@dailephd/my-dev-kit-lab 0.2.0 → 0.2.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dailephd LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,8 +1,10 @@
 # my-dev-kit-lab
 
-my-dev-kit-lab is the experiment, evidence, reporting, and demo companion for [my-dev-kit](https://github.com/your-org/my-dev-kit). It runs reproducible experiments that test whether my-dev-kit's graph-guided retrieval helps coding-agent workflows, collects metrics, renders reports, generates plots, captures screenshots, and builds gallery outputs.
+my-dev-kit-lab is the experiment, evidence, reporting, security-validation, and future audit companion for my-dev-kit. It runs reproducible experiments that test whether my-dev-kit's graph-guided retrieval helps coding-agent workflows, collects metrics, renders reports, generates plots, captures screenshots, builds gallery outputs, and performs automated CLI/package security validation.
 
-As of v0.2.0, my-dev-kit-lab also exposes a generic experiment-plugin framework for validating local developer tools, security checks, codebase workflows, retrieval strategies, and experiment outcomes. The first plugin is `context-strategy-comparison`, which preserves the existing raw-full-file vs my-dev-kit-guided workflow through the plugin runner.
+The current package is v0.2.2, release-prepared but not yet published to npm. Its generic experiment-plugin framework was introduced in v0.2.0. The first plugin is `context-strategy-comparison`, which preserves the existing raw-full-file vs my-dev-kit-guided workflow through the plugin runner.
+
+my-dev-kit is most useful when the repository is larger than the task. It helps coding agents work with large codebases through reusable structural indexing, graph-guided retrieval, targeted source slices, and auditable context selection. Results are scoped evidence; the project does not claim that my-dev-kit always saves tokens.
 
 **my-dev-kit** is the repo indexing and graph-guided retrieval engine.
 **my-dev-kit-lab** is the separate lab layer that feeds it benchmark inputs and records evaluation outputs.
@@ -29,7 +31,7 @@ As of v0.2.0, my-dev-kit-lab also exposes a generic experiment-plugin framework
 - First experiment plugin: `context-strategy-comparison`
 - Target-aware experiment execution for local projects via `experiment:run -- --target <path>`
 - Plugin-aware JSON and HTML reports with plugin, target, variant, metric, artifact, warning, skip, and failure metadata
-- Security validation framework: dependency audit, package tarball inspection, CLI adversarial tests, static scans (CodeQL/Semgrep), bounded fuzz smoke, and release verdict — runnable against any local project via `security:validate --target <path>`
+- Security validation framework: dependency audit, package tarball inspection, CLI adversarial tests, static scans (CodeQL/Semgrep), bounded fuzz smoke, attack-scenario checks, and structured verdict/report output — runnable against any local project via `security:validate --target <path>`
 
 ---
 
@@ -37,19 +39,14 @@ As of v0.2.0, my-dev-kit-lab also exposes a generic experiment-plugin framework
 
 ```mermaid
 flowchart TD
-  A[Benchmark Projects] --> B[Prompt Variants]
-  B --> C[Agent Adapters\nfake-agent / Codex / Claude]
-  C --> D[Controlled Experiment Runner]
-  D --> E[Experiment Artifacts\nJSON]
-  E --> F[Report Renderer]
-  E --> G[Plot Generator]
-  E --> H[Visualization Demos]
-  F --> I[HTML Report + optional PNG]
-  G --> J[SVG Charts]
-  H --> K[Demo Artifacts]
-  I --> L[Gallery]
-  J --> L
-  K --> L
+  A[scripts/experiments] --> B[Experiment plugin registry + runner]
+  B --> C[context-strategy-comparison]
+  C --> D[Controlled experiment foundations]
+  D --> E[Plugin + legacy artifacts]
+  E --> F[Plugin-aware reports]
+  E --> G[Plots / screenshots / gallery]
+  H[scripts/security] --> I[Automated security validation]
+  I --> J[Security reports + verdict]
 ```
 
 ---
@@ -205,7 +202,7 @@ See [docs/METRICS.md](docs/METRICS.md) for full metric definitions.
 
 ## Current baseline release positioning
 
-my-dev-kit-lab is at a working baseline. The raw-vs-indexed experiment pipeline is fully implemented and produces reproducible artifacts. Real-agent campaign support exists for Codex and Claude. v0.2.0 adds the generic experiment-plugin framework, keeps `context-strategy-comparison` as the first plugin, and keeps future experiment types on the roadmap.
+my-dev-kit-lab is at a working baseline. The raw-vs-indexed experiment pipeline is fully implemented and produces reproducible artifacts. Real-agent campaign support exists for Codex and Claude. The current package version is `v0.2.2`, which implements the automated security-validation fortification work described below and has passed pre-release readiness and cross-platform validation. `v0.2.2` has not yet been published to npm.
 
 ---
 
@@ -223,7 +220,7 @@ This is not a web application pentest framework. **my-dev-kit** is a local CLI/p
 - database-free
 - safe to run on local repositories
 
-The release gate is implemented as of v0.1.4. It combines static scans, dependency/package checks, adversarial CLI tests, bounded fuzz smoke tests, and a structured release security report with a four-category verdict.
+The automated validation gate is implemented. It combines static scans, dependency/package checks, adversarial CLI tests, bounded fuzz smoke tests, and attack-scenario checks with structured text/JSON reports and a four-category verdict.
 
 ### Security commands
 
@@ -233,13 +230,23 @@ The release gate is implemented as of v0.1.4. It combines static scans, dependen
 | `npm run security:package` | npm pack --dry-run, forbidden content detection |
 | `npm run security:codeql` | CodeQL CLI availability check; skipped gracefully when absent |
 | `npm run security:semgrep` | Semgrep scan via local binary or npx; skipped gracefully when both absent |
-| `npm run test:security` | 165 adversarial CLI tests (path traversal, read-only boundaries, malformed artifacts, JSON safety, fuzz targets) |
+| `npm run test:security` | Automated security and adversarial CLI tests (path traversal, read-only boundaries, malformed artifacts, JSON safety, and related checks) |
 | `npm run test:fuzz:smoke` | 9 bounded fuzz targets, seeded PRNG, completes in under 1 second |
-| `npm run security:validate` | Full release gate — runs all checks and writes `reports/security/<prefix>-security-validation.{txt,json}` |
+| `npm run security:validate` | Runs selected security checks, applies profile-aware defaults when requested, and writes text/JSON reports according to `--format` |
+
+CodeQL, Semgrep, and OSV-Scanner are optional. When unavailable locally, they are recorded as `skipped` in the report, not as passed. That can lead to `ready except optional manual checks`; it does not silently turn missing tooling into a clean pass.
+
+Each security command can validate my-dev-kit-lab itself or another local project via `--target <path>`. When `--target` is omitted, the framework performs self-validation. Target projects are inspected in place: their source files are not modified by default, generated artifacts stay under `reports/security/` unless `--out` is used, and external-target reports identify the tool root, target root, target package metadata, target git metadata, command cwd, exit code, and stdout/stderr summaries.
+
+`security:validate` supports `--checks`, `--profile`, `--format`, `--fail-on`, `--out`, and `--report-prefix`. The no-flag path remains backward compatible and still runs the classic implemented check groups: `deps`, `package`, `static`, `cli-adversarial`, and `fuzz`. Supplying `--profile` without `--checks` swaps in that profile's default checks; supplying explicit `--checks` always wins over profile defaults.
+
+The current attack-scenario checks cover boundary, subprocess, secrets, and network assumptions. They are automated adversarial checks, not a manual pentest. `verdictImpact` metadata from each registered scenario drives blocker categorization in report reasoning, and narrowed `--checks` runs are labeled as scoped rather than described as a full release gate.
 
-CodeQL, Semgrep, and OSV-Scanner are optional. When unavailable locally, they are recorded as `skipped` in the report — not as failures — and the verdict is `ready except optional manual checks` rather than `not ready`.
+JSON report poisoning/config-injection checks use a baseline-diff schema guard so legitimate additive JSON fields do not fail the guard while payload-created trusted top-level fields still do. Text reports are sanitized to strip ANSI/control-byte payloads before rendering.
 
-Each security command can validate my-dev-kit-lab itself or another local project via `--target <path>`. When `--target` is omitted, the framework performs self-validation. Target projects are inspected in place: their source files are not modified, generated artifacts stay under `reports/security/`, and external-target reports identify both the tool root and the target root.
+Known limits remain intentionally explicit: secret scanning is bounded rather than exhaustive, the network/local-first check is a bounded static assumption check rather than proof of runtime isolation, package-boundary severity is still result-level rather than per-evidence-item, and profile-specific scenario behavior is limited to profile-based scenario selection/default checks.
+
+For external-target validation, `security:validate` reads the target `package.json`, detects `scripts.test:security`, and runs `npm run test:security` in the target project root when that script exists. This behavior is validated both from the source checkout and from an installed packed tarball because published-package execution differs from local source execution.
 
 Generated security reports under `reports/security/` are excluded from git by default. They are produced locally or in CI as release-gate evidence and are not committed to the repository.
 
@@ -247,6 +254,12 @@ See [docs/COMMANDS.md](docs/COMMANDS.md) for full command options and [docs/secu
 
 ---
 
+## License
+
+MIT License. See [LICENSE](LICENSE) for the full text.
+
+---
+
 ## Support
 
 my-dev-kit-lab is an independent project by dailephd LLC, developed and maintained by Dai Le.

package/dist/scripts/security/resolveToolRoot.js

@@ -0,0 +1,16 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+export function resolveToolRoot(moduleUrl) {
+    let current = path.dirname(fileURLToPath(moduleUrl));
+    while (true) {
+        if (fs.existsSync(path.join(current, "package.json"))) {
+            return current;
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return process.cwd();
+        }
+        current = parent;
+    }
+}

package/dist/scripts/security/runCodeql.js

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 import { runCodeqlCheck } from "../../src/securityValidation/staticScans/codeql.js";
 import { resolveValidationTarget } from "../../src/securityValidation/validate/resolveTarget.js";
+import { resolveToolRoot } from "./resolveToolRoot.js";
 const rawArgs = process.argv.slice(2);
 const args = parseArgs(rawArgs);
-const toolRoot = process.cwd();
+const toolRoot = resolveToolRoot(import.meta.url);
 let targetRoot;
 try {
     const target = resolveValidationTarget(args.target, toolRoot);

package/dist/scripts/security/runDependencyChecks.js

@@ -3,9 +3,10 @@ import path from "node:path";
 import { runDependencyChecks } from "../../src/securityValidation/index.js";
 import { DEFAULT_SECURITY_CONFIG } from "../../src/securityValidation/index.js";
 import { resolveValidationTarget } from "../../src/securityValidation/validate/resolveTarget.js";
+import { resolveToolRoot } from "./resolveToolRoot.js";
 const rawArgs = process.argv.slice(2);
 const args = parseArgs(rawArgs);
-const toolRoot = process.cwd();
+const toolRoot = resolveToolRoot(import.meta.url);
 let targetRoot;
 try {
     const target = resolveValidationTarget(args.target, toolRoot);

package/dist/scripts/security/runPackageChecks.js

@@ -3,9 +3,10 @@ import path from "node:path";
 import { runPackageChecks } from "../../src/securityValidation/index.js";
 import { DEFAULT_SECURITY_CONFIG } from "../../src/securityValidation/index.js";
 import { resolveValidationTarget } from "../../src/securityValidation/validate/resolveTarget.js";
+import { resolveToolRoot } from "./resolveToolRoot.js";
 const rawArgs = process.argv.slice(2);
 const args = parseArgs(rawArgs);
-const toolRoot = process.cwd();
+const toolRoot = resolveToolRoot(import.meta.url);
 let targetRoot;
 try {
     const target = resolveValidationTarget(args.target, toolRoot);

package/dist/scripts/security/runSemgrep.js

@@ -2,9 +2,10 @@
 import path from "node:path";
 import { runSemgrepCheck } from "../../src/securityValidation/staticScans/semgrep.js";
 import { resolveValidationTarget } from "../../src/securityValidation/validate/resolveTarget.js";
+import { resolveToolRoot } from "./resolveToolRoot.js";
 const rawArgs = process.argv.slice(2);
 const args = parseArgs(rawArgs);
-const toolRoot = process.cwd();
+const toolRoot = resolveToolRoot(import.meta.url);
 let targetRoot;
 try {
     const target = resolveValidationTarget(args.target, toolRoot);

package/dist/scripts/security/validate.js

@@ -4,10 +4,34 @@ import fs from "node:fs";
 import { runSecurityValidation } from "../../src/securityValidation/validate/runSecurityValidation.js";
 import { resolveValidationTarget, reportFilenamePrefix } from "../../src/securityValidation/validate/resolveTarget.js";
 import { renderTextReport, renderJsonReport } from "../../src/securityValidation/report/renderSecurityReport.js";
+import { parseSecurityValidateArgs, normalizeSecurityValidateConfig, applyProfileDefaultChecksIfApplicable, } from "../../src/securityValidation/validate/cliOptions.js";
+import { resolveAttackProfile } from "../../src/securityValidation/attackScenarios/attackProfile.js";
+import { findingsBreachFailOnThreshold } from "../../src/securityValidation/validate/verdict.js";
+import { resolveToolRoot } from "./resolveToolRoot.js";
+const USAGE = "Usage: npm run security:validate -- [--target <path>] [--out <dir>] [--report-prefix <name>] " +
+    "[--checks deps,package,static,cli-adversarial,fuzz,boundary,subprocess,secrets,network] " +
+    "[--profile node-cli-package|local-tool|npm-package] [--format text,json] [--fail-on blocker|high|medium|low]";
 // Parse CLI arguments from process.argv (after the node/tsx and script path).
 const rawArgs = process.argv.slice(2);
-const args = parseArgs(rawArgs);
-const toolRoot = process.cwd();
+const toolRoot = resolveToolRoot(import.meta.url);
+let args;
+let config;
+try {
+    args = parseSecurityValidateArgs(rawArgs);
+    config = normalizeSecurityValidateConfig(args, toolRoot);
+    // v0.2.2 Batch 5: --profile with no --checks uses that profile's declared
+    // default checks. No-op unless the user passed --profile without --checks
+    // (see applyProfileDefaultChecksIfApplicable's guard) — the true no-flag
+    // case and any explicit --checks case are always unaffected.
+    config = applyProfileDefaultChecksIfApplicable(config, resolveAttackProfile(config.profile).defaultCheckIds);
+}
+catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`\nERROR: ${msg}`);
+    console.error(USAGE);
+    process.exitCode = 1;
+    process.exit(1);
+}
 // Resolve and validate target early so we can fail fast with a clean error.
 let target;
 try {
@@ -16,7 +40,7 @@ try {
 catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.error(`\nERROR: ${msg}`);
-    console.error("Usage: npm run security:validate -- [--target <path>] [--out <dir>] [--report-prefix <name>]");
+    console.error(USAGE);
     process.exitCode = 1;
     process.exit(1);
 }
@@ -32,13 +56,30 @@ if (!target.isSelf) {
 else {
     console.log(`Mode       : self-validation`);
 }
+if (!config.checksWereDefault) {
+    console.log(`Checks     : ${config.checks.join(", ")}`);
+}
+if (config.plannedChecksRequested.length > 0) {
+    console.log(`Note       : ${config.plannedChecksRequested.join(", ")} are routed through the attack-scenario framework rather than the classic check-group runners. Review the attack-scenario section in the report for their concrete results.`);
+}
 console.log("");
 const summary = await runSecurityValidation({
     cwd: toolRoot,
     targetPath: args.target,
     fuzzIterations: parseInt(process.env["FUZZ_ITERATIONS"] ?? "50", 10),
     fuzzSeed: parseInt(process.env["FUZZ_SEED"] ?? "0xDEADBEEF", 16),
+    // Full selection (implemented + planned/attack-scenario ids) — the runner
+    // gates both implemented check groups and attack-scenario checks off the
+    // same selectedChecks set.
+    selectedChecks: config.checks,
+    profile: config.profile,
 });
+// v0.2.2 Batch 5: --fail-on breach is additive to (never a substitute for)
+// the existing verdict-based exit decision below — it can only escalate
+// exit 0 to exit 1 (e.g. --fail-on medium/low catching minor/informational
+// findings the verdict policy doesn't already treat as blocking), never
+// downgrade an existing blocker.
+const failOnBreached = findingsBreachFailOnThreshold(summary.findings, config.failOnThreshold);
 // Build report object
 const report = {
     metadata: {
@@ -54,19 +95,25 @@ const report = {
         isSelf: summary.isSelf,
         generatedAt: summary.finishedAt,
         totalDurationMs: new Date(summary.finishedAt).getTime() - new Date(summary.startedAt).getTime(),
+        profile: config.profile,
+        selectedChecks: config.checks,
+        failOnThreshold: config.failOnThreshold,
+        formats: config.formats,
+        failOnBreached,
+        isFullReleaseGate: summary.isFullReleaseGate,
     },
     sections: [],
     allChecks: summary.checks,
     allFindings: summary.findings,
     verdict: summary.verdict,
     recommendedNextStep: summary.recommendedNextStep,
+    attackResults: summary.attackResults,
+    verdictReasonSummary: summary.verdictReasonSummary,
 };
 const textReport = renderTextReport(report);
 const jsonReport = renderJsonReport(report);
 // Determine output directory
-const reportsDir = args.out
-    ? path.resolve(args.out)
-    : path.join(toolRoot, "reports", "security");
+const reportsDir = config.out;
 if (!fs.existsSync(reportsDir)) {
     fs.mkdirSync(reportsDir, { recursive: true });
 }
@@ -74,14 +121,22 @@ if (!fs.existsSync(reportsDir)) {
 const prefix = args.reportPrefix ?? reportFilenamePrefix(target);
 const txtPath = path.join(reportsDir, `${prefix}-security-validation.txt`);
 const jsonPath = path.join(reportsDir, `${prefix}-security-validation.json`);
-fs.writeFileSync(txtPath, textReport, "utf8");
-fs.writeFileSync(jsonPath, jsonReport, "utf8");
+const writtenPaths = [];
+if (config.formats.includes("text")) {
+    fs.writeFileSync(txtPath, textReport, "utf8");
+    writtenPaths.push(txtPath);
+}
+if (config.formats.includes("json")) {
+    fs.writeFileSync(jsonPath, jsonReport, "utf8");
+    writtenPaths.push(jsonPath);
+}
 // Print report to stdout
 console.log(textReport);
 console.log(`\nReports written:`);
-console.log(`  ${txtPath}`);
-console.log(`  ${jsonPath}`);
-// Exit code based on verdict
+for (const p of writtenPaths) {
+    console.log(`  ${p}`);
+}
+// Exit code based on verdict, escalated (never downgraded) by --fail-on.
 const blockerExists = summary.verdict === "not-ready-security-blocker-remains";
 const inconclusive = summary.verdict === "inconclusive-audit-environment-incomplete";
 if (blockerExists) {
@@ -92,26 +147,11 @@ else if (inconclusive) {
     console.warn("\nExit 2 — audit environment incomplete.");
     process.exitCode = 2;
 }
+else if (failOnBreached) {
+    console.error(`\nExit 1 — --fail-on ${config.failOnThreshold} threshold breached.`);
+    process.exitCode = 1;
+}
 else {
     console.log("\nExit 0 — validation completed.");
     process.exitCode = 0;
 }
-// ---------------------------------------------------------------------------
-// Argument parser
-// ---------------------------------------------------------------------------
-function parseArgs(argv) {
-    const result = {};
-    for (let i = 0; i < argv.length; i++) {
-        const arg = argv[i];
-        if ((arg === "--target" || arg === "-t") && i + 1 < argv.length) {
-            result.target = argv[++i];
-        }
-        else if (arg === "--out" && i + 1 < argv.length) {
-            result.out = argv[++i];
-        }
-        else if (arg === "--report-prefix" && i + 1 < argv.length) {
-            result.reportPrefix = argv[++i];
-        }
-    }
-    return result;
-}

package/dist/src/core/localProjectTarget.js

@@ -27,6 +27,7 @@ export function resolveLocalProjectTarget(targetPathArg, toolRoot) {
         packageName: packageMetadata.packageName,
         packageVersion: packageMetadata.packageVersion,
         hasPackageJson: packageMetadata.hasPackageJson,
+        hasSecurityTestScript: packageMetadata.hasSecurityTestScript,
         hasLockfile: hasLockfile(resolvedTargetRoot),
         ...readGitMetadata(resolvedTargetRoot),
         isSelf: resolvedTargetRoot === resolvedToolRoot,
@@ -36,10 +37,12 @@ function readPackageMetadata(targetRoot) {
     try {
         const pkgRaw = fs.readFileSync(path.join(targetRoot, "package.json"), "utf8");
         const pkg = JSON.parse(pkgRaw);
+        const testSecurityScript = pkg.scripts && typeof pkg.scripts["test:security"] === "string";
         return {
             hasPackageJson: true,
             packageName: typeof pkg.name === "string" ? pkg.name : null,
             packageVersion: typeof pkg.version === "string" ? pkg.version : null,
+            hasSecurityTestScript: Boolean(testSecurityScript),
         };
     }
     catch {
@@ -47,6 +50,7 @@ function readPackageMetadata(targetRoot) {
             hasPackageJson: false,
             packageName: null,
             packageVersion: null,
+            hasSecurityTestScript: false,
         };
     }
 }

package/dist/src/core/runMeasuredCommand.js

@@ -70,9 +70,9 @@ export async function runMeasuredCommand(options) {
                 resolvedCommand: resolution
             };
             void Promise.all([
-                writeFile(stdoutPath, stdout, "utf8"),
-                writeFile(stderrPath, stderr, "utf8"),
-                writeFile(telemetryPath, JSON.stringify(measured, null, 2), "utf8")
+                writeArtifact(stdoutPath, stdout),
+                writeArtifact(stderrPath, stderr),
+                writeArtifact(telemetryPath, JSON.stringify(measured, null, 2))
             ]).then(() => resolve(measured));
             return;
         }
@@ -98,8 +98,8 @@ export async function runMeasuredCommand(options) {
             }
             const endedAt = new Date().toISOString();
             const durationMs = Date.now() - started;
-            await writeFile(stdoutPath, stdout, "utf8");
-            await writeFile(stderrPath, stderr, "utf8");
+            await writeArtifact(stdoutPath, stdout);
+            await writeArtifact(stderrPath, stderr);
             const measured = {
                 commandId: options.commandId,
                 commandString: options.commandString,
@@ -119,12 +119,16 @@ export async function runMeasuredCommand(options) {
                 error: spawnError,
                 resolvedCommand: resolution
             };
-            await writeFile(telemetryPath, JSON.stringify(measured, null, 2), "utf8");
+            await writeArtifact(telemetryPath, JSON.stringify(measured, null, 2));
             resolve(measured);
         });
     });
     return result;
 }
+async function writeArtifact(filePath, value) {
+    await mkdir(path.dirname(filePath), { recursive: true });
+    await writeFile(filePath, value, "utf8");
+}
 function killProcessTree(pid) {
     if (!pid) {
         return;

package/dist/src/securityValidation/attackScenarios/attackProfile.js

@@ -0,0 +1,20 @@
+import { SECURITY_PROFILE_IDS } from "../validate/cliOptions.js";
+import { NODE_CLI_PACKAGE_PROFILE } from "./profiles/nodeCliPackageProfile.js";
+import { LOCAL_TOOL_PROFILE } from "./profiles/localToolProfile.js";
+import { NPM_PACKAGE_PROFILE } from "./profiles/npmPackageProfile.js";
+const PROFILE_REGISTRY = {
+    "node-cli-package": NODE_CLI_PACKAGE_PROFILE,
+    "local-tool": LOCAL_TOOL_PROFILE,
+    "npm-package": NPM_PACKAGE_PROFILE,
+};
+// Resolves a profile id to its definition. Throws a clean, descriptive Error
+// for unknown ids (mirrors Batch 1's --profile validation error style).
+export function resolveAttackProfile(id) {
+    if (!SECURITY_PROFILE_IDS.includes(id)) {
+        throw new Error(`Unknown security profile: "${id}". Valid values are: ${SECURITY_PROFILE_IDS.join(", ")}.`);
+    }
+    return PROFILE_REGISTRY[id];
+}
+export function listAttackProfiles() {
+    return SECURITY_PROFILE_IDS.map((id) => PROFILE_REGISTRY[id]);
+}

package/dist/src/securityValidation/attackScenarios/attackResult.js

@@ -0,0 +1,37 @@
+// Bridges an AttackResult into the existing SecurityCheckResult shape so it
+// can flow through the existing verdict/report pipeline without redesigning
+// either. "blocked" (scenario crashed) maps to a failed check with severity
+// bumped to at least "major" so a scenario crash is never silently invisible.
+export function toSecurityCheckResult(result) {
+    const now = new Date().toISOString();
+    const status = result.status === "blocked" ? "failed" : result.status;
+    const severity = result.status === "blocked" && result.severity === "skipped" ? "major" : result.severity;
+    return {
+        id: result.scenarioId,
+        name: result.scenarioTitle,
+        category: result.category,
+        status,
+        severity,
+        startedAt: now,
+        finishedAt: now,
+        durationMs: 0,
+        findings: result.status === "failed" || result.status === "blocked"
+            ? [
+                {
+                    id: `${result.scenarioId}-finding`,
+                    title: result.scenarioTitle,
+                    severity,
+                    category: result.category,
+                    description: result.status === "blocked"
+                        ? `Scenario execution error: ${result.errorSummary ?? "unknown error"}`
+                        : `Attack scenario detected unsafe behavior for check group '${result.checkId}'.`,
+                    evidence: result.evidence.map((e) => e.redactedPreview).filter(Boolean).join(" | ") || undefined,
+                    recommendation: result.recommendation,
+                    releaseImpact: severity === "blocker" ? "Must fix before release" : "Should fix before release",
+                },
+            ]
+            : [],
+        skippedReason: result.skippedReason,
+        verdictImpact: result.verdictImpact,
+    };
+}