@dailephd/my-dev-kit-lab 0.2.1 → 0.2.2

package/dist/src/securityValidation/attackScenarios/scenarios/targetSandboxScenario.js

@@ -0,0 +1,118 @@
+import path from "node:path";
+import { makeEvidence } from "../exploitEvidence.js";
+import { captureTargetSnapshot, diffTargetSnapshots, isGeneratedArtifactPath } from "../targetSnapshot.js";
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 3 — target sandbox / read-only validation scenario.
+//
+// Compares the target's git status "before" (captured by runSecurityValidation
+// before any checks ran, threaded via ctx.targetSnapshotBefore) against a
+// fresh snapshot taken here (after all other checks in this run finished —
+// attack-scenario checks run last in the orchestrator). Never mutates the
+// target: only `git status --porcelain` is executed, no clean/reset/restore.
+//
+// Known limitation: this only detects changes visible to `git status`. It
+// cannot detect a file that was modified and then reverted to its original
+// content, or changes in a non-git target (which is skipped, not silently
+// assumed safe).
+// ---------------------------------------------------------------------------
+export const TARGET_SANDBOX_SCENARIO = {
+    id: "target-sandbox-read-only",
+    title: "Target sandbox: validation does not modify the target working tree",
+    description: "Compares target git status before and after the validation run to confirm the run did not modify or add tracked/untracked files, and did not write generated security artifacts inside the target.",
+    checkId: "boundary",
+    applicableProfiles: [],
+    severityBaseline: "blocker",
+    verdictImpact: "target-project-blocker",
+    expectedSafeBehavior: "git status for the target is identical before and after the run, except for pre-existing dirtiness which is reported separately and not treated as caused by this run.",
+    evidenceRequirements: ["filesystem", "target-modification", "skipped-tool"],
+    skipCondition: (ctx) => {
+        if (!ctx.target.hasGit) {
+            return "Target is not a git repository; git-status-based read-only verification is not applicable. This does not imply the target was modified.";
+        }
+        if (!ctx.targetSnapshotBefore || !ctx.targetSnapshotBefore.hasGit) {
+            return "No pre-run git status snapshot was available for comparison.";
+        }
+        return undefined;
+    },
+    run: async (ctx) => {
+        const before = ctx.targetSnapshotBefore;
+        const after = captureTargetSnapshot(ctx.target.targetRoot, ctx.target.hasGit);
+        const diff = diffTargetSnapshots(before, after);
+        if (!diff.comparable) {
+            return {
+                status: "blocked",
+                confidence: "low",
+                evidence: [
+                    makeEvidence({
+                        kind: "skipped-tool",
+                        source: "git status --porcelain",
+                        confidence: "low",
+                        observedBehavior: diff.reason,
+                        expectedBehavior: "git status should be readable before and after the run for comparison.",
+                    }),
+                ],
+                recommendation: "Ensure git is available and the target is a valid git repository to enable this check.",
+            };
+        }
+        const newGeneratedArtifacts = diff.newEntries.filter((e) => isGeneratedArtifactPath(e.path));
+        const newOtherEntries = diff.newEntries.filter((e) => !isGeneratedArtifactPath(e.path));
+        const evidence = [];
+        if (diff.preExistingEntries.length > 0) {
+            evidence.push(makeEvidence({
+                kind: "observation",
+                source: "git status --porcelain (before)",
+                confidence: "high",
+                observedBehavior: `${diff.preExistingEntries.length} pre-existing dirty entr${diff.preExistingEntries.length === 1 ? "y" : "ies"} (not caused by this run).`,
+                rawPreview: diff.preExistingEntries.map((e) => `${e.code} ${e.path}`).join(", "),
+            }));
+        }
+        for (const entry of newGeneratedArtifacts.slice(0, 10)) {
+            evidence.push(makeEvidence({
+                kind: "target-modification",
+                source: "git status --porcelain (after)",
+                filePath: entry.path,
+                confidence: "high",
+                expectedBehavior: "Generated security artifacts must not be written inside the target working tree.",
+                observedBehavior: `New entry '${entry.code} ${entry.path}' appeared inside the target during validation.`,
+            }));
+        }
+        for (const entry of newOtherEntries.slice(0, 10)) {
+            evidence.push(makeEvidence({
+                kind: "target-modification",
+                source: "git status --porcelain (after)",
+                filePath: entry.path,
+                confidence: "high",
+                expectedBehavior: "Target tracked/untracked files must remain unchanged during validation.",
+                observedBehavior: `New entry '${entry.code} ${entry.path}' appeared inside the target during validation.`,
+            }));
+        }
+        if (newGeneratedArtifacts.length > 0 || newOtherEntries.length > 0) {
+            return {
+                status: "failed",
+                confidence: "high",
+                evidence,
+                category: "artifact-safety",
+                recommendation: newGeneratedArtifacts.length > 0
+                    ? "Generated security report/artifact directories must only be written under the tool's own output area, never inside the target project."
+                    : "Validation must be strictly read-only with respect to the target working tree.",
+            };
+        }
+        return {
+            status: "passed",
+            confidence: "high",
+            evidence,
+            category: "artifact-safety",
+        };
+    },
+};
+// Exposed for tests / reuse: default reportDir/rawOutputDir collision check
+// used by outputBoundaryScenario, kept here since it reasons about the same
+// "target boundary" concept.
+export function reportDirIsInsideExternalTarget(reportDir, targetRoot, isSelf) {
+    if (isSelf)
+        return false;
+    const resolvedReportDir = path.resolve(reportDir);
+    const resolvedTargetRoot = path.resolve(targetRoot);
+    const relative = path.relative(resolvedTargetRoot, resolvedReportDir);
+    return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}

package/dist/src/securityValidation/attackScenarios/targetSnapshot.js

@@ -0,0 +1,70 @@
+import { execSync } from "node:child_process";
+// Reads `git status --porcelain=v1` for targetRoot without mutating anything.
+// Returns hasGit:false (not a thrown error) when the target is not a git
+// repository or git is unavailable — callers must treat that as "unknown",
+// never as "crashed".
+export function captureTargetSnapshot(targetRoot, hasGit) {
+    const takenAt = new Date().toISOString();
+    if (!hasGit) {
+        return { targetRoot, takenAt, hasGit: false, unreadableReason: "Target is not a git repository." };
+    }
+    try {
+        const raw = execSync("git status --porcelain=v1", {
+            cwd: targetRoot,
+            encoding: "utf8",
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        const entries = parsePorcelainStatus(raw);
+        return { targetRoot, takenAt, hasGit: true, entries };
+    }
+    catch (err) {
+        return {
+            targetRoot,
+            takenAt,
+            hasGit: false,
+            unreadableReason: `git status failed: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+}
+function parsePorcelainStatus(raw) {
+    const entries = [];
+    for (const line of raw.split(/\r?\n/)) {
+        if (!line)
+            continue;
+        const code = line.slice(0, 2);
+        const rawPath = line.slice(3).trim();
+        // Renames report as "old -> new"; keep the new path for comparisons.
+        const filePath = rawPath.includes(" -> ") ? rawPath.split(" -> ")[1] : rawPath;
+        entries.push({ code, path: filePath });
+    }
+    // Stable, deterministic ordering independent of git's own output order.
+    return entries.sort((a, b) => a.path.localeCompare(b.path));
+}
+const GENERATED_ARTIFACT_PATTERNS = [
+    "reports/security/",
+    "reports/audits/",
+    ".my-dev-kit/",
+    "lab-output/",
+];
+export function isGeneratedArtifactPath(p) {
+    const normalized = p.replace(/\\/g, "/");
+    return (GENERATED_ARTIFACT_PATTERNS.some((pattern) => normalized.startsWith(pattern)) ||
+        /-security-validation\.(txt|json)$/i.test(normalized));
+}
+export function diffTargetSnapshots(before, after) {
+    if (!before.hasGit || !after.hasGit || !before.entries || !after.entries) {
+        return {
+            comparable: false,
+            reason: before.unreadableReason ?? after.unreadableReason ?? "git status was not available for comparison.",
+            newEntries: [],
+            preExistingEntries: [],
+        };
+    }
+    const beforeKeys = new Set(before.entries.map((e) => `${e.code}:${e.path}`));
+    const newEntries = after.entries.filter((e) => !beforeKeys.has(`${e.code}:${e.path}`));
+    return {
+        comparable: true,
+        newEntries,
+        preExistingEntries: before.entries,
+    };
+}

package/dist/src/securityValidation/packageChecks/forbiddenPackageContents.js

@@ -56,7 +56,10 @@ export function detectForbiddenContents(options) {
     }));
     return { matches, findings };
 }
-function isCriticalForbidden(file) {
+// Exported for reuse by packageBoundaryScenario.ts, which needs the same
+// critical/major distinction to set its AttackResult severity correctly
+// (v0.2.2 Batch 5).
+export function isCriticalForbidden(file) {
     const f = file.toLowerCase();
     return (f.includes(".env") ||
         f.endsWith(".pem") ||

package/dist/src/securityValidation/report/renderSecurityReport.js

@@ -1,7 +1,16 @@
 import { verdictToHumanLabel } from "../validate/verdict.js";
+import { stripUnsafeControlChars } from "../attackScenarios/exploitEvidence.js";
 // ---------------------------------------------------------------------------
 // Human-readable text report
 // ---------------------------------------------------------------------------
+// v0.2.2 Batch 4 — sanitizes text-report content that may originate from
+// scanned source, target output, or an attack-scenario payload before it is
+// printed. Strips ANSI/control bytes (report-poisoning defense); preserves
+// ordinary whitespace. JSON output needs no equivalent helper — JSON.stringify
+// already escapes control characters by construction.
+export function sanitizeForTextReport(raw) {
+    return stripUnsafeControlChars(raw);
+}
 function pad(label, width = 36) {
     return label.padEnd(width, " ");
 }
@@ -24,7 +33,7 @@ function divider(char = "-", width = 72) {
 }
 export function renderTextReport(report) {
     const lines = [];
-    const { metadata, allChecks, allFindings, verdict, recommendedNextStep } = report;
+    const { metadata, allChecks, allFindings, verdict, recommendedNextStep, attackResults, verdictReasonSummary } = report;
     lines.push(divider("="));
     lines.push("SECURITY VALIDATION REPORT");
     lines.push(divider("="));
@@ -41,6 +50,23 @@ export function renderTextReport(report) {
     lines.push(`Commit     : ${metadata.commit}`);
     lines.push(`Generated  : ${metadata.generatedAt}`);
     lines.push(`Duration   : ${formatDuration(metadata.totalDurationMs)}`);
+    if (metadata.profile) {
+        lines.push(`Profile    : ${metadata.profile}`);
+    }
+    if (metadata.selectedChecks && metadata.selectedChecks.length > 0) {
+        lines.push(`Checks     : ${metadata.selectedChecks.join(", ")}`);
+    }
+    if (metadata.failOnThreshold) {
+        const breachNote = metadata.failOnBreached === true
+            ? " — BREACHED"
+            : metadata.failOnBreached === false
+                ? " — not breached"
+                : "";
+        lines.push(`Fail-on    : ${metadata.failOnThreshold}${breachNote}`);
+    }
+    if (metadata.isFullReleaseGate === false) {
+        lines.push(`Scope      : NARROWED — selected checks do not include the full classic release gate (deps, package, static, cli-adversarial, fuzz). This run does not represent full release readiness.`);
+    }
     lines.push("");
     // --- 1. Executive Summary ---
     lines.push(divider());
@@ -60,7 +86,7 @@ export function renderTextReport(report) {
                 lines.push(`  ${sev.padEnd(16)} : ${count}`);
         }
     }
-    lines.push(`Next step  : ${recommendedNextStep}`);
+    lines.push(`Next step  : ${sanitizeForTextReport(recommendedNextStep)}`);
     lines.push("");
     // --- Check sections ---
     const sectionDefs = [
@@ -143,7 +169,7 @@ export function renderTextReport(report) {
             continue;
         }
         for (const check of sectionChecks) {
-            lines.push(`[${statusIcon(check.status)}] ${pad(check.name)} ${formatDuration(check.durationMs)}`);
+            lines.push(`[${statusIcon(check.status)}] ${pad(sanitizeForTextReport(check.name))} ${formatDuration(check.durationMs)}`);
             if (check.command) {
                 lines.push(`       Command: ${check.command}`);
             }
@@ -154,24 +180,87 @@ export function renderTextReport(report) {
                 lines.push(`       Exit code: ${String(check.exitCode)}`);
             }
             if (check.stdoutSummary) {
-                lines.push(`       Stdout: ${check.stdoutSummary.slice(0, 200)}`);
+                lines.push(`       Stdout: ${sanitizeForTextReport(check.stdoutSummary).slice(0, 200)}`);
             }
             if (check.stderrSummary) {
-                lines.push(`       Stderr: ${check.stderrSummary.slice(0, 200)}`);
+                lines.push(`       Stderr: ${sanitizeForTextReport(check.stderrSummary).slice(0, 200)}`);
             }
             if (check.status === "skipped" && check.skippedReason) {
-                lines.push(`       Reason: ${check.skippedReason}`);
+                lines.push(`       Reason: ${sanitizeForTextReport(check.skippedReason)}`);
             }
             if (check.findings.length > 0) {
                 for (const f of check.findings) {
-                    lines.push(`       [${f.severity.toUpperCase()}] ${f.title}`);
+                    lines.push(`       [${f.severity.toUpperCase()}] ${sanitizeForTextReport(f.title)}`);
                     if (f.description)
-                        lines.push(`              ${f.description.slice(0, 120)}`);
+                        lines.push(`              ${sanitizeForTextReport(f.description).slice(0, 120)}`);
                 }
             }
         }
         lines.push("");
     }
+    // --- Attack Scenario Framework (v0.2.2) ---
+    // Only rendered when the run selected attack-scenario-shaped checks.
+    // Batch 3 registered concrete scenarios for boundary/subprocess; secrets
+    // and network still resolve to an explicit "no scenarios registered"
+    // placeholder (scenarioId ending in "-no-scenarios-registered") — the
+    // pending-framework note is only shown when at least one such placeholder
+    // is present in this run, not unconditionally.
+    if (attackResults && attackResults.length > 0) {
+        const pendingResults = attackResults.filter((r) => r.scenarioId.endsWith("-no-scenarios-registered"));
+        const concreteResults = attackResults.filter((r) => !r.scenarioId.endsWith("-no-scenarios-registered"));
+        lines.push(divider());
+        lines.push("ATTACK SCENARIO FRAMEWORK (v0.2.2)");
+        lines.push(divider());
+        if (concreteResults.length > 0) {
+            lines.push(`${concreteResults.length} concrete attack scenario(s) executed.`);
+        }
+        if (pendingResults.length > 0) {
+            const pendingChecks = [...new Set(pendingResults.map((r) => r.checkId))].join(", ");
+            lines.push(`Concrete attack scenarios are still pending for: ${pendingChecks}. This is not evidence that those check groups are safe.`);
+        }
+        lines.push("");
+        for (const result of attackResults) {
+            lines.push(`[${statusIcon(result.status === "blocked" ? "failed" : result.status)}] ${pad(sanitizeForTextReport(result.scenarioTitle))} (check: ${result.checkId}, profile: ${result.profileId})`);
+            if (result.skippedReason) {
+                lines.push(`       Reason: ${sanitizeForTextReport(result.skippedReason)}`);
+            }
+            if (result.errorSummary) {
+                lines.push(`       Error: ${sanitizeForTextReport(result.errorSummary)}`);
+            }
+            if (result.recommendation) {
+                lines.push(`       Recommendation: ${sanitizeForTextReport(result.recommendation)}`);
+            }
+            if (result.evidence.length > 0) {
+                for (const e of result.evidence.slice(0, 10)) {
+                    const preview = e.redactedPreview ?? e.observedBehavior ?? "(no preview)";
+                    lines.push(`       [${e.kind}] ${sanitizeForTextReport(preview)}`);
+                }
+                if (result.evidence.length > 10) {
+                    lines.push(`       ... ${result.evidence.length - 10} more evidence item(s)`);
+                }
+            }
+        }
+        lines.push("");
+    }
+    // --- Verdict Reasoning (v0.2.2 Batch 5) ---
+    // Only rendered when the caller supplied the summary (additive; existing
+    // report construction that omits it is unaffected).
+    if (verdictReasonSummary) {
+        lines.push(divider());
+        lines.push("VERDICT REASONING (v0.2.2)");
+        lines.push(divider());
+        lines.push(`Release blockers          : ${verdictReasonSummary.releaseBlockerCount}`);
+        lines.push(`Target-project blockers   : ${verdictReasonSummary.targetProjectBlockerCount}`);
+        lines.push(`Tool-framework blockers   : ${verdictReasonSummary.toolFrameworkBlockerCount}`);
+        lines.push(`Environment inconclusive  : ${verdictReasonSummary.environmentInconclusiveCount}`);
+        lines.push(`Required evidence missing : ${verdictReasonSummary.requiredEvidenceMissingCount}`);
+        lines.push(`Scanner findings          : ${verdictReasonSummary.scannerFindingCount}`);
+        lines.push(`Adversarial scenario fail : ${verdictReasonSummary.adversarialScenarioFailureCount}`);
+        lines.push(`Adversarial scenario skip : ${verdictReasonSummary.adversarialScenarioSkippedCount}`);
+        lines.push(`Optional skipped tools    : ${verdictReasonSummary.optionalSkippedToolCount}`);
+        lines.push(`Informational evidence    : ${verdictReasonSummary.informationalEvidenceCount}`);
+        lines.push("");
+    }
     // --- 20. Findings by Severity ---
     lines.push(divider());
     lines.push("20. FINDINGS BY SEVERITY");
@@ -186,11 +275,11 @@ export function renderTextReport(report) {
                 continue;
             lines.push(`${sev.toUpperCase()} (${sevFindings.length}):`);
             for (const f of sevFindings) {
-                lines.push(`  [${f.id}] ${f.title}`);
+                lines.push(`  [${f.id}] ${sanitizeForTextReport(f.title)}`);
                 if (f.description)
-                    lines.push(`    ${f.description.slice(0, 120)}`);
+                    lines.push(`    ${sanitizeForTextReport(f.description).slice(0, 120)}`);
                 if (f.recommendation)
-                    lines.push(`    Recommendation: ${f.recommendation}`);
+                    lines.push(`    Recommendation: ${sanitizeForTextReport(f.recommendation)}`);
             }
         }
     }
@@ -205,7 +294,7 @@ export function renderTextReport(report) {
     lines.push(divider());
     lines.push("22. RECOMMENDED NEXT STEP");
     lines.push(divider());
-    lines.push(recommendedNextStep);
+    lines.push(sanitizeForTextReport(recommendedNextStep));
     lines.push("");
     lines.push(divider("="));
     return lines.join("\n");
@@ -214,7 +303,7 @@ export function renderTextReport(report) {
 // JSON report
 // ---------------------------------------------------------------------------
 export function renderJsonReport(report) {
-    const { metadata, allChecks, allFindings, verdict, recommendedNextStep } = report;
+    const { metadata, allChecks, allFindings, verdict, recommendedNextStep, attackResults, verdictReasonSummary } = report;
     const sanitizedChecks = allChecks.map((c) => ({
         id: c.id,
         name: c.name,
@@ -243,6 +332,33 @@ export function renderJsonReport(report) {
         recommendation: f.recommendation ?? undefined,
         releaseImpact: f.releaseImpact,
     }));
+    const sanitizedAttackResults = (attackResults ?? []).map((r) => ({
+        scenarioId: r.scenarioId,
+        scenarioTitle: r.scenarioTitle,
+        checkId: r.checkId,
+        profileId: r.profileId,
+        status: r.status,
+        severity: r.severity,
+        confidence: r.confidence,
+        category: r.category,
+        recommendation: r.recommendation ?? null,
+        skippedReason: r.skippedReason ?? null,
+        errorSummary: r.errorSummary ?? null,
+        evidence: r.evidence.map((e) => ({
+            id: e.id,
+            kind: e.kind,
+            source: e.source,
+            filePath: e.filePath ?? null,
+            line: e.line ?? null,
+            commandCwd: e.commandCwd ?? null,
+            commandSummary: e.commandSummary ?? null,
+            exitCode: e.exitCode ?? null,
+            expectedBehavior: e.expectedBehavior ?? null,
+            observedBehavior: e.observedBehavior ?? null,
+            redactedPreview: e.redactedPreview ?? null,
+            confidence: e.confidence,
+        })),
+    }));
     const output = {
         schemaVersion: 1,
         metadata,
@@ -256,12 +372,18 @@ export function renderJsonReport(report) {
             blockerFindings: allFindings.filter((f) => f.severity === "blocker").length,
             majorFindings: allFindings.filter((f) => f.severity === "major").length,
             minorFindings: allFindings.filter((f) => f.severity === "minor").length,
+            informationalFindings: allFindings.filter((f) => f.severity === "informational").length,
         },
         verdict,
         verdictLabel: verdictToHumanLabel(verdict),
         recommendedNextStep,
         checks: sanitizedChecks,
         findings: sanitizedFindings,
+        attackScenarios: {
+            count: sanitizedAttackResults.length,
+            results: sanitizedAttackResults,
+        },
+        verdictReasonSummary: verdictReasonSummary ?? null,
     };
     return JSON.stringify(output, null, 2);
 }

package/dist/src/securityValidation/types.js

@@ -32,3 +32,10 @@ export const SECURITY_CHECK_CATEGORIES = [
     "artifact-safety",
     "report-generation",
 ];
+export const VERDICT_IMPACTS = [
+    "release-blocker",
+    "target-project-blocker",
+    "tool-framework-blocker",
+    "adversarial-scenario-failure",
+    "informational-evidence",
+];

package/dist/src/securityValidation/validate/cliOptions.js

@@ -0,0 +1,182 @@
+import path from "node:path";
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 1 — security:validate command/config surface.
+//
+// This module parses and normalizes --checks, --profile, --format, --fail-on,
+// and --out. It intentionally does not implement attack scenarios, profile
+// behavior, or verdict-policy changes — those are later v0.2.2 batches. This
+// batch only builds a stable, extensible config surface.
+// ---------------------------------------------------------------------------
+export const SECURITY_CHECK_IDS = [
+    "deps",
+    "package",
+    "static",
+    "cli-adversarial",
+    "fuzz",
+    "boundary",
+    "subprocess",
+    "secrets",
+    "network",
+];
+// Checks with real behavior wired in Batch 1.
+export const IMPLEMENTED_SECURITY_CHECK_IDS = [
+    "deps",
+    "package",
+    "static",
+    "cli-adversarial",
+    "fuzz",
+];
+// Checks accepted as valid --checks values but not yet implemented. Selecting
+// one of these must never be reported as passed.
+export const PLANNED_SECURITY_CHECK_IDS = [
+    "boundary",
+    "subprocess",
+    "secrets",
+    "network",
+];
+export const DEFAULT_SECURITY_CHECKS = IMPLEMENTED_SECURITY_CHECK_IDS;
+export const SECURITY_PROFILE_IDS = ["node-cli-package", "local-tool", "npm-package"];
+export const DEFAULT_SECURITY_PROFILE = "node-cli-package";
+export const SECURITY_OUTPUT_FORMATS = ["text", "json"];
+export const DEFAULT_SECURITY_OUTPUT_FORMATS = ["text", "json"];
+// Distinct vocabulary from SecuritySeverity (blocker/major/minor/informational/skipped).
+// Batch 1 only carries this value through config; verdict-policy integration is later.
+export const SECURITY_FAIL_ON_THRESHOLDS = ["blocker", "high", "medium", "low"];
+export const DEFAULT_SECURITY_FAIL_ON_THRESHOLD = "blocker";
+const FLAGS_WITH_VALUE = {
+    "--target": "target",
+    "-t": "target",
+    "--out": "out",
+    "--report-prefix": "reportPrefix",
+    "--checks": "checks",
+    "--profile": "profile",
+    "--format": "format",
+    "--fail-on": "failOn",
+};
+export function parseSecurityValidateArgs(argv) {
+    const result = {};
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        const key = FLAGS_WITH_VALUE[arg];
+        if (!key)
+            continue;
+        if (i + 1 >= argv.length) {
+            throw new Error(`Missing value for ${arg}. Expected a value after ${arg}.`);
+        }
+        result[key] = argv[++i];
+    }
+    return result;
+}
+export function normalizeSecurityValidateConfig(raw, toolRoot) {
+    const checks = parseChecksOption(raw.checks);
+    const profile = parseProfileOption(raw.profile);
+    const formats = parseFormatOption(raw.format);
+    const failOn = parseFailOnOption(raw.failOn);
+    const out = raw.out !== undefined ? resolveOutDir(raw.out) : path.join(toolRoot, "reports", "security");
+    return {
+        target: raw.target,
+        out,
+        outWasDefault: raw.out === undefined,
+        reportPrefix: raw.reportPrefix,
+        checks: checks.value,
+        checksWereDefault: checks.wasDefault,
+        implementedChecks: checks.value.filter((c) => IMPLEMENTED_SECURITY_CHECK_IDS.includes(c)),
+        plannedChecksRequested: checks.value.filter((c) => PLANNED_SECURITY_CHECK_IDS.includes(c)),
+        profile: profile.value,
+        profileWasDefault: profile.wasDefault,
+        formats: formats.value,
+        formatsWereDefault: formats.wasDefault,
+        failOnThreshold: failOn.value,
+        failOnWasDefault: failOn.wasDefault,
+    };
+}
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 5 — profile-aware default checks
+// ---------------------------------------------------------------------------
+// Applies a profile's declared default check ids when the user provided
+// --profile but omitted --checks. Deliberately takes the profile's
+// defaultCheckIds as a plain parameter rather than importing
+// attackScenarios/attackProfile.ts here — that module already imports this
+// one (SecurityProfileId/SECURITY_PROFILE_IDS), so importing it back would
+// create a circular import. Callers (scripts/security/validate.ts) resolve
+// the profile definition via resolveAttackProfile() and pass its
+// defaultCheckIds in.
+//
+// No-op (returns config unchanged) unless BOTH:
+//   - the user did not pass --checks (checksWereDefault), AND
+//   - the user did pass --profile (profileWasDefault === false)
+// This guarantees the true no-flag case (no --profile, no --checks) and any
+// explicit --checks case are always unaffected.
+export function applyProfileDefaultChecksIfApplicable(config, profileDefaultCheckIds) {
+    if (!config.checksWereDefault || config.profileWasDefault) {
+        return config;
+    }
+    const uniqueRequested = new Set(profileDefaultCheckIds);
+    const ordered = SECURITY_CHECK_IDS.filter((id) => uniqueRequested.has(id));
+    return {
+        ...config,
+        checks: ordered,
+        implementedChecks: ordered.filter((c) => IMPLEMENTED_SECURITY_CHECK_IDS.includes(c)),
+        plannedChecksRequested: ordered.filter((c) => PLANNED_SECURITY_CHECK_IDS.includes(c)),
+    };
+}
+function splitAndNormalizeList(raw, flagName) {
+    const parts = raw.split(",").map((p) => p.trim());
+    if (parts.some((p) => p.length === 0)) {
+        throw new Error(`Invalid ${flagName} value: empty entries are not allowed. Got "${raw}".`);
+    }
+    return parts;
+}
+function parseChecksOption(raw) {
+    if (raw === undefined) {
+        return { value: [...DEFAULT_SECURITY_CHECKS], wasDefault: true };
+    }
+    const parts = splitAndNormalizeList(raw, "--checks");
+    const invalid = parts.filter((p) => !SECURITY_CHECK_IDS.includes(p));
+    if (invalid.length > 0) {
+        throw new Error(`Invalid --checks value(s): ${invalid.join(", ")}. Valid values are: ${SECURITY_CHECK_IDS.join(", ")}.`);
+    }
+    const unique = new Set(parts);
+    const ordered = SECURITY_CHECK_IDS.filter((id) => unique.has(id));
+    return { value: ordered, wasDefault: false };
+}
+function parseProfileOption(raw) {
+    if (raw === undefined) {
+        return { value: DEFAULT_SECURITY_PROFILE, wasDefault: true };
+    }
+    const value = raw.trim();
+    if (!SECURITY_PROFILE_IDS.includes(value)) {
+        throw new Error(`Invalid --profile value: "${raw}". Valid values are: ${SECURITY_PROFILE_IDS.join(", ")}.`);
+    }
+    return { value: value, wasDefault: false };
+}
+function parseFormatOption(raw) {
+    if (raw === undefined) {
+        return { value: [...DEFAULT_SECURITY_OUTPUT_FORMATS], wasDefault: true };
+    }
+    const parts = splitAndNormalizeList(raw, "--format");
+    const invalid = parts.filter((p) => !SECURITY_OUTPUT_FORMATS.includes(p));
+    if (invalid.length > 0) {
+        throw new Error(`Invalid --format value(s): ${invalid.join(", ")}. Valid values are: ${SECURITY_OUTPUT_FORMATS.join(", ")}.`);
+    }
+    const unique = new Set(parts);
+    const ordered = SECURITY_OUTPUT_FORMATS.filter((id) => unique.has(id));
+    return { value: ordered, wasDefault: false };
+}
+function parseFailOnOption(raw) {
+    if (raw === undefined) {
+        return { value: DEFAULT_SECURITY_FAIL_ON_THRESHOLD, wasDefault: true };
+    }
+    const value = raw.trim();
+    if (!SECURITY_FAIL_ON_THRESHOLDS.includes(value)) {
+        throw new Error(`Invalid --fail-on value: "${raw}". Valid values are: ${SECURITY_FAIL_ON_THRESHOLDS.join(", ")}.`);
+    }
+    return { value: value, wasDefault: false };
+}
+function resolveOutDir(raw) {
+    const trimmed = raw.trim();
+    if (trimmed.length === 0) {
+        throw new Error("Invalid --out value: path must not be empty.");
+    }
+    return path.resolve(trimmed);
+}