@dailephd/my-dev-kit-lab 0.2.1 → 0.3.0

package/dist/src/securityValidation/validate/verdict.js

@@ -1,3 +1,4 @@
+import { VERDICT_IMPACTS } from "../types.js";
 // ---------------------------------------------------------------------------
 // Verdict calculation
 //
@@ -71,3 +72,149 @@ export function verdictToHumanLabel(verdict) {
             return "inconclusive: audit environment incomplete";
     }
 }
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 5 — fail-on severity threshold
+//
+// --fail-on uses a separate vocabulary (blocker/high/medium/low) from
+// SecuritySeverity (blocker/major/minor/informational/skipped) — Batch 1
+// deliberately kept these distinct. This maps one onto the other so a
+// --fail-on breach can be detected without renaming any existing severity.
+// Mapping (conservative — never understates a blocker-level finding):
+//   blocker fail-on -> only "blocker" severity findings breach it
+//   high    fail-on -> "blocker" or "major" ("major" is treated as "high")
+//   medium  fail-on -> "blocker", "major", or "minor" ("minor" -> "medium")
+//   low     fail-on -> "blocker", "major", "minor", or "informational"
+// "skipped" severity never breaches any threshold — a skipped optional tool
+// is not a finding.
+// ---------------------------------------------------------------------------
+const SEVERITY_THRESHOLD_RANK = {
+    blocker: 4,
+    major: 3,
+    minor: 2,
+    informational: 1,
+    skipped: 0,
+};
+const FAIL_ON_THRESHOLD_RANK = {
+    blocker: 4,
+    high: 3,
+    medium: 2,
+    low: 1,
+};
+export function severityMeetsFailOnThreshold(severity, threshold) {
+    return SEVERITY_THRESHOLD_RANK[severity] >= FAIL_ON_THRESHOLD_RANK[threshold];
+}
+// True when at least one finding's severity breaches the given --fail-on
+// threshold. Callers should OR this with the existing verdict-based exit
+// decision, never use it to replace/weaken that decision — this only adds
+// stricter exit-1 triggers for --fail-on medium/low (which the default
+// verdict policy doesn't already cover via its blocker/major rules); for
+// --fail-on blocker/high it is always a no-op given the existing policy.
+export function findingsBreachFailOnThreshold(findings, threshold) {
+    return findings.some((f) => severityMeetsFailOnThreshold(f.severity, threshold));
+}
+export const VERDICT_REASON_CATEGORIES = [
+    "release-blocker",
+    "target-project-blocker",
+    "tool-framework-blocker",
+    "environment-inconclusive",
+    "optional-skipped-tool",
+    "adversarial-scenario-skipped",
+    "scanner-finding",
+    "adversarial-scenario-failure",
+    "required-evidence-missing",
+    "informational-evidence",
+];
+// v0.2.2 Batch 6: scenario blocker-impact classification now comes directly
+// from SecurityCheckResult.verdictImpact (carried through from the
+// originating AttackScenario's static declaration — see attackScenario.ts /
+// attackResult.ts). verdict.ts no longer owns a separate scenario-id map, so
+// there is nothing to keep in sync when a new scenario is registered — as
+// long as the scenario declares verdictImpact, categorization is correct
+// automatically. Checks with no verdictImpact but a scenario-shaped id
+// (placeholder/error results, or a scenario that doesn't declare one) fall
+// back to the generic "adversarial-scenario-failure"/"-skipped" buckets.
+//
+// A check is "scenario-shaped" if it carries a verdictImpact OR its id
+// matches the synthetic placeholder/error patterns produced by
+// attackRunner.ts for unregistered checks or runner crashes (those never
+// carry verdictImpact since there's no real AttackScenario object).
+function isAttackScenarioCheckId(id) {
+    return id.endsWith("-no-scenarios-registered") || id.endsWith("-attack-runner-error");
+}
+// Categorizes a single check for verdict-reasoning purposes. Returns null
+// for passed/warning checks — those don't need a blocker-reasoning bucket.
+export function categorizeCheck(check) {
+    const scenario = isAttackScenarioCheckId(check.id) || check.verdictImpact !== undefined;
+    if (check.status === "skipped") {
+        if (scenario)
+            return "adversarial-scenario-skipped";
+        if (MANDATORY_CHECK_IDS.has(check.id))
+            return "required-evidence-missing";
+        return "optional-skipped-tool";
+    }
+    if (check.status === "failed") {
+        if (check.verdictImpact && VERDICT_IMPACTS.includes(check.verdictImpact)) {
+            return check.verdictImpact;
+        }
+        if (scenario)
+            return "adversarial-scenario-failure";
+        if (check.severity === "informational")
+            return "informational-evidence";
+        return "scanner-finding";
+    }
+    return null;
+}
+// Aggregates categorizeCheck() across all checks, plus a direct informational
+// finding count (informational findings don't get their own check-level
+// bucket since a check can carry multiple findings of mixed severity).
+export function summarizeVerdictReasoning(checks, findings) {
+    const summary = {
+        releaseBlockerCount: 0,
+        targetProjectBlockerCount: 0,
+        toolFrameworkBlockerCount: 0,
+        environmentInconclusiveCount: 0,
+        optionalSkippedToolCount: 0,
+        adversarialScenarioSkippedCount: 0,
+        scannerFindingCount: 0,
+        adversarialScenarioFailureCount: 0,
+        requiredEvidenceMissingCount: 0,
+        informationalEvidenceCount: 0,
+    };
+    for (const check of checks) {
+        const category = categorizeCheck(check);
+        switch (category) {
+            case "release-blocker":
+                summary.releaseBlockerCount++;
+                break;
+            case "target-project-blocker":
+                summary.targetProjectBlockerCount++;
+                break;
+            case "tool-framework-blocker":
+                summary.toolFrameworkBlockerCount++;
+                break;
+            case "environment-inconclusive":
+                summary.environmentInconclusiveCount++;
+                break;
+            case "optional-skipped-tool":
+                summary.optionalSkippedToolCount++;
+                break;
+            case "adversarial-scenario-skipped":
+                summary.adversarialScenarioSkippedCount++;
+                break;
+            case "scanner-finding":
+                summary.scannerFindingCount++;
+                break;
+            case "adversarial-scenario-failure":
+                summary.adversarialScenarioFailureCount++;
+                break;
+            case "required-evidence-missing":
+                summary.requiredEvidenceMissingCount++;
+                break;
+            case "informational-evidence":
+            case null:
+                break;
+        }
+    }
+    summary.informationalEvidenceCount = findings.filter((f) => f.severity === "informational").length;
+    return summary;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dailephd/my-dev-kit-lab",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "type": "module",
   "description": "Evidence, benchmark, and evaluation companion for my-dev-kit.",
   "bin": {
@@ -38,7 +38,7 @@
     "claude"
   ],
   "author": "Dai Le",
-  "license": "UNLICENSED",
+  "license": "MIT",
   "scripts": {
     "build": "node scripts/clean-dist.mjs && tsc -p tsconfig.json",
     "typecheck": "tsc --noEmit",
@@ -77,19 +77,20 @@
     "security:semgrep": "tsx scripts/security/runSemgrep.ts",
     "test:security": "vitest run tests/security/",
     "test:fuzz:smoke": "tsx scripts/security/runFuzzSmoke.ts",
-    "security:validate": "tsx scripts/security/validate.ts"
+    "security:validate": "tsx scripts/security/validate.ts",
+    "audit": "tsx scripts/audits/runAudit.ts"
   },
-  "devDependencies": {
-    "@types/node": "^24.0.0",
-    "playwright": "^1.54.1",
-    "tsx": "^4.20.3",
-    "typescript": "^5.8.3",
-    "vitest": "^3.2.4"
-  },
-  "overrides": {
-    "vite": "7.3.6"
-  },
-  "engines": {
-    "node": ">=20"
-  }
-}
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "playwright": "^1.54.1",
+    "tsx": "^4.20.3",
+    "typescript": "^5.8.3",
+    "vitest": "^3.2.4"
+  },
+  "overrides": {
+    "vite": "7.3.6"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}