@metasession.co/devaudit-cli 0.3.28 → 0.3.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.3.28",
+  "version": "0.3.29",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@metasession.co/devaudit-plugin-sdk": "^0.3.28",
+    "@metasession.co/devaudit-plugin-sdk": "^0.3.29",
     "ajv": "^8.20.0",
     "commander": "^12.1.0",
     "consola": "^3.2.3",

package/sdlc/files/_common/scripts/evaluate-npm-audit.sh

@@ -161,78 +161,108 @@ accepted = []
 unresolved = []
 seen_advisories = set()
 
-for finding_name, finding in audit["vulnerabilities"].items():
+vulnerabilities = audit["vulnerabilities"]
+
+
+def concrete_advisories(finding_name, trail=()):
+    if finding_name in trail:
+        fail(f"audit vulnerability graph contains a cycle: {' -> '.join((*trail, finding_name))}")
+    finding = vulnerabilities.get(finding_name)
     if not isinstance(finding, dict):
-        fail(f"audit vulnerability {finding_name} must be an object")
+        fail(f"audit vulnerability {finding_name} is missing or is not an object")
     via = finding.get("via", [])
     if not isinstance(via, list):
         fail(f"audit vulnerability {finding_name} has invalid via data")
-    advisory_objects = [
-        item for item in via
-        if isinstance(item, dict) and item.get("severity") in ("high", "critical")
-    ]
-    if finding.get("severity") in ("high", "critical") and not advisory_objects:
-        fail(f"high/critical audit vulnerability {finding_name} has no resolvable advisory object")
-
-    nodes = finding.get("nodes", [])
-    if advisory_objects and (not isinstance(nodes, list) or not nodes):
-        fail(f"audit vulnerability {finding_name} has no installed package-lock node")
-
-    for advisory in advisory_objects:
-        package = advisory.get("dependency") or finding_name
-        advisory_range = advisory.get("range")
-        if not isinstance(package, str) or not package:
-            fail(f"advisory in {finding_name} has no package name")
-        if not isinstance(advisory_range, str) or not advisory_range:
-            fail(f"advisory {advisory_id(advisory)} has no vulnerable range")
-        identifier = advisory_id(advisory)
-        for node_path in nodes:
-            if not isinstance(node_path, str):
-                fail(f"advisory {identifier} has invalid package-lock node")
-            node = packages.get(node_path)
-            if not isinstance(node, dict) or not isinstance(node.get("version"), str):
-                fail(f"cannot resolve installed version for {node_path}")
-            if package_name_from_path(node_path) != package:
-                fail(f"audit package {package} does not match package-lock node {node_path}")
-            version = node["version"]
-            introduced_by = introducer_for(node_path, packages)
-            decision_key = (identifier, node_path)
-            if decision_key in seen_advisories:
-                continue
-            seen_advisories.add(decision_key)
-            context = {
-                "advisoryId": identifier,
-                "severity": advisory["severity"],
-                "package": package,
-                "vulnerableRange": advisory_range,
-                "vulnerableVersion": version,
-                "dependencyPath": node_path,
-                "introducedBy": introduced_by,
+
+    resolved = []
+    for index, item in enumerate(via):
+        if isinstance(item, str):
+            if item not in vulnerabilities:
+                fail(f"audit vulnerability {finding_name} references missing vulnerability {item}")
+            resolved.extend(concrete_advisories(item, (*trail, finding_name)))
+        elif isinstance(item, dict):
+            if item.get("severity") in ("high", "critical"):
+                resolved.append((finding_name, index, item))
+        else:
+            fail(f"audit vulnerability {finding_name} has invalid via entry")
+    return resolved
+
+
+advisory_sources = {}
+for finding_name, finding in vulnerabilities.items():
+    if not isinstance(finding, dict):
+        fail(f"audit vulnerability {finding_name} must be an object")
+    resolved = concrete_advisories(finding_name)
+    if finding.get("severity") in ("high", "critical") and not resolved:
+        fail(f"high/critical audit vulnerability {finding_name} has no reachable advisory object")
+    for source_name, source_index, advisory in resolved:
+        advisory_sources.setdefault((source_name, source_index), {
+            "advisory": advisory,
+            "affectedFindings": set(),
+        })["affectedFindings"].add(finding_name)
+
+for (source_name, _source_index), source in advisory_sources.items():
+    advisory = source["advisory"]
+    source_finding = vulnerabilities[source_name]
+    nodes = source_finding.get("nodes", [])
+    if not isinstance(nodes, list) or not nodes:
+        fail(f"audit vulnerability {source_name} has no installed package-lock node")
+
+    package = advisory.get("dependency") or source_name
+    advisory_range = advisory.get("range")
+    if not isinstance(package, str) or not package:
+        fail(f"advisory in {source_name} has no package name")
+    if not isinstance(advisory_range, str) or not advisory_range:
+        fail(f"advisory {advisory_id(advisory)} has no vulnerable range")
+    identifier = advisory_id(advisory)
+    for node_path in nodes:
+        if not isinstance(node_path, str):
+            fail(f"advisory {identifier} has invalid package-lock node")
+        node = packages.get(node_path)
+        if not isinstance(node, dict) or not isinstance(node.get("version"), str):
+            fail(f"cannot resolve installed version for {node_path}")
+        if package_name_from_path(node_path) != package:
+            fail(f"audit package {package} does not match package-lock node {node_path}")
+        version = node["version"]
+        introduced_by = introducer_for(node_path, packages)
+        decision_key = (identifier, node_path)
+        if decision_key in seen_advisories:
+            continue
+        seen_advisories.add(decision_key)
+        context = {
+            "advisoryId": identifier,
+            "severity": advisory["severity"],
+            "package": package,
+            "vulnerableRange": advisory_range,
+            "vulnerableVersion": version,
+            "dependencyPath": node_path,
+            "introducedBy": introduced_by,
+            "affectedFindings": sorted(source["affectedFindings"]),
+        }
+        match = next((item for item in validated_exceptions if all(
+            item[field] == context[field]
+            for field in ("advisoryId", "package", "vulnerableRange", "vulnerableVersion", "dependencyPath", "introducedBy")
+        )), None)
+        if match is None:
+            unresolved.append(context)
+            print(
+                f"Unaccepted {context['severity']} risk: {identifier} "
+                f"({package}@{version} at {node_path})",
+                file=sys.stderr,
+            )
+        else:
+            acceptance = {
+                field: match[field]
+                for field in ("approvedAt", "expiresAt", "approvedBy", "reason", "remediationIssue")
             }
-            match = next((item for item in validated_exceptions if all(
-                item[field] == context[field]
-                for field in ("advisoryId", "package", "vulnerableRange", "vulnerableVersion", "dependencyPath", "introducedBy")
-            )), None)
-            if match is None:
-                unresolved.append(context)
-                print(
-                    f"Unaccepted {context['severity']} risk: {identifier} "
-                    f"({package}@{version} at {node_path})",
-                    file=sys.stderr,
-                )
-            else:
-                acceptance = {
-                    field: match[field]
-                    for field in ("approvedAt", "expiresAt", "approvedBy", "reason", "remediationIssue")
-                }
-                if "compensatingControls" in match:
-                    acceptance["compensatingControls"] = match["compensatingControls"]
-                accepted.append({**context, "acceptance": acceptance})
-                print(
-                    f"Accepted temporary risk: {identifier} ({package}@{version}) "
-                    f"until {match['expiresAt']} by {match['approvedBy']}; "
-                    f"remediation {match['remediationIssue']}",
-                )
+            if "compensatingControls" in match:
+                acceptance["compensatingControls"] = match["compensatingControls"]
+            accepted.append({**context, "acceptance": acceptance})
+            print(
+                f"Accepted temporary risk: {identifier} ({package}@{version}) "
+                f"until {match['expiresAt']} by {match['approvedBy']}; "
+                f"remediation {match['remediationIssue']}",
+            )
 
 result = {
     "schemaVersion": 1,

package/sdlc/files/_common/scripts/evaluate-npm-audit.test.sh

@@ -40,6 +40,47 @@ write_empty_audit() {
   printf '{"vulnerabilities":{}}\n' > "$WORK/dependency-audit.json"
 }
 
+write_meta_audit() {
+  cat > "$WORK/dependency-audit.json" <<'JSON'
+{
+  "vulnerabilities": {
+    "eslint": {
+      "name": "eslint",
+      "severity": "high",
+      "via": ["@eslint/eslintrc"],
+      "nodes": ["node_modules/eslint"]
+    },
+    "@eslint/eslintrc": {
+      "name": "@eslint/eslintrc",
+      "severity": "high",
+      "via": ["minimatch"],
+      "nodes": ["node_modules/@eslint/eslintrc"]
+    },
+    "minimatch": {
+      "name": "minimatch",
+      "severity": "high",
+      "via": ["brace-expansion"],
+      "nodes": ["node_modules/@eslint/eslintrc/node_modules/minimatch"]
+    },
+    "brace-expansion": {
+      "name": "brace-expansion",
+      "severity": "high",
+      "via": [
+        {
+          "name": "brace-expansion",
+          "dependency": "brace-expansion",
+          "url": "https://github.com/advisories/GHSA-meta-chain",
+          "severity": "high",
+          "range": "<=5.0.7"
+        }
+      ],
+      "nodes": ["node_modules/@eslint/eslintrc/node_modules/brace-expansion"]
+    }
+  }
+}
+JSON
+}
+
 write_lock() {
   cat > "$WORK/package-lock.json" <<'JSON'
 {
@@ -53,6 +94,21 @@ write_lock() {
 JSON
 }
 
+write_meta_lock() {
+  cat > "$WORK/package-lock.json" <<'JSON'
+{
+  "lockfileVersion": 3,
+  "packages": {
+    "": {"name": "fixture"},
+    "node_modules/eslint": {"version": "9.0.0"},
+    "node_modules/@eslint/eslintrc": {"version": "3.0.0"},
+    "node_modules/@eslint/eslintrc/node_modules/minimatch": {"version": "9.0.0"},
+    "node_modules/@eslint/eslintrc/node_modules/brace-expansion": {"version": "2.0.1"}
+  }
+}
+JSON
+}
+
 write_exception() {
   cat > "$WORK/compliance/security/accepted-vulnerabilities.json" <<'JSON'
 {
@@ -193,4 +249,33 @@ write_exception
 printf '{not-json}\n' > "$WORK/compliance/security/accepted-vulnerabilities.json"
 expect_failure
 
+write_meta_audit
+write_meta_lock
+rm -f "$WORK/compliance/security/accepted-vulnerabilities.json"
+expect_failure
+jq -e '
+  .summary.unresolved == 1 and
+  .unresolved[0].advisoryId == "GHSA-meta-chain" and
+  .unresolved[0].dependencyPath == "node_modules/@eslint/eslintrc/node_modules/brace-expansion" and
+  .unresolved[0].affectedFindings == ["@eslint/eslintrc", "brace-expansion", "eslint", "minimatch"]
+' "$WORK/dependency-risk-evaluation.json" >/dev/null
+
+write_meta_audit
+jq '.vulnerabilities.minimatch.via = ["missing-package"]' \
+  "$WORK/dependency-audit.json" > "$WORK/changed.json"
+mv "$WORK/changed.json" "$WORK/dependency-audit.json"
+expect_failure
+
+write_meta_audit
+jq '.vulnerabilities["brace-expansion"].via = ["eslint"]' \
+  "$WORK/dependency-audit.json" > "$WORK/changed.json"
+mv "$WORK/changed.json" "$WORK/dependency-audit.json"
+expect_failure
+
+write_meta_audit
+jq '.vulnerabilities["brace-expansion"].via = []' \
+  "$WORK/dependency-audit.json" > "$WORK/changed.json"
+mv "$WORK/changed.json" "$WORK/dependency-audit.json"
+expect_failure
+
 echo "evaluate-npm-audit: PASS"

package/sdlc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-sdlc",
-  "version": "0.3.28",
+  "version": "0.3.29",
   "description": "DevAudit SDLC CLI Engine — cross-agent terminal-driven SDLC orchestrator.",
   "bin": {
     "devaudit-sdlc": "./src/bin/devaudit-sdlc.js"