@dailephd/my-dev-kit-lab 0.2.0 → 0.2.2

package/dist/src/securityValidation/report/renderSecurityReport.js

@@ -1,7 +1,16 @@
 import { verdictToHumanLabel } from "../validate/verdict.js";
+import { stripUnsafeControlChars } from "../attackScenarios/exploitEvidence.js";
 // ---------------------------------------------------------------------------
 // Human-readable text report
 // ---------------------------------------------------------------------------
+// v0.2.2 Batch 4 — sanitizes text-report content that may originate from
+// scanned source, target output, or an attack-scenario payload before it is
+// printed. Strips ANSI/control bytes (report-poisoning defense); preserves
+// ordinary whitespace. JSON output needs no equivalent helper — JSON.stringify
+// already escapes control characters by construction.
+export function sanitizeForTextReport(raw) {
+    return stripUnsafeControlChars(raw);
+}
 function pad(label, width = 36) {
     return label.padEnd(width, " ");
 }
@@ -24,7 +33,7 @@ function divider(char = "-", width = 72) {
 }
 export function renderTextReport(report) {
     const lines = [];
-    const { metadata, allChecks, allFindings, verdict, recommendedNextStep } = report;
+    const { metadata, allChecks, allFindings, verdict, recommendedNextStep, attackResults, verdictReasonSummary } = report;
     lines.push(divider("="));
     lines.push("SECURITY VALIDATION REPORT");
     lines.push(divider("="));
@@ -41,6 +50,23 @@ export function renderTextReport(report) {
     lines.push(`Commit     : ${metadata.commit}`);
     lines.push(`Generated  : ${metadata.generatedAt}`);
     lines.push(`Duration   : ${formatDuration(metadata.totalDurationMs)}`);
+    if (metadata.profile) {
+        lines.push(`Profile    : ${metadata.profile}`);
+    }
+    if (metadata.selectedChecks && metadata.selectedChecks.length > 0) {
+        lines.push(`Checks     : ${metadata.selectedChecks.join(", ")}`);
+    }
+    if (metadata.failOnThreshold) {
+        const breachNote = metadata.failOnBreached === true
+            ? " — BREACHED"
+            : metadata.failOnBreached === false
+                ? " — not breached"
+                : "";
+        lines.push(`Fail-on    : ${metadata.failOnThreshold}${breachNote}`);
+    }
+    if (metadata.isFullReleaseGate === false) {
+        lines.push(`Scope      : NARROWED — selected checks do not include the full classic release gate (deps, package, static, cli-adversarial, fuzz). This run does not represent full release readiness.`);
+    }
     lines.push("");
     // --- 1. Executive Summary ---
     lines.push(divider());
@@ -60,7 +86,7 @@ export function renderTextReport(report) {
                 lines.push(`  ${sev.padEnd(16)} : ${count}`);
         }
     }
-    lines.push(`Next step  : ${recommendedNextStep}`);
+    lines.push(`Next step  : ${sanitizeForTextReport(recommendedNextStep)}`);
     lines.push("");
     // --- Check sections ---
     const sectionDefs = [
@@ -72,7 +98,7 @@ export function renderTextReport(report) {
         { num: 7, title: "npm audit Result", ids: ["npm-audit-full", "npm-audit-runtime"] },
         { num: 8, title: "OSV-Scanner Result", ids: ["osv-scanner"] },
         { num: 9, title: "Package Tarball Inspection", ids: ["npm-pack-dry-run"] },
-        { num: 10, title: "File-System / Path Traversal Tests", ids: ["path-traversal-root", "path-traversal-out", "path-traversal-index", "absolute-path-escape", "path-harness-escape-detection"] },
+        { num: 10, title: "CLI / File-System / Path Traversal Tests", ids: ["cli-adversarial-suite", "path-traversal-root", "path-traversal-out", "path-traversal-index", "absolute-path-escape", "path-harness-escape-detection"] },
         { num: 11, title: "Source Read-Only Boundary Tests", ids: ["source-files-not-modified", "writes-limited-to-output", "index-write-containment", "artifact-cleanup-safe"] },
         { num: 12, title: "Graphviz / Subprocess Safety Tests", ids: ["graphviz-label-escaping", "subprocess-no-shell-interpolation"] },
         { num: 13, title: "JSON stdout/stderr Safety Tests", ids: ["json-mode-parseable-output", "stderr-not-in-stdout", "json-failure-error-object", "progress-not-in-json-stdout"] },
@@ -143,20 +169,98 @@ export function renderTextReport(report) {
             continue;
         }
         for (const check of sectionChecks) {
-            lines.push(`[${statusIcon(check.status)}] ${pad(check.name)} ${formatDuration(check.durationMs)}`);
+            lines.push(`[${statusIcon(check.status)}] ${pad(sanitizeForTextReport(check.name))} ${formatDuration(check.durationMs)}`);
+            if (check.command) {
+                lines.push(`       Command: ${check.command}`);
+            }
+            if (check.commandCwd) {
+                lines.push(`       Cwd: ${check.commandCwd}`);
+            }
+            if (check.exitCode !== undefined) {
+                lines.push(`       Exit code: ${String(check.exitCode)}`);
+            }
+            if (check.stdoutSummary) {
+                lines.push(`       Stdout: ${sanitizeForTextReport(check.stdoutSummary).slice(0, 200)}`);
+            }
+            if (check.stderrSummary) {
+                lines.push(`       Stderr: ${sanitizeForTextReport(check.stderrSummary).slice(0, 200)}`);
+            }
             if (check.status === "skipped" && check.skippedReason) {
-                lines.push(`       Reason: ${check.skippedReason}`);
+                lines.push(`       Reason: ${sanitizeForTextReport(check.skippedReason)}`);
             }
             if (check.findings.length > 0) {
                 for (const f of check.findings) {
-                    lines.push(`       [${f.severity.toUpperCase()}] ${f.title}`);
+                    lines.push(`       [${f.severity.toUpperCase()}] ${sanitizeForTextReport(f.title)}`);
                     if (f.description)
-                        lines.push(`              ${f.description.slice(0, 120)}`);
+                        lines.push(`              ${sanitizeForTextReport(f.description).slice(0, 120)}`);
+                }
+            }
+        }
+        lines.push("");
+    }
+    // --- Attack Scenario Framework (v0.2.2) ---
+    // Only rendered when the run selected attack-scenario-shaped checks.
+    // Batch 3 registered concrete scenarios for boundary/subprocess; secrets
+    // and network still resolve to an explicit "no scenarios registered"
+    // placeholder (scenarioId ending in "-no-scenarios-registered") — the
+    // pending-framework note is only shown when at least one such placeholder
+    // is present in this run, not unconditionally.
+    if (attackResults && attackResults.length > 0) {
+        const pendingResults = attackResults.filter((r) => r.scenarioId.endsWith("-no-scenarios-registered"));
+        const concreteResults = attackResults.filter((r) => !r.scenarioId.endsWith("-no-scenarios-registered"));
+        lines.push(divider());
+        lines.push("ATTACK SCENARIO FRAMEWORK (v0.2.2)");
+        lines.push(divider());
+        if (concreteResults.length > 0) {
+            lines.push(`${concreteResults.length} concrete attack scenario(s) executed.`);
+        }
+        if (pendingResults.length > 0) {
+            const pendingChecks = [...new Set(pendingResults.map((r) => r.checkId))].join(", ");
+            lines.push(`Concrete attack scenarios are still pending for: ${pendingChecks}. This is not evidence that those check groups are safe.`);
+        }
+        lines.push("");
+        for (const result of attackResults) {
+            lines.push(`[${statusIcon(result.status === "blocked" ? "failed" : result.status)}] ${pad(sanitizeForTextReport(result.scenarioTitle))} (check: ${result.checkId}, profile: ${result.profileId})`);
+            if (result.skippedReason) {
+                lines.push(`       Reason: ${sanitizeForTextReport(result.skippedReason)}`);
+            }
+            if (result.errorSummary) {
+                lines.push(`       Error: ${sanitizeForTextReport(result.errorSummary)}`);
+            }
+            if (result.recommendation) {
+                lines.push(`       Recommendation: ${sanitizeForTextReport(result.recommendation)}`);
+            }
+            if (result.evidence.length > 0) {
+                for (const e of result.evidence.slice(0, 10)) {
+                    const preview = e.redactedPreview ?? e.observedBehavior ?? "(no preview)";
+                    lines.push(`       [${e.kind}] ${sanitizeForTextReport(preview)}`);
+                }
+                if (result.evidence.length > 10) {
+                    lines.push(`       ... ${result.evidence.length - 10} more evidence item(s)`);
                 }
             }
         }
         lines.push("");
     }
+    // --- Verdict Reasoning (v0.2.2 Batch 5) ---
+    // Only rendered when the caller supplied the summary (additive; existing
+    // report construction that omits it is unaffected).
+    if (verdictReasonSummary) {
+        lines.push(divider());
+        lines.push("VERDICT REASONING (v0.2.2)");
+        lines.push(divider());
+        lines.push(`Release blockers          : ${verdictReasonSummary.releaseBlockerCount}`);
+        lines.push(`Target-project blockers   : ${verdictReasonSummary.targetProjectBlockerCount}`);
+        lines.push(`Tool-framework blockers   : ${verdictReasonSummary.toolFrameworkBlockerCount}`);
+        lines.push(`Environment inconclusive  : ${verdictReasonSummary.environmentInconclusiveCount}`);
+        lines.push(`Required evidence missing : ${verdictReasonSummary.requiredEvidenceMissingCount}`);
+        lines.push(`Scanner findings          : ${verdictReasonSummary.scannerFindingCount}`);
+        lines.push(`Adversarial scenario fail : ${verdictReasonSummary.adversarialScenarioFailureCount}`);
+        lines.push(`Adversarial scenario skip : ${verdictReasonSummary.adversarialScenarioSkippedCount}`);
+        lines.push(`Optional skipped tools    : ${verdictReasonSummary.optionalSkippedToolCount}`);
+        lines.push(`Informational evidence    : ${verdictReasonSummary.informationalEvidenceCount}`);
+        lines.push("");
+    }
     // --- 20. Findings by Severity ---
     lines.push(divider());
     lines.push("20. FINDINGS BY SEVERITY");
@@ -171,11 +275,11 @@ export function renderTextReport(report) {
                 continue;
             lines.push(`${sev.toUpperCase()} (${sevFindings.length}):`);
             for (const f of sevFindings) {
-                lines.push(`  [${f.id}] ${f.title}`);
+                lines.push(`  [${f.id}] ${sanitizeForTextReport(f.title)}`);
                 if (f.description)
-                    lines.push(`    ${f.description.slice(0, 120)}`);
+                    lines.push(`    ${sanitizeForTextReport(f.description).slice(0, 120)}`);
                 if (f.recommendation)
-                    lines.push(`    Recommendation: ${f.recommendation}`);
+                    lines.push(`    Recommendation: ${sanitizeForTextReport(f.recommendation)}`);
             }
         }
     }
@@ -190,7 +294,7 @@ export function renderTextReport(report) {
     lines.push(divider());
     lines.push("22. RECOMMENDED NEXT STEP");
     lines.push(divider());
-    lines.push(recommendedNextStep);
+    lines.push(sanitizeForTextReport(recommendedNextStep));
     lines.push("");
     lines.push(divider("="));
     return lines.join("\n");
@@ -199,7 +303,7 @@ export function renderTextReport(report) {
 // JSON report
 // ---------------------------------------------------------------------------
 export function renderJsonReport(report) {
-    const { metadata, allChecks, allFindings, verdict, recommendedNextStep } = report;
+    const { metadata, allChecks, allFindings, verdict, recommendedNextStep, attackResults, verdictReasonSummary } = report;
     const sanitizedChecks = allChecks.map((c) => ({
         id: c.id,
         name: c.name,
@@ -212,6 +316,10 @@ export function renderJsonReport(report) {
         findingCount: c.findings.length,
         skippedReason: c.skippedReason ?? null,
         command: c.command ?? null,
+        commandCwd: c.commandCwd ?? null,
+        exitCode: c.exitCode ?? null,
+        stdoutSummary: c.stdoutSummary ?? null,
+        stderrSummary: c.stderrSummary ?? null,
     }));
     const sanitizedFindings = allFindings.map((f) => ({
         id: f.id,
@@ -224,6 +332,33 @@ export function renderJsonReport(report) {
         recommendation: f.recommendation ?? undefined,
         releaseImpact: f.releaseImpact,
     }));
+    const sanitizedAttackResults = (attackResults ?? []).map((r) => ({
+        scenarioId: r.scenarioId,
+        scenarioTitle: r.scenarioTitle,
+        checkId: r.checkId,
+        profileId: r.profileId,
+        status: r.status,
+        severity: r.severity,
+        confidence: r.confidence,
+        category: r.category,
+        recommendation: r.recommendation ?? null,
+        skippedReason: r.skippedReason ?? null,
+        errorSummary: r.errorSummary ?? null,
+        evidence: r.evidence.map((e) => ({
+            id: e.id,
+            kind: e.kind,
+            source: e.source,
+            filePath: e.filePath ?? null,
+            line: e.line ?? null,
+            commandCwd: e.commandCwd ?? null,
+            commandSummary: e.commandSummary ?? null,
+            exitCode: e.exitCode ?? null,
+            expectedBehavior: e.expectedBehavior ?? null,
+            observedBehavior: e.observedBehavior ?? null,
+            redactedPreview: e.redactedPreview ?? null,
+            confidence: e.confidence,
+        })),
+    }));
     const output = {
         schemaVersion: 1,
         metadata,
@@ -237,12 +372,18 @@ export function renderJsonReport(report) {
             blockerFindings: allFindings.filter((f) => f.severity === "blocker").length,
             majorFindings: allFindings.filter((f) => f.severity === "major").length,
             minorFindings: allFindings.filter((f) => f.severity === "minor").length,
+            informationalFindings: allFindings.filter((f) => f.severity === "informational").length,
         },
         verdict,
         verdictLabel: verdictToHumanLabel(verdict),
         recommendedNextStep,
         checks: sanitizedChecks,
         findings: sanitizedFindings,
+        attackScenarios: {
+            count: sanitizedAttackResults.length,
+            results: sanitizedAttackResults,
+        },
+        verdictReasonSummary: verdictReasonSummary ?? null,
     };
     return JSON.stringify(output, null, 2);
 }

package/dist/src/securityValidation/types.js

@@ -32,3 +32,10 @@ export const SECURITY_CHECK_CATEGORIES = [
     "artifact-safety",
     "report-generation",
 ];
+export const VERDICT_IMPACTS = [
+    "release-blocker",
+    "target-project-blocker",
+    "tool-framework-blocker",
+    "adversarial-scenario-failure",
+    "informational-evidence",
+];

package/dist/src/securityValidation/validate/cliOptions.js

@@ -0,0 +1,182 @@
+import path from "node:path";
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 1 — security:validate command/config surface.
+//
+// This module parses and normalizes --checks, --profile, --format, --fail-on,
+// and --out. It intentionally does not implement attack scenarios, profile
+// behavior, or verdict-policy changes — those are later v0.2.2 batches. This
+// batch only builds a stable, extensible config surface.
+// ---------------------------------------------------------------------------
+export const SECURITY_CHECK_IDS = [
+    "deps",
+    "package",
+    "static",
+    "cli-adversarial",
+    "fuzz",
+    "boundary",
+    "subprocess",
+    "secrets",
+    "network",
+];
+// Checks with real behavior wired in Batch 1.
+export const IMPLEMENTED_SECURITY_CHECK_IDS = [
+    "deps",
+    "package",
+    "static",
+    "cli-adversarial",
+    "fuzz",
+];
+// Checks accepted as valid --checks values but not yet implemented. Selecting
+// one of these must never be reported as passed.
+export const PLANNED_SECURITY_CHECK_IDS = [
+    "boundary",
+    "subprocess",
+    "secrets",
+    "network",
+];
+export const DEFAULT_SECURITY_CHECKS = IMPLEMENTED_SECURITY_CHECK_IDS;
+export const SECURITY_PROFILE_IDS = ["node-cli-package", "local-tool", "npm-package"];
+export const DEFAULT_SECURITY_PROFILE = "node-cli-package";
+export const SECURITY_OUTPUT_FORMATS = ["text", "json"];
+export const DEFAULT_SECURITY_OUTPUT_FORMATS = ["text", "json"];
+// Distinct vocabulary from SecuritySeverity (blocker/major/minor/informational/skipped).
+// Batch 1 only carries this value through config; verdict-policy integration is later.
+export const SECURITY_FAIL_ON_THRESHOLDS = ["blocker", "high", "medium", "low"];
+export const DEFAULT_SECURITY_FAIL_ON_THRESHOLD = "blocker";
+const FLAGS_WITH_VALUE = {
+    "--target": "target",
+    "-t": "target",
+    "--out": "out",
+    "--report-prefix": "reportPrefix",
+    "--checks": "checks",
+    "--profile": "profile",
+    "--format": "format",
+    "--fail-on": "failOn",
+};
+export function parseSecurityValidateArgs(argv) {
+    const result = {};
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        const key = FLAGS_WITH_VALUE[arg];
+        if (!key)
+            continue;
+        if (i + 1 >= argv.length) {
+            throw new Error(`Missing value for ${arg}. Expected a value after ${arg}.`);
+        }
+        result[key] = argv[++i];
+    }
+    return result;
+}
+export function normalizeSecurityValidateConfig(raw, toolRoot) {
+    const checks = parseChecksOption(raw.checks);
+    const profile = parseProfileOption(raw.profile);
+    const formats = parseFormatOption(raw.format);
+    const failOn = parseFailOnOption(raw.failOn);
+    const out = raw.out !== undefined ? resolveOutDir(raw.out) : path.join(toolRoot, "reports", "security");
+    return {
+        target: raw.target,
+        out,
+        outWasDefault: raw.out === undefined,
+        reportPrefix: raw.reportPrefix,
+        checks: checks.value,
+        checksWereDefault: checks.wasDefault,
+        implementedChecks: checks.value.filter((c) => IMPLEMENTED_SECURITY_CHECK_IDS.includes(c)),
+        plannedChecksRequested: checks.value.filter((c) => PLANNED_SECURITY_CHECK_IDS.includes(c)),
+        profile: profile.value,
+        profileWasDefault: profile.wasDefault,
+        formats: formats.value,
+        formatsWereDefault: formats.wasDefault,
+        failOnThreshold: failOn.value,
+        failOnWasDefault: failOn.wasDefault,
+    };
+}
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 5 — profile-aware default checks
+// ---------------------------------------------------------------------------
+// Applies a profile's declared default check ids when the user provided
+// --profile but omitted --checks. Deliberately takes the profile's
+// defaultCheckIds as a plain parameter rather than importing
+// attackScenarios/attackProfile.ts here — that module already imports this
+// one (SecurityProfileId/SECURITY_PROFILE_IDS), so importing it back would
+// create a circular import. Callers (scripts/security/validate.ts) resolve
+// the profile definition via resolveAttackProfile() and pass its
+// defaultCheckIds in.
+//
+// No-op (returns config unchanged) unless BOTH:
+//   - the user did not pass --checks (checksWereDefault), AND
+//   - the user did pass --profile (profileWasDefault === false)
+// This guarantees the true no-flag case (no --profile, no --checks) and any
+// explicit --checks case are always unaffected.
+export function applyProfileDefaultChecksIfApplicable(config, profileDefaultCheckIds) {
+    if (!config.checksWereDefault || config.profileWasDefault) {
+        return config;
+    }
+    const uniqueRequested = new Set(profileDefaultCheckIds);
+    const ordered = SECURITY_CHECK_IDS.filter((id) => uniqueRequested.has(id));
+    return {
+        ...config,
+        checks: ordered,
+        implementedChecks: ordered.filter((c) => IMPLEMENTED_SECURITY_CHECK_IDS.includes(c)),
+        plannedChecksRequested: ordered.filter((c) => PLANNED_SECURITY_CHECK_IDS.includes(c)),
+    };
+}
+function splitAndNormalizeList(raw, flagName) {
+    const parts = raw.split(",").map((p) => p.trim());
+    if (parts.some((p) => p.length === 0)) {
+        throw new Error(`Invalid ${flagName} value: empty entries are not allowed. Got "${raw}".`);
+    }
+    return parts;
+}
+function parseChecksOption(raw) {
+    if (raw === undefined) {
+        return { value: [...DEFAULT_SECURITY_CHECKS], wasDefault: true };
+    }
+    const parts = splitAndNormalizeList(raw, "--checks");
+    const invalid = parts.filter((p) => !SECURITY_CHECK_IDS.includes(p));
+    if (invalid.length > 0) {
+        throw new Error(`Invalid --checks value(s): ${invalid.join(", ")}. Valid values are: ${SECURITY_CHECK_IDS.join(", ")}.`);
+    }
+    const unique = new Set(parts);
+    const ordered = SECURITY_CHECK_IDS.filter((id) => unique.has(id));
+    return { value: ordered, wasDefault: false };
+}
+function parseProfileOption(raw) {
+    if (raw === undefined) {
+        return { value: DEFAULT_SECURITY_PROFILE, wasDefault: true };
+    }
+    const value = raw.trim();
+    if (!SECURITY_PROFILE_IDS.includes(value)) {
+        throw new Error(`Invalid --profile value: "${raw}". Valid values are: ${SECURITY_PROFILE_IDS.join(", ")}.`);
+    }
+    return { value: value, wasDefault: false };
+}
+function parseFormatOption(raw) {
+    if (raw === undefined) {
+        return { value: [...DEFAULT_SECURITY_OUTPUT_FORMATS], wasDefault: true };
+    }
+    const parts = splitAndNormalizeList(raw, "--format");
+    const invalid = parts.filter((p) => !SECURITY_OUTPUT_FORMATS.includes(p));
+    if (invalid.length > 0) {
+        throw new Error(`Invalid --format value(s): ${invalid.join(", ")}. Valid values are: ${SECURITY_OUTPUT_FORMATS.join(", ")}.`);
+    }
+    const unique = new Set(parts);
+    const ordered = SECURITY_OUTPUT_FORMATS.filter((id) => unique.has(id));
+    return { value: ordered, wasDefault: false };
+}
+function parseFailOnOption(raw) {
+    if (raw === undefined) {
+        return { value: DEFAULT_SECURITY_FAIL_ON_THRESHOLD, wasDefault: true };
+    }
+    const value = raw.trim();
+    if (!SECURITY_FAIL_ON_THRESHOLDS.includes(value)) {
+        throw new Error(`Invalid --fail-on value: "${raw}". Valid values are: ${SECURITY_FAIL_ON_THRESHOLDS.join(", ")}.`);
+    }
+    return { value: value, wasDefault: false };
+}
+function resolveOutDir(raw) {
+    const trimmed = raw.trim();
+    if (trimmed.length === 0) {
+        throw new Error("Invalid --out value: path must not be empty.");
+    }
+    return path.resolve(trimmed);
+}

package/dist/src/securityValidation/validate/runCliSecuritySuiteCheck.js

@@ -0,0 +1,124 @@
+import { runSecurityCommand, resolveNpmCommand } from "../commandRunner.js";
+export async function runCliSecuritySuiteCheck(options) {
+    const startedAt = new Date().toISOString();
+    if (!options.target.isSelf && !options.target.hasPackageJson) {
+        const finishedAt = new Date().toISOString();
+        return {
+            id: "cli-adversarial-suite",
+            name: "Target security test suite",
+            category: "cli-adversarial",
+            status: "failed",
+            severity: "major",
+            startedAt,
+            finishedAt,
+            durationMs: 0,
+            command: "npm run test:security",
+            commandCwd: options.target.targetRoot,
+            exitCode: null,
+            findings: [
+                {
+                    id: "target-security-suite-missing-package-json",
+                    title: "Target package.json is missing",
+                    severity: "major",
+                    category: "cli-adversarial",
+                    description: "Target-aware security suite validation requires a package.json at the target root.",
+                    recommendation: "Add a package.json with a test:security script or validate a package-based target.",
+                    releaseImpact: "Should fix before release",
+                },
+            ],
+        };
+    }
+    if (!options.target.isSelf && !options.target.hasSecurityTestScript) {
+        const finishedAt = new Date().toISOString();
+        return {
+            id: "cli-adversarial-suite",
+            name: "Target security test suite",
+            category: "cli-adversarial",
+            status: "failed",
+            severity: "major",
+            startedAt,
+            finishedAt,
+            durationMs: 0,
+            command: "npm run test:security",
+            commandCwd: options.target.targetRoot,
+            exitCode: null,
+            findings: [
+                {
+                    id: "target-security-suite-missing-script",
+                    title: "Target test:security script is missing",
+                    severity: "major",
+                    category: "cli-adversarial",
+                    description: "The target package.json does not define scripts.test:security, so the target security suite could not be validated.",
+                    recommendation: "Add a target test:security script and rerun security:validate.",
+                    releaseImpact: "Should fix before release",
+                },
+            ],
+        };
+    }
+    const npm = resolveNpmCommand();
+    const isSelf = options.target.isSelf;
+    const commandCwd = isSelf ? options.toolRoot : options.target.targetRoot;
+    const cmd = await runSecurityCommand({
+        command: npm,
+        args: ["run", "test:security"],
+        cwd: commandCwd,
+        timeoutMs: Math.min(options.timeoutMs * 3, 180_000),
+    });
+    const finishedAt = new Date().toISOString();
+    const passed = cmd.exitCode === 0;
+    const name = isSelf
+        ? "CLI adversarial test suite (tool self-tests)"
+        : "Target security test suite";
+    return {
+        id: "cli-adversarial-suite",
+        name,
+        category: "cli-adversarial",
+        status: passed ? "passed" : "failed",
+        severity: "major",
+        startedAt,
+        finishedAt,
+        durationMs: cmd.durationMs,
+        findings: passed
+            ? []
+            : [
+                {
+                    id: "cli-adversarial-suite-failed",
+                    title: isSelf ? "CLI adversarial test suite had failures" : "Target test:security script failed",
+                    severity: "major",
+                    category: "cli-adversarial",
+                    description: isSelf
+                        ? `Tool-root test:security exited with code ${String(cmd.exitCode)}.`
+                        : `Target-root test:security exited with code ${String(cmd.exitCode)}.`,
+                    evidence: buildEvidence(cmd),
+                    recommendation: isSelf
+                        ? "Fix failing tool security tests before release."
+                        : "Fix the target test:security failure and rerun security:validate.",
+                    releaseImpact: "Should fix before release",
+                },
+            ],
+        command: `${npm} run test:security`,
+        commandCwd,
+        exitCode: cmd.exitCode,
+        stdoutSummary: summarizeOutput(cmd.stdout),
+        stderrSummary: summarizeOutput(cmd.stderr),
+    };
+}
+function summarizeOutput(value) {
+    const normalized = value.replace(/\r\n/g, "\n").trim();
+    if (!normalized) {
+        return undefined;
+    }
+    return normalized.slice(0, 500);
+}
+function buildEvidence(cmd) {
+    const parts = [`cwd=${cmd.cwd}`, `exitCode=${String(cmd.exitCode)}`];
+    const stdoutSummary = summarizeOutput(cmd.stdout);
+    const stderrSummary = summarizeOutput(cmd.stderr);
+    if (stdoutSummary) {
+        parts.push(`stdout=${stdoutSummary}`);
+    }
+    if (stderrSummary) {
+        parts.push(`stderr=${stderrSummary}`);
+    }
+    return parts.join(" | ");
+}