary  info
+ *
+ * Persists `evidence/mass-assignment-audit.json`. Read-only,
+ * parallel-safe, static analysis only.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { BaseAgent } from './base-agent.js';
+import { maskNonCode, isTestPath } from './lib/source-scan.js';
+const SRC_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
+const SKIP_DIRS = new Set([
+    'node_modules', '.git', 'dist', 'build', '.next', '.nuxt', 'coverage', 'reports', 'baselines', 'evidence',
+]);
+const BODY = String.raw `(?:req|request|ctx\.request)\.body`;
+/**
+ * Patterns where the whole request body flows into a write. Each requires
+ * `body` NOT be followed by `.ident` (that would be a single field, which
+ * is the safe picked-field case).
+ */
+const MASS_ASSIGN_PATTERNS = [
+    { re: new RegExp(String.raw `\.\.\.\s*${BODY}\b(?!\.)`), label: 'spread ...req.body' },
+    { re: new RegExp(String.raw `\bdata\s*:\s*${BODY}\b(?!\.)`), label: 'data: req.body' },
+    { re: new RegExp(String.raw `\b(?:create|update|save|insert|insertOne|insertMany|bulkCreate|upsert)\s*\(\s*${BODY}\b(?!\.)`), label: 'create/update(req.body)' },
+    { re: new RegExp(String.raw `\bObject\.assign\s*\([^,]+,\s*${BODY}\b(?!\.)`), label: 'Object.assign(x, req.body)' },
+    { re: new RegExp(String.raw `\bnew\s+[A-Z]\w*\s*\(\s*${BODY}\b(?!\.)`), label: 'new Model(req.body)' },
+];
+function walk(dir, results = []) {
+    if (!fs.existsSync(dir))
+        return results;
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return results;
+    }
+    for (const entry of entries) {
+        if (SKIP_DIRS.has(entry.name))
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            walk(full, results);
+        }
+        else if (entry.isFile() && SRC_EXTENSIONS.has(path.extname(entry.name))) {
+            results.push(full);
+        }
+    }
+    return results;
+}
+function relativise(absPath, root) {
+    return path.relative(root, absPath).split(path.sep).join('/');
+}
+function snippetOfLine(line) {
+    return line.trim().slice(0, 160);
+}
+/** Scan a file (line by line) for wholesale request-body writes. */
+export function scanMassAssignment(content) {
+    const hits = [];
+    // Match against code only. The masker blanks comments and string/template
+    // contents (including this detector's own pattern labels and `String.raw`
+    // sources), which subsumes the old `//`/`*` line-prefix heuristic. Length is
+    // preserved, so masked lines align 1:1 with the original for snippets.
+    const lines = content.split(/\r?\n/);
+    const maskedLines = maskNonCode(content).split(/\r?\n/);
+    lines.forEach((raw, i) => {
+        const codeLine = maskedLines[i] ?? '';
+        for (const { re, label } of MASS_ASSIGN_PATTERNS) {
+            if (re.test(codeLine)) {
+                hits.push({ line: i + 1, pattern: label, snippet: snippetOfLine(raw) });
+                break; // one finding per line is enough
+            }
+        }
+    });
+    return hits;
+}
+export class MassAssignmentDetectorAgent extends BaseAgent {
+    agentId = 110;
+    agentName = 'Mass-Assignment Detector';
+    async preFlight() {
+        const root = this.config.projectRoot ?? process.cwd();
+        if (!fs.existsSync(root)) {
+            throw new Error(`projectRoot does not exist: ${root}`);
+        }
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        const sourceFiles = new Set();
+        const mapPath = path.join(this.runDir, 'evidence', 'connection-map.json');
+        try {
+            const map = JSON.parse(fs.readFileSync(mapPath, 'utf-8'));
+            for (const f of map.files) {
+                if (!f.isTest)
+                    sourceFiles.add(path.join(projectRoot, f.path));
+            }
+        }
+        catch {
+            for (const f of walk(projectRoot))
+                sourceFiles.add(f);
+        }
+        const allHits = [];
+        let filesScanned = 0;
+        for (const file of sourceFiles) {
+            if (isTestPath(file, projectRoot))
+                continue;
+            let content;
+            try {
+                content = fs.readFileSync(file, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            filesScanned++;
+            const rel = relativise(file, projectRoot);
+            for (const hit of scanMassAssignment(content)) {
+                allHits.push({ ...hit, file: rel });
+            }
+        }
+        if (allHits.length === 0) {
+            findings.push({
+                id: `${this.agentId}-clean`,
+                type: 'infra-issue',
+                severity: 'info',
+                agentId: this.agentId,
+                module: 'mass-assignment-detector',
+                description: `Scanned ${filesScanned} non-test file(s) — no request bodies passed wholesale into a write.`,
+            });
+            this.persistAudit(projectRoot, filesScanned, allHits);
+            return findings;
+        }
+        for (const hit of allHits.slice(0, 100)) {
+            findings.push({
+                id: `${this.agentId}-mass-assignment-${hit.file.replace(/[^\w]/g, '_')}-${hit.line}`,
+                type: 'code-bug-security',
+                severity: 'high',
+                agentId: this.agentId,
+                module: 'mass-assignment-detector',
+                description: `Request body passed wholesale into a write at ${hit.file}:${hit.line} (${hit.pattern}) — mass assignment. A client can add fields the UI never exposed (isAdmin, role, balance, verified). Pick explicit fields or validate against a DTO / allowlist before persisting. \`${hit.snippet}\``,
+                file: hit.file,
+                line: hit.line,
+            });
+        }
+        this.persistAudit(projectRoot, filesScanned, allHits);
+        findings.push({
+            id: `${this.agentId}-summary`,
+            type: 'infra-issue',
+            severity: 'info',
+            agentId: this.agentId,
+            module: 'mass-assignment-detector',
+            description: `Mass-assignment audit: ${allHits.length} wholesale request-body write(s) across ${filesScanned} file(s).`,
+        });
+        return findings;
+    }
+    persistAudit(projectRoot, filesScanned, hits) {
+        const audit = {
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            projectRoot,
+            filesScanned,
+            hits,
+        };
+        try {
+            const evidenceDir = path.join(this.runDir, 'evidence');
+            fs.mkdirSync(evidenceDir, { recursive: true });
+            fs.writeFileSync(path.join(evidenceDir, 'mass-assignment-audit.json'), JSON.stringify(audit, null, 2), 'utf-8');
+            this.addEvidence({
+                type: 'report',
+                path: 'evidence/mass-assignment-audit.json',
+                description: `Mass-assignment audit: ${hits.length} site(s) across ${filesScanned} file(s)`,
+            });
+        }
+        catch {
+            // non-fatal
+        }
+    }
+}
+//# sourceMappingURL=110-mass-assignment-detector.js.map

package/dist/agents/110-mass-assignment-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"110-mass-assignment-detector.js","sourceRoot":"","sources":["../../agents/110-mass-assignment-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE5D,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACpG,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC;IAC7C,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU;CAC1G,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAA,oCAAoC,CAAC;AAE5D;;;;GAIG;AACH,MAAM,oBAAoB,GAAiD;IACzE,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,YAAY,IAAI,UAAU,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE;IACrF,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,gBAAgB,IAAI,UAAU,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE;IACrF,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,iFAAiF,IAAI,UAAU,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE;IAC/J,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,iCAAiC,IAAI,UAAU,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE;IAClH,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,2BAA2B,IAAI,UAAU,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE;CACtG,CAAC;AAiBF,SAAS,IAAI,CAAC,GAAW,EAAE,UAAoB,EAAE;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,IAAI,GAA2C,EAAE,CAAC;IACxD,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E,uEAAuE;IACvE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxD,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,oBAAoB,EAAE,CAAC;YACjD,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxE,MAAM,CAAC,iCAAiC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,2BAA4B,SAAQ,SAAS;IAC/C,OAAO,GAAG,GAAG,CAAC;IACd,SAAS,GAAG,0BAA0B,CAAC;IAEtC,KAAK,CAAC,SAAS;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAkB,CAAC;YAC3E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC1B,IAAI,CAAC,CAAC,CAAC,MAAM;oBAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAI,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC;gBAAE,SAAS;YAC5C,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,YAAY,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC1C,KAAK,MAAM,GAAG,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9C,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ;gBAC3B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,0BAA0B;gBAClC,WAAW,EAAE,WAAW,YAAY,sEAAsE;aAC3G,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,oBAAoB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE;gBACpF,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,0BAA0B;gBAClC,WAAW,EAAE,iDAAiD,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,yLAAyL,GAAG,CAAC,OAAO,IAAI;gBAC1S,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAEtD,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU;YAC7B,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,0BAA0B;YAClC,WAAW,EAAE,0BAA0B,OAAO,CAAC,MAAM,2CAA2C,YAAY,WAAW;SACxH,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,YAAY,CAAC,WAAmB,EAAE,YAAoB,EAAE,IAAyB;QACvF,MAAM,KAAK,GAAwB;YACjC,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,WAAW;YACX,YAAY;YACZ,IAAI;SACL,CAAC;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACvD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,4BAA4B,CAAC,EACpD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9B,OAAO,CACR,CAAC;YACF,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,qCAAqC;gBAC3C,WAAW,EAAE,0BAA0B,IAAI,CAAC,MAAM,mBAAmB,YAAY,UAAU;aAC5F,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/agents/111-dynamic-eval-detector.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Dynamic Code Execution Detector — static scan for the runtime
+ * code-evaluation primitives that turn data into executable code. If any
+ * of these ever touch attacker-influenced input, it's remote code
+ * execution; even when they don't, they're a code-smell and a CSP /
+ * audit headache.
+ *
+ * Flagged:
+ *   - 111-eval               high      eval(...)
+ *   - 111-new-function       high      new Function(...) (runtime codegen)
+ *   - 111-vm-exec            high      vm.runInContext / runInNewContext /
+ *                                       runInThisContext / compileFunction
+ *   - 111-settimeout-string  medium    setTimeout / setInterval with a
+ *                                       STRING first arg (implicit eval)
+ *   - 111-clean / 111-summary  info
+ *
+ * Persists `evidence/dynamic-eval-audit.json`. Read-only, parallel-safe,
+ * static analysis only.
+ */
+import type { Finding } from '../core/types.js';
+import { BaseAgent } from './base-agent.js';
+export type EvalKind = 'eval' | 'new-function' | 'vm-exec' | 'settimeout-string';
+export interface EvalHit {
+    kind: EvalKind;
+    file: string;
+    line: number;
+    snippet: string;
+}
+export interface DynamicEvalAudit {
+    version: 1;
+    generatedAt: string;
+    projectRoot: string;
+    filesScanned: number;
+    hits: EvalHit[];
+}
+/** Scan a file for dynamic-code-execution sinks. */
+export declare function scanDynamicEval(content: string): Array<Omit<EvalHit, 'file'>>;
+export declare class DynamicEvalDetectorAgent extends BaseAgent {
+    readonly agentId = 111;
+    readonly agentName = "Dynamic Code Execution Detector";
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private toFinding;
+    private persistAudit;
+}
+//# sourceMappingURL=111-dynamic-eval-detector.d.ts.map

package/dist/agents/111-dynamic-eval-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"111-dynamic-eval-detector.d.ts","sourceRoot":"","sources":["../../agents/111-dynamic-eval-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AASzC,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,cAAc,GAAG,SAAS,GAAG,mBAAmB,CAAC;AAEjF,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB;AAqCD,oDAAoD;AACpD,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAsC7E;AAED,qBAAa,wBAAyB,SAAQ,SAAS;IACrD,QAAQ,CAAC,OAAO,OAAO;IACvB,QAAQ,CAAC,SAAS,qCAAqC;cAEvC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAO1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAgE7C,OAAO,CAAC,SAAS;IAuCjB,OAAO,CAAC,YAAY;CAyBrB"}