@dailephd/my-dev-kit-lab 0.2.0 → 0.2.2

package/dist/src/securityValidation/attackScenarios/attackRunner.js

@@ -0,0 +1,153 @@
+import { CHECK_ID_CATEGORY } from "./attackScenario.js";
+import { TARGET_SANDBOX_SCENARIO } from "./scenarios/targetSandboxScenario.js";
+import { PACKAGE_BOUNDARY_SCENARIO } from "./scenarios/packageBoundaryScenario.js";
+import { OUTPUT_BOUNDARY_SCENARIO } from "./scenarios/outputBoundaryScenario.js";
+import { PATH_TRAVERSAL_SCENARIO } from "./scenarios/pathTraversalScenario.js";
+import { CONFIG_INJECTION_SCENARIO } from "./scenarios/configInjectionScenario.js";
+import { SUBPROCESS_INJECTION_SCENARIO } from "./scenarios/subprocessInjectionScenario.js";
+import { SECRET_LEAKAGE_SCENARIO } from "./scenarios/secretLeakageScenario.js";
+import { REPORT_POISONING_SCENARIO } from "./scenarios/reportPoisoningScenario.js";
+import { NETWORK_ASSUMPTION_SCENARIO } from "./scenarios/networkAssumptionScenario.js";
+import { registerScenarioPayloadGroups } from "./payloadCorpus.js";
+registerScenarioPayloadGroups(OUTPUT_BOUNDARY_SCENARIO.id, ["output-boundary"]);
+registerScenarioPayloadGroups(PATH_TRAVERSAL_SCENARIO.id, ["path-traversal"]);
+registerScenarioPayloadGroups(CONFIG_INJECTION_SCENARIO.id, ["malformed-config", "report-poisoning"]);
+registerScenarioPayloadGroups(SUBPROCESS_INJECTION_SCENARIO.id, ["subprocess-injection"]);
+registerScenarioPayloadGroups(REPORT_POISONING_SCENARIO.id, ["report-poisoning"]);
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 2/3/4 — attack scenario runner.
+//
+// SCENARIO_REGISTRY was empty in Batch 2. Batch 3 registered the first
+// concrete scenarios (boundary: target sandbox, package boundary, output
+// boundary, path traversal, config injection; subprocess: subprocess
+// injection). Batch 4 adds secret leakage (secrets), report poisoning
+// (boundary — report-rendering safety is a boundary-of-trust concern), and
+// network/local-first assumption (network). All 9 --checks ids now have at
+// least one registered scenario.
+// ---------------------------------------------------------------------------
+export const SCENARIO_REGISTRY = [
+    TARGET_SANDBOX_SCENARIO,
+    PACKAGE_BOUNDARY_SCENARIO,
+    OUTPUT_BOUNDARY_SCENARIO,
+    PATH_TRAVERSAL_SCENARIO,
+    CONFIG_INJECTION_SCENARIO,
+    REPORT_POISONING_SCENARIO,
+    SUBPROCESS_INJECTION_SCENARIO,
+    SECRET_LEAKAGE_SCENARIO,
+    NETWORK_ASSUMPTION_SCENARIO,
+];
+const DEFAULT_SCENARIO_TIMEOUT_MS = 30_000;
+// Selects scenarios whose checkId is in selectedChecks and whose
+// applicableProfiles either is empty (applies to all profiles) or includes
+// the given profile. Preserves registry order (deterministic).
+export function filterScenarios(scenarios, selectedChecks, profile) {
+    const checkSet = new Set(selectedChecks);
+    return scenarios.filter((s) => checkSet.has(s.checkId) && (s.applicableProfiles.length === 0 || s.applicableProfiles.includes(profile)));
+}
+async function withTimeout(promise, timeoutMs, scenarioId) {
+    let timer;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((_resolve, reject) => {
+                timer = setTimeout(() => {
+                    reject(new Error(`Scenario '${scenarioId}' exceeded its ${timeoutMs}ms execution budget.`));
+                }, timeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+// Runs a single scenario, converting a skip condition, thrown error, or
+// timeout into a structured AttackResult rather than letting exceptions
+// propagate to the caller.
+export async function runScenario(scenario, ctx) {
+    const baseFields = {
+        scenarioId: scenario.id,
+        scenarioTitle: scenario.title,
+        checkId: scenario.checkId,
+        profileId: ctx.profile,
+    };
+    try {
+        const skipReason = scenario.skipCondition?.(ctx);
+        if (skipReason) {
+            return {
+                ...baseFields,
+                status: "skipped",
+                severity: "skipped",
+                confidence: "low",
+                evidence: [],
+                category: CHECK_ID_CATEGORY[scenario.checkId],
+                skippedReason: skipReason,
+            };
+        }
+        const outcome = await withTimeout(scenario.run(ctx), scenario.timeoutMs ?? DEFAULT_SCENARIO_TIMEOUT_MS, scenario.id);
+        return {
+            ...baseFields,
+            status: outcome.status,
+            severity: outcome.severity ?? scenario.severityBaseline,
+            confidence: outcome.confidence,
+            evidence: outcome.evidence,
+            category: outcome.category ?? CHECK_ID_CATEGORY[scenario.checkId],
+            recommendation: outcome.recommendation,
+            verdictImpact: scenario.verdictImpact,
+        };
+    }
+    catch (err) {
+        return {
+            ...baseFields,
+            status: "blocked",
+            severity: scenario.severityBaseline,
+            confidence: "low",
+            evidence: [],
+            category: CHECK_ID_CATEGORY[scenario.checkId],
+            errorSummary: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+function unavailableResult(checkId, profile) {
+    return {
+        scenarioId: `${checkId}-no-scenarios-registered`,
+        scenarioTitle: `No attack scenarios registered for '${checkId}'`,
+        checkId,
+        profileId: profile,
+        status: "skipped",
+        severity: "skipped",
+        confidence: "low",
+        evidence: [],
+        category: CHECK_ID_CATEGORY[checkId],
+        skippedReason: `No attack scenarios are registered yet for check group '${checkId}'. ` +
+            `The attack-scenario framework is present (v0.2.2 Batch 2); concrete scenarios are planned for a later v0.2.2 batch. ` +
+            `This must not be treated as evidence that '${checkId}' is safe.`,
+    };
+}
+// Runs all scenarios matching selectedChecks/profile, then appends one
+// explicit "unavailable" placeholder result for every selected check that
+// matched zero scenarios. Safe when the scenario list is empty. Result order
+// is deterministic: matched scenarios in registry order, then unavailable
+// placeholders in selectedChecks order.
+export async function runAttackScenarios(options) {
+    const scenarios = options.scenarios ?? SCENARIO_REGISTRY;
+    const matched = filterScenarios(scenarios, options.selectedChecks, options.profile);
+    const ctx = {
+        toolRoot: options.toolRoot,
+        target: options.target,
+        profile: options.profile,
+        config: options.config,
+        targetSnapshotBefore: options.targetSnapshotBefore,
+    };
+    const results = [];
+    for (const scenario of matched) {
+        results.push(await runScenario(scenario, ctx));
+    }
+    const matchedCheckIds = new Set(matched.map((s) => s.checkId));
+    for (const checkId of options.selectedChecks) {
+        if (!matchedCheckIds.has(checkId)) {
+            results.push(unavailableResult(checkId, options.profile));
+        }
+    }
+    return results;
+}

package/dist/src/securityValidation/attackScenarios/attackScenario.js

@@ -0,0 +1,21 @@
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 2 — attack scenario contract.
+//
+// This is the shared interface later v0.2.2 batches implement concrete
+// scenarios against. Batch 2 intentionally ships with an empty scenario
+// registry (see attackRunner.ts) — this file only defines the shape.
+// ---------------------------------------------------------------------------
+// Maps a planned/attack-scenario check id to its default report category.
+// Used both when no scenarios are registered yet (placeholder result) and by
+// scenario authors as a sensible default category.
+export const CHECK_ID_CATEGORY = {
+    deps: "dependency-audit",
+    package: "package-content",
+    static: "static-scan",
+    "cli-adversarial": "cli-adversarial",
+    fuzz: "fuzz-smoke",
+    boundary: "artifact-safety",
+    subprocess: "cli-adversarial",
+    secrets: "secret-leakage",
+    network: "network-boundary",
+};

package/dist/src/securityValidation/attackScenarios/boundedSourceScan.js

@@ -0,0 +1,100 @@
+import fs from "node:fs";
+import { collectFilesForGlobs } from "../../core/fileGlobs.js";
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 4 — shared bounded, deterministic source-file scan helper.
+//
+// Reused by secretLeakageScenario and networkAssumptionScenario. Both need
+// "read a bounded, deterministic set of source-ish files, skip large/binary
+// content" and nothing more — collectFilesForGlobs() already provides
+// deterministic ordering and standard exclusions (node_modules, dist, build,
+// coverage, .git, lab-output, .my-dev-kit); this layer adds a size cap and a
+// small file-content allowlist filter for scenario-specific exclusions.
+// ---------------------------------------------------------------------------
+// Default bounded glob set: project manifests/config plus first-party source
+// and scripts. Deliberately excludes tests/, benchmarks/, examples/ — those
+// commonly contain intentionally fake secret-shaped fixtures (including this
+// project's own security payload corpus test suite) that would otherwise be
+// permanent false positives against this project's own repo.
+export const DEFAULT_SOURCE_SCAN_GLOBS = [
+    "package.json",
+    "package-lock.json",
+    "npm-shrinkwrap.json",
+    "tsconfig.json",
+    "tsconfig.*.json",
+    ".env",
+    ".env.*",
+    "src/**/*",
+    "scripts/**/*",
+];
+// Files that are deliberately excluded from scan output even though they
+// match a glob above — e.g. the payload corpus itself, which intentionally
+// contains fake-secret-shaped strings for Batch 2's test corpus.
+const KNOWN_SYNTHETIC_FIXTURE_FILES = new Set(["src/securityValidation/attackScenarios/payloadCorpus.ts"]);
+// Skip files larger than this to keep the scan bounded and fast; source
+// files this large are not expected in this project.
+const MAX_SCANNABLE_FILE_BYTES = 1_000_000;
+// A single NUL character, used as a cheap binary-file heuristic below.
+// Built via fromCharCode rather than a "\0" string escape to avoid any
+// literal control byte ending up in this source file.
+const NUL_CHAR = String.fromCharCode(0);
+// Returns file contents for the bounded glob set, skipping known synthetic
+// fixtures, oversized files, and anything unreadable as UTF-8 text (treated
+// as binary and skipped, not an error). Stable, deterministic order.
+export function collectBoundedSourceFiles(targetRoot, globs = DEFAULT_SOURCE_SCAN_GLOBS) {
+    // collectFilesForGlobs() throws for the *entire* call if any single glob's
+    // base path doesn't exist (e.g. no .env file, no tsconfig.*.json match) —
+    // resolve each glob independently so one missing/inapplicable glob doesn't
+    // silently zero out results for all the others.
+    const candidateMap = new Map();
+    for (const glob of globs) {
+        let matches;
+        try {
+            matches = collectFilesForGlobs(targetRoot, [glob]);
+        }
+        catch {
+            // This glob's base path doesn't exist for this target — a legitimate
+            // "nothing to scan for this pattern" outcome, not an error.
+            continue;
+        }
+        for (const m of matches) {
+            candidateMap.set(m.relativePath, m.absolutePath);
+        }
+    }
+    const candidates = [...candidateMap.entries()]
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([relativePath, absolutePath]) => ({ relativePath, absolutePath }));
+    const files = [];
+    for (const candidate of candidates) {
+        const normalizedRel = candidate.relativePath.replace(/\\/g, "/");
+        if (KNOWN_SYNTHETIC_FIXTURE_FILES.has(normalizedRel))
+            continue;
+        let stat;
+        try {
+            stat = fs.statSync(candidate.absolutePath);
+        }
+        catch {
+            continue;
+        }
+        if (!stat.isFile() || stat.size > MAX_SCANNABLE_FILE_BYTES)
+            continue;
+        try {
+            const content = fs.readFileSync(candidate.absolutePath, "utf8");
+            if (content.indexOf(NUL_CHAR) !== -1)
+                continue;
+            files.push({ relativePath: normalizedRel, absolutePath: candidate.absolutePath, content });
+        }
+        catch {
+            continue;
+        }
+    }
+    return files;
+}
+// Returns the 1-based line number containing `index` within `content`.
+export function lineNumberAt(content, index) {
+    let line = 1;
+    for (let i = 0; i < index && i < content.length; i++) {
+        if (content[i] === "\n")
+            line++;
+    }
+    return line;
+}

package/dist/src/securityValidation/attackScenarios/exploitEvidence.js

@@ -0,0 +1,69 @@
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 2 — exploit evidence model.
+//
+// Evidence attached to an AttackResult. Kept small and JSON-serializable by
+// construction (no functions, no circular references, no raw Buffers).
+// Redaction helpers here must never leak full secret-like values into
+// reports; only bounded, redacted previews are stored.
+// ---------------------------------------------------------------------------
+export const EXPLOIT_EVIDENCE_KINDS = [
+    "command",
+    "filesystem",
+    "output",
+    "target-modification",
+    "secret-leak",
+    "package-content",
+    "skipped-tool",
+    "skipped-scenario",
+    "observation",
+];
+const MAX_PREVIEW_LENGTH = 200;
+// Patterns for common secret-like tokens. Deliberately conservative — false
+// positives (over-redacting) are safe; false negatives are not.
+const SECRET_LIKE_PATTERNS = [
+    /sk-[a-zA-Z0-9]{16,}/g,
+    /gh[pousr]_[a-zA-Z0-9]{16,}/g,
+    /AKIA[0-9A-Z]{12,}/g,
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+    /[A-Za-z0-9_\-]{32,}/g,
+];
+// ANSI CSI sequences (color codes, cursor movement, etc.) and other C0/DEL
+// control bytes. Newline/carriage-return/tab are preserved — they're
+// structural whitespace, not a terminal-rewriting risk.
+const ANSI_CSI_PATTERN = /\x1b\[[0-9;]*[a-zA-Z]/g;
+const OTHER_CONTROL_CHARS_PATTERN = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
+// Strips ANSI escape sequences and other unsafe control bytes. Applied
+// before secret redaction so a payload cannot use control characters to
+// hide from the secret-pattern matchers.
+export function stripUnsafeControlChars(raw) {
+    return raw.replace(ANSI_CSI_PATTERN, "").replace(OTHER_CONTROL_CHARS_PATTERN, "");
+}
+// Redacts secret-looking substrings and terminal control sequences, and
+// truncates to a bounded preview. Never returns the full original value when
+// it is long, matches a secret-like pattern, or contains unsafe control
+// bytes (e.g. ANSI escapes from a report-poisoning payload).
+export function redactPreview(raw, maxLength = MAX_PREVIEW_LENGTH) {
+    let redacted = stripUnsafeControlChars(raw);
+    for (const pattern of SECRET_LIKE_PATTERNS) {
+        redacted = redacted.replace(pattern, (match) => `[REDACTED:${match.length}chars]`);
+    }
+    if (redacted.length > maxLength) {
+        return `${redacted.slice(0, maxLength)}... [truncated, ${raw.length} chars total]`;
+    }
+    return redacted;
+}
+let evidenceCounter = 0;
+// Deterministic-enough id generator for evidence created within a single
+// process run (report rendering does not depend on global uniqueness).
+export function nextEvidenceId(prefix) {
+    evidenceCounter += 1;
+    return `${prefix}-${evidenceCounter}`;
+}
+export function makeEvidence(partial) {
+    const { rawPreview, ...rest } = partial;
+    return {
+        id: nextEvidenceId(partial.kind),
+        ...rest,
+        redactedPreview: rawPreview !== undefined ? redactPreview(rawPreview) : undefined,
+    };
+}

package/dist/src/securityValidation/attackScenarios/profiles/localToolProfile.js

@@ -0,0 +1,10 @@
+export const LOCAL_TOOL_PROFILE = {
+    id: "local-tool",
+    label: "Local tool",
+    description: "Profile for a tool that is only ever run locally and is not published to a registry — package-content and npm-publish-shaped checks are less relevant, boundary/subprocess checks still matter.",
+    defaultCheckIds: ["deps", "static", "cli-adversarial", "fuzz"],
+    applicableCheckIds: ["deps", "static", "cli-adversarial", "fuzz", "boundary", "subprocess", "secrets", "network"],
+    scenarioGroups: ["boundary", "subprocess", "secrets", "network"],
+    mandatoryEvidenceCategories: ["command", "filesystem"],
+    skippedWording: "planned for a later v0.2.2 batch",
+};

package/dist/src/securityValidation/attackScenarios/profiles/nodeCliPackageProfile.js

@@ -0,0 +1,20 @@
+export const NODE_CLI_PACKAGE_PROFILE = {
+    id: "node-cli-package",
+    label: "Node CLI package",
+    description: "Default profile for a published Node.js CLI/package like my-dev-kit itself: local-first, deterministic, read-only with respect to user source.",
+    defaultCheckIds: ["deps", "package", "static", "cli-adversarial", "fuzz"],
+    applicableCheckIds: [
+        "deps",
+        "package",
+        "static",
+        "cli-adversarial",
+        "fuzz",
+        "boundary",
+        "subprocess",
+        "secrets",
+        "network",
+    ],
+    scenarioGroups: ["boundary", "subprocess", "secrets", "network"],
+    mandatoryEvidenceCategories: ["command", "filesystem", "output"],
+    skippedWording: "planned for a later v0.2.2 batch",
+};

package/dist/src/securityValidation/attackScenarios/profiles/npmPackageProfile.js

@@ -0,0 +1,10 @@
+export const NPM_PACKAGE_PROFILE = {
+    id: "npm-package",
+    label: "npm package",
+    description: "Profile for a general published npm package (not necessarily a CLI) — emphasizes package-content, dependency, and secret-leakage checks over CLI-argument-shaped adversarial tests.",
+    defaultCheckIds: ["deps", "package", "static"],
+    applicableCheckIds: ["deps", "package", "static", "cli-adversarial", "fuzz", "boundary", "secrets", "network"],
+    scenarioGroups: ["boundary", "secrets", "network"],
+    mandatoryEvidenceCategories: ["package-content", "secret-leak"],
+    skippedWording: "planned for a later v0.2.2 batch",
+};

package/dist/src/securityValidation/attackScenarios/reportSchemaGuard.js

@@ -0,0 +1,41 @@
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 6 — report-poisoning JSON schema guard.
+//
+// Batch 3/4 scenarios (configInjectionScenario, reportPoisoningScenario)
+// each hardcoded their own "expected top-level JSON keys" allowlist to
+// detect payload-created structural injection. That approach broke twice
+// (Batch 4, Batch 5) purely because a *legitimate* additive top-level field
+// was introduced elsewhere and nobody remembered to update both copies of
+// the list.
+//
+// This module replaces the hardcoded-allowlist approach with a baseline
+// comparison: render the same report shape twice — once with an inert
+// placeholder string in the content fields a payload would occupy, once
+// with the actual payload — and compare the top-level key *sets* of the
+// parsed JSON. A payload can only produce an "extra" key if it actually broke
+// out of its string context and created new JSON structure; legitimate
+// schema evolution (a new field added to renderJsonReport's output) shows up
+// identically in both renders and is never flagged. This keeps the
+// injection check meaningful without hardcoding field names anywhere.
+// ---------------------------------------------------------------------------
+// Inert content used for the "clean" baseline render — deliberately boring,
+// never matches any payload shape.
+export const SAFE_BASELINE_CONTENT = "SAFE_BASELINE_CONTENT_NOT_A_PAYLOAD";
+// Compares the top-level key sets of two already-rendered JSON strings
+// (baseline vs. candidate). Returns parseable:false (and no injected keys)
+// if either fails to parse — a parse failure is reported separately by
+// callers as "jsonCorrupted", not conflated with structural injection.
+export function detectJsonStructuralInjection(baselineJson, candidateJson) {
+    let baseline;
+    let candidate;
+    try {
+        baseline = JSON.parse(baselineJson);
+        candidate = JSON.parse(candidateJson);
+    }
+    catch {
+        return { parseable: false, injectedTopLevelKeys: [] };
+    }
+    const baselineKeys = new Set(Object.keys(baseline));
+    const injectedTopLevelKeys = Object.keys(candidate).filter((k) => !baselineKeys.has(k));
+    return { parseable: true, injectedTopLevelKeys };
+}

package/dist/src/securityValidation/attackScenarios/scenarios/configInjectionScenario.js

@@ -0,0 +1,144 @@
+import { makeEvidence } from "../exploitEvidence.js";
+import { getPayloadsForGroup } from "../payloadCorpus.js";
+import { normalizeSecurityValidateConfig } from "../../validate/cliOptions.js";
+import { renderJsonReport, renderTextReport } from "../../report/renderSecurityReport.js";
+import { SAFE_BASELINE_CONTENT, detectJsonStructuralInjection } from "../reportSchemaGuard.js";
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 3 — config injection scenario.
+//
+// Two parts, using the Batch 2 "malformed-config" and "report-poisoning"
+// payload groups:
+//  1. Confirms malformed values for --checks/--profile/--format/--fail-on are
+//     rejected by normalizeSecurityValidateConfig() (Batch 1) rather than
+//     silently accepted or partially applied.
+//  2. Confirms JSON-breakout / ANSI-escape style strings embedded in report
+//     content (e.g. via a check name or skip reason) do not corrupt
+//     renderJsonReport()'s output (still valid, parseable JSON) or crash
+//     renderTextReport().
+// ---------------------------------------------------------------------------
+function makeFixtureReport(injected) {
+    const now = new Date().toISOString();
+    return {
+        metadata: {
+            toolRoot: "/tool/root",
+            toolPackageName: "my-dev-kit-lab",
+            toolPackageVersion: "0.2.1",
+            targetRoot: "/tool/root",
+            targetDescription: "self (my-dev-kit-lab)",
+            packageName: "my-dev-kit-lab",
+            packageVersion: "0.2.1",
+            branch: injected,
+            commit: "abc1234",
+            isSelf: true,
+            generatedAt: now,
+            totalDurationMs: 1,
+        },
+        sections: [],
+        allChecks: [
+            {
+                id: "config-injection-fixture",
+                name: injected,
+                category: "artifact-safety",
+                status: "skipped",
+                severity: "skipped",
+                startedAt: now,
+                finishedAt: now,
+                durationMs: 0,
+                findings: [],
+                skippedReason: injected,
+            },
+        ],
+        allFindings: [],
+        verdict: "ready-except-optional-manual-checks",
+        recommendedNextStep: injected,
+    };
+}
+export const CONFIG_INJECTION_SCENARIO = {
+    id: "config-injection-safety",
+    title: "Config injection: malformed CLI config is rejected; injected content cannot corrupt reports",
+    description: "Confirms malformed --checks/--profile/--format/--fail-on values fail cleanly via normalizeSecurityValidateConfig(), and that JSON-breakout/ANSI-escape strings embedded in report content do not corrupt JSON output or crash text rendering.",
+    checkId: "boundary",
+    applicableProfiles: [],
+    severityBaseline: "major",
+    verdictImpact: "tool-framework-blocker",
+    expectedSafeBehavior: "Malformed config values always throw before any validation runs; injected content in report fields never breaks JSON parseability or text rendering.",
+    evidenceRequirements: ["observation", "output"],
+    run: async (ctx) => {
+        const evidence = [];
+        const notRejected = [];
+        const malformedPayloads = getPayloadsForGroup("malformed-config");
+        const flagsToTest = ["checks", "profile", "format", "failOn"];
+        for (const payload of malformedPayloads) {
+            for (const flag of flagsToTest) {
+                let rejected = false;
+                try {
+                    normalizeSecurityValidateConfig({ [flag]: payload.value }, ctx.toolRoot);
+                }
+                catch {
+                    rejected = true;
+                }
+                if (!rejected) {
+                    notRejected.push(`${flag}=${payload.id}`);
+                }
+            }
+        }
+        evidence.push(makeEvidence({
+            kind: "observation",
+            source: "normalizeSecurityValidateConfig()",
+            confidence: "high",
+            expectedBehavior: `All ${malformedPayloads.length * flagsToTest.length} malformed (payload, flag) combinations must throw.`,
+            observedBehavior: notRejected.length === 0
+                ? "All malformed combinations were rejected."
+                : `${notRejected.length} combination(s) were NOT rejected.`,
+        }));
+        const poisoningPayloads = getPayloadsForGroup("report-poisoning");
+        const baselineJson = renderJsonReport(makeFixtureReport(SAFE_BASELINE_CONTENT));
+        let jsonCorrupted = false;
+        let textCrashed = false;
+        for (const payload of poisoningPayloads) {
+            const report = makeFixtureReport(payload.value);
+            try {
+                const json = renderJsonReport(report);
+                // Baseline-diff check (v0.2.2 Batch 6): a payload can only widen the
+                // top-level JSON shape by actually breaking out of its string
+                // context — legitimate additive schema fields render identically in
+                // both the baseline and poisoned renders and are never flagged.
+                const injection = detectJsonStructuralInjection(baselineJson, json);
+                if (!injection.parseable || injection.injectedTopLevelKeys.length > 0) {
+                    jsonCorrupted = true;
+                }
+            }
+            catch {
+                jsonCorrupted = true;
+            }
+            try {
+                renderTextReport(report);
+            }
+            catch {
+                textCrashed = true;
+            }
+        }
+        evidence.push(makeEvidence({
+            kind: "output",
+            source: "renderJsonReport() / renderTextReport() with report-poisoning payloads",
+            confidence: "high",
+            expectedBehavior: "JSON stays parseable with no extra top-level keys; text rendering never throws.",
+            observedBehavior: `jsonCorrupted=${jsonCorrupted}, textCrashed=${textCrashed}`,
+        }));
+        if (notRejected.length > 0 || jsonCorrupted || textCrashed) {
+            return {
+                status: "failed",
+                confidence: "high",
+                evidence,
+                recommendation: notRejected.length > 0
+                    ? "Ensure normalizeSecurityValidateConfig() validates every enum flag against its known-value list."
+                    : "Ensure report rendering treats all field content as opaque data (JSON.stringify already does this by construction).",
+            };
+        }
+        return {
+            status: "passed",
+            confidence: "high",
+            evidence,
+        };
+    },
+};