@quantakrypto/core 0.4.0 → 0.4.2

package/src/redact.ts

@@ -12,20 +12,96 @@ import type { ContextLevel, RedactedContext } from "./agent-types.js";
 /** Lines of context on each side of the match at `snippet` level. */
 const SNIPPET_RADIUS = 8;
 
+/** The placeholder that replaces any redacted secret. */
+const REDACTED = "«redacted-secret»";
+
 /**
- * PEM blocks and long unbroken base64 runs (≥120 chars) are treated as secret
- * material and masked, even inside otherwise-shareable code.
+ * Text longer than this is not scanned pattern-by-pattern — we fail CLOSED
+ * (redact the whole thing). Bounds worst-case work and sidesteps any engine
+ * limit on pathological single-token runs.
  */
-const SECRET_RE =
-  /-----BEGIN [A-Z0-9 ]+-----[\s\S]*?-----END [A-Z0-9 ]+-----|[A-Za-z0-9+/]{120,}={0,2}/g;
+const MAX_SECRET_SCAN = 2_000_000;
 
-function stripSecrets(text: string): { text: string; redacted: boolean } {
+/**
+ * High-signal secret shapes. EVERY quantifier has an explicit upper bound so
+ * matching stays linear — no catastrophic backtracking and no regex-engine
+ * stack overflow on multi-megabyte runs (both were real DoS vectors with the
+ * old unbounded `{120,}` / `[\s\S]*?` patterns). Private-key BLOCKS are handled
+ * separately, line-by-line, so a truncated key (missing `-----END-----`) is
+ * still caught.
+ */
+const TOKEN_PATTERNS: readonly RegExp[] = [
+  /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g, // AWS access key id
+  /\bgh[posru]_[A-Za-z0-9]{20,255}\b/g, // GitHub token
+  /\bgithub_pat_[A-Za-z0-9_]{20,255}\b/g, // GitHub fine-grained PAT
+  /\bxox[baprs]-[A-Za-z0-9-]{10,255}\b/g, // Slack
+  /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,255}\b/g, // OpenAI
+  /\b[rs]k_live_[A-Za-z0-9]{20,255}\b/g, // Stripe
+  /\bAIza[A-Za-z0-9_-]{35}\b/g, // Google API key
+  /\bglpat-[A-Za-z0-9_-]{20,255}\b/g, // GitLab PAT
+  /\beyJ[A-Za-z0-9_-]{8,4096}\.[A-Za-z0-9_-]{8,4096}\.[A-Za-z0-9_-]{6,4096}\b/g, // JWT
+  // Assignment of a secret-looking key (.env / config lines).
+  /(?:secret|token|passwd|password|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)["'`]?\s*[:=]\s*["'`]?[^\s"'`,;]{6,4096}/gi,
+  /\b[0-9a-fA-F]{40,4096}\b/g, // long hex run (≥20 bytes)
+  /[A-Za-z0-9+/]{44,4096}={0,2}/g, // long base64 run (≥32 bytes)
+];
+
+/** Redact PEM/OpenSSH/PGP private-key blocks line-by-line (linear; tolerant of
+ * a missing END marker — a truncated key is still fully redacted). */
+function redactPrivateKeyBlocks(text: string): { text: string; redacted: boolean } {
+  const begin =
+    /-----BEGIN (?:[A-Z0-9 ]*PRIVATE KEY|OPENSSH PRIVATE KEY|PGP PRIVATE KEY BLOCK)-----/;
+  const end = /-----END /;
   let redacted = false;
-  const out = text.replace(SECRET_RE, () => {
-    redacted = true;
-    return "«redacted-secret»";
-  });
-  return { text: out, redacted };
+  let inKey = false;
+  const out: string[] = [];
+  for (const line of text.split("\n")) {
+    if (!inKey && begin.test(line)) {
+      inKey = true;
+      redacted = true;
+      out.push(REDACTED);
+      continue;
+    }
+    if (inKey) {
+      if (end.test(line)) inKey = false;
+      continue; // drop key-body / END lines
+    }
+    out.push(line);
+  }
+  return { text: out.join("\n"), redacted };
+}
+
+// Single-entry memo: same-file findings re-request the identical file content;
+// this makes the whole-file redaction O(n) across all of them instead of O(n·k).
+let memoInput: string | undefined;
+let memoResult: { text: string; redacted: boolean } | undefined;
+
+/** Replace every secret-looking token/block in `text` with {@link REDACTED}.
+ * Fails CLOSED: on oversized input or any error, the whole text is redacted. */
+function stripSecrets(text: string): { text: string; redacted: boolean } {
+  if (memoInput === text && memoResult) return memoResult;
+  let result: { text: string; redacted: boolean };
+  if (text.length > MAX_SECRET_SCAN) {
+    result = { text: REDACTED, redacted: true };
+  } else {
+    try {
+      const pem = redactPrivateKeyBlocks(text);
+      let out = pem.text;
+      let redacted = pem.redacted;
+      for (const re of TOKEN_PATTERNS) {
+        out = out.replace(re, () => {
+          redacted = true;
+          return REDACTED;
+        });
+      }
+      result = { text: out, redacted };
+    } catch {
+      result = { text: REDACTED, redacted: true };
+    }
+  }
+  memoInput = text;
+  memoResult = result;
+  return result;
 }
 
 /** Best-effort enclosing brace/colon block around a 0-based line index. */

package/src/remediation.ts

@@ -160,7 +160,24 @@ export function remediationForTier(
   const base = REMEDIATIONS[algorithm];
   const params = TIER_PARAMS[tier];
   // Confidentiality families lean on the KEM; signature families on the signer.
-  const primary = isConfidentialityFamily(algorithm) ? params.kem : params.signature;
+  const isConf = isConfidentialityFamily(algorithm);
+  const primary = isConf ? params.kem : params.signature;
+
+  // Category-5 (CNSA 2.0 / NSS) mandates the ML-KEM-1024 / ML-DSA-87 parameter
+  // sets and must NOT surface the category-3 X25519MLKEM768 hybrid (its PQC
+  // component is ML-KEM-768 — sub-CNSA). Lead with the mandated set; only point
+  // at a hybrid TLS group at the 1024 level (audit: quantum #1, crypto S5).
+  if (tier === "category-5") {
+    const hybridNote = isConf
+      ? " If a hybrid TLS group is required, use SecP384r1MLKEM1024 (draft-ietf-tls-ecdhe-mlkem) — not X25519MLKEM768, whose ML-KEM-768 component does not meet CNSA 2.0."
+      : "";
+    return {
+      algorithm,
+      recommendation: `${primary} — CNSA 2.0 mandates this parameter set (hybrids optional)`,
+      detail: `${base.detail} ${params.note} For CNSA 2.0 / national-security systems use ${params.kem} (KEM) and ${params.signature} (signatures).${hybridNote}`,
+    };
+  }
+
   return {
     algorithm,
     recommendation: `${base.recommendation} — ${tier}: ${primary}`,

package/src/scan.ts

@@ -118,7 +118,14 @@ export async function scan(options: ScanOptions): Promise<ScanResult> {
   const cacheFile = options.cacheFile;
   const ruleset = cacheFile ? rulesetFingerprint(dets, options.disabledRules) : "";
   const cache = cacheFile ? await loadCache(cacheFile, ruleset) : null;
-  const nextEntries: Map<string, CacheEntry> | null = cacheFile ? new Map() : null;
+  // A full scan starts with an empty next-cache so files that vanished are
+  // evicted. An INCREMENTAL scan (explicit `files` list) only visits a subset,
+  // so seed the next-cache with the existing entries — otherwise saving would
+  // drop every file we didn't happen to scan this run (audit: arch #4).
+  const incremental = Array.isArray(options.files);
+  const nextEntries: Map<string, CacheEntry> | null = cacheFile
+    ? new Map(incremental && cache ? cache : [])
+    : null;
 
   // Work-budget / cancellation controls (all optional, unlimited when omitted).
   const signal = options.signal;

package/src/types.ts

@@ -107,6 +107,13 @@ export interface VulnerableDependency {
   /** Algorithm families the package primarily exposes. */
   algorithms: AlgorithmFamily[];
   severity: Severity;
+  /**
+   * Explicit harvest-now-decrypt-later override. When omitted, HNDL is inferred
+   * from whether any listed family is a confidentiality family. Set `false` for
+   * signing-only packages (e.g. JWS/JWT libraries) that list RSA/EC as families
+   * but never do key transport or key agreement — signatures are not HNDL-exposed.
+   */
+  hndl?: boolean;
 }
 
 /**

package/src/version.ts

@@ -3,4 +3,4 @@
  * the scan orchestrator can import it without creating a cycle through index.ts.
  * Keep in sync with packages/core/package.json.
  */
-export const VERSION = "0.4.0";
+export const VERSION = "0.4.2";

package/src/worktree.ts

@@ -31,8 +31,10 @@ export async function withWorktree<T>(
   }
   const base = await mkdtemp(join(tmpdir(), "quantakrypto-wt-"));
   const dir = join(base, "wt");
-  await git(["worktree", "add", "--detach", dir], repoRoot);
+  // `worktree add` is INSIDE the try so a failure (locked index, disk full)
+  // still cleans up the temp dir in `finally` (audit: arch #6).
   try {
+    await git(["worktree", "add", "--detach", dir], repoRoot);
     return await fn(dir);
   } finally {
     try {
@@ -40,6 +42,12 @@ export async function withWorktree<T>(
     } catch {
       // best effort — the temp dir removal below still reclaims the disk.
     }
+    // Prune stale `.git/worktrees/<name>` metadata a failed add/remove can leave.
+    try {
+      await git(["worktree", "prune"], repoRoot);
+    } catch {
+      // best effort
+    }
     await rm(base, { recursive: true, force: true });
   }
 }