@avi770/testteam 3.0.0 → 3.2.0

package/dist/agents/98-cors-csp-auditor.d.ts

@@ -0,0 +1,70 @@
+/**
+ * CORS / CSP Auditor — static scan for the two most common web
+ * security-header misconfigurations. Pairs with #96 (Cookie Security):
+ * #96 covers what the browser stores, #98 covers what the browser is
+ * allowed to do across origins and which scripts it will execute.
+ *
+ * CORS findings:
+ *   - 98-cors-wildcard-origin             medium  code-bug-security
+ *     Access-Control-Allow-Origin: * (or cors() with no config / origin:true).
+ *     Any site can read authenticated responses if the API also sends
+ *     credentials.
+ *   - 98-cors-wildcard-with-credentials   critical code-bug-security
+ *     Wildcard origin AND credentials enabled. The dangerous combination —
+ *     browsers block literal `*` + credentials, but frameworks that
+ *     reflect the Origin header back while sending credentials are fully
+ *     exploitable. This is the bug that combo signals.
+ *
+ * CSP findings:
+ *   - 98-csp-unsafe-inline   medium  code-bug-security  script-src 'unsafe-inline'
+ *   - 98-csp-unsafe-eval     medium  code-bug-security  script-src 'unsafe-eval'
+ *   - 98-csp-wildcard-src    medium  code-bug-security  default-src/script-src *
+ *   - 98-no-csp              low     infra-issue        no CSP header anywhere
+ *
+ * Detection sources: source files (via #87's connection-map, or a fresh
+ * walk). Recognises both raw header strings and the common middleware
+ * config shapes (Express `cors()`, `helmet()` CSP options).
+ *
+ * Persists `evidence/cors-csp-audit.json`. Read-only, parallel-safe,
+ * static analysis only.
+ */
+import type { Finding } from '../core/types.js';
+import { BaseAgent } from './base-agent.js';
+export interface CorsCspSignals {
+    wildcardOrigin: boolean;
+    credentialsEnabled: boolean;
+    hasCsp: boolean;
+    cspUnsafeInline: boolean;
+    cspUnsafeEval: boolean;
+    cspWildcardSrc: boolean;
+}
+export interface CorsCspHit {
+    kind: 'cors-wildcard-origin' | 'cors-wildcard-with-credentials' | 'csp-unsafe-inline' | 'csp-unsafe-eval' | 'csp-wildcard-src';
+    file: string;
+    line: number;
+    snippet: string;
+}
+export interface CorsCspAudit {
+    version: 1;
+    generatedAt: string;
+    projectRoot: string;
+    filesScanned: number;
+    cspSeenAnywhere: boolean;
+    hits: CorsCspHit[];
+}
+/**
+ * Scan a single file's content for CORS / CSP misconfigurations.
+ * Stateless and exported so tests can exercise the matcher directly.
+ */
+export declare function scanCorsCsp(content: string): Array<Omit<CorsCspHit, 'file'>>;
+/** Does this file mention CSP at all? Used for the project-wide "no CSP" check. */
+export declare function mentionsCsp(content: string): boolean;
+export declare class CorsCspAuditorAgent extends BaseAgent {
+    readonly agentId = 98;
+    readonly agentName = "CORS / CSP Auditor";
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private toFinding;
+    private persistAudit;
+}
+//# sourceMappingURL=98-cors-csp-auditor.d.ts.map

package/dist/agents/98-cors-csp-auditor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"98-cors-csp-auditor.d.ts","sourceRoot":"","sources":["../../agents/98-cors-csp-auditor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AASzC,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,OAAO,CAAC;IACxB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,eAAe,EAAE,OAAO,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EACA,sBAAsB,GACtB,gCAAgC,GAChC,mBAAmB,GACnB,iBAAiB,GACjB,kBAAkB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,OAAO,CAAC;IACzB,IAAI,EAAE,UAAU,EAAE,CAAC;CACpB;AAqCD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAsE5E;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,qBAAa,mBAAoB,SAAQ,SAAS;IAChD,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,wBAAwB;cAE1B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAO1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IA4E7C,OAAO,CAAC,SAAS;IAuDjB,OAAO,CAAC,YAAY;CA+BrB"}

package/dist/agents/98-cors-csp-auditor.js

@@ -0,0 +1,308 @@
+/**
+ * CORS / CSP Auditor — static scan for the two most common web
+ * security-header misconfigurations. Pairs with #96 (Cookie Security):
+ * #96 covers what the browser stores, #98 covers what the browser is
+ * allowed to do across origins and which scripts it will execute.
+ *
+ * CORS findings:
+ *   - 98-cors-wildcard-origin             medium  code-bug-security
+ *     Access-Control-Allow-Origin: * (or cors() with no config / origin:true).
+ *     Any site can read authenticated responses if the API also sends
+ *     credentials.
+ *   - 98-cors-wildcard-with-credentials   critical code-bug-security
+ *     Wildcard origin AND credentials enabled. The dangerous combination —
+ *     browsers block literal `*` + credentials, but frameworks that
+ *     reflect the Origin header back while sending credentials are fully
+ *     exploitable. This is the bug that combo signals.
+ *
+ * CSP findings:
+ *   - 98-csp-unsafe-inline   medium  code-bug-security  script-src 'unsafe-inline'
+ *   - 98-csp-unsafe-eval     medium  code-bug-security  script-src 'unsafe-eval'
+ *   - 98-csp-wildcard-src    medium  code-bug-security  default-src/script-src *
+ *   - 98-no-csp              low     infra-issue        no CSP header anywhere
+ *
+ * Detection sources: source files (via #87's connection-map, or a fresh
+ * walk). Recognises both raw header strings and the common middleware
+ * config shapes (Express `cors()`, `helmet()` CSP options).
+ *
+ * Persists `evidence/cors-csp-audit.json`. Read-only, parallel-safe,
+ * static analysis only.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { BaseAgent } from './base-agent.js';
+import { maskNonCode, isTestPath } from './lib/source-scan.js';
+const SRC_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
+const SKIP_DIRS = new Set([
+    'node_modules', '.git', 'dist', 'build', '.next', '.nuxt', 'coverage', 'reports', 'baselines', 'evidence',
+]);
+function walk(dir, results = []) {
+    if (!fs.existsSync(dir))
+        return results;
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return results;
+    }
+    for (const entry of entries) {
+        if (SKIP_DIRS.has(entry.name))
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            walk(full, results);
+        }
+        else if (entry.isFile() && SRC_EXTENSIONS.has(path.extname(entry.name))) {
+            results.push(full);
+        }
+    }
+    return results;
+}
+function relativise(absPath, root) {
+    return path.relative(root, absPath).split(path.sep).join('/');
+}
+function lineOf(content, index) {
+    return content.slice(0, index).split('\n').length;
+}
+function snippetOf(content, index) {
+    const start = content.lastIndexOf('\n', index) + 1;
+    let end = content.indexOf('\n', index);
+    if (end === -1)
+        end = content.length;
+    return content.slice(start, end).trim().slice(0, 160);
+}
+/**
+ * Scan a single file's content for CORS / CSP misconfigurations.
+ * Stateless and exported so tests can exercise the matcher directly.
+ */
+export function scanCorsCsp(content) {
+    const hits = [];
+    // Strip comments so the `// cors({ origin: '*' })`-style doc examples in this
+    // (and any) file don't read as real config. Strings are kept — the signal
+    // ('*', 'unsafe-inline', wildcard src) lives inside them. Line numbers and
+    // snippets come from the original (comment-only masking preserves offsets).
+    const masked = maskNonCode(content, { maskStrings: false });
+    // --- CORS ---
+    // Raw header: res.setHeader('Access-Control-Allow-Origin', '*') / header strings
+    const acaoWildcard = /Access-Control-Allow-Origin['"]?\s*[:,]\s*['"]\*['"]/gi;
+    // cors({ origin: '*' }) or cors({ origin: true }). Note: no trailing \b on
+    // the quoted alternative — a closing quote followed by space/comma is not a
+    // word boundary, so `\b` there would never match.
+    const corsOriginWildcard = /\borigin\s*:\s*(?:['"]\*['"]|true\b)/gi;
+    // bare cors() with no args defaults to reflecting any origin
+    const bareCors = /\bcors\s*\(\s*\)/g;
+    const wildcardMatches = [];
+    let m;
+    for (const re of [acaoWildcard, corsOriginWildcard, bareCors]) {
+        const r = new RegExp(re.source, re.flags);
+        while ((m = r.exec(masked)) !== null)
+            wildcardMatches.push(m.index);
+    }
+    // credentials: true  OR  Access-Control-Allow-Credentials: true — checked in a
+    // window *around each wildcard* (same cors()/header block), not file-wide: an
+    // unrelated `credentials: true` (axios/fetch/cookie opts elsewhere in the
+    // file) must not escalate every wildcard-origin hit to critical.
+    const credentialsRe = /\bcredentials\s*:\s*true\b|Access-Control-Allow-Credentials['"]?\s*[:,]\s*['"]?true/i;
+    for (const idx of wildcardMatches) {
+        const near = masked.slice(Math.max(0, idx - 250), idx + 250);
+        hits.push({
+            kind: credentialsRe.test(near) ? 'cors-wildcard-with-credentials' : 'cors-wildcard-origin',
+            line: lineOf(content, idx),
+            snippet: snippetOf(content, idx),
+        });
+    }
+    // --- CSP ---
+    // unsafe-inline / unsafe-eval inside any CSP-ish context
+    const unsafeInline = /'unsafe-inline'|"unsafe-inline"|unsafe-inline/gi;
+    const unsafeEval = /'unsafe-eval'|"unsafe-eval"|unsafe-eval/gi;
+    // Only treat unsafe-* as a CSP signal when the file actually mentions CSP /
+    // script-src / helmet to avoid matching unrelated strings.
+    const cspContext = /content-security-policy|contentSecurityPolicy|script-src|default-src|style-src/i.test(masked);
+    if (cspContext) {
+        let u;
+        const ui = new RegExp(unsafeInline.source, unsafeInline.flags);
+        while ((u = ui.exec(masked)) !== null) {
+            hits.push({ kind: 'csp-unsafe-inline', line: lineOf(content, u.index), snippet: snippetOf(content, u.index) });
+            break; // one per file is enough signal
+        }
+        const ue = new RegExp(unsafeEval.source, unsafeEval.flags);
+        while ((u = ue.exec(masked)) !== null) {
+            hits.push({ kind: 'csp-unsafe-eval', line: lineOf(content, u.index), snippet: snippetOf(content, u.index) });
+            break;
+        }
+        // default-src * / script-src *
+        const wildcardSrc = /(?:default-src|script-src)\s+[^;'"]*\*/i;
+        const ws = wildcardSrc.exec(masked);
+        if (ws) {
+            hits.push({ kind: 'csp-wildcard-src', line: lineOf(content, ws.index), snippet: snippetOf(content, ws.index) });
+        }
+    }
+    return hits;
+}
+/** Does this file mention CSP at all? Used for the project-wide "no CSP" check. */
+export function mentionsCsp(content) {
+    return /content-security-policy|contentSecurityPolicy/i.test(content);
+}
+export class CorsCspAuditorAgent extends BaseAgent {
+    agentId = 98;
+    agentName = 'CORS / CSP Auditor';
+    async preFlight() {
+        const root = this.config.projectRoot ?? process.cwd();
+        if (!fs.existsSync(root)) {
+            throw new Error(`projectRoot does not exist: ${root}`);
+        }
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        const sourceFiles = new Set();
+        const mapPath = path.join(this.runDir, 'evidence', 'connection-map.json');
+        try {
+            const map = JSON.parse(fs.readFileSync(mapPath, 'utf-8'));
+            for (const f of map.files) {
+                if (!f.isTest)
+                    sourceFiles.add(path.join(projectRoot, f.path));
+            }
+        }
+        catch {
+            for (const f of walk(projectRoot))
+                sourceFiles.add(f);
+        }
+        const hits = [];
+        let cspSeenAnywhere = false;
+        let scanned = 0;
+        for (const file of sourceFiles) {
+            // Test files carry deliberate CORS/CSP fixtures — skip them, as the other
+            // static scanners do (the map path filters them too).
+            if (isTestPath(file, projectRoot))
+                continue;
+            let content;
+            try {
+                content = fs.readFileSync(file, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            scanned++;
+            if (mentionsCsp(content))
+                cspSeenAnywhere = true;
+            const rel = relativise(file, projectRoot);
+            for (const hit of scanCorsCsp(content)) {
+                hits.push({ ...hit, file: rel });
+            }
+        }
+        // Emit per-hit findings (dedup by kind+file+line; cap output).
+        const seen = new Set();
+        for (const hit of hits) {
+            const key = `${hit.kind}:${hit.file}:${hit.line}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            findings.push(this.toFinding(hit));
+            if (seen.size >= 100)
+                break;
+        }
+        // Project-wide "no CSP at all" — only meaningful if the app actually
+        // serves HTML (has routes). Low severity / advisory.
+        const hasRoutes = sourceFiles.size > 0;
+        if (!cspSeenAnywhere && hasRoutes && hits.length >= 0) {
+            findings.push({
+                id: `${this.agentId}-no-csp`,
+                type: 'infra-issue',
+                severity: 'low',
+                agentId: this.agentId,
+                module: 'cors-csp-auditor',
+                description: 'No Content-Security-Policy header found anywhere in the codebase. A CSP is the strongest defence-in-depth against XSS — consider adding one (e.g. via helmet.contentSecurityPolicy).',
+            });
+        }
+        this.persistAudit(projectRoot, scanned, cspSeenAnywhere, hits);
+        findings.push({
+            id: `${this.agentId}-summary`,
+            type: 'infra-issue',
+            severity: 'info',
+            agentId: this.agentId,
+            module: 'cors-csp-auditor',
+            description: `CORS/CSP audit: scanned ${scanned} file(s), ${hits.length} issue(s) found; CSP ${cspSeenAnywhere ? 'present' : 'absent'}.`,
+        });
+        return findings;
+    }
+    toFinding(hit) {
+        const base = {
+            agentId: this.agentId,
+            module: 'cors-csp-auditor',
+            file: hit.file,
+            line: hit.line,
+        };
+        const slug = `${hit.file.replace(/[^\w]/g, '_')}-${hit.line}`;
+        switch (hit.kind) {
+            case 'cors-wildcard-with-credentials':
+                return {
+                    ...base,
+                    id: `${this.agentId}-cors-wildcard-with-credentials-${slug}`,
+                    type: 'code-bug-security',
+                    severity: 'critical',
+                    description: `Wildcard CORS origin combined with credentials at ${hit.file}:${hit.line}. If the server reflects the Origin header while sending credentials, any site can make authenticated cross-origin requests. \`${hit.snippet}\``,
+                };
+            case 'cors-wildcard-origin':
+                // Wildcard origin WITHOUT credentials is the recommended pattern for a
+                // public, cookie-less API — the browser blocks credentialed `*` requests,
+                // so there's no exploit. Advisory (low), not a security defect.
+                return {
+                    ...base,
+                    id: `${this.agentId}-cors-wildcard-origin-${slug}`,
+                    type: 'infra-issue',
+                    severity: 'low',
+                    description: `Wildcard CORS origin (Access-Control-Allow-Origin: *) at ${hit.file}:${hit.line} with no credentials — safe for a public API, but confirm this endpoint is meant to be world-readable. \`${hit.snippet}\``,
+                };
+            case 'csp-unsafe-inline':
+                return {
+                    ...base,
+                    id: `${this.agentId}-csp-unsafe-inline-${slug}`,
+                    type: 'code-bug-security',
+                    severity: 'medium',
+                    description: `CSP allows 'unsafe-inline' at ${hit.file}:${hit.line} — inline scripts execute, defeating much of the XSS protection a CSP provides. \`${hit.snippet}\``,
+                };
+            case 'csp-unsafe-eval':
+                return {
+                    ...base,
+                    id: `${this.agentId}-csp-unsafe-eval-${slug}`,
+                    type: 'code-bug-security',
+                    severity: 'medium',
+                    description: `CSP allows 'unsafe-eval' at ${hit.file}:${hit.line} — eval()/new Function() execute, a common XSS sink. \`${hit.snippet}\``,
+                };
+            case 'csp-wildcard-src':
+                return {
+                    ...base,
+                    id: `${this.agentId}-csp-wildcard-src-${slug}`,
+                    type: 'code-bug-security',
+                    severity: 'medium',
+                    description: `CSP uses a wildcard source (default-src/script-src *) at ${hit.file}:${hit.line} — scripts can load from any origin. \`${hit.snippet}\``,
+                };
+        }
+    }
+    persistAudit(projectRoot, filesScanned, cspSeenAnywhere, hits) {
+        const audit = {
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            projectRoot,
+            filesScanned,
+            cspSeenAnywhere,
+            hits,
+        };
+        try {
+            const evidenceDir = path.join(this.runDir, 'evidence');
+            fs.mkdirSync(evidenceDir, { recursive: true });
+            fs.writeFileSync(path.join(evidenceDir, 'cors-csp-audit.json'), JSON.stringify(audit, null, 2), 'utf-8');
+            this.addEvidence({
+                type: 'report',
+                path: 'evidence/cors-csp-audit.json',
+                description: `CORS/CSP audit: ${hits.length} issue(s) across ${filesScanned} file(s)`,
+            });
+        }
+        catch {
+            // non-fatal
+        }
+    }
+}
+//# sourceMappingURL=98-cors-csp-auditor.js.map

package/dist/agents/98-cors-csp-auditor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"98-cors-csp-auditor.js","sourceRoot":"","sources":["../../agents/98-cors-csp-auditor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE5D,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACpG,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC;IAC7C,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU;CAC1G,CAAC,CAAC;AAgCH,SAAS,IAAI,CAAC,GAAW,EAAE,UAAoB,EAAE;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,MAAM,CAAC,OAAe,EAAE,KAAa;IAC5C,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,KAAa;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,IAAI,GAAoC,EAAE,CAAC;IACjD,8EAA8E;IAC9E,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAE5D,eAAe;IACf,iFAAiF;IACjF,MAAM,YAAY,GAAG,wDAAwD,CAAC;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,kDAAkD;IAClD,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;IACpE,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,mBAAmB,CAAC;IAErC,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,IAAI,CAAyB,CAAC;IAC9B,KAAK,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI;YAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,aAAa,GACjB,sFAAsF,CAAC;IAEzF,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,sBAAsB;YAC1F,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC;YAC1B,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IAED,cAAc;IACd,yDAAyD;IACzD,MAAM,YAAY,GAAG,iDAAiD,CAAC;IACvE,MAAM,UAAU,GAAG,2CAA2C,CAAC;IAC/D,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,UAAU,GAAG,iFAAiF,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAElH,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAyB,CAAC;QAC9B,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/D,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC/G,MAAM,CAAC,gCAAgC;QACzC,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC7G,MAAM;QACR,CAAC;QACD,+BAA+B;QAC/B,MAAM,WAAW,GAAG,yCAAyC,CAAC;QAC9D,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,EAAE,EAAE,CAAC;YACP,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,gDAAgD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IACvC,OAAO,GAAG,EAAE,CAAC;IACb,SAAS,GAAG,oBAAoB,CAAC;IAEhC,KAAK,CAAC,SAAS;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAkB,CAAC;YAC3E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC1B,IAAI,CAAC,CAAC,CAAC,MAAM;oBAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,IAAI,GAAiB,EAAE,CAAC;QAC9B,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,0EAA0E;YAC1E,sDAAsD;YACtD,IAAI,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC;gBAAE,SAAS;YAC5C,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,OAAO,EAAE,CAAC;YACV,IAAI,WAAW,CAAC,OAAO,CAAC;gBAAE,eAAe,GAAG,IAAI,CAAC;YACjD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC1C,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG;gBAAE,MAAM;QAC9B,CAAC;QAED,qEAAqE;QACrE,qDAAqD;QACrD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,eAAe,IAAI,SAAS,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACtD,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,SAAS;gBAC5B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,kBAAkB;gBAC1B,WAAW,EACT,sLAAsL;aACzL,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;QAE/D,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU;YAC7B,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,kBAAkB;YAC1B,WAAW,EAAE,2BAA2B,OAAO,aAAa,IAAI,CAAC,MAAM,wBAAwB,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,GAAG;SACzI,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,SAAS,CAAC,GAAe;QAC/B,MAAM,IAAI,GAAG;YACX,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;QACF,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9D,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,gCAAgC;gBACnC,OAAO;oBACL,GAAG,IAAI;oBACP,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,mCAAmC,IAAI,EAAE;oBAC5D,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,UAAU;oBACpB,WAAW,EAAE,qDAAqD,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,kIAAkI,GAAG,CAAC,OAAO,IAAI;iBACxO,CAAC;YACJ,KAAK,sBAAsB;gBACzB,uEAAuE;gBACvE,0EAA0E;gBAC1E,gEAAgE;gBAChE,OAAO;oBACL,GAAG,IAAI;oBACP,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,yBAAyB,IAAI,EAAE;oBAClD,IAAI,EAAE,aAAa;oBACnB,QAAQ,EAAE,KAAK;oBACf,WAAW,EAAE,4DAA4D,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,4GAA4G,GAAG,CAAC,OAAO,IAAI;iBACzN,CAAC;YACJ,KAAK,mBAAmB;gBACtB,OAAO;oBACL,GAAG,IAAI;oBACP,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,sBAAsB,IAAI,EAAE;oBAC/C,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,QAAQ;oBAClB,WAAW,EAAE,iCAAiC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,qFAAqF,GAAG,CAAC,OAAO,IAAI;iBACvK,CAAC;YACJ,KAAK,iBAAiB;gBACpB,OAAO;oBACL,GAAG,IAAI;oBACP,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,oBAAoB,IAAI,EAAE;oBAC7C,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,QAAQ;oBAClB,WAAW,EAAE,+BAA+B,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,0DAA0D,GAAG,CAAC,OAAO,IAAI;iBAC1I,CAAC;YACJ,KAAK,kBAAkB;gBACrB,OAAO;oBACL,GAAG,IAAI;oBACP,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,qBAAqB,IAAI,EAAE;oBAC9C,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,QAAQ;oBAClB,WAAW,EAAE,4DAA4D,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,0CAA0C,GAAG,CAAC,OAAO,IAAI;iBACvJ,CAAC;QACN,CAAC;IACH,CAAC;IAEO,YAAY,CAClB,WAAmB,EACnB,YAAoB,EACpB,eAAwB,EACxB,IAAkB;QAElB,MAAM,KAAK,GAAiB;YAC1B,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,WAAW;YACX,YAAY;YACZ,eAAe;YACf,IAAI;SACL,CAAC;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACvD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,qBAAqB,CAAC,EAC7C,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9B,OAAO,CACR,CAAC;YACF,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,8BAA8B;gBACpC,WAAW,EAAE,mBAAmB,IAAI,CAAC,MAAM,oBAAoB,YAAY,UAAU;aACtF,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/agents/99-logging-hygiene-auditor.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Logging Hygiene Auditor — static scan for log statements that leak
+ * secrets or PII. Logs routinely get shipped to third-party aggregators
+ * (Datadog, Sentry, CloudWatch), so a `console.log(user)` that includes a
+ * password hash or a `logger.info(req.headers)` that includes an
+ * Authorization bearer token is a real exfiltration path.
+ *
+ * Detected log calls: console.{log,info,warn,error,debug,trace,dir},
+ * logger.{...}, log.{...}, req.log.{...}, fastify.log.{...},
+ * this.logger.{...}.
+ *
+ * Findings (scanned within each log call's argument list):
+ *   - 99-logs-sensitive-var  high    code-bug-security
+ *     A clearly-secret identifier/property is logged: password, secret,
+ *     apiKey, privateKey, clientSecret, accessToken, authorization,
+ *     creditCard, ssn (and snake_case variants).
+ *   - 99-logs-process-env    high    code-bug-security
+ *     process.env (whole object or a specific var) is logged — dumps
+ *     secrets straight into the log stream.
+ *   - 99-logs-request-object medium  code-bug-security
+ *     A raw request / req.body / req.headers / req.cookies is logged —
+ *     may carry auth headers, session cookies, or PII in the body.
+ *   - 99-summary             info    infra-issue
+ *
+ * Persists `evidence/logging-audit.json`. Read-only, parallel-safe,
+ * static analysis only.
+ */
+import type { Finding } from '../core/types.js';
+import { BaseAgent } from './base-agent.js';
+export type LogIssueKind = 'logs-sensitive-var' | 'logs-process-env' | 'logs-request-object';
+export interface LogHit {
+    kind: LogIssueKind;
+    detail: string;
+    file: string;
+    line: number;
+    snippet: string;
+}
+export interface LoggingAudit {
+    version: 1;
+    generatedAt: string;
+    projectRoot: string;
+    filesScanned: number;
+    logCallsSeen: number;
+    hits: LogHit[];
+}
+/**
+ * Inspect a log call's argument text for sensitive content. Returns the
+ * issues found (a single call can trip more than one).
+ */
+export declare function inspectLogArgs(args: string): Array<{
+    kind: LogIssueKind;
+    detail: string;
+}>;
+/** Find all log-call sites and the issues within their arguments. */
+export declare function scanLogging(content: string): {
+    logCalls: number;
+    hits: Array<Omit<LogHit, 'file'>>;
+};
+export declare class LoggingHygieneAuditorAgent extends BaseAgent {
+    readonly agentId = 99;
+    readonly agentName = "Logging Hygiene Auditor";
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private toFinding;
+    private persistAudit;
+}
+//# sourceMappingURL=99-logging-hygiene-auditor.d.ts.map

package/dist/agents/99-logging-hygiene-auditor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"99-logging-hygiene-auditor.d.ts","sourceRoot":"","sources":["../../agents/99-logging-hygiene-auditor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAqBzC,MAAM,MAAM,YAAY,GAAG,oBAAoB,GAAG,kBAAkB,GAAG,qBAAqB,CAAC;AAE7F,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAwDD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAkD1F;AAED,qEAAqE;AACrE,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAAE,CAkCpG;AAED,qBAAa,0BAA2B,SAAQ,SAAS;IACvD,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,6BAA6B;cAE/B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAO1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAwE7C,OAAO,CAAC,SAAS;IA+BjB,OAAO,CAAC,YAAY;CA+BrB"}