@avi770/testteam 3.0.0 → 3.2.0

package/dist/agents/101-rate-limit-auditor.js

@@ -0,0 +1,295 @@
+/**
+ * Rate-Limit Auditor — opt-in probe that checks whether authentication and
+ * other sensitive endpoints throttle rapid requests. An unthrottled login
+ * is an open door for credential stuffing and brute force; the auth-flow
+ * checks in #88 verify correctness but say nothing about brute-force
+ * protection. This fills that gap.
+ *
+ * Triggered only when `config.rateLimit.enabled === true` (default off):
+ * bursting endpoints can trip real limiters, pollute logs, or — if keyed
+ * on account — lock the account. To stay safe, the burst uses a
+ * NON-EXISTENT email + random password, so a real account is never locked
+ * and we exercise IP-based limiting (the common case).
+ *
+ * The agent owns its own dev-server lifecycle (it does not piggyback on
+ * #88). It targets the login endpoint plus any sensitive-shaped routes
+ * (signup, password-reset, OTP, verify) discovered by #87.
+ *
+ * Findings:
+ *   - 101-no-rate-limit-<endpoint>  high (auth) / medium (other)
+ *     A burst of N requests never produced a 429 (or 423 lockout) — the
+ *     endpoint has no observable rate limiting.
+ *   - 101-disabled / 101-summary    info
+ *
+ * Persists `evidence/rate-limit-audit.json`. Free tier.
+ */
+import { spawn } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { BaseAgent } from './base-agent.js';
+import { resolveDevServer, findLoginUrl } from './88-localhost-walkthrough.js';
+const REQUEST_TIMEOUT_MS = 5_000;
+const DEFAULT_BURST_SIZE = 20;
+const MAX_ENDPOINTS = 10;
+/** Sensitive route shapes worth probing for rate limiting (beyond login). */
+const SENSITIVE_PATH_PATTERNS = [
+    { re: /^\/api\/auth\/(?:login|sign[-_]?in)\/?$/i, label: 'login' },
+    { re: /(?:^|\/)(?:login|sign[-_]?in)\/?$/i, label: 'login' },
+    { re: /(?:^|\/)(?:signup|sign[-_]?up|register)\/?$/i, label: 'signup' },
+    { re: /(?:^|\/)(?:forgot[-_]?password|password[-_]?reset|reset[-_]?password)\/?$/i, label: 'password-reset' },
+    { re: /(?:^|\/)(?:otp|verify[-_]?otp|2fa|mfa)\/?$/i, label: 'otp' },
+    { re: /(?:^|\/)(?:verify|verification|verify[-_]?email)\/?$/i, label: 'verify' },
+];
+const AUTH_LABELS = new Set(['login', 'signup', 'password-reset', 'otp']);
+/**
+ * Validate that a probe target is an http(s) URL before a burst is fired at it.
+ * Targets derive from the connection-map (file data), so this barrier prevents
+ * an outbound request from being coerced into a non-http(s) scheme. Throws on a
+ * malformed or disallowed URL; callers treat a throw as a skipped probe.
+ */
+function assertSafeProbeUrl(raw) {
+    const parsed = new URL(raw);
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new Error(`unsupported URL scheme: ${parsed.protocol}`);
+    }
+    return parsed;
+}
+function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+async function waitForReady(url, timeoutMs, child) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (child.exitCode !== null)
+            return false;
+        try {
+            const res = await fetch(url, { signal: AbortSignal.timeout(2_000) });
+            if (res.status > 0)
+                return true;
+        }
+        catch {
+            // keep polling
+        }
+        await new Promise((r) => setTimeout(r, 500));
+    }
+    return false;
+}
+function killTree(child) {
+    if (child.exitCode !== null || child.killed)
+        return;
+    try {
+        if (process.platform !== 'win32' && child.pid) {
+            process.kill(-child.pid, 'SIGTERM');
+        }
+        else {
+            child.kill('SIGTERM');
+        }
+    }
+    catch {
+        // best effort
+    }
+}
+/**
+ * Resolve the set of endpoints to probe: the login URL (always, if one
+ * resolves) plus sensitive-shaped POST routes from the connection-map.
+ */
+export function resolveRateLimitTargets(loginUrl, routes, baseUrl) {
+    const targets = [];
+    const seen = new Set();
+    if (loginUrl) {
+        targets.push({ url: loginUrl, label: 'login', path: new URL(loginUrl).pathname });
+        seen.add(new URL(loginUrl).pathname);
+    }
+    for (const r of routes) {
+        if (r.method !== 'POST' && r.method !== 'ALL')
+            continue;
+        if (seen.has(r.path))
+            continue;
+        for (const { re, label } of SENSITIVE_PATH_PATTERNS) {
+            if (re.test(r.path)) {
+                const url = baseUrl + (r.path.startsWith('/') ? r.path : `/${r.path}`);
+                targets.push({ url, label, path: r.path });
+                seen.add(r.path);
+                break;
+            }
+        }
+    }
+    return targets.slice(0, MAX_ENDPOINTS);
+}
+export class RateLimitAuditorAgent extends BaseAgent {
+    agentId = 101;
+    agentName = 'Rate-Limit Auditor';
+    /** Test seam — defaults to real spawn. */
+    spawnImpl = spawn;
+    /** Test seam — readiness check; defaults to polling the health URL. */
+    checkReady(url, timeoutMs, child) {
+        return waitForReady(url, timeoutMs, child);
+    }
+    async preFlight() {
+        const root = this.config.projectRoot ?? process.cwd();
+        if (!fs.existsSync(root)) {
+            throw new Error(`projectRoot does not exist: ${root}`);
+        }
+    }
+    async execute() {
+        const findings = [];
+        const cfg = this.config.rateLimit;
+        if (!cfg?.enabled) {
+            findings.push({
+                id: `${this.agentId}-disabled`,
+                type: 'infra-issue',
+                severity: 'info',
+                agentId: this.agentId,
+                module: 'rate-limit-auditor',
+                description: 'Rate-limit auditor disabled. Set config.rateLimit.enabled = true to opt in (bursts auth endpoints with a fake account; may trip real limiters / fill logs).',
+            });
+            return findings;
+        }
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        const map = readJson(path.join(this.runDir, 'evidence', 'connection-map.json'));
+        if (!map) {
+            findings.push({
+                id: `${this.agentId}-no-map`,
+                type: 'infra-issue',
+                severity: 'high',
+                agentId: this.agentId,
+                module: 'rate-limit-auditor',
+                description: 'connection-map.json not found. Agent #87 (Connection Mapper) must run first.',
+            });
+            return findings;
+        }
+        const resolved = resolveDevServer(projectRoot, this.config.devServer);
+        if ('error' in resolved) {
+            findings.push({
+                id: `${this.agentId}-no-dev-server`,
+                type: 'infra-issue',
+                severity: 'high',
+                agentId: this.agentId,
+                module: 'rate-limit-auditor',
+                description: resolved.error + '. Add a devServer block to testteam.config.ts.',
+            });
+            return findings;
+        }
+        const burstSize = cfg.burstSize && cfg.burstSize > 0 ? cfg.burstSize : DEFAULT_BURST_SIZE;
+        const report = {
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            burstSize,
+            results: [],
+        };
+        let child = null;
+        try {
+            const [bin, ...args] = resolved.command.split(/\s+/);
+            child = this.spawnImpl(bin, args, {
+                cwd: resolved.cwd,
+                env: { ...process.env, BROWSER: 'none', CI: '1' },
+                detached: process.platform !== 'win32',
+                stdio: ['ignore', 'pipe', 'pipe'],
+            });
+            const ready = await this.checkReady(resolved.healthUrl, resolved.readyTimeoutMs, child);
+            if (!ready) {
+                findings.push({
+                    id: `${this.agentId}-dev-server-not-ready`,
+                    type: 'infra-issue',
+                    severity: 'critical',
+                    agentId: this.agentId,
+                    module: 'rate-limit-auditor',
+                    description: `Dev server (${resolved.command}) did not respond on ${resolved.healthUrl} within ${resolved.readyTimeoutMs}ms.`,
+                });
+                return findings;
+            }
+            const baseUrl = new URL(resolved.healthUrl).origin;
+            const loginUrl = findLoginUrl(this.config.auth?.loginUrl, map.routes, baseUrl);
+            const targets = resolveRateLimitTargets(loginUrl, map.routes, baseUrl);
+            if (targets.length === 0) {
+                findings.push({
+                    id: `${this.agentId}-no-targets`,
+                    type: 'infra-issue',
+                    severity: 'info',
+                    agentId: this.agentId,
+                    module: 'rate-limit-auditor',
+                    description: 'No login or sensitive endpoints discovered to probe.',
+                });
+                return findings;
+            }
+            for (const target of targets) {
+                const result = await this.burstEndpoint(target, burstSize);
+                report.results.push(result);
+                if (!result.throttled) {
+                    const isAuth = AUTH_LABELS.has(target.label);
+                    findings.push({
+                        id: `${this.agentId}-no-rate-limit-${target.label}-${target.path.replace(/[^\w]/g, '_')}`,
+                        type: 'code-bug-security',
+                        severity: isAuth ? 'high' : 'medium',
+                        agentId: this.agentId,
+                        module: 'rate-limit-auditor',
+                        description: `${target.label} endpoint ${target.path} accepted ${result.requestsSent} rapid requests without ever returning 429/423 — no observable rate limiting. ${isAuth ? 'This exposes it to credential stuffing / brute force.' : 'Consider throttling this sensitive endpoint.'}`,
+                    });
+                }
+            }
+            try {
+                const evidenceDir = path.join(this.runDir, 'evidence');
+                fs.mkdirSync(evidenceDir, { recursive: true });
+                fs.writeFileSync(path.join(evidenceDir, 'rate-limit-audit.json'), JSON.stringify(report, null, 2), 'utf-8');
+                this.addEvidence({
+                    type: 'report',
+                    path: 'evidence/rate-limit-audit.json',
+                    description: `Rate-limit audit: ${report.results.length} endpoint(s), ${report.results.filter((r) => !r.throttled).length} unthrottled`,
+                });
+            }
+            catch {
+                // non-fatal
+            }
+            findings.push({
+                id: `${this.agentId}-summary`,
+                type: 'infra-issue',
+                severity: 'info',
+                agentId: this.agentId,
+                module: 'rate-limit-auditor',
+                description: `Rate-limit audit: probed ${report.results.length} endpoint(s) with bursts of ${burstSize}; ${report.results.filter((r) => r.throttled).length} throttled, ${report.results.filter((r) => !r.throttled).length} unthrottled.`,
+            });
+        }
+        finally {
+            if (child)
+                killTree(child);
+        }
+        return findings;
+    }
+    /**
+     * Fire `burstSize` rapid POSTs at a target using a fake account, and
+     * report whether any response was a 429 (rate limited) or 423 (locked).
+     * Requests run concurrently to better simulate a burst. Test seam:
+     * subclasses can override to avoid real network calls.
+     */
+    async burstEndpoint(target, burstSize) {
+        // Cryptographically-secure random throwaway credentials (never a real
+        // account) — Math.random() is not suitable in a security-probe context.
+        const fakeEmail = `ratelimit-probe-${randomBytes(8).toString('hex').slice(0, 8)}@example.invalid`;
+        const fakePassword = randomBytes(12).toString('hex').slice(0, 12);
+        const body = JSON.stringify({ email: fakeEmail, username: fakeEmail, password: fakePassword });
+        const fire = async () => {
+            try {
+                const res = await fetch(assertSafeProbeUrl(target.url), {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body,
+                    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+                });
+                return res.status;
+            }
+            catch {
+                return 0; // network error / timeout — treated as non-throttling
+            }
+        };
+        const statuses = await Promise.all(Array.from({ length: burstSize }, () => fire()));
+        const throttled = statuses.some((s) => s === 429 || s === 423);
+        return { url: target.url, label: target.label, requestsSent: burstSize, statuses, throttled };
+    }
+}
+//# sourceMappingURL=101-rate-limit-auditor.js.map

package/dist/agents/101-rate-limit-auditor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"101-rate-limit-auditor.js","sourceRoot":"","sources":["../../agents/101-rate-limit-auditor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAG5E,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,6EAA6E;AAC7E,MAAM,uBAAuB,GAAiD;IAC5E,EAAE,EAAE,EAAE,0CAA0C,EAAE,KAAK,EAAE,OAAO,EAAE;IAClE,EAAE,EAAE,EAAE,oCAAoC,EAAE,KAAK,EAAE,OAAO,EAAE;IAC5D,EAAE,EAAE,EAAE,8CAA8C,EAAE,KAAK,EAAE,QAAQ,EAAE;IACvE,EAAE,EAAE,EAAE,4EAA4E,EAAE,KAAK,EAAE,gBAAgB,EAAE;IAC7G,EAAE,EAAE,EAAE,6CAA6C,EAAE,KAAK,EAAE,KAAK,EAAE;IACnE,EAAE,EAAE,EAAE,uDAAuD,EAAE,KAAK,EAAE,QAAQ,EAAE;CACjF,CAAC;AAEF,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC;AAE/F;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAuBD,SAAS,QAAQ,CAAI,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAM,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,SAAiB,EAAE,KAAmB;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACrE,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAmB;IACnC,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO;IACpD,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAuB,EACvB,MAAuD,EACvD,OAAe;IAEf,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK;YAAE,SAAS;QACxD,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/B,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,uBAAuB,EAAE,CAAC;YACpD,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACvE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3C,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACjB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,OAAO,qBAAsB,SAAQ,SAAS;IACzC,OAAO,GAAG,GAAG,CAAC;IACd,SAAS,GAAG,oBAAoB,CAAC;IAE1C,0CAA0C;IAChC,SAAS,GAAiB,KAAK,CAAC;IAE1C,uEAAuE;IAC7D,UAAU,CAAC,GAAW,EAAE,SAAiB,EAAE,KAAmB;QACtE,OAAO,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAES,KAAK,CAAC,SAAS;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,WAAW;gBAC9B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,oBAAoB;gBAC5B,WAAW,EACT,6JAA6J;aAChK,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,QAAQ,CAAgB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,SAAS;gBAC5B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,oBAAoB;gBAC5B,WAAW,EAAE,8EAA8E;aAC5F,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,gBAAgB;gBACnC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,oBAAoB;gBAC5B,WAAW,EAAE,QAAQ,CAAC,KAAK,GAAG,gDAAgD;aAC/E,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAC1F,MAAM,MAAM,GAAmB;YAC7B,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,SAAS;YACT,OAAO,EAAE,EAAE;SACZ,CAAC;QAEF,IAAI,KAAK,GAAwB,IAAI,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrD,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE;gBAChC,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE;gBACjD,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;gBACtC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YACxF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,uBAAuB;oBAC1C,IAAI,EAAE,aAAa;oBACnB,QAAQ,EAAE,UAAU;oBACpB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,oBAAoB;oBAC5B,WAAW,EAAE,eAAe,QAAQ,CAAC,OAAO,wBAAwB,QAAQ,CAAC,SAAS,WAAW,QAAQ,CAAC,cAAc,KAAK;iBAC9H,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;YACnD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC/E,MAAM,OAAO,GAAG,uBAAuB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAEvE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,aAAa;oBAChC,IAAI,EAAE,aAAa;oBACnB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,oBAAoB;oBAC5B,WAAW,EAAE,sDAAsD;iBACpE,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBAC3D,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAE5B,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;oBACtB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBAC7C,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,kBAAkB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE;wBACzF,IAAI,EAAE,mBAAmB;wBACzB,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;wBACpC,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,MAAM,EAAE,oBAAoB;wBAC5B,WAAW,EAAE,GAAG,MAAM,CAAC,KAAK,aAAa,MAAM,CAAC,IAAI,aAAa,MAAM,CAAC,YAAY,iFAAiF,MAAM,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC,CAAC,8CAA8C,EAAE;qBACzR,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;gBACvD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBAC5G,IAAI,CAAC,WAAW,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,gCAAgC;oBACtC,WAAW,EAAE,qBAAqB,MAAM,CAAC,OAAO,CAAC,MAAM,iBAAiB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,cAAc;iBACxI,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YAED,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU;gBAC7B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,oBAAoB;gBAC5B,WAAW,EAAE,4BAA4B,MAAM,CAAC,OAAO,CAAC,MAAM,+BAA+B,SAAS,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,eAAe,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,eAAe;aAC3O,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,aAAa,CAAC,MAAuB,EAAE,SAAiB;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,SAAS,GAAG,mBAAmB,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,kBAAkB,CAAC;QAClG,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAE/F,MAAM,IAAI,GAAG,KAAK,IAAqB,EAAE;YACvC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;oBACtD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI;oBACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;iBAChD,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,MAAM,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,CAAC,CAAC,sDAAsD;YAClE,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACpF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QAC/D,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAChG,CAAC;CACF"}

package/dist/agents/102-dockerfile-auditor.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Dockerfile Auditor — static scan of Dockerfiles for the most common
+ * container security / reproducibility mistakes. Completes the deploy-
+ * readiness theme started by #97 (healthcheck routes): #97 checks the app
+ * exposes probes, #102 checks the container that runs it is hardened.
+ *
+ * Checks (on the FINAL build stage, which is what actually ships):
+ *   - 102-runs-as-root        high    code-bug-security
+ *     No USER directive, or the last USER is root / 0. A compromised
+ *     process then has root in the container.
+ *   - 102-latest-base-tag     medium  infra-issue
+ *     FROM image with no tag or `:latest` — non-reproducible builds,
+ *     surprise upgrades.
+ *   - 102-secret-in-env       high    code-bug-security
+ *     ENV / ARG with a secret-shaped name AND a literal value baked into
+ *     the image (readable via `docker history`).
+ *   - 102-no-healthcheck      low     infra-issue
+ *     No HEALTHCHECK directive — orchestrators can't tell if the
+ *     container is actually serving.
+ *   - 102-summary             info
+ *
+ * Persists `evidence/dockerfile-audit.json`. Read-only, parallel-safe,
+ * static analysis only.
+ */
+import type { Finding } from '../core/types.js';
+import { BaseAgent } from './base-agent.js';
+export type DockerIssueKind = 'runs-as-root' | 'latest-base-tag' | 'secret-in-env' | 'no-healthcheck';
+export interface DockerfileHit {
+    kind: DockerIssueKind;
+    file: string;
+    line: number;
+    detail: string;
+}
+export interface DockerfileAudit {
+    version: 1;
+    generatedAt: string;
+    projectRoot: string;
+    dockerfiles: string[];
+    hits: DockerfileHit[];
+}
+interface LogicalLine {
+    text: string;
+    line: number;
+}
+/** Join Dockerfile line continuations (`\`) and drop comments/blanks. */
+export declare function logicalLines(content: string): LogicalLine[];
+/**
+ * Audit a single Dockerfile's content. Splits into build stages on FROM and
+ * applies the root / healthcheck checks to the FINAL stage (the shipped
+ * image); base-tag and secret checks apply across all stages.
+ */
+export declare function auditDockerfile(content: string): Array<Omit<DockerfileHit, 'file'>>;
+export declare class DockerfileAuditorAgent extends BaseAgent {
+    readonly agentId = 102;
+    readonly agentName = "Dockerfile Auditor";
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private toFinding;
+    private persistAudit;
+}
+export {};
+//# sourceMappingURL=102-dockerfile-auditor.d.ts.map

package/dist/agents/102-dockerfile-auditor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"102-dockerfile-auditor.d.ts","sourceRoot":"","sources":["../../agents/102-dockerfile-auditor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAWzC,MAAM,MAAM,eAAe,GACvB,cAAc,GACd,iBAAiB,GACjB,eAAe,GACf,gBAAgB,CAAC;AAErB,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,eAAe,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,IAAI,EAAE,aAAa,EAAE,CAAC;CACvB;AA8BD,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE,CAoB3D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CA6FnF;AAgCD,qBAAa,sBAAuB,SAAQ,SAAS;IACnD,QAAQ,CAAC,OAAO,OAAO;IACvB,QAAQ,CAAC,SAAS,wBAAwB;cAE1B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAO1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAkD7C,OAAO,CAAC,SAAS;IAuCjB,OAAO,CAAC,YAAY;CAyBrB"}