@kirrosh/zond 0.26.0 → 0.27.0

package/src/core/probe/security/orchestrator.ts

@@ -1,398 +0,0 @@
-/**
- * `zond probe-security <classes>` — live SSRF / CRLF / open-redirect probes.
- *
- * Mirrors the `probe-mass-assignment` shape: live runner, optional regression
- * YAML emission, idempotent cleanup. Where mass-assignment injects extra
- * suspect fields, this probe replaces a single benign field with a security
- * payload (SSRF / CRLF / open-redirect) and classifies the response.
- */
-import type { EndpointInfo, SecuritySchemeInfo } from "../../generator/types.ts";
-import { executeRequest } from "../../runner/http-client.ts";
-import {
-  classifyPostSemantics,
-  findDeleteCounterpart,
-  pathTouchesSeededVar,
-} from "../shared.ts";
-import {
-  buildBaselineFromSpec,
-  buildBodyAuthHeaders,
-  buildProbeUrl,
-  hasProbeBody,
-  serializeProbeBody,
-} from "../probe-harness.ts";
-import { detectFields, PAYLOADS } from "./detectors.ts";
-import {
-  restoreOriginal,
-  sendBaseline,
-  snapshotOriginal,
-} from "./baseline.ts";
-import { classify } from "./classify.ts";
-import { tryCleanup } from "./cleanup.ts";
-import type {
-  CleanupFeasibility,
-  ProbeStepOpts,
-  SecurityFieldHit,
-  SecurityProbeOptions,
-  SecurityProbeResult,
-  SecuritySeverity,
-  SecurityVerdict,
-} from "./types.ts";
-
-export async function runSecurityProbes(
-  opts: SecurityProbeOptions,
-): Promise<SecurityProbeResult> {
-  const verdicts: SecurityVerdict[] = [];
-  const warnings: string[] = [];
-  let totalEndpoints = 0;
-
-  // ARV-140: pre-flight cleanup-feasibility scan. For each POST target, look
-  // up the DELETE counterpart in the spec once. Without --allow-leaks any
-  // attack against a POST-without-DELETE is dropped — orphan tracker can't
-  // clean it (no DELETE path to retry) so it would linger in the user's
-  // tenant indefinitely (feedback round-01/02 Sentry: 18 manual cleanups).
-  const feasibility: CleanupFeasibility = {
-    status: {},
-    skippedNoCleanup: 0,
-    forcedNoCleanup: 0,
-    actionNoCleanupNeeded: 0,
-  };
-  for (const ep of opts.endpoints) {
-    if (ep.deprecated) continue;
-    if (ep.method.toUpperCase() !== "POST") continue;
-    const key = `POST ${ep.path}`;
-    // ARV-153: action POSTs (`/capture`, `/verify`, `/cancel`, …) don't
-    // allocate a new resource — there is nothing to DELETE. Attacking them
-    // without `--allow-leaks` is safe; classifying them up front prevents
-    // the feasibility pre-flight from masking 18/22 Stripe action endpoints.
-    const semantics = classifyPostSemantics(ep);
-    if (semantics === "action") {
-      feasibility.status[key] = "action";
-      feasibility.actionNoCleanupNeeded += 1;
-      continue;
-    }
-    const hasDelete = findDeleteCounterpart(ep, opts.endpoints) !== undefined;
-    feasibility.status[key] = hasDelete ? "has-delete" : "no-delete-counterpart";
-    if (!hasDelete) {
-      if (opts.allowLeaks) feasibility.forcedNoCleanup += 1;
-      else feasibility.skippedNoCleanup += 1;
-    }
-  }
-
-  for (const ep of opts.endpoints) {
-    if (ep.deprecated) continue;
-    const m = ep.method.toUpperCase();
-    if (m !== "POST" && m !== "PUT" && m !== "PATCH") continue;
-    totalEndpoints++;
-
-    // ARV-140: cleanup-feasibility gate. POST without a DELETE counterpart
-    // (and without --allow-leaks) is dropped before any live request fires.
-    // PUT/PATCH have snapshot/restore so they're unaffected here.
-    if (m === "POST" && !opts.allowLeaks) {
-      const status = feasibility.status[`POST ${ep.path}`];
-      if (status === "no-delete-counterpart") {
-        verdicts.push(skipped(ep, "skipped: no DELETE counterpart in spec (cleanup-feasibility pre-flight; pass --allow-leaks to override)"));
-        continue;
-      }
-    }
-
-    // TASK-264: --isolated guard. Mutation on a seeded fixture would corrupt
-    // user data the next `zond run` depends on; skip the endpoint instead.
-    if (opts.isolated && (m === "PUT" || m === "PATCH") && pathTouchesSeededVar(ep.path, opts.vars)) {
-      verdicts.push(skipped(ep, "skipped: --isolated mode protects seeded fixtures (PUT/PATCH on seeded path-params)"));
-      continue;
-    }
-
-    // ARV-161 (round-08 F18): parity with mass-assignment — accept
-    // application/x-www-form-urlencoded endpoints too. Stripe v1 declares
-    // user-controlled URL fields (webhook url, return_url, ...) only on
-    // form-encoded bodies; the previous JSON-only gate hid 78+ POSTs from
-    // SSRF/CRLF/open-redirect probing.
-    if (!hasProbeBody(ep)) {
-      verdicts.push(skipped(ep, "no JSON or form-urlencoded request body"));
-      continue;
-    }
-
-    const detected = detectFields(ep, opts.classes);
-    if (detected.length === 0) {
-      verdicts.push(skipped(ep, `no fields matched classes: ${opts.classes.join(",")}`));
-      continue;
-    }
-
-    if (opts.dryRun) {
-      verdicts.push({
-        method: m,
-        path: ep.path,
-        severity: "skipped",
-        summary: "dry-run: would attack " + detected.map(d => `${d.field}/${d.class}`).join(", "),
-        detectedFields: detected,
-        findings: [],
-        skipReason: "dry-run",
-      });
-      continue;
-    }
-
-    const verdict = await probeOneEndpoint(
-      ep,
-      opts.endpoints,
-      opts.securitySchemes,
-      opts.vars,
-      detected,
-      {
-        noCleanup: opts.noCleanup === true,
-        timeoutMs: opts.timeoutMs,
-        cleanupRetryDelaysMs: opts.cleanupRetryDelaysMs,
-        seedBody: opts.seedBodies?.get(`${ep.method.toUpperCase()} ${ep.path}`),
-      },
-    );
-    verdicts.push(verdict);
-  }
-
-  return {
-    classes: opts.classes,
-    totalEndpoints,
-    specProbed: verdicts.length,
-    verdicts,
-    warnings,
-    cleanupFeasibility: feasibility,
-  };
-}
-
-async function probeOneEndpoint(
-  ep: EndpointInfo,
-  allEndpoints: EndpointInfo[],
-  schemes: SecuritySchemeInfo[],
-  vars: Record<string, string>,
-  detected: SecurityFieldHit[],
-  opts: ProbeStepOpts,
-): Promise<SecurityVerdict> {
-  const m = ep.method.toUpperCase();
-  const verdict: SecurityVerdict = {
-    method: m,
-    path: ep.path,
-    severity: "ok",
-    summary: "",
-    detectedFields: detected,
-    findings: [],
-  };
-
-  // Build baseline body. Same recipe as mass-assignment: spec → generators → vars.
-  // ARV-269: agent-authored `seed_body` overlay wins when present.
-  const baseline = buildBaselineFromSpec(ep, vars, opts.seedBody);
-  if (baseline === null) {
-    return skipped(ep, "request body not a JSON object");
-  }
-
-  const { url, unresolved } = buildProbeUrl(ep, vars);
-  if (unresolved.length > 0) {
-    return skipped(ep, `cannot resolve path placeholders: ${unresolved.join(", ")}`);
-  }
-
-  // ARV-161: Content-Type follows the spec — form-urlencoded for Stripe v1,
-  // JSON otherwise. All outbound payloads in this function (baseline, per-
-  // attack, restore-PUT) flow through serializeProbeBody for matching wire
-  // encoding.
-  const headers = buildBodyAuthHeaders(ep, schemes, vars);
-
-  // ── Snapshot original state (TASK-151) ────────────────────────────────
-  // For PUT/PATCH we MUST capture original state before any mutation. The
-  // old DELETE-cleanup is wrong for rename'ы — it can't undo a renamed
-  // DSN-key / team-name / webhook URL. Snapshot first, restore after each
-  // 2xx. POST falls back to DELETE-cleanup (correct semantics there).
-  const isUpdate = m === "PUT" || m === "PATCH";
-  const snapshot = isUpdate && !opts.noCleanup
-    ? await snapshotOriginal(ep, allEndpoints, schemes, vars, opts)
-    : null;
-
-  // ── Baseline-OK gate ────────────────────────────────────────────────────
-  // Eliminates the "5 × 404" output the markdown template produced in the
-  // audit. If baseline isn't 2xx, attacks would just hit the same 4xx
-  // wall and tell us nothing.
-  const fullBaseline = await sendBaseline(ep, m, url, headers, baseline, opts);
-  if (fullBaseline.kind === "network") {
-    verdict.severity = "high";
-    verdict.summary = `baseline network error: ${fullBaseline.reason}`;
-    return verdict;
-  }
-  verdict.baseline = { status: fullBaseline.status };
-
-  // ── Partial-body fallback (TASK-152) ──────────────────────────────────
-  // common SaaS-style APIs accept partial PUT — full bodies
-  // generated from spec get rejected (422 / 400). Walking each detected
-  // field with a single-key body recovers the proven-HIGH cases that
-  // otherwise fall into INCONCLUSIVE-BASELINE.
-  let fullOk = fullBaseline.kind === "ok" && fullBaseline.status >= 200 && fullBaseline.status < 300;
-  const perFieldBaseline = new Map<string, Record<string, unknown>>();
-  if (!fullOk && isUpdate && fullBaseline.kind === "ok") {
-    for (const hit of detected) {
-      // Reuse spec value when present; otherwise fall back to the substituted
-      // generator output for the field. Either way the partial body has
-      // exactly one key, which is what partial-PUT APIs accept.
-      const partial: Record<string, unknown> = {};
-      if (hit.field in baseline) partial[hit.field] = baseline[hit.field];
-      else partial[hit.field] = "";
-      const partResp = await sendBaseline(ep, m, url, headers, partial, opts);
-      if (partResp.kind === "ok" && partResp.status >= 200 && partResp.status < 300) {
-        perFieldBaseline.set(hit.field, partial);
-      }
-    }
-    if (perFieldBaseline.size > 0 && snapshot) {
-      // Each successful partial baseline mutated only its single key; restore
-      // exactly those before attacks start.
-      await restoreOriginal(
-        ep, snapshot, headers, schemes, vars, opts, verdict,
-        perFieldBaseline.keys(),
-      );
-    }
-  }
-
-  if (!fullOk && perFieldBaseline.size === 0) {
-    // fullBaseline.kind === "network" was already returned above; here it
-    // must be "ok" with non-2xx status.
-    const status = fullBaseline.kind === "ok" ? fullBaseline.status : 0;
-    verdict.severity = "inconclusive-baseline";
-    verdict.summary = isUpdate
-      ? `baseline ${status} on full body; partial-body per-field also rejected — fixture/scope issue`
-      : `baseline ${status} — endpoint unreachable or fixture invalid; skipping attacks`;
-    return verdict;
-  }
-
-  // Cleanup state mutated by the (full) baseline, before issuing attacks.
-  // With a snapshot → restore PUT (full baseline mutated every key).
-  // Without snapshot → DELETE-counterpart (POST flow).
-  if (fullOk && fullBaseline.kind === "ok" && !opts.noCleanup) {
-    if (snapshot) {
-      await restoreOriginal(
-        ep, snapshot, headers, schemes, vars, opts, verdict,
-        Object.keys(baseline),
-      );
-    } else {
-      await tryCleanup(
-        ep, allEndpoints, schemes, vars,
-        fullBaseline.body, verdict, opts,
-      );
-    }
-  }
-
-  // ── Attacks ──────────────────────────────────────────────────────────────
-  for (const hit of detected) {
-    // Pick the body shape that this endpoint actually accepts.
-    let baseBody: Record<string, unknown> | undefined;
-    let mode: "full" | "partial" | "none" = "none";
-    if (fullOk) {
-      baseBody = baseline;
-      mode = "full";
-    } else if (perFieldBaseline.has(hit.field)) {
-      baseBody = perFieldBaseline.get(hit.field)!;
-      mode = "partial";
-    }
-
-    if (mode === "none" || !baseBody) {
-      // Field doesn't have a usable baseline body shape — record one
-      // INCONCLUSIVE per payload so the digest still exposes the field.
-      for (const payload of PAYLOADS[hit.class]) {
-        verdict.findings.push({
-          field: hit.field,
-          class: hit.class,
-          payload,
-          status: 0,
-          echoed: false,
-          severity: "inconclusive",
-          reason: "no baseline body shape accepted (full+partial both rejected)",
-        });
-      }
-      continue;
-    }
-
-    for (const payload of PAYLOADS[hit.class]) {
-      const body = { ...baseBody, [hit.field]: payload };
-      let resp;
-      try {
-        resp = await executeRequest(
-          { method: m, url, headers, body: serializeProbeBody(ep, body).content },
-          { timeout: opts.timeoutMs ?? 30000, retries: 0 },
-        );
-      } catch (err) {
-        verdict.findings.push({
-          field: hit.field,
-          class: hit.class,
-          payload,
-          status: 0,
-          echoed: false,
-          severity: "inconclusive",
-          reason: `network error: ${err instanceof Error ? err.message : String(err)}`,
-        });
-        continue;
-      }
-      const finding = classify(hit, payload, resp, { endpoint: ep });
-      // Annotate which body shape was used for this attack — useful for
-      // case-studies and emit-tests.
-      finding.reason = mode === "partial"
-        ? `${finding.reason} [partial-body]`
-        : finding.reason;
-      verdict.findings.push(finding);
-
-      // Per-finding cleanup. Snapshot path takes precedence — DELETE on a
-      // PUT-rename'd resource would wipe a live entity, restore-PUT puts
-      // it back to the captured original. Only restore the single field
-      // this attack mutated — sending a multi-key body trips
-      // `422 use partial PUT` on common SaaS-shaped APIs.
-      if (resp.status >= 200 && resp.status < 300 && !opts.noCleanup) {
-        if (snapshot) {
-          await restoreOriginal(
-            ep, snapshot, headers, schemes, vars, opts, verdict,
-            [hit.field],
-          );
-        } else {
-          await tryCleanup(
-            ep, allEndpoints, schemes, vars,
-            resp.body_parsed ?? resp.body, verdict, opts,
-          );
-        }
-      }
-    }
-  }
-
-  verdict.severity = rollupSecuritySeverity(verdict.findings);
-  verdict.summary = summaryLine(verdict);
-  return verdict;
-}
-
-/**
- * Roll up per-finding severities to the worst verdict-level severity.
- * ARV-253: "info" sits below "low" (single_signal sanitization-only).
- * ARV-254: "medium" sits between "high" and "low" (SSRF accept on an
- * endpoint declaring delivery). Exported so callers can recompute the
- * verdict rollup after adjusting individual finding severities.
- */
-export function rollupSecuritySeverity(
-  findings: readonly { severity: SecuritySeverity }[],
-): SecuritySeverity {
-  const severities = findings.map((f) => f.severity);
-  if (severities.includes("high")) return "high";
-  if (severities.includes("inconclusive")) return "inconclusive";
-  if (severities.includes("medium")) return "medium";
-  if (severities.includes("low")) return "low";
-  if (severities.includes("info")) return "info";
-  return "ok";
-}
-
-function summaryLine(v: SecurityVerdict): string {
-  const counts: Record<SecuritySeverity, number> = {
-    high: 0, medium: 0, low: 0, info: 0, inconclusive: 0, "inconclusive-baseline": 0, ok: 0, skipped: 0,
-  };
-  for (const f of v.findings) counts[f.severity]++;
-  const fields = Array.from(new Set(v.detectedFields.map(d => d.field))).join(", ");
-  return `fields=[${fields}] · HIGH=${counts.high} MED=${counts.medium} LOW=${counts.low} INFO=${counts.info} INCONCLUSIVE=${counts.inconclusive} OK=${counts.ok}`;
-}
-
-function skipped(ep: EndpointInfo, reason: string): SecurityVerdict {
-  return {
-    method: ep.method.toUpperCase(),
-    path: ep.path,
-    severity: "skipped",
-    summary: `skipped: ${reason}`,
-    detectedFields: [],
-    findings: [],
-    skipReason: reason,
-  };
-}

package/src/core/probe/security/regression.ts

@@ -1,103 +0,0 @@
-import type { EndpointInfo, SecuritySchemeInfo } from "../../generator/types.ts";
-import { generateFromSchema } from "../../generator/data-factory.ts";
-import type { RawStep, RawSuite } from "../../generator/serializer.ts";
-import { flattenToFormFields } from "../../runner/form-encode.ts";
-import {
-  captureFieldFor,
-  convertPath,
-  endpointStem,
-  findDeleteCounterpart,
-  getAuthHeaders,
-} from "../shared.ts";
-import type { SecurityProbeResult } from "./types.ts";
-
-const ATTACK_EXPECTED_STATUS = [400, 403, 404, 405, 409, 415, 422];
-
-function shortPayload(s: string): string {
-  return s.length > 40 ? s.slice(0, 37) + "…" : s;
-}
-
-export function emitSecurityRegressionSuites(
-  result: SecurityProbeResult,
-  endpoints: EndpointInfo[],
-  schemes: SecuritySchemeInfo[],
-): RawSuite[] {
-  const suites: RawSuite[] = [];
-  for (const v of result.verdicts) {
-    // ARV-247 (R-04/F18): `high` findings are 2xx-with-echoed-payload — the
-    // strongest regression signal we have. Skipping them meant CI had nothing
-    // to gate on for confirmed stored injections. Treat them like `ok` here:
-    // the suite locks in the *expected* state (attack rejected) once the API
-    // owner ships a fix, and fails loud while it's still broken.
-    if (v.severity !== "ok" && v.severity !== "low" && v.severity !== "high") continue;
-    const ep = endpoints.find(
-      e => e.path === v.path && e.method.toUpperCase() === v.method,
-    );
-    if (!ep) continue;
-    const suiteHeaders = getAuthHeaders(ep, schemes);
-    const tests: RawStep[] = [];
-    for (const f of v.findings) {
-      // `ok` = attack already rejected; `high` = attack accepted+echoed (the
-      // regression target is rejection, same expected set as `ok`). `low` =
-      // attack accepted but no echo — lock in the 2xx-without-echo shape.
-      const expected = (f.severity === "ok" || f.severity === "high") ? ATTACK_EXPECTED_STATUS : [200, 201, 202, 204];
-      const body = ep.requestBodySchema ? generateFromSchema(ep.requestBodySchema) : {};
-      if (typeof body === "object" && body !== null && !Array.isArray(body)) {
-        (body as Record<string, unknown>)[f.field] = f.payload;
-      }
-      // ARV-161: mirror mass-assignment-probe — emit `form:` instead of
-      // `json:` for form-urlencoded endpoints (Stripe v1), otherwise the
-      // regression suite gets rejected with 400 "check that your POST
-      // content type is application/x-www-form-urlencoded" and never
-      // exercises the actual attack vector.
-      const bodyField =
-        ep.requestBodyContentType === "application/x-www-form-urlencoded"
-          ? { form: flattenToFormFields(body) }
-          : { json: body };
-      const step: RawStep = {
-        name: `${f.class}: ${f.field}=${shortPayload(f.payload)} must ${f.severity === "ok" ? "be rejected" : "not echo"}`,
-        source: {
-          generator: "probe-security",
-          endpoint: `${v.method} ${v.path}`,
-          response_branch: expected.map(String).join("|"),
-        },
-        [v.method]: convertPath(ep.path),
-        ...bodyField,
-        expect: { status: expected },
-      };
-      tests.push(step);
-    }
-    if (tests.length === 0) continue;
-    // Attach a generic cleanup step keyed off `created_id` (only fires when
-    // a previous step captured one — same `always:true` semantics other
-    // probes use).
-    const delEp = findDeleteCounterpart(ep, endpoints);
-    if (delEp) {
-      const idField = captureFieldFor(ep);
-      tests[0]!.expect.body = { ...(tests[0]!.expect.body ?? {}), [idField]: { capture: "created_id" } };
-      const idParam = (delEp.path.match(/\{([^}]+)\}/) ?? [])[1] ?? "id";
-      const delStep: RawStep = {
-        name: "cleanup",
-        source: { generator: "probe-security-cleanup", endpoint: `DELETE ${delEp.path}` },
-        always: true,
-        DELETE: convertPath(delEp.path).replace(`{{${idParam}}}`, "{{created_id}}"),
-        expect: { status: [200, 202, 204, 404] },
-      } as RawStep & { always: boolean };
-      tests.push(delStep);
-    }
-    suites.push({
-      name: `probe-security ${v.method} ${v.path}`,
-      tags: ["probe-security", ...result.classes],
-      source: {
-        type: "probe-suite",
-        generator: "probe-security",
-        endpoint: `${v.method} ${v.path}`,
-      },
-      fileStem: `probe-security-${endpointStem(ep)}`,
-      base_url: "{{base_url}}",
-      ...(suiteHeaders ? { headers: suiteHeaders } : {}),
-      tests,
-    });
-  }
-  return suites;
-}

package/src/core/probe/security/types.ts

@@ -1,151 +0,0 @@
-import type { EndpointInfo, SecuritySchemeInfo } from "../../generator/types.ts";
-import type { SeedBodyConfig } from "../../generator/resources-builder.ts";
-import type { RecommendedAction } from "../../diagnostics/failure-hints.ts";
-
-export type SecurityClass = "ssrf" | "crlf" | "open-redirect";
-
-export const SECURITY_CLASSES: SecurityClass[] = ["ssrf", "crlf", "open-redirect"];
-
-/**
- * Security-probe severity ladder. Includes 'info' (ARV-253) for
- * sanitization-only signals (CRLF accept-without-reflection) and
- * 'medium' (ARV-254) for SSRF accept on endpoints declaring delivery
- * semantics. The full m-21 matrix governs the cap: HIGH requires
- * evidence_chain proof, OOB-backed SSRF lands here only when ARV-177
- * lifts.
- */
-export type SecuritySeverity =
-  | "high"
-  | "medium"
-  | "low"
-  | "info"
-  | "inconclusive"
-  | "inconclusive-baseline"
-  | "ok"
-  | "skipped";
-
-export interface SecurityFieldHit {
-  /** Field name in the request body. */
-  field: string;
-  /** Class that triggered (a field can hit multiple — we record all). */
-  class: SecurityClass;
-}
-
-export interface SecurityFinding {
-  field: string;
-  class: SecurityClass;
-  payload: string;
-  /** Raw HTTP status of the attack request. */
-  status: number;
-  /** Whether the response body echoes the payload (suggesting stored injection). */
-  echoed: boolean;
-  /** PASS / FAIL classification per finding. */
-  severity: SecuritySeverity;
-  reason: string;
-  /** TASK-294: agent-routable action. FAIL/WARN → `report_backend_bug`;
-   *  PASS → undefined (no action needed). */
-  recommended_action?: RecommendedAction;
-  /** Reserved suppression trace (audit-trail). Currently unset — the
-   *  agent triages severity from the raw finding. */
-  suppressed_by?: { source: string; rule_index: number; reason: string };
-}
-
-export interface SecurityVerdict {
-  method: string;
-  path: string;
-  /** Most-severe finding wins. */
-  severity: SecuritySeverity;
-  summary: string;
-  /** Field hits detected on this endpoint (some may have produced no findings). */
-  detectedFields: SecurityFieldHit[];
-  /** All attempted attacks. Empty for SKIPPED endpoints. */
-  findings: SecurityFinding[];
-  baseline?: { status: number };
-  cleanup?: {
-    attempted: boolean;
-    status?: number;
-    error?: string;
-    /** TASK-278: created resource id (slug/uuid/...) so `zond cleanup --orphans`
-     *  can retry DELETE without re-running the probe. */
-    id?: string | number;
-    /** TASK-278: concrete DELETE URL path with the id substituted. */
-    deletePath?: string;
-  };
-  skipReason?: string;
-}
-
-export interface SecurityProbeOptions {
-  endpoints: EndpointInfo[];
-  securitySchemes: SecuritySchemeInfo[];
-  vars: Record<string, string>;
-  classes: SecurityClass[];
-  noCleanup?: boolean;
-  timeoutMs?: number;
-  /** When true, only print which endpoints/fields would be attacked. */
-  dryRun?: boolean;
-  /**
-   * DELETE-cleanup retry delays in ms (round-5: handles eventual
-   * consistency between write replica and read replica). Default
-   * `[200, 1000]` — two retries on 404, total worst-case ~1.2s. Tests
-   * pass `[]` to disable; ops can pass longer for laggier replicas.
-   */
-  cleanupRetryDelaysMs?: number[];
-  /** TASK-264: when true, refuse to attack PUT/PATCH/DELETE endpoints whose
-   *  path-params are filled from `.env.yaml` (a.k.a. seeded fixtures). The
-   *  trade-off: lower coverage (those endpoints get SKIPPED), but a
-   *  guaranteed «probe doesn't mutate fixtures the user spent time
-   *  bootstrapping» property. POST endpoints still run — they create their
-   *  own resources, so isolation is automatic, with cleanup falling back to
-   *  the existing DELETE-counterpart + orphan-tracker flow (TASK-278). */
-  isolated?: boolean;
-  /** ARV-140: opt-in to attacks that have no cleanup path (POSTs without a
-   *  DELETE counterpart). By default we now skip them — round-01/02 Sentry
-   *  runs left ~18 manually-cleanable orphans in prod because the probe
-   *  happily POSTed to `/teams/`, `/symbol-sources/`, etc., where the spec
-   *  has no DELETE. The pre-flight feasibility map drops these unless the
-   *  caller explicitly accepts the leak. */
-  allowLeaks?: boolean;
-  /** ARV-269: agent-authored `seed_body` overlays from `.api-resources.local.yaml`,
-   *  keyed by `"METHOD /path"`. Wins over `generateFromSchema` when the
-   *  endpoint matches — see `MassAssignmentOptions.seedBodies` for the
-   *  rationale (strict APIs reject random-scalar baselines). */
-  seedBodies?: Map<string, SeedBodyConfig>;
-}
-
-/** ARV-140: cleanup-feasibility map. Built once before the live loop so
- *  every POST verdict can see whether the spec has a DELETE counterpart;
- *  the summary digest also reports counts for skipped/forced endpoints.
- *
- *  ARV-153 extends the status enum with "action": POSTs whose last path
- *  segment is a known action verb (`/capture`, `/verify`, `/cancel`, …)
- *  operate on an existing resource and never allocate a new one, so a
- *  DELETE counterpart isn't meaningful. These are attacked the same way
- *  as POSTs with a real DELETE — without `--allow-leaks` — because there
- *  is no resource to leak. */
-export interface CleanupFeasibility {
-  status: Record<string, "has-delete" | "no-delete-counterpart" | "action">;
-  skippedNoCleanup: number;
-  forcedNoCleanup: number;
-  /** ARV-153: POSTs we attacked even though no DELETE counterpart exists,
-   *  because the operation is semantically an action (no resource created). */
-  actionNoCleanupNeeded: number;
-}
-
-export interface SecurityProbeResult {
-  classes: SecurityClass[];
-  totalEndpoints: number;
-  specProbed: number;
-  verdicts: SecurityVerdict[];
-  warnings: string[];
-  /** ARV-140: cleanup-feasibility digest (POSTs without DELETE counterpart). */
-  cleanupFeasibility?: CleanupFeasibility;
-}
-
-/** Internal: per-step options shared between orchestrator/baseline/cleanup. */
-export interface ProbeStepOpts {
-  noCleanup: boolean;
-  timeoutMs?: number;
-  cleanupRetryDelaysMs?: number[];
-  /** ARV-269: optional `seed_body` overlay for this endpoint. */
-  seedBody?: SeedBodyConfig;
-}