@qa-ai-stlc/runner-security 0.0.0-stage → 1.8.0

package/dist/source-checkout.js

@@ -0,0 +1,140 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { posix } from 'node:path';
+import { assertRelativePath, resolveRelativePath, toRelativePath, } from '@qa-ai-stlc/core';
+export const DEFAULT_MAX_SOURCE_FILES = 3000;
+export const DEFAULT_MAX_SOURCE_FILE_SIZE_BYTES = 256 * 1024;
+// Directories that hold installed or generated code rather than what the team wrote. Their content
+// is somebody else's (or a copy of it), and walking them would bury the checkout's own files.
+const IGNORED_DIRECTORIES = new Set([
+    '.git',
+    'node_modules',
+    'dist',
+    'build',
+    'coverage',
+    '.next',
+    '.nuxt',
+    '.qa',
+    '.venv',
+    '__pycache__',
+    'vendor',
+    'target',
+]);
+const BINARY_EXTENSIONS = new Set([
+    '.png',
+    '.jpg',
+    '.jpeg',
+    '.gif',
+    '.webp',
+    '.ico',
+    '.bmp',
+    '.pdf',
+    '.zip',
+    '.gz',
+    '.tgz',
+    '.jar',
+    '.woff',
+    '.woff2',
+    '.ttf',
+    '.eot',
+    '.otf',
+    '.mp3',
+    '.mp4',
+    '.mov',
+    '.exe',
+    '.dll',
+    '.so',
+    '.map',
+]);
+// A NUL byte near the start is the usual sign of a file that is not text.
+const BINARY_SNIFF_BYTES = 1024;
+/**
+ * A read-only view of the application's source checkout (`source.path`). It exposes no write, so a
+ * code-assisted check cannot change the code it audits (AGENTS.md 12.4). The scan is bounded by a
+ * file count and a file size and says when it was cut short, so a clean result is never mistaken
+ * for a complete one.
+ */
+export class SourceCheckout {
+    /** Project-relative with `/` separators; `''` when the checkout is the project root itself. */
+    relativeRoot;
+    processRunner;
+    projectRoot;
+    fs;
+    maxFiles;
+    maxFileSizeBytes;
+    constructor(options) {
+        const normalizedRoot = posix.normalize(options.relativeRoot).replace(/\/$/u, '');
+        this.relativeRoot = normalizedRoot === '.' ? '' : normalizedRoot;
+        this.processRunner = options.processRunner;
+        this.projectRoot = options.projectRoot;
+        this.fs = options.fs;
+        this.maxFiles = options.maxFiles ?? DEFAULT_MAX_SOURCE_FILES;
+        this.maxFileSizeBytes = options.maxFileSizeBytes ?? DEFAULT_MAX_SOURCE_FILE_SIZE_BYTES;
+    }
+    /** The text files of the checkout in a stable order, without installed or generated directories. */
+    async scan() {
+        const root = this.absoluteDirectory(this.relativeRoot);
+        const candidates = (await this.fs.listFiles(root))
+            .map((absolutePath) => toRelativePath(this.projectRoot, absolutePath))
+            .filter((path) => this.isInsideRoot(path) && !this.isInIgnoredDirectory(path))
+            .sort();
+        const isTruncated = candidates.length > this.maxFiles;
+        const files = [];
+        let skippedCount = 0;
+        for (const path of candidates.slice(0, this.maxFiles)) {
+            const text = await this.readText(path);
+            if (text === undefined) {
+                skippedCount += 1;
+                continue;
+            }
+            files.push({ path, text });
+        }
+        return { files, isTruncated, skippedCount };
+    }
+    /** One file's text, or `undefined` when it is missing, binary or over the size limit. */
+    async readText(path) {
+        const absolutePath = resolveRelativePath(this.projectRoot, path);
+        if (BINARY_EXTENSIONS.has(posix.extname(path).toLowerCase()) ||
+            !(await this.fs.pathExists(absolutePath))) {
+            return undefined;
+        }
+        const bytes = await this.fs.readBytes(absolutePath);
+        if (bytes.length > this.maxFileSizeBytes || bytes.subarray(0, BINARY_SNIFF_BYTES).includes(0)) {
+            return undefined;
+        }
+        return Buffer.from(bytes).toString('utf-8');
+    }
+    /**
+     * The nearest directory, from the checkout's root up to the project root, that holds `fileName`:
+     * project-relative, `''` for the project root itself. A monorepo keeps one lockfile above the
+     * packages it covers.
+     */
+    async findDirectoryWith(fileName) {
+        let directory = this.relativeRoot;
+        for (;;) {
+            const candidate = directory === '' ? fileName : posix.join(directory, fileName);
+            if (await this.fs.pathExists(resolveRelativePath(this.projectRoot, assertRelativePath(candidate)))) {
+                return directory;
+            }
+            if (directory === '') {
+                return undefined;
+            }
+            const parent = posix.dirname(directory);
+            directory = parent === '.' ? '' : parent;
+        }
+    }
+    /** The absolute, OS-native path of a project-relative directory (`''` is the project root). */
+    absoluteDirectory(relativeDirectory) {
+        return relativeDirectory === ''
+            ? this.projectRoot
+            : resolveRelativePath(this.projectRoot, assertRelativePath(relativeDirectory));
+    }
+    isInsideRoot(path) {
+        return this.relativeRoot === '' || path.startsWith(`${this.relativeRoot}/`);
+    }
+    isInIgnoredDirectory(path) {
+        const relativeToRoot = (this.relativeRoot === '' ? path : path.slice(this.relativeRoot.length + 1)).split('/');
+        return relativeToRoot.slice(0, -1).some((segment) => IGNORED_DIRECTORIES.has(segment));
+    }
+}
+//# sourceMappingURL=source-checkout.js.map

package/dist/source-checkout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-checkout.js","sourceRoot":"","sources":["../src/source-checkout.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,GAGf,MAAM,kBAAkB,CAAC;AA2B1B,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAC7C,MAAM,CAAC,MAAM,kCAAkC,GAAG,GAAG,GAAG,IAAI,CAAC;AAE7D,mGAAmG;AACnG,8FAA8F;AAC9F,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IACvD,MAAM;IACN,cAAc;IACd,MAAM;IACN,OAAO;IACP,UAAU;IACV,OAAO;IACP,OAAO;IACP,KAAK;IACL,OAAO;IACP,aAAa;IACb,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;CACP,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,OAAO,cAAc;IACzB,+FAA+F;IACtF,YAAY,CAAS;IACrB,aAAa,CAAgB;IACrB,WAAW,CAAS;IACpB,EAAE,CAAa;IACf,QAAQ,CAAS;IACjB,gBAAgB,CAAS;IAE1C,YAAY,OAA8B;QACxC,MAAM,cAAc,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,YAAY,GAAG,cAAc,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;QACjE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,wBAAwB,CAAC;QAC7D,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,kCAAkC,CAAC;IACzF,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;aAC/C,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;aACrE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;aAC7E,IAAI,EAAE,CAAC;QACV,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC;QACtD,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,YAAY,IAAI,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IAC9C,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,QAAQ,CAAC,IAAkB;QAC/B,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACjE,IACE,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YACxD,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EACzC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CAAC,QAAgB;QACtC,IAAI,SAAS,GAAW,IAAI,CAAC,YAAY,CAAC;QAC1C,SAAS,CAAC;YACR,MAAM,SAAS,GAAG,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAChF,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnG,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACxC,SAAS,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,+FAA+F;IAC/F,iBAAiB,CAAC,iBAAyB;QACzC,OAAO,iBAAiB,KAAK,EAAE;YAC7B,CAAC,CAAC,IAAI,CAAC,WAAW;YAClB,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACnF,CAAC;IAEO,YAAY,CAAC,IAAY;QAC/B,OAAO,IAAI,CAAC,YAAY,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;IAC9E,CAAC;IAEO,oBAAoB,CAAC,IAAY;QACvC,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CACvG,GAAG,CACJ,CAAC;QACF,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACzF,CAAC;CACF"}

package/package.json

@@ -1,6 +1,38 @@
 {
   "name": "@qa-ai-stlc/runner-security",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.8.0",
+  "description": "On-demand, non-destructive black-box security audit: an authorization-gated probe, security checks and findings registered as evidence and defect drafts.",
+  "type": "module",
+  "license": "Apache-2.0",
+  "homepage": "https://github.com/Klim-101/QA-AI-STLC/tree/main/packages/runner-security#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Klim-101/QA-AI-STLC.git",
+    "directory": "packages/runner-security"
+  },
+  "bugs": "https://github.com/Klim-101/QA-AI-STLC/issues",
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "scripts": {
+    "pretypecheck": "npm run build --workspace @qa-ai-stlc/schemas --workspace @qa-ai-stlc/core --workspace @qa-ai-stlc/test-utils",
+    "typecheck": "tsc --noEmit -p .",
+    "pretest": "npm run build --workspace @qa-ai-stlc/schemas --workspace @qa-ai-stlc/core --workspace @qa-ai-stlc/test-utils",
+    "test": "vitest run",
+    "pretest:coverage": "npm run build --workspace @qa-ai-stlc/schemas --workspace @qa-ai-stlc/core --workspace @qa-ai-stlc/test-utils",
+    "test:coverage": "vitest run --coverage",
+    "build": "tsc -b tsconfig.build.json",
+    "clean": "node ../../scripts/clean-dir.mjs dist"
+  },
+  "dependencies": {
+    "@qa-ai-stlc/core": "1.8.0",
+    "@qa-ai-stlc/schemas": "1.8.0",
+    "zod": "4.6.5"
+  },
+  "devDependencies": {
+    "@qa-ai-stlc/test-utils": "0.0.0"
+  }
+}