@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/security-runtime/src/agent/schema.mjs

@@ -0,0 +1,62 @@
+// Agent findings file (schemaVersion 1): validation with one clear message per problem, and the example shown in the brief.
+export const AREAS = ['access-control', 'supabase', 'payments', 'webhooks-integrations', 'input-handling', 'secrets-config', 'ai-features', 'privacy-account-recovery', 'mobile-expo', 'desktop-python', 'supply-chain'];
+export const AGENT_SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
+// Agents may not claim "confirmed": only vsg sets it, by running the reproduction test and seeing it fail.
+export const AGENT_CONFIDENCES = ['high', 'medium', 'low'];
+export const MAX_FINDINGS = 100;
+
+export const EXAMPLE = {
+  schemaVersion: 1,
+  agent: { name: 'your-agent-name', version: '1.2.3', model: 'the-model-id-you-run-on' },
+  findings: [{
+    title: 'Report download does not check that the report belongs to the caller\'s organization',
+    area: 'access-control',
+    severity: 'high',
+    confidence: 'high',
+    files: [{ path: 'app/api/reports/[id]/route.ts', line: 14 }],
+    scenario: 'Any signed-in user can request /api/reports/<id> with another organization\'s report id. The handler loads the report by id and returns it after checking only that a session exists.',
+    impact: 'Cross-tenant disclosure of report contents.',
+    fix: 'Load the report with the caller\'s organization id in the query (where id = $1 and org_id = $2) and return 404 when no row matches.',
+    reproduction: { type: 'test', command: 'node --test test/security/report-tenancy.test.mjs', testFile: 'test/security/report-tenancy.test.mjs' },
+  }],
+};
+
+/** Returns { errors: [string], value }. An empty errors list means the file is valid. */
+export function validateAgentFindings(doc) {
+  const errors = [];
+  const is = (c, m) => { if (!c) errors.push(m); return c; };
+  const str = (v, max = 4000) => typeof v === 'string' && v.trim().length > 0 && v.length <= max;
+  if (!is(doc && typeof doc === 'object' && !Array.isArray(doc), 'the file must be a JSON object')) return { errors };
+  is(doc.schemaVersion === 1, 'schemaVersion must be 1');
+  if (Object.hasOwn(doc, 'verdict')) errors.push('remove "verdict": only vsg issues verdicts');
+  if (is(doc.agent && typeof doc.agent === 'object', 'agent must be { name, version, model }')) {
+    for (const k of ['name', 'version', 'model']) is(str(doc.agent[k], 200), `agent.${k} must be a non-empty string`);
+  }
+  if (!is(Array.isArray(doc.findings), 'findings must be an array (use [] when nothing was found)')) return { errors };
+  is(doc.findings.length <= MAX_FINDINGS, `findings has ${doc.findings.length} entries; the limit is ${MAX_FINDINGS}`);
+  doc.findings.slice(0, MAX_FINDINGS).forEach((f, i) => {
+    const at = `findings[${i}]`;
+    if (!is(f && typeof f === 'object' && !Array.isArray(f), `${at} must be an object`)) return;
+    is(str(f.title, 200), `${at}.title must be a non-empty string of at most 200 characters`);
+    const validAreaText = is(str(f.area, 60), `${at}.area must be a non-empty string (one of ${AREAS.join(', ')})`);
+    if (validAreaText) is(AREAS.includes(f.area), `${at}.area must be one of ${AREAS.join(', ')}`);
+    is(AGENT_SEVERITIES.includes(f.severity), `${at}.severity must be one of ${AGENT_SEVERITIES.join(', ')}`);
+    if (f.confidence === 'confirmed') errors.push(`${at}.confidence cannot be "confirmed": vsg sets that itself when the reproduction test fails; use high, medium or low`);
+    else is(AGENT_CONFIDENCES.includes(f.confidence), `${at}.confidence must be one of ${AGENT_CONFIDENCES.join(', ')}`);
+    for (const k of ['scenario', 'impact', 'fix']) is(str(f[k]), `${at}.${k} must be a non-empty string`);
+    if (is(Array.isArray(f.files) && f.files.length > 0 && f.files.length <= 10, `${at}.files must list 1 to 10 { path, line } entries`)) {
+      f.files.forEach((x, j) => {
+        is(x && str(x.path, 500), `${at}.files[${j}].path must be a non-empty string`);
+        is(x && Number.isInteger(x.line) && x.line >= 1, `${at}.files[${j}].line must be a positive integer`);
+      });
+    }
+    if (is(f.reproduction && typeof f.reproduction === 'object', `${at}.reproduction must be { type, command, testFile }`)) {
+      const r = f.reproduction;
+      if (is(['test', 'none'].includes(r.type), `${at}.reproduction.type must be "test" or "none"`) && r.type === 'test') {
+        is(str(r.command, 1000), `${at}.reproduction.command must be a non-empty string when type is "test"`);
+        is(str(r.testFile, 500), `${at}.reproduction.testFile must be a non-empty string when type is "test"`);
+      }
+    }
+  });
+  return { errors, value: doc };
+}

package/dist/security-runtime/src/agent/tokenize.mjs

@@ -0,0 +1,38 @@
+// Command-string parser for agent reproduction commands and agentReview.command. It builds an argv array and never touches a shell:
+// shell operators are refused instead of interpreted, so nothing in the string can chain, redirect or substitute another command.
+// Rules: whitespace separates arguments; 'single quotes' are literal; "double quotes" allow \" and \\ escapes; outside quotes a
+// backslash is literal (Windows paths work); $VARIABLES and wildcards are NOT expanded.
+
+/** Returns { argv } or { error } (a short reason, suitable for a report). */
+export function tokenize(input) {
+  const s = String(input ?? '');
+  if (/[\r\n]/.test(s)) return { error: 'the command spans several lines' };
+  if (s.includes('`')) return { error: 'it contains the shell operator "`"' };
+  if (s.includes('$(')) return { error: 'it contains the shell operator "$("' };
+  const argv = [];
+  let cur = '';
+  let started = false;
+  let quote = null;
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (quote === "'") { if (c === "'") quote = null; else cur += c; continue; }
+    if (quote === '"') {
+      if (c === '\\' && (s[i + 1] === '"' || s[i + 1] === '\\')) cur += s[++i];
+      else if (c === '"') quote = null;
+      else cur += c;
+      continue;
+    }
+    if (c === "'" || c === '"') { quote = c; started = true; continue; }
+    if (c === ' ' || c === '\t') { if (started) { argv.push(cur); cur = ''; started = false; } continue; }
+    if ('|;<>&'.includes(c)) {
+      const two = s.slice(i, i + 2);
+      return { error: `it contains the shell operator "${two === '&&' || two === '||' || two === '>>' ? two : c}"` };
+    }
+    cur += c;
+    started = true;
+  }
+  if (quote) return { error: `a ${quote === '"' ? 'double' : 'single'} quote is not closed` };
+  if (started) argv.push(cur);
+  if (!argv.length) return { error: 'the command is empty' };
+  return { argv };
+}

package/dist/security-runtime/src/checks/README.md

@@ -0,0 +1,8 @@
+# Checks
+
+One directory per check: `src/checks/<id>/index.mjs`, discovered by directory scan at startup.
+
+Each module exports `{ id, title, modes, requiredIn, applies(ctx), run(ctx) }`. `run` returns
+`{ status: "ran" | "not_run" | "not_applicable", reason, findings, evidence, toolVersion?, dataVersions? }`.
+A thrown error, timeout or invalid finding becomes `not_run`. Check ids that the gate requires per mode are in
+`src/core/gate.mjs` (`REQUIRED_CHECKS`); the contract is in `docs/build-spec.md` (Architecture).

package/dist/security-runtime/src/checks/_lib/gitfiles.mjs

@@ -0,0 +1,35 @@
+// File lists from git for checks that read the working tree: tracked files plus untracked files that .gitignore does not hide.
+// Two things went wrong with one plain `git ls-files --cached --others` on a working copy that holds an installed project (a nested
+// node_modules is untracked and rarely ignored): the 32 MB output cap of the process runner cut the sorted list short (every file after
+// "sentry-local-agent-..." silently disappeared, including all of src/), and 200,000 dependency files were then stat-ed and read.
+// So untracked files below directories that never hold the project's own code are left out of git's walk, and a list that still
+// does not fit is reported as unusable instead of being used half-read.
+import { excludeNested } from '../../core/nested.mjs';
+
+/** Directories that are never the project's own code. Only untracked files inside them are left out; tracked files are always listed. */
+export const PRUNED_DIRS = ['node_modules', '.pnpm-store', '.venv', 'venv', '__pycache__', '.vsg'];
+export const MAX_LIST_BYTES = 256 * 1024 * 1024;
+
+const GIT = ['-c', 'core.fsmonitor=false', '--no-optional-locks'];
+const nul = (s) => s.split('\0').filter(Boolean).map((p) => p.replace(/\\/g, '/'));
+export const prunedSpecs = () => PRUNED_DIRS.map((d) => `:(exclude,glob)**/${d}/**`);
+
+/** Pathspec tail for an untracked listing: the whole tree, minus nested checkouts and the pruned directories. */
+export const untrackedSpecs = (nested) => {
+  const n = excludeNested(nested);
+  return [...(n.length ? n : ['--', '.']), ...prunedSpecs()];
+};
+
+/**
+ * { tracked: string[], untracked: string[] } (posix paths relative to ctx.repo), or null when git could not give a complete list
+ * (not a repository, a failure, or output over MAX_LIST_BYTES). Callers then fall back to a directory walk.
+ */
+export async function gitFileLists(ctx) {
+  const run = (args) => ctx.runProcess({ command: 'git', args: [...GIT, ...args], cwd: ctx.repo, timeoutMs: 120_000, maxOutputBytes: MAX_LIST_BYTES });
+  const [tracked, others] = await Promise.all([
+    run(['ls-files', '-z']),
+    run(['ls-files', '-z', '--others', '--exclude-standard', ...untrackedSpecs(ctx.nestedRepos)]),
+  ]);
+  const usable = (r) => r.status === 'ran' && r.exitCode === 0 && !r.truncated;
+  return usable(tracked) && usable(others) ? { tracked: nul(tracked.stdout), untracked: nul(others.stdout) } : null;
+}

package/dist/security-runtime/src/checks/_lib/lockfiles.mjs

@@ -0,0 +1,135 @@
+// Shared lockfile parsing for dep-change and sbom (REQ-010, REQ-020). Pure functions over lockfile text; nothing is installed or executed.
+// Supported: npm package-lock.json / npm-shrinkwrap.json (v1-v3), pnpm-lock.yaml (line-based, no YAML library),
+// Python requirements*.txt pinned lines, uv.lock and poetry.lock (simple TOML [[package]] tables).
+
+export const NPM_NAME = /^(?:@[a-z0-9~][a-z0-9._~-]*\/)?[a-z0-9~][a-z0-9._~-]*$/;
+export const PYPI_NAME = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+export const VERSION_SAFE = /^[A-Za-z0-9][A-Za-z0-9._+!-]*$/;
+const REGISTRY_HOSTS = ['https://registry.npmjs.org/', 'https://registry.yarnpkg.com/'];
+
+export const normPyName = (n) => n.toLowerCase().replace(/[-_.]+/g, '-');
+const base = (f) => f.slice(f.lastIndexOf('/') + 1);
+
+/** Which parser handles a repository-relative path, or null. */
+export function lockfileKind(file) {
+  const b = base(file);
+  if (b === 'package-lock.json' || b === 'npm-shrinkwrap.json') return 'npm-lock';
+  if (b === 'pnpm-lock.yaml') return 'pnpm-lock';
+  if (b === 'uv.lock') return 'uv-lock';
+  if (b === 'poetry.lock') return 'poetry-lock';
+  if (/^requirements.*\.txt$/.test(b)) return 'requirements';
+  return null;
+}
+
+// Each parser returns [{ name, version, ecosystem, direct?, skip? }]. `skip` is a reason when the package does not come from the public registry.
+
+export function parseNpmLock(text) {
+  const j = JSON.parse(text);
+  const out = [];
+  const skipFor = (resolved) => (resolved && !REGISTRY_HOSTS.some((h) => String(resolved).startsWith(h)) ? 'not from the public npm registry' : null);
+  if (j.packages && typeof j.packages === 'object') {
+    for (const [key, v] of Object.entries(j.packages)) {
+      if (key === '' || !v || v.link) continue;
+      const idx = key.lastIndexOf('node_modules/');
+      if (idx < 0) continue; // workspace package folders
+      const name = v.name ?? key.slice(idx + 'node_modules/'.length);
+      if (!v.version) continue;
+      out.push({ name, version: v.version, ecosystem: 'npm', top: key === `node_modules/${name}`, skip: skipFor(v.resolved), installScript: !!v.hasInstallScript });
+    }
+  } else if (j.dependencies && typeof j.dependencies === 'object') {
+    const walk = (deps, top) => {
+      for (const [name, v] of Object.entries(deps)) {
+        if (v?.version && !/^(file|link|git|github|https?):/.test(v.version)) out.push({ name, version: v.version, ecosystem: 'npm', top, skip: skipFor(v.resolved) });
+        if (v?.dependencies) walk(v.dependencies, false);
+      }
+    };
+    walk(j.dependencies, true);
+  }
+  return out;
+}
+
+const unquote = (s) => s.trim().replace(/^(['"])(.*)\1$/, '$2');
+
+export function parsePnpmLock(text) {
+  const out = [];
+  const lines = text.split(/\r?\n/);
+  let inPackages = false;
+  let entry = null;
+  const flush = () => {
+    if (!entry) return;
+    const k = entry.key.replace(/^\//, '').replace(/\(.*$/, '');
+    let name; let version;
+    let m = /^(@?[^@/]+(?:\/[^@/]+)?)@([^@]+)$/.exec(k); // v6 and v9: name@version
+    if (m) [, name, version] = m;
+    else if ((m = /^(@?[^/]+(?:\/[^/]+)?)\/([^/_]+)(?:_.*)?$/.exec(k))) [, name, version] = m; // v5: name/version
+    if (name && version && /^\d/.test(version)) {
+      const body = entry.body.join('\n');
+      const res = /^\s+resolution:.*$/m.exec(body)?.[0] ?? '';
+      const skip = /tarball:\s*(?!https:\/\/registry\.(npmjs\.org|yarnpkg\.com)\/)\S|type:\s*(git|directory)|\brepo:|\bdirectory:/.test(res)
+        ? 'not from the public npm registry' : null;
+      out.push({ name, version, ecosystem: 'npm', skip, installScript: /requiresBuild:\s*true/.test(body) });
+    }
+    entry = null;
+  };
+  for (const line of lines) {
+    if (/^\S/.test(line)) { flush(); inPackages = /^packages:\s*$/.test(line); continue; }
+    if (!inPackages) continue;
+    const key = /^ {2}(\S.*):\s*$/.exec(line);
+    if (key) { flush(); entry = { key: unquote(key[1]), body: [] }; continue; }
+    if (entry) entry.body.push(line);
+  }
+  flush();
+  return out;
+}
+
+/** Pinned requirements only (name==version). Unpinned lines are not parsed here (deps-vuln reports them). */
+export function parseRequirementsPinned(text) {
+  const out = [];
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.replace(/\s+#.*$/, '').trim();
+    if (!line || line.startsWith('#') || line.startsWith('-') || line.includes('://')) continue;
+    const m = /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*(?:\[[^\]]*\])?\s*===?\s*([A-Za-z0-9][A-Za-z0-9._+!-]*)\s*(?:;.*)?(?:\\)?$/.exec(line);
+    if (m && !/\*/.test(m[2])) out.push({ name: m[1], version: m[2], ecosystem: 'PyPI', direct: true });
+  }
+  return out;
+}
+
+/** uv.lock and poetry.lock: [[package]] tables with name and version lines. Non-registry sources are skipped. */
+export function parseTomlLock(text, kind) {
+  const out = [];
+  let cur = null;
+  const flush = () => {
+    if (cur?.name && cur.version) {
+      const skip = cur.skip ?? null;
+      out.push({ name: cur.name, version: cur.version, ecosystem: 'PyPI', skip });
+    }
+    cur = null;
+  };
+  let inSource = false;
+  for (const line of text.split(/\r?\n/)) {
+    if (/^\[\[package\]\]\s*$/.test(line)) { flush(); cur = {}; inSource = false; continue; }
+    if (/^\[/.test(line)) { inSource = /^\[package\.source\]/.test(line); if (!inSource && !/^\[package\./.test(line)) flush(); continue; }
+    if (!cur) continue;
+    let m;
+    if (!inSource && (m = /^name\s*=\s*"([^"]+)"/.exec(line))) cur.name = m[1];
+    else if (!inSource && (m = /^version\s*=\s*"([^"]+)"/.exec(line))) cur.version = m[1];
+    else if (kind === 'uv-lock' && (m = /^source\s*=\s*\{(.*)\}/.exec(line)) && !/registry\s*=\s*"https:\/\/pypi\.org\//.test(m[1])) cur.skip = 'not from PyPI';
+    else if (inSource && (m = /^type\s*=\s*"([^"]+)"/.exec(line)) && m[1] !== 'pypi') cur.skip = 'not from PyPI';
+  }
+  flush();
+  return out;
+}
+
+/** Parses one lockfile by kind. Throws on malformed JSON (callers record the file as unreadable). */
+export function parseLockfile(file, text) {
+  switch (lockfileKind(file)) {
+    case 'npm-lock': return parseNpmLock(text);
+    case 'pnpm-lock': return parsePnpmLock(text);
+    case 'requirements': return parseRequirementsPinned(text);
+    case 'uv-lock': return parseTomlLock(text, 'uv-lock');
+    case 'poetry-lock': return parseTomlLock(text, 'poetry-lock');
+    default: return null;
+  }
+}
+
+export const keyOf = (p) => `${p.ecosystem}:${p.ecosystem === 'PyPI' ? normPyName(p.name) : p.name}@${p.version}`;

package/dist/security-runtime/src/checks/_lib/osv.mjs

@@ -0,0 +1,6 @@
+// OSV-Scanner exclusions shared by deps-vuln, licenses and sbom. These run with --no-ignore, so .gitignore cannot hide dependency folders or
+// other checkouts: both are excluded explicitly. A plain value is an exact directory path relative to the working directory (verified on 2.6.0
+// with --help and a worktree fixture; "r:" and "g:" prefixes switch to regex and glob matching, so a path is never given a prefix).
+const ALWAYS = ['node_modules', '.venv', 'venv', '.vsg'];
+
+export const osvExcludeArgs = (ctx) => [...ALWAYS, ...(ctx.nestedRepos ?? []).map((n) => n.path)].flatMap((e) => ['--experimental-exclude', e]);