@dailephd/my-dev-kit-lab 0.3.1 → 0.3.2

package/dist/src/audits/security/securityAuditAdapter.js

@@ -0,0 +1,67 @@
+import fs from "node:fs";
+import path from "node:path";
+import { runSecurityValidation } from "../../securityValidation/validate/runSecurityValidation.js";
+import { reportFilenamePrefix } from "../../securityValidation/validate/resolveTarget.js";
+import { renderJsonReport, renderTextReport } from "../../securityValidation/report/renderSecurityReport.js";
+import { buildSecurityReportFromSummary } from "../../securityValidation/report/buildSecurityReport.js";
+import { DEFAULT_SECURITY_CHECKS, DEFAULT_SECURITY_PROFILE } from "../../securityValidation/validate/cliOptions.js";
+import { verdictToHumanLabel } from "../../securityValidation/validate/verdict.js";
+import { mapSecurityFindingToAuditIssue } from "./mapSecurityFindingToAuditIssue.js";
+export async function runSecurityAuditAdapter(options) {
+    const { toolRoot, config } = options;
+    const summary = await runSecurityValidation({
+        cwd: toolRoot,
+        targetPath: config.targetPathArg,
+    });
+    // Only real findings on executed checks become AuditIssue entries. A
+    // skipped optional tool never has findings attached to it (see
+    // skippedCheck() in runSecurityValidation.ts), so it can never silently
+    // masquerade as an issue or as a passed check here.
+    const issues = summary.findings.map(mapSecurityFindingToAuditIssue);
+    const report = buildSecurityReportFromSummary(summary, {
+        profile: DEFAULT_SECURITY_PROFILE,
+        selectedChecks: [...DEFAULT_SECURITY_CHECKS],
+        formats: ["text", "json"],
+    });
+    // Always under my-dev-kit-lab's own reports/ tree (toolRoot), never under
+    // the audited target's root — matches the target-safety guarantee
+    // AuditTarget.safeReportOutputRoot already documents for code-rot reports.
+    const reportDir = path.join(toolRoot, "reports", "security");
+    if (!fs.existsSync(reportDir)) {
+        fs.mkdirSync(reportDir, { recursive: true });
+    }
+    const prefix = reportFilenamePrefix({
+        isSelf: summary.isSelf,
+        packageName: summary.packageName,
+        packageVersion: summary.packageVersion,
+        targetRoot: summary.targetRoot,
+    });
+    const textPath = path.join(reportDir, `${prefix}-security-validation.txt`);
+    const jsonPath = path.join(reportDir, `${prefix}-security-validation.json`);
+    fs.writeFileSync(textPath, renderTextReport(report), "utf8");
+    fs.writeFileSync(jsonPath, renderJsonReport(report), "utf8");
+    const findingCounts = {
+        blocker: summary.findings.filter((f) => f.severity === "blocker").length,
+        major: summary.findings.filter((f) => f.severity === "major").length,
+        minor: summary.findings.filter((f) => f.severity === "minor").length,
+        informational: summary.findings.filter((f) => f.severity === "informational").length,
+    };
+    const securitySummary = {
+        ran: true,
+        verdict: summary.verdict,
+        verdictLabel: verdictToHumanLabel(summary.verdict),
+        recommendedNextStep: summary.recommendedNextStep,
+        targetDescription: summary.targetDescription,
+        isSelf: summary.isSelf,
+        totalChecks: summary.checks.length,
+        checksPassed: summary.checks.filter((c) => c.status === "passed").length,
+        checksWarning: summary.checks.filter((c) => c.status === "warning").length,
+        checksFailed: summary.checks.filter((c) => c.status === "failed").length,
+        checksSkipped: summary.checks.filter((c) => c.status === "skipped").length,
+        findingCounts,
+        mappedIssueCount: issues.length,
+        verdictReasonSummary: summary.verdictReasonSummary ?? null,
+        reportPaths: { text: textPath, json: jsonPath },
+    };
+    return { issues, summary: securitySummary };
+}

package/dist/src/audits/security/securityAuditTypes.js

@@ -0,0 +1,17 @@
+export const SECURITY_AUDIT_NOT_RUN_SUMMARY = {
+    ran: false,
+    verdict: null,
+    verdictLabel: null,
+    recommendedNextStep: null,
+    targetDescription: null,
+    isSelf: null,
+    totalChecks: 0,
+    checksPassed: 0,
+    checksWarning: 0,
+    checksFailed: 0,
+    checksSkipped: 0,
+    findingCounts: { blocker: 0, major: 0, minor: 0, informational: 0 },
+    mappedIssueCount: 0,
+    verdictReasonSummary: null,
+    reportPaths: { text: null, json: null },
+};

package/dist/src/securityValidation/report/buildSecurityReport.js

@@ -0,0 +1,31 @@
+export function buildSecurityReportFromSummary(summary, options = {}) {
+    return {
+        metadata: {
+            toolRoot: summary.toolRoot,
+            toolPackageName: summary.toolPackageName,
+            toolPackageVersion: summary.toolPackageVersion,
+            targetRoot: summary.targetRoot,
+            targetDescription: summary.targetDescription,
+            packageName: summary.packageName,
+            packageVersion: summary.packageVersion,
+            branch: summary.auditedBranch,
+            commit: summary.auditedCommit,
+            isSelf: summary.isSelf,
+            generatedAt: summary.finishedAt,
+            totalDurationMs: new Date(summary.finishedAt).getTime() - new Date(summary.startedAt).getTime(),
+            profile: options.profile,
+            selectedChecks: options.selectedChecks,
+            failOnThreshold: options.failOnThreshold,
+            formats: options.formats,
+            failOnBreached: options.failOnBreached,
+            isFullReleaseGate: summary.isFullReleaseGate,
+        },
+        sections: [],
+        allChecks: summary.checks,
+        allFindings: summary.findings,
+        verdict: summary.verdict,
+        recommendedNextStep: summary.recommendedNextStep,
+        attackResults: summary.attackResults,
+        verdictReasonSummary: summary.verdictReasonSummary,
+    };
+}

package/dist/src/securityValidation/validate/resolveTarget.js

@@ -8,6 +8,15 @@ export function resolveValidationTarget(targetPathArg, toolRoot) {
 // Returns the prefix to use for report filenames based on target metadata.
 // For self-validation: "v<version>" (preserves existing behavior).
 // For external targets: "<sanitized-name>-v<version>" or "<sanitized-dirname>".
+//
+// v0.3.2 Batch 4 — the parameter type is deliberately narrowed to a Pick of
+// SecurityValidationTarget (rather than the full type) so the audit security
+// adapter (src/audits/security/securityAuditAdapter.ts) can call this with a
+// plain object built from a SecurityValidationSummary (which carries these
+// same four fields but isn't itself a SecurityValidationTarget) instead of
+// re-resolving the target a second time. Every existing caller already passes
+// a full SecurityValidationTarget, which satisfies this narrower type
+// unchanged.
 export function reportFilenamePrefix(target) {
     if (target.isSelf && target.packageVersion) {
         return `v${target.packageVersion}`;

package/package.json

@@ -1,99 +1,97 @@
-{
-  "name": "@dailephd/my-dev-kit-lab",
-  "version": "0.3.1",
-  "type": "module",
-  "description": "Evidence, benchmark, and evaluation companion for my-dev-kit.",
-  "bin": {
-    "my-dev-kit-lab": "dist/scripts/run-final-demo.js"
-  },
+{
+  "name": "@dailephd/my-dev-kit-lab",
+  "version": "0.3.2",
+  "type": "module",
+  "description": "Evidence, benchmark, and evaluation companion for my-dev-kit.",
+  "bin": {
+    "my-dev-kit-lab": "dist/scripts/run-final-demo.js"
+  },
   "files": [
     "dist/scripts/",
     "!dist/scripts/docs/",
     "dist/src/",
     "benchmarks/",
-    "docs/METRICS.md",
-    "examples/",
-    "tests/fixtures/"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/dailephd/my-dev-kit-lab.git"
-  },
-  "homepage": "https://github.com/dailephd/my-dev-kit-lab#readme",
-  "bugs": {
-    "url": "https://github.com/dailephd/my-dev-kit-lab/issues"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "funding": [
-    "https://github.com/sponsors/dailephd",
-    "https://paypal.me/daile88"
-  ],
-  "keywords": [
-    "benchmark",
-    "evaluation",
-    "reporting",
-    "graph-retrieval",
-    "codex",
-    "claude"
-  ],
-  "author": "Dai Le",
-  "license": "MIT",
-  "scripts": {
-    "build": "node scripts/clean-dist.mjs && tsc -p tsconfig.json",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run",
-    "test:benchmarks": "vitest run tests/benchmarks tests/scripts",
-    "test:report": "vitest run tests/report tests/commands",
-    "test:screenshot": "vitest run tests/screenshot",
-    "test:evaluation": "vitest run tests/core tests/evaluation tests/commands",
-    "test:gallery": "vitest run tests/gallery",
-    "test:demo": "vitest run tests/commands/runLabDemo.spec.ts tests/integration/runLabDemoCommand.spec.ts",
-    "test:integration": "vitest run tests/integration",
-    "test:e2e": "vitest run tests/e2e",
-    "test:agents": "vitest run tests/agents tests/commands/runAgentPromptCommand.spec.ts tests/integration/runAgentPromptFake.spec.ts",
-    "test:experiments": "vitest run tests/evaluation/buildExperimentMatrix.spec.ts tests/evaluation/classifyAgentRunOutcome.spec.ts tests/evaluation/parseAgentAnswer.spec.ts tests/evaluation/scoreCorrectness.spec.ts tests/evaluation/compareExperimentRuns.spec.ts tests/evaluation/runControlledExperiment.spec.ts tests/commands/runControlledExperimentCommand.spec.ts tests/integration/runControlledExperimentFake.spec.ts",
-    "capture-demo-report": "tsx scripts/capture-demo-report.ts",
-    "evaluate-token-savings": "tsx scripts/evaluate-token-savings.ts",
-    "generate-experiment-plots": "tsx scripts/generate-experiment-plots.ts",
-    "generate-prompt-variants": "tsx scripts/generate-prompt-variants.ts",
-    "build-gallery": "tsx scripts/build-gallery.ts",
-    "lab-demo": "tsx scripts/run-lab-demo.ts",
-    "render-experiment-report": "tsx scripts/render-experiment-report.ts",
-    "experiment:list": "tsx scripts/experiments/listExperiments.ts",
-    "experiment:describe": "tsx scripts/experiments/describeExperiment.ts",
-    "experiment:run": "tsx scripts/experiments/runExperiment.ts",
-    "ecosystem:sync": "tsx scripts/docs/syncEcosystemDocs.ts",
-    "ecosystem:check": "tsx scripts/docs/checkEcosystemDocs.ts",
-    "run-final-demo": "tsx scripts/run-final-demo.ts",
-    "run-agent-prompt": "tsx scripts/run-agent-prompt.ts",
-    "run-controlled-experiment": "tsx scripts/run-controlled-experiment.ts",
-    "run-visualization-demos": "tsx scripts/run-visualization-demos.ts",
-    "test:plots": "vitest run tests/plots tests/commands/generateExperimentPlotsCommand.spec.ts",
-    "test:visualization-demos": "vitest run tests/visualizationDemos tests/commands/runVisualizationDemosCommand.spec.ts",
-    "verify:benchmarks": "tsx scripts/verify-benchmarks.ts",
-    "verify": "npm run build && npm run test && npm run test:benchmarks && npm run test:report && npm run test:screenshot && npm run test:evaluation && npm run test:agents && npm run test:experiments && npm run test:plots && npm run test:visualization-demos && npm run test:gallery && npm run test:demo && npm run test:integration && npm run test:e2e && npm run verify:benchmarks",
-    "security:deps": "tsx scripts/security/runDependencyChecks.ts",
-    "security:package": "tsx scripts/security/runPackageChecks.ts",
-    "security:codeql": "tsx scripts/security/runCodeql.ts",
-    "security:semgrep": "tsx scripts/security/runSemgrep.ts",
-    "test:security": "vitest run tests/security/",
-    "test:fuzz:smoke": "tsx scripts/security/runFuzzSmoke.ts",
-    "security:validate": "tsx scripts/security/validate.ts",
-    "audit": "tsx scripts/audits/runAudit.ts"
-  },
-  "devDependencies": {
-    "@types/node": "^24.0.0",
-    "playwright": "^1.54.1",
-    "tsx": "^4.20.3",
-    "typescript": "^5.8.3",
-    "vitest": "^3.2.4"
-  },
-  "overrides": {
-    "vite": "7.3.6"
-  },
-  "engines": {
-    "node": ">=20"
-  }
-}
+    "docs/METRICS.md",
+    "examples/",
+    "tests/fixtures/"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dailephd/my-dev-kit-lab.git"
+  },
+  "homepage": "https://github.com/dailephd/my-dev-kit-lab#readme",
+  "bugs": {
+    "url": "https://github.com/dailephd/my-dev-kit-lab/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "funding": [
+    "https://github.com/sponsors/dailephd",
+    "https://paypal.me/daile88"
+  ],
+  "keywords": [
+    "benchmark",
+    "evaluation",
+    "reporting",
+    "graph-retrieval",
+    "codex",
+    "claude"
+  ],
+  "author": "Dai Le",
+  "license": "MIT",
+  "scripts": {
+    "build": "node scripts/clean-dist.mjs && tsc -p tsconfig.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:benchmarks": "vitest run tests/benchmarks tests/scripts",
+    "test:report": "vitest run tests/report tests/commands",
+    "test:screenshot": "vitest run tests/screenshot",
+    "test:evaluation": "vitest run tests/core tests/evaluation tests/commands",
+    "test:gallery": "vitest run tests/gallery",
+    "test:demo": "vitest run tests/commands/runLabDemo.spec.ts tests/integration/runLabDemoCommand.spec.ts",
+    "test:integration": "vitest run tests/integration",
+    "test:e2e": "vitest run tests/e2e",
+    "test:agents": "vitest run tests/agents tests/commands/runAgentPromptCommand.spec.ts tests/integration/runAgentPromptFake.spec.ts",
+    "test:experiments": "vitest run tests/evaluation/buildExperimentMatrix.spec.ts tests/evaluation/classifyAgentRunOutcome.spec.ts tests/evaluation/parseAgentAnswer.spec.ts tests/evaluation/scoreCorrectness.spec.ts tests/evaluation/compareExperimentRuns.spec.ts tests/evaluation/runControlledExperiment.spec.ts tests/commands/runControlledExperimentCommand.spec.ts tests/integration/runControlledExperimentFake.spec.ts",
+    "capture-demo-report": "tsx scripts/capture-demo-report.ts",
+    "evaluate-token-savings": "tsx scripts/evaluate-token-savings.ts",
+    "generate-experiment-plots": "tsx scripts/generate-experiment-plots.ts",
+    "generate-prompt-variants": "tsx scripts/generate-prompt-variants.ts",
+    "build-gallery": "tsx scripts/build-gallery.ts",
+    "lab-demo": "tsx scripts/run-lab-demo.ts",
+    "render-experiment-report": "tsx scripts/render-experiment-report.ts",
+    "experiment:list": "tsx scripts/experiments/listExperiments.ts",
+    "experiment:describe": "tsx scripts/experiments/describeExperiment.ts",
+    "experiment:run": "tsx scripts/experiments/runExperiment.ts",
+    "run-final-demo": "tsx scripts/run-final-demo.ts",
+    "run-agent-prompt": "tsx scripts/run-agent-prompt.ts",
+    "run-controlled-experiment": "tsx scripts/run-controlled-experiment.ts",
+    "run-visualization-demos": "tsx scripts/run-visualization-demos.ts",
+    "test:plots": "vitest run tests/plots tests/commands/generateExperimentPlotsCommand.spec.ts",
+    "test:visualization-demos": "vitest run tests/visualizationDemos tests/commands/runVisualizationDemosCommand.spec.ts",
+    "verify:benchmarks": "tsx scripts/verify-benchmarks.ts",
+    "verify": "npm run build && npm run test && npm run test:benchmarks && npm run test:report && npm run test:screenshot && npm run test:evaluation && npm run test:agents && npm run test:experiments && npm run test:plots && npm run test:visualization-demos && npm run test:gallery && npm run test:demo && npm run test:integration && npm run test:e2e && npm run verify:benchmarks",
+    "security:deps": "tsx scripts/security/runDependencyChecks.ts",
+    "security:package": "tsx scripts/security/runPackageChecks.ts",
+    "security:codeql": "tsx scripts/security/runCodeql.ts",
+    "security:semgrep": "tsx scripts/security/runSemgrep.ts",
+    "test:security": "vitest run tests/security/",
+    "test:fuzz:smoke": "tsx scripts/security/runFuzzSmoke.ts",
+    "security:validate": "tsx scripts/security/validate.ts",
+    "audit": "tsx scripts/audits/runAudit.ts"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "playwright": "^1.54.1",
+    "tsx": "^4.20.3",
+    "typescript": "^5.8.3",
+    "vitest": "^3.2.4"
+  },
+  "overrides": {
+    "vite": "7.3.6"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}