@dailephd/my-dev-kit-lab 0.2.0 → 0.2.2

package/dist/src/securityValidation/attackScenarios/scenarios/secretLeakageScenario.js

@@ -0,0 +1,143 @@
+import { makeEvidence } from "../exploitEvidence.js";
+import { collectBoundedSourceFiles, lineNumberAt } from "../boundedSourceScan.js";
+const SEVERITY_FOR_KIND = {
+    "private-key": "blocker",
+    "github-token": "blocker",
+    "openai-token": "blocker",
+    "aws-key": "blocker",
+    "generic-secret-assignment": "major",
+};
+const SECRET_PATTERNS = [
+    { kind: "private-key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g },
+    { kind: "github-token", regex: /gh[pousr]_[A-Za-z0-9]{16,}/g },
+    { kind: "openai-token", regex: /sk-[A-Za-z0-9]{16,}/g },
+    { kind: "aws-key", regex: /AKIA[0-9A-Z]{12,}/g },
+    {
+        kind: "generic-secret-assignment",
+        regex: /(?:password|passwd|secret|api[_-]?key|token)\s*[:=]\s*["']?([A-Za-z0-9_\-]{8,})["']?/gi,
+    },
+];
+const PLACEHOLDER_MARKERS = [
+    /\bexample\b/i,
+    /change[-_]?me/i,
+    /\bdummy\b/i,
+    /\btest\b/i,
+    /\bfake\b/i,
+    /your[-_]?api[-_]?key/i,
+    /<[a-z_]+>/i,
+    /\bxxxx+\b/i,
+    /\bplaceholder\b/i,
+    /\bsample\b/i,
+    /\bredacted\b/i,
+];
+function isPlaceholder(text) {
+    return PLACEHOLDER_MARKERS.some((p) => p.test(text));
+}
+const SEVERITY_RANK = {
+    blocker: 4,
+    major: 3,
+    minor: 2,
+    informational: 1,
+    skipped: 0,
+};
+function scanFileForSecrets(relativePath, content) {
+    const findings = [];
+    for (const { kind, regex } of SECRET_PATTERNS) {
+        // Each pattern object's `regex` is reused across files; reset lastIndex
+        // via a fresh exec loop to stay correct for global regexes.
+        const re = new RegExp(regex.source, regex.flags);
+        let match;
+        while ((match = re.exec(content)) !== null) {
+            const matchedText = match[0];
+            // For the generic assignment pattern, judge placeholder-ness on the
+            // captured value; for shaped tokens, judge on the whole match.
+            const judgedText = kind === "generic-secret-assignment" ? (match[1] ?? matchedText) : matchedText;
+            if (isPlaceholder(judgedText) || isPlaceholder(matchedText)) {
+                // Downgrade: not a high-confidence finding, skip entirely rather
+                // than add noise — placeholders are expected in source/config.
+                continue;
+            }
+            // Guard against zero-length matches looping forever.
+            if (matchedText.length === 0) {
+                re.lastIndex += 1;
+                continue;
+            }
+            findings.push({
+                kind,
+                file: relativePath,
+                line: lineNumberAt(content, match.index),
+                matchedText,
+                matchLength: matchedText.length,
+                severity: SEVERITY_FOR_KIND[kind],
+            });
+        }
+    }
+    return findings;
+}
+export const SECRET_LEAKAGE_SCENARIO = {
+    id: "secret-leakage-bounded-scan",
+    title: "Secret leakage: bounded static scan finds no high-confidence secret-shaped literals",
+    description: "Scans a bounded, deterministic set of project files (manifests, tsconfig, src/, scripts/, .env*) for high-confidence secret-shaped literal values (private keys, GitHub/OpenAI/AWS-style tokens, generic password/token/secret assignments). Placeholder values and bare env-var-name references are excluded from findings.",
+    checkId: "secrets",
+    applicableProfiles: [],
+    severityBaseline: "informational",
+    verdictImpact: "target-project-blocker",
+    expectedSafeBehavior: "No high-confidence secret-shaped literal values are present in the bounded glob set inspected.",
+    evidenceRequirements: ["secret-leak", "observation"],
+    run: async (ctx) => {
+        const files = collectBoundedSourceFiles(ctx.target.targetRoot);
+        if (files.length === 0) {
+            return {
+                status: "passed",
+                confidence: "low",
+                evidence: [
+                    makeEvidence({
+                        kind: "observation",
+                        source: "bounded secret scan file collection",
+                        confidence: "low",
+                        expectedBehavior: "At least one file would be scanned for a meaningful bounded-scan claim.",
+                        observedBehavior: "0 files matched the bounded glob set (package.json/tsconfig/src/scripts/.env*). No findings because there was nothing to scan — this does not prove the target has no secrets elsewhere.",
+                    }),
+                ],
+            };
+        }
+        const allFindings = [];
+        for (const file of files) {
+            allFindings.push(...scanFileForSecrets(file.relativePath, file.content));
+        }
+        allFindings.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
+        const evidence = [
+            makeEvidence({
+                kind: "observation",
+                source: "bounded secret scan",
+                confidence: "medium",
+                expectedBehavior: "Bounded scan of manifests/tsconfig/src/scripts/.env* files.",
+                observedBehavior: `${files.length} file(s) scanned; ${allFindings.length} high-confidence secret-shaped finding(s).`,
+            }),
+            ...allFindings.slice(0, 20).map((f) => makeEvidence({
+                kind: "secret-leak",
+                source: `pattern '${f.kind}'`,
+                filePath: f.file,
+                line: f.line,
+                confidence: "high",
+                expectedBehavior: "No literal high-confidence secret values in scanned source paths.",
+                // Manually pre-redacted: never pass the raw matched text through —
+                // some generic-assignment matches are shorter than the 32-char
+                // generic redaction threshold in redactPreview(), so we redact
+                // explicitly here rather than relying on it for this scenario.
+                rawPreview: `${f.kind} match in ${f.file}:${f.line} [REDACTED:${f.matchLength}chars]`,
+            })),
+        ];
+        if (allFindings.length === 0) {
+            return { status: "passed", confidence: "medium", evidence };
+        }
+        const worstSeverity = allFindings.reduce((worst, f) => (SEVERITY_RANK[f.severity] > SEVERITY_RANK[worst] ? f.severity : worst), "informational");
+        return {
+            status: "failed",
+            confidence: "high",
+            evidence,
+            severity: worstSeverity,
+            recommendation: `Remove or rotate ${allFindings.length} high-confidence secret-shaped value(s) found in the scanned bounded file set; move secrets to environment variables or a secret manager, never literal source/config values.`,
+        };
+    },
+};

package/dist/src/securityValidation/attackScenarios/scenarios/subprocessInjectionScenario.js

@@ -0,0 +1,117 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { makeEvidence } from "../exploitEvidence.js";
+import { getPayloadsForGroup } from "../payloadCorpus.js";
+import { runSecurityCommand } from "../../commandRunner.js";
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 3 — subprocess injection scenario.
+//
+// Non-destructive by construction: never executes a payload as a shell
+// command. Instead it runs `node -e "..."` with each subprocess-injection
+// payload passed as a single argv element (via spawn's argument array, the
+// same mechanism runSecurityCommand/runMeasuredCommand use), and confirms
+// the child process receives it back as exactly one literal argument — proof
+// that no shell re-interpreted it (splitting it into multiple commands via
+// `;`, `&&`, backticks, `$()`, or `|`).
+//
+// Also does a bounded static check that the command-execution helpers this
+// scenario exercises are built with `shell: false` (source inspection of a
+// known-small file, not a general code scanner).
+// ---------------------------------------------------------------------------
+const ECHO_ARGV_SCRIPT = "process.stdout.write(JSON.stringify(process.argv.slice(1)))";
+function commandRunnerSourcePath() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return path.resolve(here, "..", "..", "commandRunner.ts");
+}
+export const SUBPROCESS_INJECTION_SCENARIO = {
+    id: "subprocess-injection-safety",
+    title: "Subprocess injection: shell metacharacter payloads are passed as literal arguments",
+    description: "Runs a benign argv-echoing Node script with each subprocess-injection payload as a single spawn argument and confirms it round-trips as exactly one literal string, proving no shell re-interpretation. Also checks that commandRunner.ts constructs subprocess calls with shell:false.",
+    checkId: "subprocess",
+    applicableProfiles: [],
+    severityBaseline: "blocker",
+    verdictImpact: "tool-framework-blocker",
+    expectedSafeBehavior: "Every subprocess-injection payload round-trips as a single literal argv element; commandRunner.ts uses shell:false.",
+    evidenceRequirements: ["command", "observation"],
+    run: async (ctx) => {
+        const evidence = [];
+        const notLiteral = [];
+        const payloads = getPayloadsForGroup("subprocess-injection");
+        for (const p of payloads) {
+            const cmd = await runSecurityCommand({
+                command: process.execPath,
+                args: ["-e", ECHO_ARGV_SCRIPT, p.value],
+                cwd: ctx.toolRoot,
+                timeoutMs: 10_000,
+            });
+            let roundTrippedCorrectly = false;
+            try {
+                const parsed = JSON.parse(cmd.stdout.trim());
+                roundTrippedCorrectly = parsed.length === 1 && parsed[0] === p.value;
+            }
+            catch {
+                roundTrippedCorrectly = false;
+            }
+            if (!roundTrippedCorrectly) {
+                notLiteral.push(p.id);
+            }
+            evidence.push(makeEvidence({
+                kind: "command",
+                source: `runSecurityCommand() argv round-trip for payload '${p.id}'`,
+                commandCwd: ctx.toolRoot,
+                commandSummary: "node -e <argv-echo-script> <payload>",
+                exitCode: cmd.exitCode,
+                confidence: "high",
+                expectedBehavior: "Payload must round-trip as exactly one literal argv element.",
+                observedBehavior: roundTrippedCorrectly
+                    ? "Round-tripped as a single literal argument, as expected."
+                    : "Did NOT round-trip as a single literal argument — possible shell interpretation.",
+                rawPreview: p.value,
+            }));
+        }
+        let shellFalseConfirmed = false;
+        let sourceReadable = true;
+        try {
+            const source = fs.readFileSync(commandRunnerSourcePath(), "utf8");
+            shellFalseConfirmed = /shell:\s*false/.test(source);
+        }
+        catch {
+            sourceReadable = false;
+        }
+        evidence.push(makeEvidence({
+            kind: "observation",
+            source: "static check: src/securityValidation/commandRunner.ts",
+            confidence: sourceReadable ? "high" : "low",
+            expectedBehavior: "Subprocess calls should be constructed with shell:false.",
+            observedBehavior: sourceReadable
+                ? shellFalseConfirmed
+                    ? "shell:false found in commandRunner.ts."
+                    : "shell:false NOT found in commandRunner.ts."
+                : "Could not read commandRunner.ts source for static confirmation.",
+        }));
+        if (notLiteral.length > 0 || (sourceReadable && !shellFalseConfirmed)) {
+            return {
+                status: "failed",
+                confidence: "high",
+                evidence,
+                recommendation: notLiteral.length > 0
+                    ? `Investigate argument construction — payload(s) did not round-trip literally: ${notLiteral.join(", ")}.`
+                    : "commandRunner.ts must construct child_process.spawn calls with shell:false.",
+            };
+        }
+        if (!sourceReadable) {
+            return {
+                status: "blocked",
+                confidence: "low",
+                evidence,
+                recommendation: "Could not statically confirm shell:false; argv round-trip evidence is still valid.",
+            };
+        }
+        return {
+            status: "passed",
+            confidence: "high",
+            evidence,
+        };
+    },
+};

package/dist/src/securityValidation/attackScenarios/scenarios/targetSandboxScenario.js

@@ -0,0 +1,118 @@
+import path from "node:path";
+import { makeEvidence } from "../exploitEvidence.js";
+import { captureTargetSnapshot, diffTargetSnapshots, isGeneratedArtifactPath } from "../targetSnapshot.js";
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 3 — target sandbox / read-only validation scenario.
+//
+// Compares the target's git status "before" (captured by runSecurityValidation
+// before any checks ran, threaded via ctx.targetSnapshotBefore) against a
+// fresh snapshot taken here (after all other checks in this run finished —
+// attack-scenario checks run last in the orchestrator). Never mutates the
+// target: only `git status --porcelain` is executed, no clean/reset/restore.
+//
+// Known limitation: this only detects changes visible to `git status`. It
+// cannot detect a file that was modified and then reverted to its original
+// content, or changes in a non-git target (which is skipped, not silently
+// assumed safe).
+// ---------------------------------------------------------------------------
+export const TARGET_SANDBOX_SCENARIO = {
+    id: "target-sandbox-read-only",
+    title: "Target sandbox: validation does not modify the target working tree",
+    description: "Compares target git status before and after the validation run to confirm the run did not modify or add tracked/untracked files, and did not write generated security artifacts inside the target.",
+    checkId: "boundary",
+    applicableProfiles: [],
+    severityBaseline: "blocker",
+    verdictImpact: "target-project-blocker",
+    expectedSafeBehavior: "git status for the target is identical before and after the run, except for pre-existing dirtiness which is reported separately and not treated as caused by this run.",
+    evidenceRequirements: ["filesystem", "target-modification", "skipped-tool"],
+    skipCondition: (ctx) => {
+        if (!ctx.target.hasGit) {
+            return "Target is not a git repository; git-status-based read-only verification is not applicable. This does not imply the target was modified.";
+        }
+        if (!ctx.targetSnapshotBefore || !ctx.targetSnapshotBefore.hasGit) {
+            return "No pre-run git status snapshot was available for comparison.";
+        }
+        return undefined;
+    },
+    run: async (ctx) => {
+        const before = ctx.targetSnapshotBefore;
+        const after = captureTargetSnapshot(ctx.target.targetRoot, ctx.target.hasGit);
+        const diff = diffTargetSnapshots(before, after);
+        if (!diff.comparable) {
+            return {
+                status: "blocked",
+                confidence: "low",
+                evidence: [
+                    makeEvidence({
+                        kind: "skipped-tool",
+                        source: "git status --porcelain",
+                        confidence: "low",
+                        observedBehavior: diff.reason,
+                        expectedBehavior: "git status should be readable before and after the run for comparison.",
+                    }),
+                ],
+                recommendation: "Ensure git is available and the target is a valid git repository to enable this check.",
+            };
+        }
+        const newGeneratedArtifacts = diff.newEntries.filter((e) => isGeneratedArtifactPath(e.path));
+        const newOtherEntries = diff.newEntries.filter((e) => !isGeneratedArtifactPath(e.path));
+        const evidence = [];
+        if (diff.preExistingEntries.length > 0) {
+            evidence.push(makeEvidence({
+                kind: "observation",
+                source: "git status --porcelain (before)",
+                confidence: "high",
+                observedBehavior: `${diff.preExistingEntries.length} pre-existing dirty entr${diff.preExistingEntries.length === 1 ? "y" : "ies"} (not caused by this run).`,
+                rawPreview: diff.preExistingEntries.map((e) => `${e.code} ${e.path}`).join(", "),
+            }));
+        }
+        for (const entry of newGeneratedArtifacts.slice(0, 10)) {
+            evidence.push(makeEvidence({
+                kind: "target-modification",
+                source: "git status --porcelain (after)",
+                filePath: entry.path,
+                confidence: "high",
+                expectedBehavior: "Generated security artifacts must not be written inside the target working tree.",
+                observedBehavior: `New entry '${entry.code} ${entry.path}' appeared inside the target during validation.`,
+            }));
+        }
+        for (const entry of newOtherEntries.slice(0, 10)) {
+            evidence.push(makeEvidence({
+                kind: "target-modification",
+                source: "git status --porcelain (after)",
+                filePath: entry.path,
+                confidence: "high",
+                expectedBehavior: "Target tracked/untracked files must remain unchanged during validation.",
+                observedBehavior: `New entry '${entry.code} ${entry.path}' appeared inside the target during validation.`,
+            }));
+        }
+        if (newGeneratedArtifacts.length > 0 || newOtherEntries.length > 0) {
+            return {
+                status: "failed",
+                confidence: "high",
+                evidence,
+                category: "artifact-safety",
+                recommendation: newGeneratedArtifacts.length > 0
+                    ? "Generated security report/artifact directories must only be written under the tool's own output area, never inside the target project."
+                    : "Validation must be strictly read-only with respect to the target working tree.",
+            };
+        }
+        return {
+            status: "passed",
+            confidence: "high",
+            evidence,
+            category: "artifact-safety",
+        };
+    },
+};
+// Exposed for tests / reuse: default reportDir/rawOutputDir collision check
+// used by outputBoundaryScenario, kept here since it reasons about the same
+// "target boundary" concept.
+export function reportDirIsInsideExternalTarget(reportDir, targetRoot, isSelf) {
+    if (isSelf)
+        return false;
+    const resolvedReportDir = path.resolve(reportDir);
+    const resolvedTargetRoot = path.resolve(targetRoot);
+    const relative = path.relative(resolvedTargetRoot, resolvedReportDir);
+    return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}

package/dist/src/securityValidation/attackScenarios/targetSnapshot.js

@@ -0,0 +1,70 @@
+import { execSync } from "node:child_process";
+// Reads `git status --porcelain=v1` for targetRoot without mutating anything.
+// Returns hasGit:false (not a thrown error) when the target is not a git
+// repository or git is unavailable — callers must treat that as "unknown",
+// never as "crashed".
+export function captureTargetSnapshot(targetRoot, hasGit) {
+    const takenAt = new Date().toISOString();
+    if (!hasGit) {
+        return { targetRoot, takenAt, hasGit: false, unreadableReason: "Target is not a git repository." };
+    }
+    try {
+        const raw = execSync("git status --porcelain=v1", {
+            cwd: targetRoot,
+            encoding: "utf8",
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        const entries = parsePorcelainStatus(raw);
+        return { targetRoot, takenAt, hasGit: true, entries };
+    }
+    catch (err) {
+        return {
+            targetRoot,
+            takenAt,
+            hasGit: false,
+            unreadableReason: `git status failed: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+}
+function parsePorcelainStatus(raw) {
+    const entries = [];
+    for (const line of raw.split(/\r?\n/)) {
+        if (!line)
+            continue;
+        const code = line.slice(0, 2);
+        const rawPath = line.slice(3).trim();
+        // Renames report as "old -> new"; keep the new path for comparisons.
+        const filePath = rawPath.includes(" -> ") ? rawPath.split(" -> ")[1] : rawPath;
+        entries.push({ code, path: filePath });
+    }
+    // Stable, deterministic ordering independent of git's own output order.
+    return entries.sort((a, b) => a.path.localeCompare(b.path));
+}
+const GENERATED_ARTIFACT_PATTERNS = [
+    "reports/security/",
+    "reports/audits/",
+    ".my-dev-kit/",
+    "lab-output/",
+];
+export function isGeneratedArtifactPath(p) {
+    const normalized = p.replace(/\\/g, "/");
+    return (GENERATED_ARTIFACT_PATTERNS.some((pattern) => normalized.startsWith(pattern)) ||
+        /-security-validation\.(txt|json)$/i.test(normalized));
+}
+export function diffTargetSnapshots(before, after) {
+    if (!before.hasGit || !after.hasGit || !before.entries || !after.entries) {
+        return {
+            comparable: false,
+            reason: before.unreadableReason ?? after.unreadableReason ?? "git status was not available for comparison.",
+            newEntries: [],
+            preExistingEntries: [],
+        };
+    }
+    const beforeKeys = new Set(before.entries.map((e) => `${e.code}:${e.path}`));
+    const newEntries = after.entries.filter((e) => !beforeKeys.has(`${e.code}:${e.path}`));
+    return {
+        comparable: true,
+        newEntries,
+        preExistingEntries: before.entries,
+    };
+}

package/dist/src/securityValidation/packageChecks/forbiddenPackageContents.js

@@ -56,7 +56,10 @@ export function detectForbiddenContents(options) {
     }));
     return { matches, findings };
 }
-function isCriticalForbidden(file) {
+// Exported for reuse by packageBoundaryScenario.ts, which needs the same
+// critical/major distinction to set its AttackResult severity correctly
+// (v0.2.2 Batch 5).
+export function isCriticalForbidden(file) {
     const f = file.toLowerCase();
     return (f.includes(".env") ||
         f.endsWith(".pem") ||