@dcyfr/ai 2.1.3 → 3.0.0

package/dist/ai/src/plugins/security/secret-detector.js

@@ -0,0 +1,204 @@
+/**
+ * Secret Detector
+ *
+ * Checks plugin source code for hardcoded secrets using Gitleaks CLI.
+ * Test fixtures in __tests__/fixtures/ are flagged as warnings, not blockers.
+ *
+ * @module plugins/security/secret-detector
+ * @version 1.0.0
+ * @date 2026-02-28
+ * @license MIT
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { readdir, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+const execFileAsync = promisify(execFile);
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+const TEST_FIXTURE_PATTERNS = [
+    '__tests__/fixtures',
+    'test/fixtures',
+    'spec/fixtures',
+    '__mocks__',
+];
+const SCANNABLE_EXTENSIONS = new Set([
+    '.js', '.mjs', '.cjs', '.ts', '.mts', '.cts', '.tsx', '.jsx',
+    '.json', '.yaml', '.yml', '.env', '.txt', '.md',
+]);
+const SECRET_PATTERNS = [
+    { ruleId: 'stripe-secret-key', regex: /sk_live_[0-9a-zA-Z]{16,}/g },
+    { ruleId: 'aws-access-key', regex: /AKIA[0-9A-Z]{16}/g },
+    { ruleId: 'generic-api-key-assignment', regex: /(?:api[_-]?key|secret|token)\s*[:=]\s*['"][^'"\n]{12,}['"]/gi },
+];
+function isTestFixture(filePath) {
+    const normalised = filePath.replaceAll('\\', '/');
+    return TEST_FIXTURE_PATTERNS.some((p) => normalised.includes(p));
+}
+function redact(secret) {
+    if (secret.length <= 8)
+        return '******';
+    return secret.slice(0, 4) + '****' + secret.slice(-4);
+}
+function extensionOf(path) {
+    const normalized = path.toLowerCase();
+    const lastDot = normalized.lastIndexOf('.');
+    if (lastDot === -1)
+        return '';
+    return normalized.slice(lastDot);
+}
+async function collectFiles(root) {
+    const files = [];
+    async function walk(dir) {
+        const entries = await readdir(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            const fullPath = join(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (entry.name === 'node_modules' || entry.name === '.git')
+                    continue;
+                await walk(fullPath);
+            }
+            else if (entry.isFile()) {
+                files.push(fullPath);
+            }
+        }
+    }
+    await walk(root);
+    return files;
+}
+async function fallbackScanSecrets(pluginPath) {
+    const files = await collectFiles(pluginPath);
+    const findings = [];
+    for (const file of files) {
+        const ext = extensionOf(file);
+        if (!SCANNABLE_EXTENSIONS.has(ext))
+            continue;
+        let content = '';
+        try {
+            content = await readFile(file, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        const lines = content.split(/\r?\n/);
+        for (const pattern of SECRET_PATTERNS) {
+            const matches = content.match(pattern.regex);
+            if (!matches || matches.length === 0)
+                continue;
+            for (const matched of matches) {
+                const idx = content.indexOf(matched);
+                const line = idx >= 0 ? content.slice(0, idx).split(/\r?\n/).length : 0;
+                findings.push({
+                    file,
+                    line,
+                    ruleId: pattern.ruleId,
+                    redactedMatch: redact(matched),
+                    inTestFixture: isTestFixture(file),
+                });
+            }
+        }
+        // Light line-based heuristic to catch suspicious keys even if regex misses.
+        lines.forEach((lineText, i) => {
+            if (!/sk_live_[0-9a-zA-Z]{8,}/.test(lineText))
+                return;
+            findings.push({
+                file,
+                line: i + 1,
+                ruleId: 'stripe-secret-key',
+                redactedMatch: redact(lineText.trim()),
+                inTestFixture: isTestFixture(file),
+            });
+        });
+    }
+    return findings;
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Scan a plugin directory for hardcoded secrets using Gitleaks.
+ *
+ * @param pluginPath Absolute path to the extracted plugin directory
+ */
+export async function detectSecrets(pluginPath) {
+    let gitleaksOutput = [];
+    let success = true;
+    let shouldRunFallback = false;
+    try {
+        // --exit-code 0 forces gitleaks to exit 0 even when findings exist,
+        // so execFileAsync always resolves. Capture stdout to parse findings.
+        const { stdout } = await execFileAsync('gitleaks', [
+            'detect',
+            '--source',
+            pluginPath,
+            '--report-format',
+            'json',
+            '--report-path',
+            '/dev/stdout',
+            '--no-git',
+            '--exit-code',
+            '0', // do not exit non-zero on findings so we parse stdout cleanly
+        ]);
+        if (stdout.trim()) {
+            try {
+                gitleaksOutput = JSON.parse(stdout);
+            }
+            catch {
+                // Non-JSON output (e.g. error message) — attempt fallback scanner
+                shouldRunFallback = true;
+            }
+        }
+        else {
+            shouldRunFallback = true;
+        }
+    }
+    catch (error_) {
+        // Gitleaks exits non-zero when findings exist; stdout still contains JSON
+        const err = error_;
+        if (err.stdout) {
+            try {
+                gitleaksOutput = JSON.parse(err.stdout);
+            }
+            catch {
+                shouldRunFallback = true;
+            }
+        }
+        else {
+            shouldRunFallback = true;
+        }
+    }
+    let locations = gitleaksOutput.map((f) => ({
+        file: f.File ?? 'unknown',
+        line: f.StartLine ?? 0,
+        ruleId: f.RuleID ?? 'unknown',
+        redactedMatch: redact(f.Secret ?? f.Match ?? ''),
+        inTestFixture: isTestFixture(f.File ?? ''),
+    }));
+    if ((shouldRunFallback || locations.length === 0) && pluginPath) {
+        try {
+            const fallbackLocations = await fallbackScanSecrets(pluginPath);
+            if (fallbackLocations.length > 0) {
+                const dedup = new Set(locations.map((l) => `${l.file}:${l.line}:${l.ruleId}:${l.redactedMatch}`));
+                for (const location of fallbackLocations) {
+                    const key = `${location.file}:${location.line}:${location.ruleId}:${location.redactedMatch}`;
+                    if (!dedup.has(key)) {
+                        dedup.add(key);
+                        locations.push(location);
+                    }
+                }
+            }
+        }
+        catch {
+            // Keep graceful behavior: scanner should not hard-fail when fallback
+            // traversal cannot run in constrained environments.
+            success = success && true;
+        }
+    }
+    return {
+        success,
+        found: locations.length > 0,
+        locations,
+    };
+}
+//# sourceMappingURL=secret-detector.js.map

package/dist/ai/src/plugins/security/secret-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-detector.js","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/security/secret-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAc1C,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,MAAM,qBAAqB,GAAG;IAC5B,oBAAoB;IACpB,eAAe;IACf,eAAe;IACf,WAAW;CACZ,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;CAChD,CAAC,CAAC;AAEH,MAAM,eAAe,GAA6C;IAChE,EAAE,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,2BAA2B,EAAE;IACnE,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,EAAE;IACxD,EAAE,MAAM,EAAE,4BAA4B,EAAE,KAAK,EAAE,8DAA8D,EAAE;CAChH,CAAC;AAEF,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,MAAM,CAAC,MAAc;IAC5B,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,UAAU,IAAI,CAAC,GAAW;QAC7B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;oBAAE,SAAS;gBACrE,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,UAAkB;IACnD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAqB,EAAE,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAE7C,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAE/C,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;gBAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACrC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAExE,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI;oBACJ,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC;oBAC9B,aAAa,EAAE,aAAa,CAAC,IAAI,CAAC;iBACnC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE;YAC5B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,OAAO;YACtD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI;gBACJ,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,MAAM,EAAE,mBAAmB;gBAC3B,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACtC,aAAa,EAAE,aAAa,CAAC,IAAI,CAAC;aACnC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAkB;IAElB,IAAI,cAAc,GAAsB,EAAE,CAAC;IAC3C,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,IAAI,CAAC;QACH,oEAAoE;QACpE,sEAAsE;QACtE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE;YACjD,QAAQ;YACR,UAAU;YACV,UAAU;YACV,iBAAiB;YACjB,MAAM;YACN,eAAe;YACf,aAAa;YACb,UAAU;YACV,aAAa;YACb,GAAG,EAAE,8DAA8D;SACpE,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAsB,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,kEAAkE;gBAClE,iBAAiB,GAAG,IAAI,CAAC;YAC3B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,0EAA0E;QAC1E,MAAM,GAAG,GAAG,MAA+C,CAAC;QAC5D,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAsB,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB,GAAG,IAAI,CAAC;YAC3B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,SAAS,GAAqB,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,SAAS;QACzB,IAAI,EAAE,CAAC,CAAC,SAAS,IAAI,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS;QAC7B,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;KAC3C,CAAC,CAAC,CAAC;IAEJ,IAAI,CAAC,iBAAiB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAChE,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;gBAClG,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,CAAC;oBACzC,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;oBAC7F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBACpB,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;wBACf,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAC3B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,oDAAoD;YACpD,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO;QACP,KAAK,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC;QAC3B,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/ai/src/plugins/security/signature-verifier.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Signature Verifier
+ *
+ * Verifies cryptographic signatures on plugin artifacts using cosign.
+ * A valid signature increases the trust score by 20 points; absence/invalid
+ * decreases it by 20 points.
+ *
+ * @module plugins/security/signature-verifier
+ * @version 1.0.0
+ * @date 2026-02-28
+ * @license MIT
+ */
+import type { SignatureVerificationResult } from './types.js';
+/**
+ * Verify the cosign signature on a plugin artifact.
+ *
+ * @param artifactPath  Absolute path to the plugin artifact (tarball, zip, etc.)
+ * @param publicKeyPath Path to the DCYFR cosign public key file (.pub)
+ */
+export declare function verifySignature(artifactPath: string, publicKeyPath: string): Promise<SignatureVerificationResult>;
+//# sourceMappingURL=signature-verifier.d.ts.map

package/dist/ai/src/plugins/security/signature-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature-verifier.d.ts","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/security/signature-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AA4B9D;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,2BAA2B,CAAC,CAyCtC"}

package/dist/ai/src/plugins/security/signature-verifier.js

@@ -0,0 +1,75 @@
+/**
+ * Signature Verifier
+ *
+ * Verifies cryptographic signatures on plugin artifacts using cosign.
+ * A valid signature increases the trust score by 20 points; absence/invalid
+ * decreases it by 20 points.
+ *
+ * @module plugins/security/signature-verifier
+ * @version 1.0.0
+ * @date 2026-02-28
+ * @license MIT
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+/** Timeout in milliseconds for cosign verification */
+const COSIGN_TIMEOUT_MS = 30_000;
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function withTimeout(promise, ms) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error(`Timeout after ${ms}ms`)), ms);
+        promise.then((v) => { clearTimeout(timer); resolve(v); }, (e) => { clearTimeout(timer); reject(e); });
+    });
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Verify the cosign signature on a plugin artifact.
+ *
+ * @param artifactPath  Absolute path to the plugin artifact (tarball, zip, etc.)
+ * @param publicKeyPath Path to the DCYFR cosign public key file (.pub)
+ */
+export async function verifySignature(artifactPath, publicKeyPath) {
+    if (!artifactPath || !publicKeyPath) {
+        return {
+            success: false,
+            verified: false,
+            error: 'artifactPath and publicKeyPath are required',
+        };
+    }
+    try {
+        const verifyPromise = execFileAsync('cosign', [
+            'verify-blob',
+            '--key',
+            publicKeyPath,
+            '--signature',
+            `${artifactPath}.sig`,
+            artifactPath,
+        ]);
+        const { stdout } = await withTimeout(verifyPromise, COSIGN_TIMEOUT_MS);
+        // cosign outputs signature metadata on success
+        const keyFingerprint = /Certificate fingerprint: ([A-Fa-f0-9:]+)/.exec(stdout)?.[1];
+        const signedAt = /Signed at: (.+)/.exec(stdout)?.[1];
+        return {
+            success: true,
+            verified: true,
+            publicKeyFingerprint: keyFingerprint,
+            signedAt,
+        };
+    }
+    catch (err) {
+        const message = String(err);
+        const timedOut = message.includes('Timeout after');
+        return {
+            success: !timedOut,
+            verified: false,
+            timedOut,
+            error: message,
+        };
+    }
+}
+//# sourceMappingURL=signature-verifier.js.map

package/dist/ai/src/plugins/security/signature-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature-verifier.js","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/security/signature-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,sDAAsD;AACtD,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,WAAW,CAAI,OAAmB,EAAE,EAAU;IACrD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,EAChD,EAAE,CACH,CAAC;QACF,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAC3C,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC3C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,YAAoB,EACpB,aAAqB;IAErB,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,6CAA6C;SACrD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,EAAE;YAC5C,aAAa;YACb,OAAO;YACP,aAAa;YACb,aAAa;YACb,GAAG,YAAY,MAAM;YACrB,YAAY;SACb,CAAC,CAAC;QAEH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;QAEvE,+CAA+C;QAC/C,MAAM,cAAc,GAAG,0CAA0C,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAErD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI;YACd,oBAAoB,EAAE,cAAc;YACpC,QAAQ;SACT,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,CAAC,QAAQ;YAClB,QAAQ,EAAE,KAAK;YACf,QAAQ;YACR,KAAK,EAAE,OAAO;SACf,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/ai/src/plugins/security/sonarcloud-client.d.ts

@@ -0,0 +1,20 @@
+/**
+ * SonarCloud API Client
+ *
+ * Fetches code quality metrics for a plugin project via the SonarCloud Web API.
+ * Requires SONARCLOUD_TOKEN environment variable.
+ *
+ * @module plugins/security/sonarcloud-client
+ * @version 1.0.0
+ * @date 2026-02-28
+ * @license MIT
+ */
+import type { CodeQualityResult } from './types.js';
+/**
+ * Fetch code quality metrics for a plugin from SonarCloud.
+ *
+ * @param projectKey  SonarCloud project key (e.g. "dcyfr_my-plugin")
+ * @param token       SonarCloud API token (defaults to SONARCLOUD_TOKEN env var)
+ */
+export declare function fetchCodeQuality(projectKey: string, token?: string): Promise<CodeQualityResult>;
+//# sourceMappingURL=sonarcloud-client.d.ts.map

package/dist/ai/src/plugins/security/sonarcloud-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sonarcloud-client.d.ts","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/security/sonarcloud-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAsB,MAAM,YAAY,CAAC;AA8ExE;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAA2C,GACjD,OAAO,CAAC,iBAAiB,CAAC,CAwD5B"}

package/dist/ai/src/plugins/security/sonarcloud-client.js

@@ -0,0 +1,106 @@
+/**
+ * SonarCloud API Client
+ *
+ * Fetches code quality metrics for a plugin project via the SonarCloud Web API.
+ * Requires SONARCLOUD_TOKEN environment variable.
+ *
+ * @module plugins/security/sonarcloud-client
+ * @version 1.0.0
+ * @date 2026-02-28
+ * @license MIT
+ */
+const SONARCLOUD_API_BASE = 'https://sonarcloud.io/api';
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function parseMaintainabilityRating(value) {
+    const map = {
+        '1': 'A',
+        '2': 'B',
+        '3': 'C',
+        '4': 'D',
+        '5': 'E',
+    };
+    return map[value] ?? 'unknown';
+}
+function extractMetric(measures, key) {
+    const m = measures.find((m) => m.metric === key);
+    return m ? Number.parseInt(m.value, 10) : 0;
+}
+function extractFloat(measures, key) {
+    const m = measures.find((m) => m.metric === key);
+    return m ? Number.parseFloat(m.value) : 0;
+}
+function parseQualityGate(status) {
+    if (status === 'OK')
+        return 'OK';
+    if (status === 'WARN')
+        return 'WARN';
+    if (status === 'ERROR')
+        return 'ERROR';
+    return 'NONE';
+}
+async function fetchJson(url, token) {
+    const res = await fetch(url, {
+        headers: {
+            Authorization: `Bearer ${token}`,
+            Accept: 'application/json',
+        },
+    });
+    if (!res.ok) {
+        throw new Error(`SonarCloud API ${res.status}: ${await res.text()}`);
+    }
+    return res.json();
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Fetch code quality metrics for a plugin from SonarCloud.
+ *
+ * @param projectKey  SonarCloud project key (e.g. "dcyfr_my-plugin")
+ * @param token       SonarCloud API token (defaults to SONARCLOUD_TOKEN env var)
+ */
+export async function fetchCodeQuality(projectKey, token = process.env.SONARCLOUD_TOKEN ?? '') {
+    if (!token) {
+        return {
+            success: false,
+            requiresManualReview: true,
+            qualityGate: 'NONE',
+            error: 'SONARCLOUD_TOKEN not configured',
+        };
+    }
+    try {
+        const [qualityGateData, measuresData] = await Promise.all([
+            fetchJson(`${SONARCLOUD_API_BASE}/qualitygates/project_status?projectKey=${encodeURIComponent(projectKey)}`, token),
+            fetchJson(`${SONARCLOUD_API_BASE}/measures/component?component=${encodeURIComponent(projectKey)}&metricKeys=bugs,vulnerabilities,security_hotspots,code_smells,sqale_rating,coverage`, token),
+        ]);
+        const measures = measuresData.component?.measures ?? [];
+        const metrics = {
+            bugs: extractMetric(measures, 'bugs'),
+            vulnerabilities: extractMetric(measures, 'vulnerabilities'),
+            securityHotspots: extractMetric(measures, 'security_hotspots'),
+            codeSmells: extractMetric(measures, 'code_smells'),
+            maintainabilityRating: parseMaintainabilityRating(measures.find((m) => m.metric === 'sqale_rating')?.value ?? ''),
+            coverage: extractFloat(measures, 'coverage'),
+        };
+        const qualityGate = parseQualityGate(qualityGateData.projectStatus?.status);
+        // Security hotspots always require manual review
+        const requiresManualReview = metrics.securityHotspots > 0 || metrics.vulnerabilities > 0;
+        return {
+            success: true,
+            metrics,
+            requiresManualReview,
+            qualityGate,
+        };
+    }
+    catch (err) {
+        return {
+            success: false,
+            requiresManualReview: true,
+            qualityGate: 'NONE',
+            error: String(err),
+        };
+    }
+}
+//# sourceMappingURL=sonarcloud-client.js.map

package/dist/ai/src/plugins/security/sonarcloud-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sonarcloud-client.js","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/security/sonarcloud-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAuBxD,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,0BAA0B,CACjC,KAAa;IAEb,MAAM,GAAG,GAAgE;QACvE,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG;KACT,CAAC;IACF,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;AACjC,CAAC;AAED,SAAS,aAAa,CAAC,QAAwB,EAAE,GAAW;IAC1D,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,YAAY,CAAC,QAAwB,EAAE,GAAW;IACzD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAe;IAEf,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACrC,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACvC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,SAAS,CAAI,GAAW,EAAE,KAAa;IACpD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,MAAM,EAAE,kBAAkB;SAC3B;KACF,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,MAAM,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;AAClC,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAkB,EAClB,QAAgB,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE;IAElD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,OAAO,EAAE,KAAK;YACd,oBAAoB,EAAE,IAAI;YAC1B,WAAW,EAAE,MAAM;YACnB,KAAK,EAAE,iCAAiC;SACzC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxD,SAAS,CACP,GAAG,mBAAmB,2CAA2C,kBAAkB,CAAC,UAAU,CAAC,EAAE,EACjG,KAAK,CACN;YACD,SAAS,CACP,GAAG,mBAAmB,iCAAiC,kBAAkB,CAAC,UAAU,CAAC,sFAAsF,EAC3K,KAAK,CACN;SACF,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;QACxD,MAAM,OAAO,GAAuB;YAClC,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC;YACrC,eAAe,EAAE,aAAa,CAAC,QAAQ,EAAE,iBAAiB,CAAC;YAC3D,gBAAgB,EAAE,aAAa,CAAC,QAAQ,EAAE,mBAAmB,CAAC;YAC9D,UAAU,EAAE,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC;YAClD,qBAAqB,EAAE,0BAA0B,CAC/C,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,EAAE,KAAK,IAAI,EAAE,CAC/D;YACD,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC;SAC7C,CAAC;QAEF,MAAM,WAAW,GAAG,gBAAgB,CAClC,eAAe,CAAC,aAAa,EAAE,MAAM,CACtC,CAAC;QAEF,iDAAiD;QACjD,MAAM,oBAAoB,GACxB,OAAO,CAAC,gBAAgB,GAAG,CAAC,IAAI,OAAO,CAAC,eAAe,GAAG,CAAC,CAAC;QAE9D,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO;YACP,oBAAoB;YACpB,WAAW;SACZ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,KAAK;YACd,oBAAoB,EAAE,IAAI;YAC1B,WAAW,EAAE,MAAM;YACnB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;SACnB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/ai/src/plugins/security/trust-score.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Trust Score Calculation Engine
+ *
+ * Computes a 4-dimension weighted trust score (0–100) for a plugin based on
+ * security scan results, community data, maintenance activity, and transparency.
+ *
+ * Weights:
+ *   - Security posture  40%
+ *   - Community trust   30%
+ *   - Maintenance       20%
+ *   - Transparency      10%
+ *
+ * @module plugins/security/trust-score
+ * @version 1.0.0
+ * @date 2026-02-28
+ * @license MIT
+ */
+import type { TrustScore, VulnerabilityScanResult, SecretDetectionResult, CodeQualityResult, MalwareScanResult, SignatureVerificationResult, LicenseComplianceResult, SBOMResult } from './types.js';
+/**
+ * Inputs for the maintenance dimension.
+ * This data typically comes from the reputation database (not scan results).
+ */
+export interface MaintenanceInput {
+    /** Days since last commit (undefined = unknown) */
+    daysSinceLastCommit?: number;
+    /** Whether CI/CD is configured */
+    hasCiCd?: boolean;
+    /** Whether the repository is archived */
+    isArchived?: boolean;
+}
+/**
+ * Inputs for the community trust dimension.
+ * This data typically comes from the reputation database or marketplace ratings.
+ */
+export interface CommunityInput {
+    /** Weighted average star rating (0–5) */
+    starRating?: number;
+    /** Total number of ratings (higher count = more signal) */
+    ratingCount?: number;
+    /** Number of active incidents */
+    activeIncidents?: number;
+}
+export interface TrustScoreInput {
+    vulns: VulnerabilityScanResult;
+    secrets: SecretDetectionResult;
+    malware: MalwareScanResult;
+    codeQuality: CodeQualityResult;
+    sbom: SBOMResult;
+    signature: SignatureVerificationResult;
+    license: LicenseComplianceResult;
+    maintenance?: MaintenanceInput;
+    community?: CommunityInput;
+}
+/**
+ * Calculate the overall trust score for a plugin.
+ */
+export declare function calculateTrustScore(input: TrustScoreInput): TrustScore;
+//# sourceMappingURL=trust-score.d.ts.map

package/dist/ai/src/plugins/security/trust-score.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-score.d.ts","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/security/trust-score.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EACV,UAAU,EAEV,uBAAuB,EACvB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,uBAAuB,EACvB,UAAU,EACX,MAAM,YAAY,CAAC;AA0FpB;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kCAAkC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yCAAyC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AA2BD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAkDD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,uBAAuB,CAAC;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,OAAO,EAAE,iBAAiB,CAAC;IAC3B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,2BAA2B,CAAC;IACvC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,UAAU,CAqCtE"}