@cubis/foundry 0.3.10

package/Ai Agent Workflow/skills/sarif-parsing/resources/sarif_helpers.py

@@ -0,0 +1,331 @@
+"""
+SARIF Parsing Helper Functions
+
+Reusable utilities for working with SARIF files.
+No external dependencies beyond standard library.
+"""
+
+import hashlib
+import json
+from collections import defaultdict
+from collections.abc import Iterator
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any
+from urllib.parse import unquote
+
+
+@dataclass
+class Finding:
+    """Structured representation of a SARIF result."""
+
+    rule_id: str
+    level: str
+    message: str
+    file_path: str | None = None
+    start_line: int | None = None
+    end_line: int | None = None
+    start_column: int | None = None
+    end_column: int | None = None
+    fingerprint: str | None = None
+    tool_name: str | None = None
+    rule_name: str | None = None
+    raw: dict = field(default_factory=dict, repr=False)
+
+
+def load_sarif(path: str | Path) -> dict:
+    """Load and parse a SARIF file."""
+    with open(path) as f:
+        return json.load(f)
+
+
+def save_sarif(sarif: dict, path: str | Path, indent: int = 2) -> None:
+    """Save SARIF data to file."""
+    with open(path, "w") as f:
+        json.dump(sarif, f, indent=indent)
+
+
+def validate_version(sarif: dict) -> bool:
+    """Check if SARIF version is 2.1.0."""
+    return sarif.get("version") == "2.1.0"
+
+
+def normalize_path(uri: str, base_path: str = "") -> str:
+    """Normalize SARIF artifact URI to consistent path."""
+    if not uri:
+        return ""
+
+    # Remove file:// prefix
+    if uri.startswith("file://"):
+        uri = uri[7:]
+
+    # URL decode
+    uri = unquote(uri)
+
+    # Handle relative paths
+    if base_path and not Path(uri).is_absolute():
+        uri = str(Path(base_path) / uri)
+
+    return str(Path(uri))
+
+
+def safe_get(data: dict, *keys, default: Any = None) -> Any:
+    """Safely navigate nested dict structure."""
+    for key in keys:
+        if isinstance(data, dict):
+            data = data.get(key, {})
+        elif isinstance(data, list) and isinstance(key, int):
+            data = data[key] if 0 <= key < len(data) else {}
+        else:
+            return default
+    return data if data != {} else default
+
+
+def extract_location(result: dict) -> tuple[str | None, int | None, int | None]:
+    """Extract file path, start line, and end line from result."""
+    loc = safe_get(result, "locations", 0, default={})
+    phys = loc.get("physicalLocation", {})
+    region = phys.get("region", {})
+
+    file_path = safe_get(phys, "artifactLocation", "uri")
+    start_line = region.get("startLine")
+    end_line = region.get("endLine")
+
+    return file_path, start_line, end_line
+
+
+def iter_results(sarif: dict) -> Iterator[tuple[dict, dict]]:
+    """Iterate over all results with their run context."""
+    for run in sarif.get("runs", []):
+        for result in run.get("results", []):
+            yield result, run
+
+
+def extract_findings(sarif: dict) -> list[Finding]:
+    """Extract all findings as structured objects."""
+    findings = []
+
+    for result, run in iter_results(sarif):
+        tool_name = safe_get(run, "tool", "driver", "name")
+        file_path, start_line, end_line = extract_location(result)
+
+        loc = safe_get(result, "locations", 0, default={})
+        phys = loc.get("physicalLocation", {})
+        region = phys.get("region", {})
+
+        # Get fingerprint
+        fp = None
+        if result.get("partialFingerprints"):
+            fp = next(iter(result["partialFingerprints"].values()), None)
+        elif result.get("fingerprints"):
+            fp = next(iter(result["fingerprints"].values()), None)
+
+        findings.append(
+            Finding(
+                rule_id=result.get("ruleId", "unknown"),
+                level=result.get("level", "warning"),
+                message=safe_get(result, "message", "text", default=""),
+                file_path=file_path,
+                start_line=start_line,
+                end_line=end_line,
+                start_column=region.get("startColumn"),
+                end_column=region.get("endColumn"),
+                fingerprint=fp,
+                tool_name=tool_name,
+                raw=result,
+            )
+        )
+
+    return findings
+
+
+def filter_by_level(findings: list[Finding], *levels: str) -> list[Finding]:
+    """Filter findings by severity level(s)."""
+    return [f for f in findings if f.level in levels]
+
+
+def filter_by_file(findings: list[Finding], pattern: str) -> list[Finding]:
+    """Filter findings by file path pattern (substring match)."""
+    return [f for f in findings if f.file_path and pattern in f.file_path]
+
+
+def filter_by_rule(findings: list[Finding], *rule_ids: str) -> list[Finding]:
+    """Filter findings by rule ID(s)."""
+    return [f for f in findings if f.rule_id in rule_ids]
+
+
+def sort_by_severity(findings: list[Finding], reverse: bool = False) -> list[Finding]:
+    """Sort findings by severity (error > warning > note > none)."""
+    severity_order = {"error": 0, "warning": 1, "note": 2, "none": 3}
+    return sorted(findings, key=lambda f: severity_order.get(f.level, 99), reverse=reverse)
+
+
+def group_by_file(findings: list[Finding]) -> dict[str, list[Finding]]:
+    """Group findings by file path."""
+    grouped = defaultdict(list)
+    for f in findings:
+        key = f.file_path or "unknown"
+        grouped[key].append(f)
+    return dict(grouped)
+
+
+def group_by_rule(findings: list[Finding]) -> dict[str, list[Finding]]:
+    """Group findings by rule ID."""
+    grouped = defaultdict(list)
+    for f in findings:
+        grouped[f.rule_id].append(f)
+    return dict(grouped)
+
+
+def count_by_level(findings: list[Finding]) -> dict[str, int]:
+    """Count findings by severity level."""
+    counts = defaultdict(int)
+    for f in findings:
+        counts[f.level] += 1
+    return dict(counts)
+
+
+def count_by_rule(findings: list[Finding]) -> dict[str, int]:
+    """Count findings by rule ID."""
+    counts = defaultdict(int)
+    for f in findings:
+        counts[f.rule_id] += 1
+    return dict(counts)
+
+
+def compute_fingerprint(result: dict, include_message: bool = True) -> str:
+    """Compute stable fingerprint from result data."""
+    components = [result.get("ruleId", "")]
+
+    file_path, start_line, _ = extract_location(result)
+    if file_path:
+        # Use only filename, not full path (more stable across environments)
+        components.append(Path(file_path).name)
+    if start_line:
+        components.append(str(start_line))
+    if include_message:
+        msg = safe_get(result, "message", "text", default="")
+        # First 50 chars of message for stability
+        components.append(msg[:50])
+
+    return hashlib.sha256("|".join(components).encode()).hexdigest()[:16]
+
+
+def deduplicate(findings: list[Finding]) -> list[Finding]:
+    """Remove duplicate findings based on fingerprints."""
+    seen = set()
+    unique = []
+
+    for f in findings:
+        key = f.fingerprint or compute_fingerprint(f.raw)
+        if key not in seen:
+            seen.add(key)
+            unique.append(f)
+
+    return unique
+
+
+def merge_sarif_files(*paths: str | Path) -> dict:
+    """Merge multiple SARIF files into one."""
+    merged = {
+        "version": "2.1.0",
+        "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
+        "runs": [],
+    }
+
+    for path in paths:
+        sarif = load_sarif(path)
+        merged["runs"].extend(sarif.get("runs", []))
+
+    return merged
+
+
+def diff_findings(
+    baseline: list[Finding], current: list[Finding]
+) -> tuple[list[Finding], list[Finding], list[Finding]]:
+    """
+    Compare two sets of findings.
+
+    Returns:
+        - new: findings in current but not baseline
+        - fixed: findings in baseline but not current
+        - unchanged: findings in both
+    """
+    baseline_fps = {f.fingerprint or compute_fingerprint(f.raw) for f in baseline}
+    current_fps = {f.fingerprint or compute_fingerprint(f.raw) for f in current}
+
+    new = [f for f in current if (f.fingerprint or compute_fingerprint(f.raw)) not in baseline_fps]
+    fixed = [
+        f for f in baseline if (f.fingerprint or compute_fingerprint(f.raw)) not in current_fps
+    ]
+    unchanged = [
+        f for f in current if (f.fingerprint or compute_fingerprint(f.raw)) in baseline_fps
+    ]
+
+    return new, fixed, unchanged
+
+
+def get_rules(sarif: dict) -> dict[str, dict]:
+    """Extract rule definitions from SARIF file."""
+    rules = {}
+    for run in sarif.get("runs", []):
+        for rule in safe_get(run, "tool", "driver", "rules", default=[]):
+            rules[rule.get("id", "")] = rule
+    return rules
+
+
+def to_csv_rows(findings: list[Finding]) -> list[list[str]]:
+    """Convert findings to CSV-ready rows."""
+    rows = [["rule_id", "level", "file", "line", "message"]]
+    for f in findings:
+        rows.append(
+            [
+                f.rule_id,
+                f.level,
+                f.file_path or "",
+                str(f.start_line or ""),
+                f.message.replace("\n", " ")[:200],
+            ]
+        )
+    return rows
+
+
+def summary(findings: list[Finding]) -> dict:
+    """Generate summary statistics for findings."""
+    return {
+        "total": len(findings),
+        "by_level": count_by_level(findings),
+        "by_rule": count_by_rule(findings),
+        "files_affected": len(set(f.file_path for f in findings if f.file_path)),
+        "rules_triggered": len(set(f.rule_id for f in findings)),
+    }
+
+
+# Example usage
+if __name__ == "__main__":
+    import sys
+
+    if len(sys.argv) < 2:
+        print("Usage: python sarif_helpers.py <sarif_file>")
+        sys.exit(1)
+
+    sarif = load_sarif(sys.argv[1])
+
+    if not validate_version(sarif):
+        print("Warning: SARIF version is not 2.1.0")
+
+    findings = extract_findings(sarif)
+    findings = sort_by_severity(findings)
+
+    print("\nSummary:")
+    stats = summary(findings)
+    print(f"  Total findings: {stats['total']}")
+    print(f"  Files affected: {stats['files_affected']}")
+    print(f"  Rules triggered: {stats['rules_triggered']}")
+    print("\nBy severity:")
+    for level, count in stats["by_level"].items():
+        print(f"  {level}: {count}")
+
+    print("\nTop 5 rules:")
+    for rule, count in sorted(stats["by_rule"].items(), key=lambda x: -x[1])[:5]:
+        print(f"  {rule}: {count}")

package/Ai Agent Workflow/skills/secure-code-guardian/SKILL.md

@@ -0,0 +1,83 @@
+---
+name: secure-code-guardian
+description: Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention.
+license: MIT
+metadata:
+  author: https://github.com/Jeffallan
+  version: "1.0.0"
+  domain: security
+  triggers: security, authentication, authorization, encryption, OWASP, vulnerability, secure coding, password, JWT, OAuth
+  role: specialist
+  scope: implementation
+  output-format: code
+  related-skills: fullstack-guardian, security-reviewer, architecture-designer
+---
+
+# Secure Code Guardian
+
+Security-focused developer specializing in writing secure code and preventing vulnerabilities.
+
+## Role Definition
+
+You are a senior security engineer with 10+ years of application security experience. You specialize in secure coding practices, OWASP Top 10 prevention, and implementing authentication/authorization. You think defensively and assume all input is malicious.
+
+## When to Use This Skill
+
+- Implementing authentication/authorization
+- Securing user input handling
+- Implementing encryption
+- Preventing OWASP Top 10 vulnerabilities
+- Security hardening existing code
+- Implementing secure session management
+
+## Core Workflow
+
+1. **Threat model** - Identify attack surface and threats
+2. **Design** - Plan security controls
+3. **Implement** - Write secure code with defense in depth
+4. **Validate** - Test security controls
+5. **Document** - Record security decisions
+
+## Reference Guide
+
+Load detailed guidance based on context:
+
+| Topic | Reference | Load When |
+|-------|-----------|-----------|
+| OWASP | `references/owasp-prevention.md` | OWASP Top 10 patterns |
+| Authentication | `references/authentication.md` | Password hashing, JWT |
+| Input Validation | `references/input-validation.md` | Zod, SQL injection |
+| XSS/CSRF | `references/xss-csrf.md` | XSS prevention, CSRF |
+| Headers | `references/security-headers.md` | Helmet, rate limiting |
+
+## Constraints
+
+### MUST DO
+- Hash passwords with bcrypt/argon2 (never plaintext)
+- Use parameterized queries (prevent SQL injection)
+- Validate and sanitize all user input
+- Implement rate limiting on auth endpoints
+- Use HTTPS everywhere
+- Set security headers
+- Log security events
+- Store secrets in environment/secret managers
+
+### MUST NOT DO
+- Store passwords in plaintext
+- Trust user input without validation
+- Expose sensitive data in logs or errors
+- Use weak encryption algorithms
+- Hardcode secrets in code
+- Disable security features for convenience
+
+## Output Templates
+
+When implementing security features, provide:
+1. Secure implementation code
+2. Security considerations noted
+3. Configuration requirements (env vars, headers)
+4. Testing recommendations
+
+## Knowledge Reference
+
+OWASP Top 10, bcrypt/argon2, JWT, OAuth 2.0, OIDC, CSP, CORS, rate limiting, input validation, output encoding, encryption (AES, RSA), TLS, security headers

package/Ai Agent Workflow/skills/secure-code-guardian/references/authentication.md

@@ -0,0 +1,136 @@
+# Authentication
+
+## Password Hashing
+
+```typescript
+import bcrypt from 'bcrypt';
+
+const SALT_ROUNDS = 12;
+
+async function hashPassword(password: string): Promise<string> {
+  return bcrypt.hash(password, SALT_ROUNDS);
+}
+
+async function verifyPassword(password: string, hash: string): Promise<boolean> {
+  return bcrypt.compare(password, hash);
+}
+
+// Password requirements
+const PASSWORD_REGEX = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{12,}$/;
+
+function validatePassword(password: string): { valid: boolean; errors: string[] } {
+  const errors: string[] = [];
+
+  if (password.length < 12) errors.push('Minimum 12 characters');
+  if (!/[a-z]/.test(password)) errors.push('Requires lowercase');
+  if (!/[A-Z]/.test(password)) errors.push('Requires uppercase');
+  if (!/\d/.test(password)) errors.push('Requires digit');
+  if (!/[@$!%*?&]/.test(password)) errors.push('Requires special character');
+
+  return { valid: errors.length === 0, errors };
+}
+```
+
+## JWT Implementation
+
+```typescript
+import jwt from 'jsonwebtoken';
+
+const JWT_SECRET = process.env.JWT_SECRET!;
+const ACCESS_TOKEN_EXPIRY = '15m';
+const REFRESH_TOKEN_EXPIRY = '7d';
+
+interface TokenPayload {
+  sub: string;
+  type: 'access' | 'refresh';
+}
+
+function generateAccessToken(userId: string): string {
+  return jwt.sign(
+    { sub: userId, type: 'access' },
+    JWT_SECRET,
+    { expiresIn: ACCESS_TOKEN_EXPIRY }
+  );
+}
+
+function generateRefreshToken(userId: string): string {
+  return jwt.sign(
+    { sub: userId, type: 'refresh' },
+    JWT_SECRET,
+    { expiresIn: REFRESH_TOKEN_EXPIRY }
+  );
+}
+
+function verifyToken(token: string): TokenPayload {
+  return jwt.verify(token, JWT_SECRET) as TokenPayload;
+}
+```
+
+## Auth Middleware
+
+```typescript
+function authMiddleware(req: Request, res: Response, next: NextFunction) {
+  const header = req.headers.authorization;
+
+  if (!header?.startsWith('Bearer ')) {
+    return res.status(401).json({ error: 'Missing token' });
+  }
+
+  try {
+    const token = header.slice(7);
+    const payload = verifyToken(token);
+
+    if (payload.type !== 'access') {
+      return res.status(401).json({ error: 'Invalid token type' });
+    }
+
+    req.userId = payload.sub;
+    next();
+  } catch (error) {
+    if (error instanceof jwt.TokenExpiredError) {
+      return res.status(401).json({ error: 'Token expired' });
+    }
+    return res.status(401).json({ error: 'Invalid token' });
+  }
+}
+```
+
+## Account Lockout
+
+```typescript
+const MAX_ATTEMPTS = 5;
+const LOCKOUT_DURATION = 15 * 60 * 1000; // 15 minutes
+
+async function handleLoginAttempt(email: string, success: boolean) {
+  const key = `login:attempts:${email}`;
+
+  if (success) {
+    await redis.del(key);
+    return;
+  }
+
+  const attempts = await redis.incr(key);
+  await redis.expire(key, LOCKOUT_DURATION / 1000);
+
+  if (attempts >= MAX_ATTEMPTS) {
+    await redis.set(`login:locked:${email}`, '1', 'PX', LOCKOUT_DURATION);
+    throw new Error('Account locked. Try again later.');
+  }
+}
+```
+
+## Quick Reference
+
+| Practice | Implementation |
+|----------|----------------|
+| Password hash | bcrypt (12+ rounds) |
+| Token expiry | Access: 15m, Refresh: 7d |
+| Lockout | 5 attempts, 15min lockout |
+| MFA | TOTP (authenticator apps) |
+
+| JWT Claim | Purpose |
+|-----------|---------|
+| `sub` | User ID |
+| `exp` | Expiration |
+| `iat` | Issued at |
+| `type` | access/refresh |

package/Ai Agent Workflow/skills/secure-code-guardian/references/input-validation.md

@@ -0,0 +1,146 @@
+# Input Validation
+
+## Zod Validation
+
+```typescript
+import { z } from 'zod';
+
+const UserSchema = z.object({
+  email: z.string().email().max(255),
+  name: z.string().min(1).max(100).regex(/^[\w\s-]+$/),
+  age: z.number().int().min(0).max(150).optional(),
+  role: z.enum(['user', 'admin']).default('user'),
+});
+
+function validateUser(data: unknown) {
+  return UserSchema.parse(data); // Throws on invalid
+}
+
+// Safe parse (no throw)
+const result = UserSchema.safeParse(data);
+if (!result.success) {
+  console.error(result.error.issues);
+}
+```
+
+## SQL Injection Prevention
+
+```typescript
+// ❌ NEVER do this
+const bad = `SELECT * FROM users WHERE id = ${userId}`;
+const bad2 = `SELECT * FROM users WHERE name = '${name}'`;
+
+// ✅ Parameterized queries
+const good = await db.query(
+  'SELECT * FROM users WHERE id = $1 AND name = $2',
+  [userId, name]
+);
+
+// ✅ Use ORM
+const user = await prisma.user.findFirst({
+  where: { id: userId, name: name }
+});
+
+// ✅ Query builder
+const user = await knex('users')
+  .where({ id: userId, name: name })
+  .first();
+```
+
+## Path Traversal Prevention
+
+```typescript
+import path from 'path';
+
+// ❌ Vulnerable
+const vulnerable = path.join('/uploads', userInput);
+
+// ✅ Safe - validate and sanitize
+function getSecurePath(baseDir: string, userInput: string): string {
+  // Remove any path traversal attempts
+  const sanitized = path.basename(userInput);
+
+  // Resolve and verify it's within base directory
+  const fullPath = path.resolve(baseDir, sanitized);
+
+  if (!fullPath.startsWith(path.resolve(baseDir))) {
+    throw new Error('Invalid path');
+  }
+
+  return fullPath;
+}
+```
+
+## Command Injection Prevention
+
+```typescript
+import { execFile } from 'child_process';
+
+// ❌ Never use exec with user input
+exec(`convert ${userInput}`); // Vulnerable!
+
+// ✅ Use execFile with arguments array
+execFile('convert', ['-resize', '100x100', safeFilename], (error, stdout) => {
+  // ...
+});
+
+// ✅ Better: Use library functions instead of shell
+import sharp from 'sharp';
+await sharp(inputPath).resize(100, 100).toFile(outputPath);
+```
+
+## URL Validation
+
+```typescript
+function validateUrl(input: string, allowedHosts: string[]): URL {
+  const url = new URL(input);
+
+  // Check protocol
+  if (!['http:', 'https:'].includes(url.protocol)) {
+    throw new Error('Invalid protocol');
+  }
+
+  // Check host allowlist
+  if (!allowedHosts.includes(url.hostname)) {
+    throw new Error('Host not allowed');
+  }
+
+  return url;
+}
+```
+
+## File Upload Validation
+
+```typescript
+const ALLOWED_TYPES = ['image/jpeg', 'image/png', 'image/gif'];
+const MAX_SIZE = 5 * 1024 * 1024; // 5MB
+
+function validateUpload(file: Express.Multer.File) {
+  if (!ALLOWED_TYPES.includes(file.mimetype)) {
+    throw new Error('Invalid file type');
+  }
+
+  if (file.size > MAX_SIZE) {
+    throw new Error('File too large');
+  }
+
+  // Verify magic bytes (not just extension)
+  const buffer = fs.readFileSync(file.path);
+  const type = fileType.fromBuffer(buffer);
+
+  if (!type || !ALLOWED_TYPES.includes(type.mime)) {
+    throw new Error('Invalid file content');
+  }
+}
+```
+
+## Quick Reference
+
+| Input Type | Validation |
+|------------|------------|
+| Email | Regex + max length |
+| URL | Protocol + host allowlist |
+| File path | basename + resolve check |
+| SQL | Parameterized queries |
+| Command | execFile + no shell |
+| File upload | Type + size + magic bytes |