@rafinery/cli 0.11.0 → 0.12.0

package/lib/audit/core.mjs

@@ -0,0 +1,488 @@
+// audit/core.mjs — the pure heart of `rafa audit` (finding shape rafa.audit/v1).
+//
+// Shared by TWO callers: lib/audit.mjs (the CLI command, local checkout) and
+// apps/agent's merge-time security node (no checkout — lockfile fetched via
+// GitHub MCC, OSV queried over HTTP). Because the agent deep-imports this file
+// (the lib/distiller/doctrine.mjs precedent), it must stay dependency-free and
+// I/O-free: pure (string|object) → object functions only — no fs, no
+// child_process, no fetch. All I/O lives in the callers.
+//
+// NO ASSUMPTIONS: a field a source does not provide is null, never guessed; a
+// tier that did not run says so structurally ({ran:false, reason}), never via
+// an empty findings list.
+
+export const AUDIT_SCHEMA = "rafa.audit/v1";
+
+export const SEVERITIES = ["critical", "high", "moderate", "low", "info"];
+const SEV_RANK = Object.fromEntries(SEVERITIES.map((s, i) => [s, i]));
+const TIER_ORDER = { dependency: 0, secret: 1, sast: 2 };
+
+// Bounded-concurrency map — shared control flow for the OSV detail fetches
+// (both callers cap at ~8). Pure orchestration; the fn does the I/O.
+export async function mapConcurrent(items, limit, fn) {
+  const out = new Array(items.length);
+  let i = 0;
+  const workers = Array.from({ length: Math.min(limit, items.length) || 0 }, async () => {
+    while (i < items.length) {
+      const idx = i++;
+      out[idx] = await fn(items[idx], idx);
+    }
+  });
+  await Promise.all(workers);
+  return out;
+}
+
+export function severityFromCvss(score) {
+  if (typeof score !== "number" || Number.isNaN(score)) return null;
+  if (score >= 9) return "critical";
+  if (score >= 7) return "high";
+  if (score >= 4) return "moderate";
+  if (score > 0) return "low";
+  return "info";
+}
+
+const normSeverity = (label) => {
+  const l = String(label ?? "").toLowerCase();
+  if (l === "critical") return "critical";
+  if (l === "high") return "high";
+  if (l === "moderate" || l === "medium") return "moderate";
+  if (l === "low") return "low";
+  return null;
+};
+
+// ---------------------------------------------------------------------------
+// pnpm-lock.yaml v9 — a rigid machine-emitted YAML subset; a line scanner is
+// enough and keeps the CLI at one runtime dep (no @pnpm/lockfile-file, whose
+// API churns with pnpm majors). Non-v9 lockfiles degrade honestly:
+// packages-only, no chain/dev classification.
+// ---------------------------------------------------------------------------
+
+const unquote = (s) => s.replace(/^['"]/, "").replace(/['"]$/, "");
+
+// "name@version(peerA@1)(peerB@2)" → { name, version } — peers stripped; the
+// last "@" before the peer suffix splits scoped names correctly.
+export function splitSnapshotKey(key) {
+  const base = unquote(key).replace(/\(.*$/, "");
+  const at = base.lastIndexOf("@");
+  if (at <= 0) return null; // "@scope/…" keeps its leading @; bare "@x" invalid
+  const name = base.slice(0, at);
+  const version = base.slice(at + 1);
+  if (!name || !version) return null;
+  return { name, version };
+}
+
+// version values inside snapshot dependency maps carry peer suffixes too:
+// "3.25.2(zod@3.25.76)" → "3.25.2". "link:…" (workspace) resolves to null.
+const cleanVersion = (v) => {
+  const s = unquote(String(v).trim()).replace(/\(.*$/, "");
+  return s.startsWith("link:") || s === "" ? null : s;
+};
+
+export function parsePnpmLock(text) {
+  const lines = String(text ?? "").split("\n");
+  const versionLine = lines.find((l) => l.startsWith("lockfileVersion:"));
+  const version = versionLine ? unquote(versionLine.split(":")[1].trim()) : null;
+
+  let section = null; // importers | packages | snapshots | other
+  let importer = null; // current importer path
+  let depKind = null; // dependencies | devDependencies | optionalDependencies
+  let importerDep = null; // current dep name inside an importer block
+  let snapshot = null; // current snapshot { name, version }
+  let snapDepBlock = false;
+
+  const importers = {}; // path → { prod: [{name,version}], dev: [{name,version}] }
+  const edges = new Map(); // "name@version" → [{name,version}]
+  const packages = new Map(); // "name@version" → {name,version}
+
+  for (const raw of lines) {
+    if (!raw.trim() || raw.trim().startsWith("#")) continue;
+    const indent = raw.length - raw.trimStart().length;
+    const line = raw.trim();
+
+    if (indent === 0) {
+      section = line.replace(/:$/, "");
+      importer = snapshot = importerDep = depKind = null;
+      snapDepBlock = false;
+      continue;
+    }
+
+    if (section === "importers") {
+      if (indent === 2 && line.endsWith(":")) {
+        importer = unquote(line.slice(0, -1));
+        importers[importer] = { prod: [], dev: [] };
+        depKind = null;
+      } else if (indent === 4 && line.endsWith(":")) {
+        const k = line.slice(0, -1);
+        depKind = ["dependencies", "devDependencies", "optionalDependencies"].includes(k) ? k : null;
+        importerDep = null;
+      } else if (indent === 6 && line.endsWith(":") && depKind) {
+        importerDep = unquote(line.slice(0, -1));
+      } else if (indent === 8 && importerDep && depKind && line.startsWith("version:")) {
+        const v = cleanVersion(line.slice("version:".length));
+        if (v) {
+          const entry = { name: importerDep, version: v };
+          (depKind === "devDependencies" ? importers[importer].dev : importers[importer].prod).push(entry);
+          packages.set(`${entry.name}@${entry.version}`, entry);
+        }
+      }
+      continue;
+    }
+
+    if (section === "snapshots") {
+      if (indent === 2 && line.endsWith(":")) {
+        snapshot = splitSnapshotKey(line.slice(0, -1));
+        snapDepBlock = false;
+        if (snapshot) {
+          const id = `${snapshot.name}@${snapshot.version}`;
+          packages.set(id, { name: snapshot.name, version: snapshot.version });
+          if (!edges.has(id)) edges.set(id, []);
+        }
+      } else if (indent === 4 && line.endsWith(":") && snapshot) {
+        snapDepBlock = ["dependencies:", "optionalDependencies:", "peerDependencies:"].includes(line)
+          ? line !== "peerDependencies:"
+          : false;
+      } else if (indent === 6 && snapshot && snapDepBlock) {
+        const at = line.indexOf(":");
+        if (at > 0) {
+          const name = unquote(line.slice(0, at).trim());
+          const v = cleanVersion(line.slice(at + 1));
+          if (v) {
+            const dep = { name, version: v };
+            edges.get(`${snapshot.name}@${snapshot.version}`).push(dep);
+            packages.set(`${name}@${v}`, dep);
+          }
+        }
+      }
+      continue;
+    }
+  }
+
+  const v9 = typeof version === "string" && version.startsWith("9");
+  return {
+    version,
+    packages: [...packages.values()],
+    importers: v9 ? importers : {},
+    edges: v9 ? edges : new Map(),
+  };
+}
+
+// BFS over the snapshot graph from the importer roots: shortest chain + the
+// direct flag + dev-only classification (dev=true iff reachable ONLY from
+// devDependency roots — an approximation the P3 rule tolerates: it downgrades,
+// never omits).
+export function classifyReachability(parsed) {
+  const info = new Map(); // "name@version" → { direct, dev, path }
+  const walk = (roots, dev) => {
+    const queue = roots.map((r) => ({ ...r, path: [`${r.name}@${r.version}`] }));
+    const seen = new Set();
+    while (queue.length) {
+      const cur = queue.shift();
+      const id = `${cur.name}@${cur.version}`;
+      if (seen.has(id)) continue;
+      seen.add(id);
+      const prev = info.get(id);
+      if (!prev) {
+        info.set(id, { direct: cur.path.length === 1, dev, path: cur.path });
+      } else if (prev.dev && !dev) {
+        prev.dev = false; // prod reachability wins
+        if (cur.path.length < prev.path.length) prev.path = cur.path;
+        if (cur.path.length === 1) prev.direct = true;
+      }
+      for (const dep of parsed.edges.get(id) ?? []) {
+        queue.push({ ...dep, path: [...cur.path, `${dep.name}@${dep.version}`] });
+      }
+    }
+  };
+  const prodRoots = [];
+  const devRoots = [];
+  for (const imp of Object.values(parsed.importers)) {
+    prodRoots.push(...imp.prod);
+    devRoots.push(...imp.dev);
+  }
+  walk(prodRoots, false);
+  walk(devRoots, true);
+  return info;
+}
+
+export function chainFor(pkg, reachability) {
+  const entry = reachability?.get(`${pkg.name}@${pkg.version}`);
+  if (!entry) return { direct: false, path: [] };
+  return { direct: entry.direct, path: entry.path };
+}
+
+// OSV querybatch bodies, chunked to the API's 1000-query page.
+export function buildOsvQueries(packages, chunkSize = 1000) {
+  const queries = packages.map((p) => ({
+    package: { name: p.name, ecosystem: "npm" },
+    version: p.version,
+  }));
+  const chunks = [];
+  for (let i = 0; i < queries.length; i += chunkSize) chunks.push(queries.slice(i, i + chunkSize));
+  return chunks;
+}
+
+const finding = (partial) => ({
+  id: null,
+  tier: null,
+  tool: null,
+  severity: "info",
+  cvss: null,
+  title: null,
+  detail: null,
+  refs: [],
+  vulnId: null,
+  aliases: [],
+  package: null,
+  chain: null,
+  fixedIn: null,
+  dev: null,
+  location: null,
+  ruleId: null,
+  fingerprint: null,
+  ...partial,
+});
+
+const cvssScoreOf = (vuln) => {
+  for (const s of vuln.severity ?? []) {
+    // OSV carries vectors; GHSA records also carry a numeric score on some
+    // mirrors. Only a NUMBER is usable — a vector is never "computed" here.
+    const n = Number(s.score);
+    if (!Number.isNaN(n) && n > 0) return n;
+  }
+  return null;
+};
+
+// Naive numeric semver compare — enough to rank fixed-version candidates.
+const cmpVersions = (a, b) => {
+  const pa = String(a).split(/[.+-]/).map(Number);
+  const pb = String(b).split(/[.+-]/).map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (!Number.isNaN(d) && d !== 0) return d;
+  }
+  return 0;
+};
+
+// An advisory often carries one range per affected major (3.x fixed at 3.15.0,
+// 4.x at 4.1.2). Report the HIGHEST fixed version — the branch a current
+// install upgrades toward; the advisory refs carry the per-range detail.
+const fixedInOf = (vuln, pkgName) => {
+  let best = null;
+  for (const aff of vuln.affected ?? []) {
+    if (aff.package?.name !== pkgName) continue;
+    for (const range of aff.ranges ?? []) {
+      for (const ev of range.events ?? []) {
+        if (ev.fixed && (best === null || cmpVersions(ev.fixed, best) > 0)) best = ev.fixed;
+      }
+    }
+  }
+  return best;
+};
+
+// osvResults: aligned with the query list — [{ vulns: [{id}] } | {}] per
+// package. vulnDetails: Map<id, full /v1/vulns/{id} record> (may be partial —
+// a detail the caller could not fetch yields a shallower finding, never a
+// guessed one).
+export function fromOsvBatch(osvResults, packages, vulnDetails, reachability) {
+  const out = [];
+  for (let i = 0; i < (osvResults ?? []).length; i++) {
+    const pkg = packages[i];
+    for (const hit of osvResults[i]?.vulns ?? []) {
+      const vuln = vulnDetails?.get?.(hit.id) ?? hit;
+      const cvss = cvssScoreOf(vuln);
+      const label = normSeverity(vuln.database_specific?.severity);
+      const chain = chainFor(pkg, reachability);
+      const entry = reachability?.get(`${pkg.name}@${pkg.version}`);
+      out.push(
+        finding({
+          id: `dependency:${hit.id}:${pkg.name}`,
+          tier: "dependency",
+          tool: "osv-api",
+          severity: label ?? severityFromCvss(cvss) ?? "info",
+          cvss,
+          title: vuln.summary ?? `${hit.id} in ${pkg.name}`,
+          detail: vuln.details ? String(vuln.details).slice(0, 2000) : null,
+          refs: (vuln.references ?? []).map((r) => r.url).filter(Boolean),
+          vulnId: hit.id,
+          aliases: vuln.aliases ?? [],
+          package: { name: pkg.name, version: pkg.version, ecosystem: "npm" },
+          chain,
+          fixedIn: fixedInOf(vuln, pkg.name),
+          dev: entry ? entry.dev : null,
+        }),
+      );
+    }
+  }
+  return out;
+}
+
+// pnpm audit --json → npm-audit-v1 advisories map.
+export function fromPnpmAudit(json, reachability) {
+  const out = [];
+  for (const adv of Object.values(json?.advisories ?? {})) {
+    const name = adv.module_name;
+    const ghsa = adv.github_advisory_id ?? (adv.url?.match(/GHSA-[a-z0-9-]+/i)?.[0] ?? null);
+    const vulnId = ghsa ?? (adv.cves?.[0] ?? `NPM-${adv.id}`);
+    const version = adv.findings?.[0]?.version ?? null;
+    const key = version ? `${name}@${version}` : null;
+    const entry = key ? reachability?.get(key) : null;
+    out.push(
+      finding({
+        id: `dependency:${vulnId}:${name}`,
+        tier: "dependency",
+        tool: "pnpm-audit",
+        severity: normSeverity(adv.severity) ?? "info",
+        cvss: typeof adv.cvss?.score === "number" && adv.cvss.score > 0 ? adv.cvss.score : null,
+        title: adv.title ?? `${vulnId} in ${name}`,
+        detail: adv.overview ? String(adv.overview).slice(0, 2000) : null,
+        refs: [adv.url].filter(Boolean),
+        vulnId,
+        aliases: adv.cves ?? [],
+        package: { name, version, ecosystem: "npm" },
+        chain: entry ? { direct: entry.direct, path: entry.path } : null,
+        fixedIn: adv.patched_versions && adv.patched_versions !== "<0.0.0" ? adv.patched_versions : null,
+        dev: entry ? entry.dev : null,
+      }),
+    );
+  }
+  return out;
+}
+
+// gitleaks JSON report rows. NEVER the secret bytes — RuleID + location +
+// gitleaks' own fingerprint only.
+export function fromGitleaks(rows) {
+  return (rows ?? []).map((r) =>
+    finding({
+      id: `secret:${r.RuleID}:${r.File}:${r.StartLine}`,
+      tier: "secret",
+      tool: "gitleaks",
+      severity: "high",
+      title: `${r.Description ?? r.RuleID} in ${r.File}`,
+      detail: `gitleaks rule ${r.RuleID} matched at ${r.File}:${r.StartLine}`,
+      location: { file: r.File, line: r.StartLine ?? null },
+      ruleId: r.RuleID,
+      fingerprint: r.Fingerprint ?? null,
+    }),
+  );
+}
+
+// Built-in secret matches — the caller runs SECRET_PATTERNS over tracked files
+// and hands rows {rule, severity, file, line, fingerprint} (fingerprint is a
+// hash the caller computed; the matched bytes never enter this module).
+export function fromRegexSecrets(rows) {
+  return (rows ?? []).map((r) =>
+    finding({
+      id: `secret:${r.rule}:${r.file}:${r.line}`,
+      tier: "secret",
+      tool: "regex-fallback",
+      severity: r.severity ?? "high",
+      title: `${r.title ?? r.rule} in ${r.file}`,
+      detail: `pattern ${r.rule} matched at ${r.file}:${r.line} (redacted)`,
+      location: { file: r.file, line: r.line },
+      ruleId: r.rule,
+      fingerprint: r.fingerprint ?? null,
+    }),
+  );
+}
+
+// semgrep SARIF (runs[0].results).
+export function fromSemgrepSarif(sarif) {
+  const out = [];
+  for (const run of sarif?.runs ?? []) {
+    for (const res of run.results ?? []) {
+      const loc = res.locations?.[0]?.physicalLocation;
+      const file = loc?.artifactLocation?.uri ?? "unknown";
+      const line = loc?.region?.startLine ?? null;
+      const severity =
+        res.level === "error" ? "high" : res.level === "warning" ? "moderate" : "low";
+      out.push(
+        finding({
+          id: `sast:${res.ruleId}:${file}:${line}`,
+          tier: "sast",
+          tool: "semgrep",
+          severity,
+          title: `${res.ruleId} at ${file}${line ? `:${line}` : ""}`,
+          detail: res.message?.text ? String(res.message.text).slice(0, 2000) : null,
+          location: { file, line },
+          ruleId: res.ruleId,
+        }),
+      );
+    }
+  }
+  return out;
+}
+
+// Curated built-in secret patterns — high-signal, low-noise. Each match is
+// reported by rule + location + fingerprint; the matched text itself is
+// redacted by the caller before anything leaves the process.
+export const SECRET_PATTERNS = [
+  { rule: "private-key-block", title: "Private key material", severity: "critical", re: /-----BEGIN (?:RSA |EC |OPENSSH |PGP |DSA )?PRIVATE KEY(?: BLOCK)?-----/ },
+  { rule: "aws-access-key-id", title: "AWS access key id", severity: "critical", re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/ },
+  { rule: "github-token", title: "GitHub token", severity: "critical", re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,255}\b|\bgithub_pat_[A-Za-z0-9_]{60,255}\b/ },
+  { rule: "stripe-live-key", title: "Stripe live secret key", severity: "critical", re: /\bsk_live_[0-9a-zA-Z]{20,}\b/ },
+  { rule: "slack-token", title: "Slack token", severity: "high", re: /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/ },
+  { rule: "google-api-key", title: "Google API key", severity: "high", re: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+  { rule: "npm-token", title: "npm token", severity: "high", re: /\bnpm_[A-Za-z0-9]{36}\b/ },
+  { rule: "anthropic-api-key", title: "Anthropic API key", severity: "critical", re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/ },
+  { rule: "openai-api-key", title: "OpenAI API key", severity: "critical", re: /\bsk-proj-[A-Za-z0-9_-]{20,}\b/ },
+  { rule: "generic-assigned-secret", title: "High-entropy assigned secret", severity: "high", entropy: 3.8, re: /(?:secret|token|password|api[_-]?key)\s*[:=]\s*["']([A-Za-z0-9+/_=-]{24,})["']/i },
+];
+
+export function entropyOf(s) {
+  if (!s) return 0;
+  const freq = {};
+  for (const c of s) freq[c] = (freq[c] ?? 0) + 1;
+  let e = 0;
+  for (const n of Object.values(freq)) {
+    const p = n / s.length;
+    e -= p * Math.log2(p);
+  }
+  return e;
+}
+
+// Merge findings from several sources: keyed by id; on collision keep the
+// richer record and the HIGHER severity (a source that knows more never loses
+// to one that knows less).
+export function dedupeFindings(findings) {
+  const byId = new Map();
+  for (const f of findings) {
+    const prev = byId.get(f.id);
+    if (!prev) {
+      byId.set(f.id, f);
+      continue;
+    }
+    const higher = SEV_RANK[f.severity] < SEV_RANK[prev.severity] ? f : prev;
+    const lower = higher === f ? prev : f;
+    byId.set(f.id, {
+      ...lower,
+      ...Object.fromEntries(Object.entries(higher).filter(([, v]) => v !== null && v !== undefined)),
+      severity: higher.severity,
+      refs: [...new Set([...(prev.refs ?? []), ...(f.refs ?? [])])],
+      aliases: [...new Set([...(prev.aliases ?? []), ...(f.aliases ?? [])])],
+    });
+  }
+  return [...byId.values()];
+}
+
+export function summarize(findings) {
+  const summary = { critical: 0, high: 0, moderate: 0, low: 0, info: 0, total: 0 };
+  for (const f of findings) {
+    summary[f.severity] = (summary[f.severity] ?? 0) + 1;
+    summary.total++;
+  }
+  return summary;
+}
+
+export function buildReport({ at, ref, tiers, findings }) {
+  const sorted = [...findings].sort(
+    (a, b) => SEV_RANK[a.severity] - SEV_RANK[b.severity] || TIER_ORDER[a.tier] - TIER_ORDER[b.tier] || a.id.localeCompare(b.id),
+  );
+  return {
+    schema: AUDIT_SCHEMA,
+    at: at ?? null,
+    ref: ref ?? null,
+    tiers,
+    summary: summarize(sorted),
+    findings: sorted,
+  };
+}