@orionscanner/cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Chandra Hotha
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,248 @@
+# Orion Security Suite (v0.1.0)
+
+<p align="center">
+  <img src="assets/logo.png" alt="Orion Security Suite" width="420" />
+</p>
+
+<p align="center">
+  <strong>Proprietary In-House Code Intelligence, Static Application Security Testing (SAST) & Architecture Auditing Platform</strong>
+</p>
+
+<p align="center">
+  <img src="https://img.shields.io/badge/version-0.1.0-blue.svg" alt="Version 0.1.0" />
+  <img src="https://img.shields.io/badge/license-Proprietary%20%2F%20In--House-green.svg" alt="License" />
+  <img src="https://img.shields.io/badge/python-%3E%3D3.10-blue.svg" alt="Python Version" />
+  <img src="https://img.shields.io/badge/platform-Windows%20%7C%20Linux%20%7C%20macOS-lightgrey.svg" alt="Platform" />
+  <img src="https://img.shields.io/badge/architecture-100%25%20In--House%20Local-purple.svg" alt="Architecture" />
+</p>
+
+---
+
+## Executive Overview
+
+**Orion Security Suite** is a unified, enterprise-grade static analysis, software security, and architecture intelligence platform. Every auditing engine is **100% custom-built and developed in-house**, executing locally with zero third-party wrappers, zero external CLI subprocess dependencies, and zero telemetry.
+
+Orion operates on a unified **Intermediate Representation (IR)** graph, performing AST semantic analysis, Inter-Procedural Control Flow Graphs (CFG), Taint Propagation, AI/LLM agent defense, Cloud/IaC misconfiguration audits, and comprehensive PII/PCI-DSS privacy inspections.
+
+---
+
+## Key Capabilities & Highlights
+
+| Capability | Orion Engine Architecture |
+| :--- | :--- |
+| **100% In-House Local IP** | All AST visitors, taint trackers, heuristics, and tokenizers run natively in pure Python. |
+| **Comprehensive Scope** | Single unified run covering Application Security, Cloud/IaC, AI Prompt/Agent Defense, Code Quality, and Architecture. |
+| **Phased Indexing** | Clear, multi-phase AST indexing and CFG synthesis without jumpy animations or progress-bar console jitter. |
+| **Cross-Engine Deduplication** | Correlates and collapses overlapping findings across multiple engines with confidence scoring. |
+| **Executive Reports** | Generates self-contained HTML dashboards with one-click print/PDF layout, JSON findings catalog, and TXT summaries in `ORION SCANNER REPORTS/`. |
+| **Isolated Execution** | Async/await execution model with per-engine resource limits, sandboxing, and timeout protection. |
+
+---
+
+## Proprietary In-House Engine Suite
+
+Orion features a full matrix of specialized auditing engines grouped by domain:
+
+### 1. Application Security & Deep SAST
+- **DeepSAST™ (`sast`)**: Detects SQL Injection, XSS, Command Injection, SSRF, Path Traversal, Insecure Deserialization, and Weak Ciphers.
+- **TaintFlow™ (`taint`)**: Inter-procedural AST taint propagation tracking untrusted inputs to critical execution sinks.
+- **KeyVault™ (`secrets`)**: High-entropy token analysis and pattern matching for leaked API keys, private keys, and passwords.
+- **AuthGate™ (`authorization`)**: Route-level access control auditor verifying RBAC/ABAC enforcement across web frameworks.
+- **CryptoGuard™ (`crypto_guard`)**: Cryptographic posture validator flagging outdated algorithms (MD5, SHA1, DES, ECB mode).
+- **APIGuard™ (`api_security`)**: OWASP API Top 10 inspector auditing endpoint rate limiting, input validation, and JWT signatures.
+- **ContainerBreak™ (`sandbox_escape`)**: Detects sandbox escape vectors, unsafe reflection, `ctypes`, and dangerous native calls.
+
+### 2. AI, LLM & Threat Modeling
+- **AegisAgent™ (`llm_security` / `prompt_security`)**: Audits LLM applications for prompt injection, jailbreak attempts, unconstrained tool use, and insecure output handling.
+- **ThreatPulse™ (`threat_model`)**: Automated STRIDE threat modeling analyzing trust boundaries, unprotected persistence crossings, and cascading I/O.
+
+### 3. Privacy, Compliance & Supply Chain
+- **PrivacyShield™ (`sensitive_data`)**: Scans for PII, GDPR, HIPAA, and PCI-DSS violations with proprietary Luhn PAN validation and SSN detectors.
+- **DataBound™ (`data_residency`)**: Verifies data sovereignty and storage boundaries to prevent unauthorized geographic transfers.
+- **SBOMTracker™ (`supply_chain_sbom` / `deps`)**: In-house Software Bill of Materials (SBOM) generator and dependency vulnerability scanner.
+- **LicenseGuard™ (`license`)**: Scans for GPL/AGPL copyleft license contamination and license compatibility conflicts.
+- **ProvenanceTrace™ (`provenance`)**: Audits source code build integrity, commit signing indicators, and pipeline reproducibility.
+
+### 4. Code Quality, Standards & Reliability
+- **CognitivePulse™ (`complexity`)**: Computes cyclomatic complexity, cognitive load metrics, and deeply nested logic paths.
+- **CloneMatrix™ (`duplication`)**: Token-based duplicate code and structural redundancy detector.
+- **CleanSweep™ (`dead_import` / `orphan`)**: Identifies unreferenced symbols, orphan functions, and dead code stores.
+- **ResilienceGuard™ (`error_handling`)**: Detects empty exception handlers (`except: pass`), swallowed errors, and unhandled promises.
+- **CodeStandard™ (`lint`)**: Static code quality and best practices enforcement without stylistic noise.
+- **CoverageGuard™ (`test_coverage`)**: Heuristic test-to-code ratio and missing unit test coverage detector.
+
+### 5. Architecture, Dataflow & Performance
+- **CallGraph360™ (`callgraph`)**: Constructs comprehensive whole-program call graphs and dependency coupling hierarchies.
+- **FlowCFG™ (`cfg`)**: Builds control flow graphs to detect unreachable branches, infinite loops, and execution anomalies.
+- **SymbolMatrix™ (`symbol`)**: Analyzes symbol resolution, shadowed builtins, and scope collisions.
+- **DataFlowIR™ (`dataflow`)**: Intra-function data flow analyzer detecting use-before-def and uninitialized state.
+- **SpeedGuard™ (`perf_guard`)**: Identifies algorithmic performance anti-patterns, nested O(n²) loops, and unindexed lookups.
+- **RegressionShield™ (`regression`)**: Flags fragile patterns, runtime monkey patching, and unsafe reflection.
+- **WiringTrace™ (`wiring_trace`)**: Dependency injection and component wiring validator.
+- **StateGuard™ (`state`)**: Concurrency analysis detecting unprotected shared mutable state and race conditions.
+
+### 6. Cloud, IaC & Resilience
+- **CloudSentry™ (`container`)**: Dockerfile and container security analyzer (root execution, exposed daemon sockets, multi-stage builds).
+- **IaCGuard™ (`iac_security`)**: Terraform, CloudFormation, and Kubernetes manifest auditor for security group and IAM misconfigurations.
+- **ConfigPulse™ (`config_engine` / `config_validation`)**: Validates environment variables, `.env` hygiene, and application configuration drift.
+- **ChaosProbe™ (`chaos` / `chaos_config`)**: Injects fault tolerance simulations and verifies circuit breaker recovery mechanisms.
+- **NoiseFilter™ (`noise`)**: Machine-level false positive suppression and signal-to-noise optimization.
+- **HunterCore™ (`hunter`)**: Heuristic zero-day vulnerability hunter for unusual code patterns.
+- **FPLearn™ (`fp_learn`)**: Contextual learning feedback loop to minimize recurring false positives.
+
+---
+
+## Quick Start & Installation
+
+### Local Editable Installation
+
+```bash
+# Clone or navigate to the Orion Engine repository
+cd D:/Homeworks/Orion_Engine
+
+# Install in editable mode
+pip install -e .
+```
+
+### Verification
+
+```bash
+orion --help
+```
+
+---
+
+## Command Line Interface (CLI)
+
+Orion provides a formatted CLI with steady status reporting and dedicated sections for **Security Vulnerabilities** and **Code Quality Standards**:
+
+```bash
+# Run a full audit across all proprietary engines on current directory
+orion .
+
+# Audit a specific repository or file
+orion /path/to/project
+orion ./src/app.py
+
+# Specialized Targeted Scans:
+orion . --security       # Application Security & Deep SAST
+orion . --threat         # Automated STRIDE Threat Modeling & Privacy (PII)
+orion . --iac            # Infrastructure as Code & Container Security
+orion . --ai             # AI, LLM Prompt Security & Agent Defense
+orion . --quality        # Code Quality, Complexity & Linter
+orion . --architecture   # Call Graph, CFG & Data Flow Analysis
+orion . --supply-chain   # SBOM, Dependencies & License Auditing
+
+# Interactive Management Console:
+orion
+```
+
+---
+
+## Executive Reporting Outputs
+
+Every execution automatically cleans previous artifacts and produces three reports in `ORION SCANNER REPORTS/`:
+
+1. **`orion_executive_security_report.html`**:
+   - High-clarity executive security dashboard.
+   - Interactive severity (`Critical`, `High`, `Medium`, `Low`) and category filter tabs (`Security`, `Code Quality`, `Architecture`, `Supply Chain`).
+   - Clean, self-contained layout with zero external CSS/JS dependencies.
+   - Built-in **🖨️ Export PDF / Print Report** stylesheet optimized for executive presentations.
+2. **`orion_executive_security_report.json`**:
+   - Machine-readable structured findings catalog with metadata, CWE identifiers, confidence scores, and contributing engine attribution.
+3. **`orion_executive_security_report.txt`**:
+   - Clean plaintext audit summary ideal for CI/CD terminal logs and build pipelines.
+
+---
+
+## Python Programmatic API
+
+You can integrate Orion directly into custom Python pipelines:
+
+```python
+import asyncio
+from pathlib import Path
+from orion.engine import OrionEngine, EngineConfig, ResourceLimits
+from orion.engine.ir import OrionIR
+
+async def audit_codebase():
+    # 1. Initialize Orion Engine
+    engine = OrionEngine()
+
+    # 2. Build Intermediate Representation (IR)
+    file_path = Path("src/server.py")
+    ir = OrionIR(
+        content=file_path.read_bytes(),
+        metadata={
+            "path": str(file_path),
+            "language": "python",
+            "project_root": "."
+        }
+    )
+
+    # 3. Configure Execution Limits
+    config = EngineConfig(
+        resource_limits=ResourceLimits(
+            max_cpu_seconds=30,
+            max_memory_mb=256
+        )
+    )
+
+    # 4. Execute Engine Suite
+    result = await engine.run([ir], config)
+
+    # 5. Process Findings
+    print(f"Total Findings: {len(result.findings)}")
+    for finding in result.findings:
+        print(f"[{finding.severity.upper()}] {finding.title} ({finding.location})")
+        print(f"  Engine: {finding.engine} | Confidence: {finding.metadata.get('confidence')}")
+
+if __name__ == "__main__":
+    asyncio.run(audit_codebase())
+```
+
+---
+
+## Supported Languages & File Formats
+
+Orion automatically detects and audits:
+- **Languages**: Python (`.py`), JavaScript (`.js`, `.jsx`, `.mjs`), TypeScript (`.ts`, `.tsx`), Go (`.go`), Java (`.java`), Rust (`.rs`), Ruby (`.rb`), PHP (`.php`), C/C++ (`.c`, `.cpp`, `.h`), C# (`.cs`), Shell (`.sh`, `.bash`), SQL (`.sql`).
+- **Infrastructure & Configs**: Dockerfile, `docker-compose.yml`, Kubernetes manifests (`.yaml`, `.yml`), Terraform (`.tf`), GitHub Actions workflows (`.github/workflows/*.yml`), `.env` configuration files.
+- **Manifests & Dependencies**: `requirements.txt`, `pyproject.toml`, `Pipfile`, `package.json`, `package-lock.json`, `go.mod`, `Cargo.toml`, `pom.xml`.
+
+---
+
+## Project Structure
+
+```text
+Orion_Engine/
+├── assets/
+│   └── logo.png                       # Official Orion Emblem & Logo
+├── src/
+│   └── orion/
+│       └── engine/
+│           ├── core.py                # OrionEngine Core Coordinator
+│           ├── ir.py                  # Intermediate Representation (IR)
+│           ├── runner.py              # CLI Runner, Formatter & Report Generator
+│           ├── registry.py            # Dynamic In-House Engine Discovery
+│           ├── config.py              # Engine Configurations & Resource Limits
+│           ├── results.py             # Finding & EngineResult Data Models
+│           ├── sast/                  # DeepSAST™ Engine
+│           ├── taint/                 # TaintFlow™ Engine
+│           ├── secrets/               # KeyVault™ Engine
+│           ├── threat_model/          # ThreatPulse™ STRIDE Engine
+│           ├── sensitive_data/        # PrivacyShield™ PII/PCI Engine
+│           ├── llm_security/          # AegisAgent™ AI/LLM Security Engine
+│           ├── perf_guard/            # SpeedGuard™ Performance Engine
+│           ├── iac_security/          # IaCGuard™ Cloud/IaC Engine
+│           └── ...                    # (All in-house proprietary engines)
+├── ORION SCANNER REPORTS/             # Output Directory for Latest Generated Reports
+├── pyproject.toml                     # Package Configuration (v0.1.0)
+└── README.md                          # Documentation
+```
+
+---
+
+## License & Compliance
+
+Orion Security Suite is a proprietary, in-house developed codebase intelligence platform. All engines, AST visitors, and parsers are original intellectual property engineered to run self-contained on local infrastructure.

package/bin/orion.js

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+/**
+ * Orion Security Suite - Global NPM CLI Wrapper (v0.1.0)
+ * 100% In-House Code Intelligence & SAST Platform
+ */
+
+const { spawn } = require('child_process');
+const path = require('path');
+const fs = require('fs');
+
+const projectRoot = path.resolve(__dirname, '..');
+const args = process.argv.slice(2);
+
+function runPython(pythonCmd) {
+    const pythonEnv = Object.assign({}, process.env, {
+        PYTHONPATH: path.join(projectRoot, 'src') + (process.env.PYTHONPATH ? path.delimiter + process.env.PYTHONPATH : '')
+    });
+
+    const scriptPath = path.join(projectRoot, 'src', 'orion', 'engine', 'runner.py');
+    const child = spawn(pythonCmd, [scriptPath, ...args], {
+        stdio: 'inherit',
+        env: pythonEnv,
+        cwd: process.cwd()
+    });
+
+    child.on('error', (err) => {
+        if (pythonCmd === 'python3') {
+            runPython('python');
+        } else if (pythonCmd === 'python') {
+            runPython('py');
+        } else {
+            console.error('\x1b[31m✖ Error: Python 3.10+ is required to execute Orion Engine.\x1b[0m');
+            console.error('Please ensure Python is installed and added to your PATH environment variable.');
+            process.exit(1);
+        }
+    });
+
+    child.on('close', (code) => {
+        process.exit(code || 0);
+    });
+}
+
+// Start with standard python executable or python3
+if (process.platform === 'win32') {
+    runPython('python');
+} else {
+    runPython('python3');
+}

package/docs/API_REFERENCE.md

@@ -0,0 +1,211 @@
+# API Reference
+
+## Core Classes
+
+### OrionEngine
+Main orchestrator — single entry point for all 38 engines.
+
+```python
+from orion.engine import OrionEngine, EngineConfig, ResourceLimits
+from orion.engine.ir import OrionIR
+from pathlib import Path
+
+engine = OrionEngine()
+ir = OrionIR(content=code.encode(), metadata={"path": "app.py", "language": "python"})
+config = EngineConfig(resource_limits=ResourceLimits(max_cpu_seconds=60))
+
+result = await engine.run([ir], config)
+```
+
+**Methods:**
+- `register_engine(name: str, engine_cls: type)` — Register custom engine
+- `run(irs: List[OrionIR], config: EngineConfig) -> EngineResult` — Run all engines
+- `registered_count: int` — Number of registered engines
+
+### EngineConfig
+Configuration for scan execution.
+
+```python
+config = EngineConfig(
+    toggles={
+        "exclude": ["tests/", "vendor/", "*.min.js"],
+        "only_engines": ["sast", "secrets", "deps"],
+        "severity_threshold": "medium",
+    },
+    resource_limits=ResourceLimits(
+        max_cpu_seconds=120,
+        max_memory_mb=1024,
+        max_file_size_mb=10,
+        max_files=50000
+    ),
+    network_policy=NetworkPolicy(
+        allow_outbound=False,
+        allowed_hosts=[]
+    )
+)
+```
+
+### ResourceLimits
+Per-engine resource constraints.
+
+```python
+ResourceLimits(
+    max_cpu_seconds=60,      # Timeout per engine
+    max_memory_mb=512,       # Memory limit
+    max_file_size_mb=10,     # Max file size to scan
+    max_files=50000          # Max files per scan
+)
+```
+
+### NetworkPolicy
+Network access control.
+
+```python
+NetworkPolicy(
+    allow_outbound=False,    # Block external calls
+    allowed_hosts=[]         # Allowlist (if outbound enabled)
+)
+```
+
+### OrionIR
+Intermediate Representation — content-addressed, immutable.
+
+```python
+ir = OrionIR(
+    content=b"source code bytes",
+    metadata={
+        "path": "relative/path.py",
+        "language": "python",
+        "project_root": "/absolute/project/root"
+    }
+)
+
+# Properties
+ir.address  # SHA-256 hash (first 16 chars)
+ir.content  # Raw bytes
+ir.metadata # Dict with path, language, project_root
+```
+
+### EngineResult
+Aggregated scan results.
+
+```python
+result = EngineResult(
+    engine="orion",           # Orchestrator name
+    findings=[Finding, ...],  # List of findings
+    errors=["engine: error"], # Engine errors (silent to user)
+    metrics={                 # Scan metadata
+        "elapsed_s": 1.23,
+        "engines_run": 38,
+        "files_scanned": 150
+    },
+    ok=True                   # False if any engine errored
+)
+```
+
+### Finding
+Individual security/quality issue.
+
+```python
+finding = Finding(
+    engine="sast",                    # Source engine
+    severity="critical",              # critical|high|medium|low|info
+    title="SQL Injection",            # Short title
+    description="User input in SQL",  # Detailed description
+    location="app.py:42",             # file:line
+    metadata={                        # Evidence
+        "confidence": 0.95,           # 0.0-1.0
+        "snippet": "query = f\"...\"", # Code context
+        "cwe": "CWE-89",              # CWE ID
+        "cvss": 8.9,                  # CVSS score
+        "pattern": "sql_injection",   # Pattern name
+        "file": "app.py",             # File path
+        "line": 42                    # Line number
+    }
+)
+```
+
+## Engine Interface
+
+All engines implement this interface:
+
+```python
+class Engine:
+    name = "engine_name"
+    version = "1.0.0"
+    
+    async def check_availability(self) -> bool:
+        """Return True if engine can run."""
+        return True
+    
+    def resource_limits(self) -> ResourceLimits:
+        """Return resource limits for this engine."""
+        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=512)
+    
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        """Analyze a single IR."""
+        # Language detection
+        language = ir.metadata.get("language")
+        if isinstance(language, str):
+            language = Language(language.lower())
+        
+        # Route to language-specific analyzer
+        if language == Language.PYTHON:
+            return await self._run_python_ast(ir, config)
+        
+        # Universal regex fallback
+        return self.universal.run(ir, config)
+```
+
+## CLI Usage
+
+```bash
+# Interactive menu
+orion
+
+# Direct scan
+orion . --security      # Security engines only
+orion . --quality       # Quality engines only
+orion . --arch          # Architecture engines only
+orion .                 # Full audit (all 38 engines)
+orion path/to/file.py   # Single file
+orion ./my_project      # Directory scan
+
+# Config
+orion . --config-json '{"resource_limits":{"max_cpu_seconds":30}}'
+```
+
+## Reports
+
+Generated in `ORION SCANNER REPORTS/`:
+- `ScanType_target_timestamp.html` — Dark theme, sidebar, expandable findings, score/grade
+- `ScanType_target_timestamp.json` — Machine-readable
+- `ScanType_target_timestamp.txt` — Human-readable summary
+
+## Language Detection
+
+Automatic from file extension/filename:
+
+| Extension | Language |
+|-----------|----------|
+| `.py` | python |
+| `.js`, `.jsx`, `.mjs` | javascript |
+| `.ts`, `.tsx` | typescript |
+| `.java` | java |
+| `.go` | go |
+| `.rs` | rust |
+| `.php` | php |
+| `.rb` | ruby |
+| `.cs` | csharp |
+| `.html`, `.htm` | html |
+| `.css`, `.scss` | css |
+| `.yml`, `.yaml` | yaml |
+| `.json` | json |
+| `.toml` | toml |
+| `.xml` | xml |
+| `Dockerfile` | dockerfile |
+| `.sh` | shell |
+| `.ps1` | powershell |
+| `.md` | markdown |
+
+Special filenames: `Dockerfile`, `Makefile`, `package.json`, `requirements.txt`, `Cargo.toml`, `pom.xml`, `go.mod`, `composer.json`, `Gemfile`, `pyproject.toml`, `poetry.lock`, `yarn.lock`, `pnpm-lock.yaml`