@dailephd/my-dev-kit-lab 0.2.1 → 0.2.2

package/dist/src/securityValidation/attackScenarios/exploitEvidence.js

@@ -0,0 +1,69 @@
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 2 — exploit evidence model.
+//
+// Evidence attached to an AttackResult. Kept small and JSON-serializable by
+// construction (no functions, no circular references, no raw Buffers).
+// Redaction helpers here must never leak full secret-like values into
+// reports; only bounded, redacted previews are stored.
+// ---------------------------------------------------------------------------
+export const EXPLOIT_EVIDENCE_KINDS = [
+    "command",
+    "filesystem",
+    "output",
+    "target-modification",
+    "secret-leak",
+    "package-content",
+    "skipped-tool",
+    "skipped-scenario",
+    "observation",
+];
+const MAX_PREVIEW_LENGTH = 200;
+// Patterns for common secret-like tokens. Deliberately conservative — false
+// positives (over-redacting) are safe; false negatives are not.
+const SECRET_LIKE_PATTERNS = [
+    /sk-[a-zA-Z0-9]{16,}/g,
+    /gh[pousr]_[a-zA-Z0-9]{16,}/g,
+    /AKIA[0-9A-Z]{12,}/g,
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+    /[A-Za-z0-9_\-]{32,}/g,
+];
+// ANSI CSI sequences (color codes, cursor movement, etc.) and other C0/DEL
+// control bytes. Newline/carriage-return/tab are preserved — they're
+// structural whitespace, not a terminal-rewriting risk.
+const ANSI_CSI_PATTERN = /\x1b\[[0-9;]*[a-zA-Z]/g;
+const OTHER_CONTROL_CHARS_PATTERN = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
+// Strips ANSI escape sequences and other unsafe control bytes. Applied
+// before secret redaction so a payload cannot use control characters to
+// hide from the secret-pattern matchers.
+export function stripUnsafeControlChars(raw) {
+    return raw.replace(ANSI_CSI_PATTERN, "").replace(OTHER_CONTROL_CHARS_PATTERN, "");
+}
+// Redacts secret-looking substrings and terminal control sequences, and
+// truncates to a bounded preview. Never returns the full original value when
+// it is long, matches a secret-like pattern, or contains unsafe control
+// bytes (e.g. ANSI escapes from a report-poisoning payload).
+export function redactPreview(raw, maxLength = MAX_PREVIEW_LENGTH) {
+    let redacted = stripUnsafeControlChars(raw);
+    for (const pattern of SECRET_LIKE_PATTERNS) {
+        redacted = redacted.replace(pattern, (match) => `[REDACTED:${match.length}chars]`);
+    }
+    if (redacted.length > maxLength) {
+        return `${redacted.slice(0, maxLength)}... [truncated, ${raw.length} chars total]`;
+    }
+    return redacted;
+}
+let evidenceCounter = 0;
+// Deterministic-enough id generator for evidence created within a single
+// process run (report rendering does not depend on global uniqueness).
+export function nextEvidenceId(prefix) {
+    evidenceCounter += 1;
+    return `${prefix}-${evidenceCounter}`;
+}
+export function makeEvidence(partial) {
+    const { rawPreview, ...rest } = partial;
+    return {
+        id: nextEvidenceId(partial.kind),
+        ...rest,
+        redactedPreview: rawPreview !== undefined ? redactPreview(rawPreview) : undefined,
+    };
+}

package/dist/src/securityValidation/attackScenarios/profiles/localToolProfile.js

@@ -0,0 +1,10 @@
+export const LOCAL_TOOL_PROFILE = {
+    id: "local-tool",
+    label: "Local tool",
+    description: "Profile for a tool that is only ever run locally and is not published to a registry — package-content and npm-publish-shaped checks are less relevant, boundary/subprocess checks still matter.",
+    defaultCheckIds: ["deps", "static", "cli-adversarial", "fuzz"],
+    applicableCheckIds: ["deps", "static", "cli-adversarial", "fuzz", "boundary", "subprocess", "secrets", "network"],
+    scenarioGroups: ["boundary", "subprocess", "secrets", "network"],
+    mandatoryEvidenceCategories: ["command", "filesystem"],
+    skippedWording: "planned for a later v0.2.2 batch",
+};

package/dist/src/securityValidation/attackScenarios/profiles/nodeCliPackageProfile.js

@@ -0,0 +1,20 @@
+export const NODE_CLI_PACKAGE_PROFILE = {
+    id: "node-cli-package",
+    label: "Node CLI package",
+    description: "Default profile for a published Node.js CLI/package like my-dev-kit itself: local-first, deterministic, read-only with respect to user source.",
+    defaultCheckIds: ["deps", "package", "static", "cli-adversarial", "fuzz"],
+    applicableCheckIds: [
+        "deps",
+        "package",
+        "static",
+        "cli-adversarial",
+        "fuzz",
+        "boundary",
+        "subprocess",
+        "secrets",
+        "network",
+    ],
+    scenarioGroups: ["boundary", "subprocess", "secrets", "network"],
+    mandatoryEvidenceCategories: ["command", "filesystem", "output"],
+    skippedWording: "planned for a later v0.2.2 batch",
+};

package/dist/src/securityValidation/attackScenarios/profiles/npmPackageProfile.js

@@ -0,0 +1,10 @@
+export const NPM_PACKAGE_PROFILE = {
+    id: "npm-package",
+    label: "npm package",
+    description: "Profile for a general published npm package (not necessarily a CLI) — emphasizes package-content, dependency, and secret-leakage checks over CLI-argument-shaped adversarial tests.",
+    defaultCheckIds: ["deps", "package", "static"],
+    applicableCheckIds: ["deps", "package", "static", "cli-adversarial", "fuzz", "boundary", "secrets", "network"],
+    scenarioGroups: ["boundary", "secrets", "network"],
+    mandatoryEvidenceCategories: ["package-content", "secret-leak"],
+    skippedWording: "planned for a later v0.2.2 batch",
+};

package/dist/src/securityValidation/attackScenarios/reportSchemaGuard.js

@@ -0,0 +1,41 @@
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 6 — report-poisoning JSON schema guard.
+//
+// Batch 3/4 scenarios (configInjectionScenario, reportPoisoningScenario)
+// each hardcoded their own "expected top-level JSON keys" allowlist to
+// detect payload-created structural injection. That approach broke twice
+// (Batch 4, Batch 5) purely because a *legitimate* additive top-level field
+// was introduced elsewhere and nobody remembered to update both copies of
+// the list.
+//
+// This module replaces the hardcoded-allowlist approach with a baseline
+// comparison: render the same report shape twice — once with an inert
+// placeholder string in the content fields a payload would occupy, once
+// with the actual payload — and compare the top-level key *sets* of the
+// parsed JSON. A payload can only produce an "extra" key if it actually broke
+// out of its string context and created new JSON structure; legitimate
+// schema evolution (a new field added to renderJsonReport's output) shows up
+// identically in both renders and is never flagged. This keeps the
+// injection check meaningful without hardcoding field names anywhere.
+// ---------------------------------------------------------------------------
+// Inert content used for the "clean" baseline render — deliberately boring,
+// never matches any payload shape.
+export const SAFE_BASELINE_CONTENT = "SAFE_BASELINE_CONTENT_NOT_A_PAYLOAD";
+// Compares the top-level key sets of two already-rendered JSON strings
+// (baseline vs. candidate). Returns parseable:false (and no injected keys)
+// if either fails to parse — a parse failure is reported separately by
+// callers as "jsonCorrupted", not conflated with structural injection.
+export function detectJsonStructuralInjection(baselineJson, candidateJson) {
+    let baseline;
+    let candidate;
+    try {
+        baseline = JSON.parse(baselineJson);
+        candidate = JSON.parse(candidateJson);
+    }
+    catch {
+        return { parseable: false, injectedTopLevelKeys: [] };
+    }
+    const baselineKeys = new Set(Object.keys(baseline));
+    const injectedTopLevelKeys = Object.keys(candidate).filter((k) => !baselineKeys.has(k));
+    return { parseable: true, injectedTopLevelKeys };
+}

package/dist/src/securityValidation/attackScenarios/scenarios/configInjectionScenario.js

@@ -0,0 +1,144 @@
+import { makeEvidence } from "../exploitEvidence.js";
+import { getPayloadsForGroup } from "../payloadCorpus.js";
+import { normalizeSecurityValidateConfig } from "../../validate/cliOptions.js";
+import { renderJsonReport, renderTextReport } from "../../report/renderSecurityReport.js";
+import { SAFE_BASELINE_CONTENT, detectJsonStructuralInjection } from "../reportSchemaGuard.js";
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 3 — config injection scenario.
+//
+// Two parts, using the Batch 2 "malformed-config" and "report-poisoning"
+// payload groups:
+//  1. Confirms malformed values for --checks/--profile/--format/--fail-on are
+//     rejected by normalizeSecurityValidateConfig() (Batch 1) rather than
+//     silently accepted or partially applied.
+//  2. Confirms JSON-breakout / ANSI-escape style strings embedded in report
+//     content (e.g. via a check name or skip reason) do not corrupt
+//     renderJsonReport()'s output (still valid, parseable JSON) or crash
+//     renderTextReport().
+// ---------------------------------------------------------------------------
+function makeFixtureReport(injected) {
+    const now = new Date().toISOString();
+    return {
+        metadata: {
+            toolRoot: "/tool/root",
+            toolPackageName: "my-dev-kit-lab",
+            toolPackageVersion: "0.2.1",
+            targetRoot: "/tool/root",
+            targetDescription: "self (my-dev-kit-lab)",
+            packageName: "my-dev-kit-lab",
+            packageVersion: "0.2.1",
+            branch: injected,
+            commit: "abc1234",
+            isSelf: true,
+            generatedAt: now,
+            totalDurationMs: 1,
+        },
+        sections: [],
+        allChecks: [
+            {
+                id: "config-injection-fixture",
+                name: injected,
+                category: "artifact-safety",
+                status: "skipped",
+                severity: "skipped",
+                startedAt: now,
+                finishedAt: now,
+                durationMs: 0,
+                findings: [],
+                skippedReason: injected,
+            },
+        ],
+        allFindings: [],
+        verdict: "ready-except-optional-manual-checks",
+        recommendedNextStep: injected,
+    };
+}
+export const CONFIG_INJECTION_SCENARIO = {
+    id: "config-injection-safety",
+    title: "Config injection: malformed CLI config is rejected; injected content cannot corrupt reports",
+    description: "Confirms malformed --checks/--profile/--format/--fail-on values fail cleanly via normalizeSecurityValidateConfig(), and that JSON-breakout/ANSI-escape strings embedded in report content do not corrupt JSON output or crash text rendering.",
+    checkId: "boundary",
+    applicableProfiles: [],
+    severityBaseline: "major",
+    verdictImpact: "tool-framework-blocker",
+    expectedSafeBehavior: "Malformed config values always throw before any validation runs; injected content in report fields never breaks JSON parseability or text rendering.",
+    evidenceRequirements: ["observation", "output"],
+    run: async (ctx) => {
+        const evidence = [];
+        const notRejected = [];
+        const malformedPayloads = getPayloadsForGroup("malformed-config");
+        const flagsToTest = ["checks", "profile", "format", "failOn"];
+        for (const payload of malformedPayloads) {
+            for (const flag of flagsToTest) {
+                let rejected = false;
+                try {
+                    normalizeSecurityValidateConfig({ [flag]: payload.value }, ctx.toolRoot);
+                }
+                catch {
+                    rejected = true;
+                }
+                if (!rejected) {
+                    notRejected.push(`${flag}=${payload.id}`);
+                }
+            }
+        }
+        evidence.push(makeEvidence({
+            kind: "observation",
+            source: "normalizeSecurityValidateConfig()",
+            confidence: "high",
+            expectedBehavior: `All ${malformedPayloads.length * flagsToTest.length} malformed (payload, flag) combinations must throw.`,
+            observedBehavior: notRejected.length === 0
+                ? "All malformed combinations were rejected."
+                : `${notRejected.length} combination(s) were NOT rejected.`,
+        }));
+        const poisoningPayloads = getPayloadsForGroup("report-poisoning");
+        const baselineJson = renderJsonReport(makeFixtureReport(SAFE_BASELINE_CONTENT));
+        let jsonCorrupted = false;
+        let textCrashed = false;
+        for (const payload of poisoningPayloads) {
+            const report = makeFixtureReport(payload.value);
+            try {
+                const json = renderJsonReport(report);
+                // Baseline-diff check (v0.2.2 Batch 6): a payload can only widen the
+                // top-level JSON shape by actually breaking out of its string
+                // context — legitimate additive schema fields render identically in
+                // both the baseline and poisoned renders and are never flagged.
+                const injection = detectJsonStructuralInjection(baselineJson, json);
+                if (!injection.parseable || injection.injectedTopLevelKeys.length > 0) {
+                    jsonCorrupted = true;
+                }
+            }
+            catch {
+                jsonCorrupted = true;
+            }
+            try {
+                renderTextReport(report);
+            }
+            catch {
+                textCrashed = true;
+            }
+        }
+        evidence.push(makeEvidence({
+            kind: "output",
+            source: "renderJsonReport() / renderTextReport() with report-poisoning payloads",
+            confidence: "high",
+            expectedBehavior: "JSON stays parseable with no extra top-level keys; text rendering never throws.",
+            observedBehavior: `jsonCorrupted=${jsonCorrupted}, textCrashed=${textCrashed}`,
+        }));
+        if (notRejected.length > 0 || jsonCorrupted || textCrashed) {
+            return {
+                status: "failed",
+                confidence: "high",
+                evidence,
+                recommendation: notRejected.length > 0
+                    ? "Ensure normalizeSecurityValidateConfig() validates every enum flag against its known-value list."
+                    : "Ensure report rendering treats all field content as opaque data (JSON.stringify already does this by construction).",
+            };
+        }
+        return {
+            status: "passed",
+            confidence: "high",
+            evidence,
+        };
+    },
+};

package/dist/src/securityValidation/attackScenarios/scenarios/networkAssumptionScenario.js

@@ -0,0 +1,129 @@
+import { makeEvidence } from "../exploitEvidence.js";
+import { collectBoundedSourceFiles, lineNumberAt } from "../boundedSourceScan.js";
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 4 — network / local-first assumption scenario.
+//
+// Careful, narrow claim only: a bounded static scan of local-first source
+// paths (manifests, src/, scripts/) finding no obvious unexpected network-API
+// usage. This is NOT proof of runtime network isolation — subprocess-invoked
+// tools (npm audit/outdated, OSV-Scanner, Semgrep's npx fallback) legitimately
+// contact the network when those check groups are selected, and this
+// scenario does not and cannot verify their runtime behavior. No network
+// calls, probes, or instrumentation are performed by this scenario itself.
+// ---------------------------------------------------------------------------
+const NETWORK_API_PATTERNS = [
+    { id: "fetch-call", regex: /\bfetch\s*\(/g },
+    { id: "http-module-import", regex: /(?:require\(\s*["']https?["']\s*\)|from\s+["']https?["'])/g },
+    { id: "net-tls-module-import", regex: /(?:require\(\s*["'](?:net|tls)["']\s*\)|from\s+["'](?:net|tls)["'])/g },
+    { id: "axios-import", regex: /(?:require\(\s*["']axios["']\s*\)|from\s+["']axios["'])/g },
+    { id: "got-import", regex: /(?:require\(\s*["']got["']\s*\)|from\s+["']got["'])/g },
+    { id: "request-import", regex: /(?:require\(\s*["']request["']\s*\)|from\s+["']request["'])/g },
+    { id: "undici-import", regex: /(?:require\(\s*["']undici["']\s*\)|from\s+["']undici["'])/g },
+    { id: "node-fetch-import", regex: /(?:require\(\s*["']node-fetch["']\s*\)|from\s+["']node-fetch["'])/g },
+    { id: "websocket-usage", regex: /new\s+WebSocket\s*\(/g },
+];
+// Paths where network-touching behavior is expected and intentional (they
+// shell out to npm/OSV-Scanner/etc, not a local-first-source violation).
+const KNOWN_NETWORK_INTENTIONAL_PREFIXES = [
+    "src/securityValidation/dependencies/",
+    "src/securityValidation/staticScans/",
+];
+function isKnownIntentionalPath(relativePath) {
+    return KNOWN_NETWORK_INTENTIONAL_PREFIXES.some((p) => relativePath.startsWith(p));
+}
+function scanFileForNetworkApis(relativePath, content) {
+    const matches = [];
+    const intentional = isKnownIntentionalPath(relativePath);
+    for (const { id, regex } of NETWORK_API_PATTERNS) {
+        const re = new RegExp(regex.source, regex.flags);
+        let match;
+        while ((match = re.exec(content)) !== null) {
+            if (match[0].length === 0) {
+                re.lastIndex += 1;
+                continue;
+            }
+            matches.push({ id, file: relativePath, line: lineNumberAt(content, match.index), intentional });
+        }
+    }
+    return matches;
+}
+export const NETWORK_ASSUMPTION_SCENARIO = {
+    id: "network-local-first-bounded-scan",
+    title: "Network assumption: bounded static scan finds no unexpected network API usage in local-first source",
+    description: "Bounded static scan of local-first source paths (manifests, src/, scripts/) for obvious network API usage (fetch/http/https/net/tls/axios/got/request/undici/node-fetch/WebSocket). Known network-using validation commands (npm audit, npm outdated, OSV-Scanner) are treated as expected, not violations. This does not prove runtime network isolation.",
+    checkId: "network",
+    applicableProfiles: [],
+    severityBaseline: "informational",
+    verdictImpact: "target-project-blocker",
+    expectedSafeBehavior: "No obvious unexpected network API usage is found in the bounded local-first source paths inspected.",
+    evidenceRequirements: ["observation"],
+    run: async (ctx) => {
+        const files = collectBoundedSourceFiles(ctx.target.targetRoot);
+        const isolationCaveat = makeEvidence({
+            kind: "observation",
+            source: "scope statement",
+            confidence: "high",
+            expectedBehavior: "This is a bounded static check of local-first source paths only. It does not prove runtime network isolation of subprocess-invoked tools (npm, CodeQL, Semgrep, OSV-Scanner) or any other process spawned during validation.",
+            observedBehavior: "Static-source-only claim; no runtime network instrumentation was performed.",
+        });
+        if (files.length === 0) {
+            return {
+                status: "passed",
+                confidence: "low",
+                evidence: [
+                    isolationCaveat,
+                    makeEvidence({
+                        kind: "observation",
+                        source: "bounded network scan file collection",
+                        confidence: "low",
+                        expectedBehavior: "At least one file would be scanned for a meaningful bounded-scan claim.",
+                        observedBehavior: "0 files matched the bounded glob set. No findings because there was nothing to scan.",
+                    }),
+                ],
+            };
+        }
+        const allMatches = [];
+        for (const file of files) {
+            allMatches.push(...scanFileForNetworkApis(file.relativePath, file.content));
+        }
+        allMatches.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
+        const unexpected = allMatches.filter((m) => !m.intentional);
+        const intentional = allMatches.filter((m) => m.intentional);
+        const evidence = [
+            isolationCaveat,
+            makeEvidence({
+                kind: "observation",
+                source: "bounded network API scan",
+                confidence: "medium",
+                expectedBehavior: "Bounded scan of manifests/src/scripts for direct network API usage.",
+                observedBehavior: `${files.length} file(s) scanned; ${unexpected.length} unexpected match(es), ${intentional.length} known-intentional match(es).`,
+            }),
+            makeEvidence({
+                kind: "observation",
+                source: "known network-using validation commands",
+                confidence: "high",
+                expectedBehavior: "npm audit / npm outdated (deps check) may contact the npm registry; OSV-Scanner may contact the OSV API; Semgrep's npx fallback may contact the npm registry. These are expected when those check groups are selected via --checks and are not local-first source violations.",
+                observedBehavior: `${intentional.length} match(es) found under known network-using paths (${KNOWN_NETWORK_INTENTIONAL_PREFIXES.join(", ")}).`,
+            }),
+            ...unexpected.slice(0, 20).map((m) => makeEvidence({
+                kind: "observation",
+                source: `pattern '${m.id}'`,
+                filePath: m.file,
+                line: m.line,
+                confidence: "medium",
+                expectedBehavior: "No unexpected direct network API usage in local-first source paths.",
+                observedBehavior: `Detected '${m.id}' usage in ${m.file}:${m.line}.`,
+            })),
+        ];
+        if (unexpected.length > 0) {
+            return {
+                status: "failed",
+                confidence: "medium",
+                evidence,
+                severity: "major",
+                recommendation: `Review ${unexpected.length} unexpected network-API usage(s) in local-first source paths and confirm they are intentional, or move them under a clearly network-using module.`,
+            };
+        }
+        return { status: "passed", confidence: "medium", evidence };
+    },
+};

package/dist/src/securityValidation/attackScenarios/scenarios/outputBoundaryScenario.js

@@ -0,0 +1,69 @@
+import path from "node:path";
+import { makeEvidence } from "../exploitEvidence.js";
+import { getPayloadsForGroup } from "../payloadCorpus.js";
+import { reportDirIsInsideExternalTarget } from "./targetSandboxScenario.js";
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 3 — output/generated-artifact boundary scenario.
+//
+// Two parts:
+//  1. A real safety check: does the *default* (no --out) report output
+//     directory resolve inside an external target's working tree? That is
+//     the one genuinely dangerous default-behavior case (Batch 1/2 already
+//     made --out itself user-directed and unrestricted by design, so an
+//     explicit --out escaping is not itself a finding here).
+//  2. Deterministic, non-destructive classification of the "output-boundary"
+//     payload corpus (paths with spaces, relative, absolute, home-dir) to
+//     produce evidence that path resolution behaves predictably — this does
+//     not write any files.
+// ---------------------------------------------------------------------------
+export const OUTPUT_BOUNDARY_SCENARIO = {
+    id: "output-boundary-report-dir",
+    title: "Output boundary: generated reports are not written inside an external target",
+    description: "Confirms the default report output directory does not resolve inside an external target's working tree, and classifies output-boundary payload path resolution without writing any files.",
+    checkId: "boundary",
+    applicableProfiles: [],
+    severityBaseline: "major",
+    verdictImpact: "release-blocker",
+    expectedSafeBehavior: "The default report output directory resolves outside any external target's working tree; payload path resolution is deterministic.",
+    evidenceRequirements: ["filesystem", "observation"],
+    run: async (ctx) => {
+        const evidence = [];
+        const insideTarget = reportDirIsInsideExternalTarget(ctx.config.reportDir, ctx.target.targetRoot, ctx.target.isSelf);
+        evidence.push(makeEvidence({
+            kind: "filesystem",
+            source: "default report output directory",
+            filePath: path.resolve(ctx.config.reportDir),
+            confidence: "high",
+            expectedBehavior: "Default report output directory must not resolve inside an external target project.",
+            observedBehavior: ctx.target.isSelf
+                ? "Self-validation: report directory is expected to be under the tool root."
+                : insideTarget
+                    ? `Report directory resolves inside external target root '${ctx.target.targetRoot}'.`
+                    : `Report directory resolves outside external target root '${ctx.target.targetRoot}'.`,
+        }));
+        const payloads = getPayloadsForGroup("output-boundary");
+        for (const p of payloads) {
+            const resolved = path.resolve(ctx.toolRoot, p.value);
+            evidence.push(makeEvidence({
+                kind: "observation",
+                source: `output-boundary payload '${p.id}'`,
+                confidence: "medium",
+                observedBehavior: `Resolved deterministically without any file write.`,
+                rawPreview: `${p.value} -> ${resolved}`,
+            }));
+        }
+        if (insideTarget) {
+            return {
+                status: "failed",
+                confidence: "high",
+                evidence,
+                recommendation: "Ensure the default report output directory is derived from the tool root, not the target root, for external-target validation.",
+            };
+        }
+        return {
+            status: "passed",
+            confidence: "high",
+            evidence,
+        };
+    },
+};

package/dist/src/securityValidation/attackScenarios/scenarios/packageBoundaryScenario.js

@@ -0,0 +1,118 @@
+import { makeEvidence } from "../exploitEvidence.js";
+import { runSecurityCommand, resolveNpmCommand } from "../../commandRunner.js";
+import { parseNpmPackDryRun } from "../../packageChecks/parseNpmPackDryRun.js";
+import { detectForbiddenContents, isCriticalForbidden } from "../../packageChecks/forbiddenPackageContents.js";
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 3 — package boundary scenario.
+//
+// Reuses the existing npm-pack-dry-run parser and forbidden-content detector
+// (src/securityValidation/packageChecks/) rather than re-implementing tarball
+// parsing. This scenario adds structured, evidence-first attack-scenario
+// framing on top of the same underlying data the "package" check group
+// already produces — it does not publish or create real package artifacts.
+//
+// v0.2.2 Batch 5: escalates the result severity to "blocker" (via
+// AttackScenarioRunOutcome.severity) when any matched file is
+// isCriticalForbidden() (.env, .pem, .key, .p12, lab-output/, .my-dev-kit/) —
+// reusing the exact same critical-file rule the underlying package check
+// already applies, so a real secret-shaped leak in the tarball reliably
+// triggers the "not-ready" verdict via blocker severity, not just "major".
+// ---------------------------------------------------------------------------
+export const PACKAGE_BOUNDARY_SCENARIO = {
+    id: "package-boundary-forbidden-content",
+    title: "Package boundary: npm tarball excludes forbidden/local-only content",
+    description: "Runs npm pack --dry-run against the target and verifies the resulting tarball file list does not include forbidden paths (.env, reports/security/, lab-output/, .my-dev-kit/, tarballs, node_modules, etc).",
+    checkId: "boundary",
+    applicableProfiles: [],
+    severityBaseline: "major",
+    verdictImpact: "target-project-blocker",
+    expectedSafeBehavior: "The npm pack --dry-run file list contains no files matching the forbidden content patterns.",
+    evidenceRequirements: ["package-content", "command"],
+    skipCondition: (ctx) => {
+        if (!ctx.target.hasPackageJson) {
+            return "Target has no package.json; npm pack --dry-run based package boundary check is not applicable.";
+        }
+        return undefined;
+    },
+    run: async (ctx) => {
+        const npm = resolveNpmCommand();
+        const cmd = await runSecurityCommand({
+            command: npm,
+            args: ["pack", "--dry-run"],
+            cwd: ctx.target.targetRoot,
+            timeoutMs: ctx.config.commandTimeoutMs,
+        });
+        const commandEvidence = makeEvidence({
+            kind: "command",
+            source: "npm pack --dry-run",
+            commandCwd: ctx.target.targetRoot,
+            commandSummary: `${npm} pack --dry-run`,
+            exitCode: cmd.exitCode,
+            confidence: "high",
+        });
+        const packOutput = [cmd.stdout, cmd.stderr].find((stream) => /tarball contents/i.test(stream)) ??
+            [cmd.stdout, cmd.stderr].filter(Boolean).join("\n");
+        const parsed = parseNpmPackDryRun(packOutput);
+        if (parsed.parseError && parsed.files.length === 0) {
+            return {
+                status: "blocked",
+                confidence: "low",
+                evidence: [
+                    commandEvidence,
+                    makeEvidence({
+                        kind: "skipped-tool",
+                        source: "npm pack --dry-run",
+                        confidence: "low",
+                        observedBehavior: parsed.parseError,
+                        expectedBehavior: "npm pack --dry-run should list tarball contents for evaluation.",
+                    }),
+                ],
+                recommendation: "Ensure npm is available and the target package.json is valid, then re-run.",
+            };
+        }
+        const { matches, findings } = detectForbiddenContents({
+            files: parsed.files,
+            forbiddenPatterns: ctx.config.forbiddenPackagePatterns,
+            allowedExceptions: ctx.config.allowedPackageExceptions,
+            checkId: "attack-boundary-package",
+        });
+        if (matches.length === 0) {
+            return {
+                status: "passed",
+                confidence: "high",
+                evidence: [
+                    commandEvidence,
+                    makeEvidence({
+                        kind: "package-content",
+                        source: "npm pack --dry-run file list",
+                        confidence: "high",
+                        observedBehavior: `${parsed.files.length} file(s) inspected; none matched a forbidden pattern.`,
+                        expectedBehavior: "No forbidden paths in the tarball file list.",
+                    }),
+                ],
+            };
+        }
+        const evidence = [
+            commandEvidence,
+            ...matches.slice(0, 20).map((m, i) => {
+                const finding = findings[i];
+                return makeEvidence({
+                    kind: "package-content",
+                    source: "npm pack --dry-run file list",
+                    filePath: m.file,
+                    confidence: "high",
+                    expectedBehavior: "Forbidden paths must not appear in the published tarball.",
+                    observedBehavior: `Included '${m.file}' matching forbidden pattern '${m.pattern}' (${finding?.severity ?? "major"} severity).`,
+                });
+            }),
+        ];
+        const hasCriticalMatch = matches.some((m) => isCriticalForbidden(m.file));
+        return {
+            status: "failed",
+            confidence: "high",
+            evidence,
+            severity: hasCriticalMatch ? "blocker" : "major",
+            recommendation: `Add ${matches.length} matched path(s) to .npmignore or the package.json "files" allowlist before publishing.`,
+        };
+    },
+};