@securecode-ai/mcp 0.6.1 → 0.8.0

package/dist/attack/probeRules.js

@@ -0,0 +1,291 @@
+"use strict";
+/**
+ * Runtime probe verdict rules — port of api/src/services/sandboxRules.ts.
+ *
+ * Seven deterministic response rules (zero LLM) that evaluate whether a probe
+ * plan's attack request actually worked against the user's local dev server.
+ * Pure functions: (attack request, attack response, baseline) → verdict.
+ * No side effects, no I/O. Kept in semantic parity with the API's sandbox
+ * rules — the same inputs must yield the same verdicts and rule identifiers.
+ *
+ * Verdict vocabulary:
+ *   'confirmed-bypass' → PROVEN (the exploit worked)
+ *   'refuted'          → UNPROVEN (the control held)
+ *   'inconclusive'     → needs AI adjudicator
+ *   'spawn-failed'     → server never came up
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECRET_PATTERN = exports.REJECTION_STATUSES = void 0;
+exports.passesLuhn = passesLuhn;
+exports.applyProbeRules = applyProbeRules;
+exports.REJECTION_STATUSES = [400, 401, 403, 404, 405, 409, 415, 422, 429];
+const REJECTION_STATUS_SET = new Set(exports.REJECTION_STATUSES);
+exports.SECRET_PATTERN = '(' +
+    'sk-[A-Za-z0-9]{20,}' +
+    '|AKIA[0-9A-Z]{16}' +
+    '|ghp_[A-Za-z0-9]{36}' +
+    '|eyJ[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}' +
+    '|-----BEGIN [A-Z ]*PRIVATE KEY-----' +
+    '|password["\']?\\s*[:=]\\s*["\'][^"\']{4,}' +
+    '|api[_-]?key["\']?\\s*[:=]\\s*["\'][^"\']{8,}' +
+    '|secret["\']?\\s*[:=]\\s*["\'][^"\']{8,}' +
+    ')';
+const SECRET_REGEX_GLOBAL = new RegExp(exports.SECRET_PATTERN, 'gi');
+const EMAIL_REGEX = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
+const PHONE_REGEX = /(?:\+\d{1,3}[\s.-]\d{2,4}[\s.-]?\d{3,4}[\s.-]\d{3,4}|\(\d{3}\)\s?\d{3}[\s.-]\d{4}|\b\d{3}[\s.-]\d{3}[\s.-]\d{4}\b)/g;
+const CREDIT_CARD_REGEX = /\b(?:\d[ -]?){12,18}\d\b/g;
+const STACKTRACE_REGEX = /at\s+[A-Za-z0-9_.]+\s+\(.*?:\d+:\d+\)|Traceback \(most recent call last\)|\bError:\s.+\n\s+at\b|stack\s+trace/i;
+const MATCH_ANYTHING = new Set(['', '.*', '.+', '(.*)', '(.+)', '[\\s\\S]*', '[\\s\\S]+']);
+function isMatchAnything(pattern) {
+    return MATCH_ANYTHING.has(pattern.trim().replace(/^\^/, '').replace(/\$$/, ''));
+}
+function bodySignatureMatches(pattern, body) {
+    if (!pattern || isMatchAnything(pattern))
+        return false;
+    try {
+        return new RegExp(pattern, 'i').test(body);
+    }
+    catch {
+        return false;
+    }
+}
+function headerSignatureMatches(patterns, headers) {
+    if (!patterns)
+        return false;
+    const entries = Object.entries(patterns);
+    if (entries.length === 0)
+        return false;
+    const lower = {};
+    for (const [k, v] of Object.entries(headers))
+        lower[k.toLowerCase()] = v;
+    return entries.every(([name, regex]) => {
+        const value = lower[name.toLowerCase()];
+        if (value === undefined)
+            return false;
+        try {
+            return new RegExp(regex, 'i').test(value);
+        }
+        catch {
+            return false;
+        }
+    });
+}
+function passesLuhn(digits) {
+    if (digits.length < 13 || digits.length > 19)
+        return false;
+    let sum = 0, double = false;
+    for (let i = digits.length - 1; i >= 0; i--) {
+        let d = digits.charCodeAt(i) - 48;
+        if (double) {
+            d *= 2;
+            if (d > 9)
+                d -= 9;
+        }
+        sum += d;
+        double = !double;
+    }
+    return sum % 10 === 0;
+}
+function extractPii(text) {
+    const strong = new Set();
+    const weak = new Set();
+    for (const m of text.match(EMAIL_REGEX) || [])
+        strong.add(m);
+    for (const m of text.match(CREDIT_CARD_REGEX) || []) {
+        if (passesLuhn(m.replace(/[^0-9]/g, '')))
+            strong.add(m);
+    }
+    for (const m of text.match(PHONE_REGEX) || [])
+        weak.add(m);
+    return { strong, weak };
+}
+function newSecrets(baselineBody, attackBody) {
+    const baseMatches = new Set();
+    if (baselineBody) {
+        for (const m of baselineBody.match(SECRET_REGEX_GLOBAL) || [])
+            baseMatches.add(m);
+    }
+    SECRET_REGEX_GLOBAL.lastIndex = 0;
+    const attackMatches = new Set();
+    for (const m of attackBody.match(SECRET_REGEX_GLOBAL) || [])
+        attackMatches.add(m);
+    return [...attackMatches].filter(m => !baseMatches.has(m));
+}
+function samplePii(items) {
+    return items.slice(0, 3).join(', ') + (items.length > 3 ? ` (+${items.length - 3} more)` : '');
+}
+const NOT_CONFIRMED = { confirmed: false, reason: '' };
+function evaluateExploitSignature(request, attack) {
+    const basis = request.successConfirmedBy ?? 'signature';
+    if (basis === 'multi-request') {
+        return {
+            confirmed: false, reason: '',
+            declined: request.successEvidenceNeeded
+                || 'This vulnerability class cannot be decided from one request and one response.',
+        };
+    }
+    if (!request.successStatus || request.successStatus.length === 0)
+        return NOT_CONFIRMED;
+    if (!request.successStatus.includes(attack.statusCode))
+        return NOT_CONFIRMED;
+    if (basis === 'latency') {
+        const window = request.successLatencyMs;
+        if (!window || window.gte === undefined) {
+            return {
+                confirmed: false, reason: '',
+                declined: 'This class is detected by an induced delay, but the pattern declared no latency threshold.',
+            };
+        }
+        if (attack.latencyMs < window.gte)
+            return NOT_CONFIRMED;
+        if (window.lte !== undefined && attack.latencyMs > window.lte)
+            return NOT_CONFIRMED;
+        if (request.successBodyPattern && !isMatchAnything(request.successBodyPattern) &&
+            !bodySignatureMatches(request.successBodyPattern, attack.body))
+            return NOT_CONFIRMED;
+        return {
+            confirmed: true,
+            reason: `Response took ${attack.latencyMs}ms against the pattern's ${window.gte}ms threshold at status ${attack.statusCode}.`,
+        };
+    }
+    const hasBody = !!request.successBodyPattern && !isMatchAnything(request.successBodyPattern);
+    const hasHeaders = !!request.successHeaders && Object.keys(request.successHeaders).length > 0;
+    if (!hasBody && !hasHeaders) {
+        return {
+            confirmed: false, reason: '',
+            declined: 'The attack pattern declared no evidence beyond a status code, and status is what an ordinary endpoint returns.',
+        };
+    }
+    if (hasBody && !bodySignatureMatches(request.successBodyPattern, attack.body))
+        return NOT_CONFIRMED;
+    if (hasHeaders && !headerSignatureMatches(request.successHeaders, attack.headers))
+        return NOT_CONFIRMED;
+    const evidence = [
+        hasBody ? `body matching /${request.successBodyPattern}/` : '',
+        hasHeaders ? `headers matching ${JSON.stringify(request.successHeaders)}` : '',
+    ].filter(Boolean).join(' and ');
+    return {
+        confirmed: true,
+        reason: `Response matched the attack pattern's documented success signature (status ${attack.statusCode}, ${evidence}).`,
+    };
+}
+function applyProbeRules(attack, attackResp, baseline, baselineResp, env = process.env) {
+    if (!attackResp) {
+        return {
+            verdict: 'inconclusive', rule: 'none',
+            reason: 'Attack request errored — no response to evaluate.',
+        };
+    }
+    const expected = attack.expectedStatus || [];
+    // Auth-precheck
+    if (attack.authRequired && attackResp.statusCode === 200 &&
+        attack.authEnvVars && attack.authEnvVars.length > 0) {
+        const configured = attack.authEnvVars.every(v => !!env[v]);
+        if (!configured) {
+            return {
+                verdict: 'inconclusive', rule: 'auth-precheck',
+                reason: `Endpoint flagged auth-required but auth env (${attack.authEnvVars.join(', ')}) is not set in the sandbox.`,
+            };
+        }
+    }
+    // Rule 0: exploit signature
+    const signature = evaluateExploitSignature(attack, attackResp);
+    if (signature.confirmed) {
+        return { verdict: 'confirmed-bypass', rule: 'exploit-signature', reason: signature.reason, requiredEvidence: ['exploit-signature-matched'] };
+    }
+    // Rule 1: status mismatch
+    if (expected.length > 0 && !expected.includes(attackResp.statusCode)) {
+        const predictedBlocked = expected.every(s => s === 401 || s === 403 || s === 404 || s >= 500);
+        if (predictedBlocked && attackResp.statusCode >= 200 && attackResp.statusCode < 300) {
+            return {
+                verdict: 'confirmed-bypass', rule: 'status-mismatch',
+                reason: `Predicted blocked (${expected.join('/')}) but got ${attackResp.statusCode}.`,
+                requiredEvidence: ['baseline-returned-blocked-status', 'exploit-returned-success-status'],
+            };
+        }
+    }
+    // Rule 2: auth bypass
+    if (baselineResp && (baselineResp.statusCode === 401 || baselineResp.statusCode === 403) &&
+        attackResp.statusCode >= 200 && attackResp.statusCode < 300) {
+        if (!attackResp.body || attackResp.body.trim().length === 0) {
+            return {
+                verdict: 'inconclusive', rule: 'auth-bypass',
+                reason: `Baseline returned ${baselineResp.statusCode}, attack returned ${attackResp.statusCode}, but response body is empty — cannot confirm protected resource was accessed.`,
+            };
+        }
+        return {
+            verdict: 'confirmed-bypass', rule: 'auth-bypass',
+            reason: `Baseline returned ${baselineResp.statusCode}, attack returned ${attackResp.statusCode} with ${attackResp.body.length} bytes of response body.`,
+            requiredEvidence: ['baseline-returned-auth-error', 'exploit-returned-success', 'response-body-non-empty'],
+        };
+    }
+    // Rule 3: secret leak
+    const leakedSecrets = newSecrets(baselineResp?.body ?? null, attackResp.body);
+    if (leakedSecrets.length > 0) {
+        return {
+            verdict: baselineResp ? 'confirmed-bypass' : 'inconclusive', rule: 'secret-leak',
+            reason: baselineResp
+                ? 'Attack response body contains a secret that the baseline did not return.'
+                : 'Attack response body matches a secret pattern, but there is no baseline.',
+            requiredEvidence: ['baseline-no-secret', 'exploit-secret-present'],
+        };
+    }
+    // Rule 4: PII leak
+    const atkPii = extractPii(attackResp.body);
+    if (baselineResp) {
+        const basePii = extractPii(baselineResp.body);
+        const leakedStrong = [...atkPii.strong].filter(p => !basePii.strong.has(p));
+        if (leakedStrong.length > 0) {
+            return {
+                verdict: 'confirmed-bypass', rule: 'pii-leak',
+                reason: `Attack response leaked PII not present in baseline: ${samplePii(leakedStrong)}.`,
+            };
+        }
+        const leakedWeak = [...atkPii.weak].filter(p => !basePii.weak.has(p));
+        if (leakedWeak.length > 0) {
+            return {
+                verdict: 'inconclusive', rule: 'pii-leak',
+                reason: `Attack response contains phone-shaped values absent from the baseline (${samplePii(leakedWeak)}).`,
+            };
+        }
+    }
+    else if (atkPii.strong.size > 0 || atkPii.weak.size > 0) {
+        return {
+            verdict: 'inconclusive', rule: 'pii-leak',
+            reason: 'Attack response contains PII, but there is no baseline to tell a leak from normal output.',
+        };
+    }
+    // Rule 5: stacktrace disclosure
+    if (attackResp.statusCode >= 500 && STACKTRACE_REGEX.test(attackResp.body)) {
+        return {
+            verdict: 'inconclusive', rule: 'stacktrace-disclosure',
+            reason: `Server returned ${attackResp.statusCode} with a stack trace — info leak.`,
+        };
+    }
+    // Rule 6: blocked
+    if (expected.length > 0 && expected.includes(attackResp.statusCode)) {
+        return {
+            verdict: 'refuted', rule: 'blocked',
+            reason: `Attack returned ${attackResp.statusCode} (expected ${expected.join('/')}) with no leak — the control held.`,
+        };
+    }
+    if (attack.successStatus && attack.successStatus.length > 0 &&
+        REJECTION_STATUS_SET.has(attackResp.statusCode)) {
+        return {
+            verdict: 'refuted', rule: 'blocked',
+            reason: `Attack was rejected with ${attackResp.statusCode} and never matched its success signature — the payload does not work.`,
+        };
+    }
+    // Fallback
+    if (signature.declined) {
+        return {
+            verdict: 'inconclusive', rule: 'none',
+            reason: `Not confirmable from a single request (status ${attackResp.statusCode}). ${signature.declined}`,
+        };
+    }
+    return {
+        verdict: 'inconclusive', rule: 'none',
+        reason: `No deterministic rule fired (status ${attackResp.statusCode}, no leak detected).`,
+    };
+}
+//# sourceMappingURL=probeRules.js.map

package/dist/attack/probeRules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probeRules.js","sourceRoot":"","sources":["../../src/attack/probeRules.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAuFH,gCAUC;AAuFD,0CAqIC;AAzRY,QAAA,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAEhF,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,0BAAkB,CAAC,CAAC;AAE5C,QAAA,cAAc,GACvB,GAAG;IACH,qBAAqB;IACrB,mBAAmB;IACnB,sBAAsB;IACtB,kEAAkE;IAClE,qCAAqC;IACrC,4CAA4C;IAC5C,+CAA+C;IAC/C,0CAA0C;IAC1C,GAAG,CAAC;AACR,MAAM,mBAAmB,GAAG,IAAI,MAAM,CAAC,sBAAc,EAAE,IAAI,CAAC,CAAC;AAE7D,MAAM,WAAW,GAAG,iDAAiD,CAAC;AACtE,MAAM,WAAW,GACb,qHAAqH,CAAC;AAC1H,MAAM,iBAAiB,GAAG,2BAA2B,CAAC;AACtD,MAAM,gBAAgB,GAClB,gHAAgH,CAAC;AAErH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAE3F,SAAS,eAAe,CAAC,OAAe;IACpC,OAAO,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,oBAAoB,CAAC,OAA2B,EAAE,IAAY;IACnE,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,CAAC;QAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC/E,CAAC;AAED,SAAS,sBAAsB,CAC3B,QAA4C,EAC5C,OAA+B;IAE/B,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;IACzE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,CAAC;YAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAgB,UAAU,CAAC,MAAc;IACrC,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC3D,IAAI,GAAG,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,MAAM,EAAE,CAAC;YAAC,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAC1C,GAAG,IAAI,CAAC,CAAC;QACT,MAAM,GAAG,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC5B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,UAAU,CAAC,YAA2B,EAAE,UAAkB;IAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,IAAI,YAAY,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,EAAE;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,mBAAmB,CAAC,SAAS,GAAG,CAAC,CAAC;IAClC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,EAAE;QAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,SAAS,CAAC,KAAe;IAC9B,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACnG,CAAC;AAGD,MAAM,aAAa,GAAsB,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAE1E,SAAS,wBAAwB,CAC7B,OAAyB,EACzB,MAAyB;IAEzB,MAAM,KAAK,GAAG,OAAO,CAAC,kBAAkB,IAAI,WAAW,CAAC;IAExD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC5B,OAAO;YACH,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC5B,QAAQ,EAAE,OAAO,CAAC,qBAAqB;mBAChC,+EAA+E;SACzF,CAAC;IACN,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IACvF,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,aAAa,CAAC;IAE7E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO;gBACH,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBAC5B,QAAQ,EAAE,4FAA4F;aACzG,CAAC;QACN,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,GAAG;YAAE,OAAO,aAAa,CAAC;QACxD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,GAAG;YAAE,OAAO,aAAa,CAAC;QACpF,IAAI,OAAO,CAAC,kBAAkB,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAC1E,CAAC,oBAAoB,CAAC,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,aAAa,CAAC;QACzF,OAAO;YACH,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,iBAAiB,MAAM,CAAC,SAAS,4BAA4B,MAAM,CAAC,GAAG,0BAA0B,MAAM,CAAC,UAAU,GAAG;SAChI,CAAC;IACN,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,kBAAkB,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9F,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO;YACH,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC5B,QAAQ,EAAE,gHAAgH;SAC7H,CAAC;IACN,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,aAAa,CAAC;IACpG,IAAI,UAAU,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,aAAa,CAAC;IAExG,MAAM,QAAQ,GAAG;QACb,OAAO,CAAC,CAAC,CAAC,kBAAkB,OAAO,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC,EAAE;QAC9D,UAAU,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;KACjF,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO;QACH,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,8EAA8E,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI;KAC3H,CAAC;AACN,CAAC;AAED,SAAgB,eAAe,CAC3B,MAAwB,EACxB,UAAoC,EACpC,QAAkC,EAClC,YAAuC,EACvC,MAA0C,OAAO,CAAC,GAAG;IAErD,IAAI,CAAC,UAAU,EAAE,CAAC;QACd,OAAO;YACH,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM;YACrC,MAAM,EAAE,mDAAmD;SAC9D,CAAC;IACN,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;IAE7C,gBAAgB;IAChB,IAAI,MAAM,CAAC,YAAY,IAAI,UAAU,CAAC,UAAU,KAAK,GAAG;QACpD,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,OAAO;gBACH,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe;gBAC9C,MAAM,EAAE,gDAAgD,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B;aACtH,CAAC;QACN,CAAC;IACL,CAAC;IAED,4BAA4B;IAC5B,MAAM,SAAS,GAAG,wBAAwB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/D,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,2BAA2B,CAAC,EAAE,CAAC;IACjJ,CAAC;IAED,0BAA0B;IAC1B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACnE,MAAM,gBAAgB,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QAC9F,IAAI,gBAAgB,IAAI,UAAU,CAAC,UAAU,IAAI,GAAG,IAAI,UAAU,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;YAClF,OAAO;gBACH,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,iBAAiB;gBACpD,MAAM,EAAE,sBAAsB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,UAAU,CAAC,UAAU,GAAG;gBACrF,gBAAgB,EAAE,CAAC,kCAAkC,EAAE,iCAAiC,CAAC;aAC5F,CAAC;QACN,CAAC;IACL,CAAC;IAED,sBAAsB;IACtB,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,UAAU,KAAK,GAAG,IAAI,YAAY,CAAC,UAAU,KAAK,GAAG,CAAC;QACpF,UAAU,CAAC,UAAU,IAAI,GAAG,IAAI,UAAU,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;QAC9D,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO;gBACH,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa;gBAC5C,MAAM,EAAE,qBAAqB,YAAY,CAAC,UAAU,qBAAqB,UAAU,CAAC,UAAU,gFAAgF;aACjL,CAAC;QACN,CAAC;QACD,OAAO;YACH,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,aAAa;YAChD,MAAM,EAAE,qBAAqB,YAAY,CAAC,UAAU,qBAAqB,UAAU,CAAC,UAAU,SAAS,UAAU,CAAC,IAAI,CAAC,MAAM,0BAA0B;YACvJ,gBAAgB,EAAE,CAAC,8BAA8B,EAAE,0BAA0B,EAAE,yBAAyB,CAAC;SAC5G,CAAC;IACN,CAAC;IAED,sBAAsB;IACtB,MAAM,aAAa,GAAG,UAAU,CAAC,YAAY,EAAE,IAAI,IAAI,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO;YACH,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,cAAc,EAAE,IAAI,EAAE,aAAa;YAChF,MAAM,EAAE,YAAY;gBAChB,CAAC,CAAC,0EAA0E;gBAC5E,CAAC,CAAC,0EAA0E;YAChF,gBAAgB,EAAE,CAAC,oBAAoB,EAAE,wBAAwB,CAAC;SACrE,CAAC;IACN,CAAC;IAED,mBAAmB;IACnB,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,YAAY,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACH,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU;gBAC7C,MAAM,EAAE,uDAAuD,SAAS,CAAC,YAAY,CAAC,GAAG;aAC5F,CAAC;QACN,CAAC;QACD,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO;gBACH,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU;gBACzC,MAAM,EAAE,0EAA0E,SAAS,CAAC,UAAU,CAAC,IAAI;aAC9G,CAAC;QACN,CAAC;IACL,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO;YACH,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU;YACzC,MAAM,EAAE,2FAA2F;SACtG,CAAC;IACN,CAAC;IAED,gCAAgC;IAChC,IAAI,UAAU,CAAC,UAAU,IAAI,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,OAAO;YACH,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,uBAAuB;YACtD,MAAM,EAAE,mBAAmB,UAAU,CAAC,UAAU,kCAAkC;SACrF,CAAC;IACN,CAAC;IAED,kBAAkB;IAClB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAClE,OAAO;YACH,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS;YACnC,MAAM,EAAE,mBAAmB,UAAU,CAAC,UAAU,cAAc,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,oCAAoC;SACvH,CAAC;IACN,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;QACvD,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAClD,OAAO;YACH,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS;YACnC,MAAM,EAAE,4BAA4B,UAAU,CAAC,UAAU,uEAAuE;SACnI,CAAC;IACN,CAAC;IAED,WAAW;IACX,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO;YACH,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM;YACrC,MAAM,EAAE,iDAAiD,UAAU,CAAC,UAAU,MAAM,SAAS,CAAC,QAAQ,EAAE;SAC3G,CAAC;IACN,CAAC;IACD,OAAO;QACH,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM;QACrC,MAAM,EAAE,uCAAuC,UAAU,CAAC,UAAU,sBAAsB;KAC7F,CAAC;AACN,CAAC"}

package/dist/attack/protocol.d.ts

@@ -1,4 +1,19 @@
 export type AgentHttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD' | 'OPTIONS';
+/** Optional success signature the runtime probe rules can corroborate. */
+export interface AgentHttpExpect {
+    successStatus?: number[];
+    successBodyPattern?: string;
+    successHeaders?: Record<string, string>;
+    successLatencyMs?: {
+        gte?: number;
+        lte?: number;
+    };
+    successConfirmedBy?: 'signature' | 'latency' | 'multi-request';
+    successEvidenceNeeded?: string;
+    expectedStatus?: number[];
+    authRequired?: boolean;
+    authEnvVars?: string[];
+}
 export interface AgentHttpRequestAction {
     type: 'http_request';
     method: AgentHttpMethod;
@@ -6,6 +21,7 @@ export interface AgentHttpRequestAction {
     headers?: Record<string, string>;
     body?: unknown;
     rationale: string;
+    expect?: AgentHttpExpect;
 }
 export interface AgentFinding {
     category: string;

package/dist/attack/qualityMetrics.js

@@ -121,6 +121,9 @@ class QualityMetricsTracker {
                 this.metrics.reads.invalid++;
                 this.metrics.reads.blocked++;
                 break;
+            case 'function-map':
+                this.metrics.reads.blocked++;
+                break;
             default: break;
         }
         if (truncated)

package/dist/attack/qualityMetrics.js.map

@@ -1 +1 @@
-{"version":3,"file":"qualityMetrics.js","sourceRoot":"","sources":["../../src/attack/qualityMetrics.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AA+EH,oDA6EC;AA7ED,SAAgB,oBAAoB;IAChC,OAAO;QACH,KAAK,EAAE;YACH,KAAK,EAAE,CAAC;YACR,UAAU,EAAE,CAAC;YACb,SAAS,EAAE,CAAC;YACZ,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,CAAC;SACb;QACD,QAAQ,EAAE;YACN,UAAU,EAAE,CAAC;YACb,YAAY,EAAE,CAAC;YACf,kBAAkB,EAAE,CAAC;YACrB,mBAAmB,EAAE,CAAC;YACtB,qBAAqB,EAAE,IAAI;SAC9B;QACD,KAAK,EAAE;YACH,YAAY,EAAE,CAAC;YACf,iBAAiB,EAAE,CAAC;YACpB,iBAAiB,EAAE,EAAE;YACrB,SAAS,EAAE,CAAC;YACZ,WAAW,EAAE,CAAC;YACd,cAAc,EAAE,CAAC;YACjB,eAAe,EAAE,CAAC;YAClB,gBAAgB,EAAE,CAAC;YACnB,iBAAiB,EAAE,CAAC;YACpB,eAAe,EAAE,CAAC;YAClB,cAAc,EAAE,CAAC;YACjB,cAAc,EAAE,CAAC;SACpB;QACD,UAAU,EAAE;YACR,KAAK,EAAE,CAAC;YACR,UAAU,EAAE,CAAC;YACb,aAAa,EAAE,CAAC;YAChB,SAAS,EAAE,CAAC;YACZ,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,CAAC;YACX,YAAY,EAAE,CAAC;YACf,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,CAAC;SACb;QACD,MAAM,EAAE;YACJ,QAAQ,EAAE,CAAC;YACX,UAAU,EAAE,CAAC;YACb,iBAAiB,EAAE,KAAK;YACxB,iBAAiB,EAAE,EAAE;YACrB,aAAa,EAAE,CAAC;YAChB,eAAe,EAAE,CAAC;SACrB;QACD,MAAM,EAAE;YACJ,oBAAoB,EAAE,CAAC;YACvB,iBAAiB,EAAE,CAAC;YACpB,kBAAkB,EAAE,CAAC;SACxB;QACD,KAAK,EAAE;YACH,yBAAyB,EAAE,CAAC;YAC5B,wBAAwB,EAAE,CAAC;YAC3B,4BAA4B,EAAE,CAAC;YAC/B,2BAA2B,EAAE,CAAC;YAC9B,oBAAoB,EAAE,CAAC;YACvB,uBAAuB,EAAE,CAAC;SAC7B;QACD,MAAM,EAAE;YACJ,SAAS,EAAE,CAAC;YACZ,YAAY,EAAE,CAAC;YACf,iBAAiB,EAAE,CAAC;YACpB,YAAY,EAAE,CAAC;YACf,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,SAAS,EAAE,CAAC;SACf;KACJ,CAAC;AACN,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC3B,YAAY,EAAE,uBAAuB,EAAE,aAAa,EAAE,cAAc;IACpE,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,YAAY;IAChE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe;CAC7D,CAAC,CAAC;AAEH,MAAa,qBAAqB;IACtB,OAAO,CAAqB;IAEpC;QACI,IAAI,CAAC,OAAO,GAAG,oBAAoB,EAAE,CAAC;IAC1C,CAAC;IAED,UAAU,CAAC,cAAsB,EAAE,SAAkB;QACjD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC3B,QAAQ,cAAc,EAAE,CAAC;YACrB,KAAK,cAAc;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;gBAAC,MAAM;YAC9F,KAAK,sBAAsB;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;gBAAC,MAAM;YACrG,KAAK,WAAW;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM;YACtF,KAAK,cAAc;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM;YAC3F,KAAK,SAAS;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM;YAClF,OAAO,CAAC,CAAC,MAAM;QACnB,CAAC;QACD,IAAI,SAAS;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;IAClD,CAAC;IAED,aAAa,CAAC,QAAgB;QAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC3C,CAAC;QACD,QAAQ,QAAQ,EAAE,CAAC;YACf,KAAK,WAAW;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;gBAAC,MAAM;YACxD,KAAK,aAAa;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;gBAAC,MAAM;YAC5D,KAAK,YAAY,CAAC;YAClB,KAAK,uBAAuB;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;gBAAC,MAAM;YACzE,KAAK,aAAa;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;gBAAC,MAAM;YAChE,KAAK,cAAc;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;gBAAC,MAAM;YAClE,KAAK,eAAe;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAAC,MAAM;YACpE,KAAK,aAAa;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;gBAAC,MAAM;YAChE,KAAK,YAAY;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;gBAAC,MAAM;YAC9D,KAAK,YAAY;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;gBAAC,MAAM;QAClE,CAAC;IACL,CAAC;IAED,cAAc,CAAC,UAAkB,EAAE,YAAoB,EAAE,mBAA2B,EAAE,gBAAuD;QACzI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,GAAG,YAAY,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5G,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;QAChE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,GAAG,gBAAgB,CAAC;IACnE,CAAC;IAED,uBAAuB,CAAC,QAAsM;QAC1N,IAAI,CAAC,OAAO,CAAC,UAAU,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC9C,CAAC;IAED,mBAAmB;QACf,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;IACnC,CAAC;IAED,qBAAqB;QACjB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IACrC,CAAC;IAED,cAAc;QACV,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;IACxC,CAAC;IAED,gBAAgB;QACZ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;IAC1C,CAAC;IAED,uBAAuB,CAAC,MAAc;QAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;IACnD,CAAC;IAED,iBAAiB,CAAC,MAAc;QAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;IACnD,CAAC;IAED,qBAAqB;QACjB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;IAC/C,CAAC;IAED,sBAAsB;QAClB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;IAC5C,CAAC;IAED,uBAAuB;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;IAC7C,CAAC;IAED,YAAY,CAAC,SAAiB,EAAE,YAAoB,EAAE,iBAAyB,EAAE,YAAoB,EAAE,UAAkB,EAAE,WAAmB,EAAE,SAAiB;QAC7J,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IAC3H,CAAC;IAED,kBAAkB,CAAC,KAWlB;QACG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,GAAG,KAAK,CAAC,aAAa,GAAG,CAAC;YAClE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,GAAG,KAAK,CAAC,eAAe,GAAG,CAAC;YACnE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,4BAA4B,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC;YAClE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACrE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,2BAA2B,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC;YACjE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACvE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,KAAK,CAAC,gBAAgB,CAAC;QACjE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,GAAG,KAAK,CAAC,mBAAmB,CAAC;IAC3E,CAAC;IAED,UAAU;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC/B,CAAC;CACJ;AA1HD,sDA0HC"}
+{"version":3,"file":"qualityMetrics.js","sourceRoot":"","sources":["../../src/attack/qualityMetrics.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AA+EH,oDA6EC;AA7ED,SAAgB,oBAAoB;IAChC,OAAO;QACH,KAAK,EAAE;YACH,KAAK,EAAE,CAAC;YACR,UAAU,EAAE,CAAC;YACb,SAAS,EAAE,CAAC;YACZ,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,CAAC;SACb;QACD,QAAQ,EAAE;YACN,UAAU,EAAE,CAAC;YACb,YAAY,EAAE,CAAC;YACf,kBAAkB,EAAE,CAAC;YACrB,mBAAmB,EAAE,CAAC;YACtB,qBAAqB,EAAE,IAAI;SAC9B;QACD,KAAK,EAAE;YACH,YAAY,EAAE,CAAC;YACf,iBAAiB,EAAE,CAAC;YACpB,iBAAiB,EAAE,EAAE;YACrB,SAAS,EAAE,CAAC;YACZ,WAAW,EAAE,CAAC;YACd,cAAc,EAAE,CAAC;YACjB,eAAe,EAAE,CAAC;YAClB,gBAAgB,EAAE,CAAC;YACnB,iBAAiB,EAAE,CAAC;YACpB,eAAe,EAAE,CAAC;YAClB,cAAc,EAAE,CAAC;YACjB,cAAc,EAAE,CAAC;SACpB;QACD,UAAU,EAAE;YACR,KAAK,EAAE,CAAC;YACR,UAAU,EAAE,CAAC;YACb,aAAa,EAAE,CAAC;YAChB,SAAS,EAAE,CAAC;YACZ,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,CAAC;YACX,YAAY,EAAE,CAAC;YACf,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,CAAC;SACb;QACD,MAAM,EAAE;YACJ,QAAQ,EAAE,CAAC;YACX,UAAU,EAAE,CAAC;YACb,iBAAiB,EAAE,KAAK;YACxB,iBAAiB,EAAE,EAAE;YACrB,aAAa,EAAE,CAAC;YAChB,eAAe,EAAE,CAAC;SACrB;QACD,MAAM,EAAE;YACJ,oBAAoB,EAAE,CAAC;YACvB,iBAAiB,EAAE,CAAC;YACpB,kBAAkB,EAAE,CAAC;SACxB;QACD,KAAK,EAAE;YACH,yBAAyB,EAAE,CAAC;YAC5B,wBAAwB,EAAE,CAAC;YAC3B,4BAA4B,EAAE,CAAC;YAC/B,2BAA2B,EAAE,CAAC;YAC9B,oBAAoB,EAAE,CAAC;YACvB,uBAAuB,EAAE,CAAC;SAC7B;QACD,MAAM,EAAE;YACJ,SAAS,EAAE,CAAC;YACZ,YAAY,EAAE,CAAC;YACf,iBAAiB,EAAE,CAAC;YACpB,YAAY,EAAE,CAAC;YACf,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,SAAS,EAAE,CAAC;SACf;KACJ,CAAC;AACN,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC3B,YAAY,EAAE,uBAAuB,EAAE,aAAa,EAAE,cAAc;IACpE,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,YAAY;IAChE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe;CAC7D,CAAC,CAAC;AAEH,MAAa,qBAAqB;IACtB,OAAO,CAAqB;IAEpC;QACI,IAAI,CAAC,OAAO,GAAG,oBAAoB,EAAE,CAAC;IAC1C,CAAC;IAED,UAAU,CAAC,cAAsB,EAAE,SAAkB;QACjD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC3B,QAAQ,cAAc,EAAE,CAAC;YACrB,KAAK,cAAc;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;gBAAC,MAAM;YAC9F,KAAK,sBAAsB;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;gBAAC,MAAM;YACrG,KAAK,WAAW;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM;YACtF,KAAK,cAAc;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM;YAC3F,KAAK,SAAS;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM;YAClF,KAAK,cAAc;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM;YACzD,OAAO,CAAC,CAAC,MAAM;QACnB,CAAC;QACD,IAAI,SAAS;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;IAClD,CAAC;IAED,aAAa,CAAC,QAAgB;QAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC3C,CAAC;QACD,QAAQ,QAAQ,EAAE,CAAC;YACf,KAAK,WAAW;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;gBAAC,MAAM;YACxD,KAAK,aAAa;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;gBAAC,MAAM;YAC5D,KAAK,YAAY,CAAC;YAClB,KAAK,uBAAuB;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;gBAAC,MAAM;YACzE,KAAK,aAAa;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;gBAAC,MAAM;YAChE,KAAK,cAAc;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;gBAAC,MAAM;YAClE,KAAK,eAAe;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAAC,MAAM;YACpE,KAAK,aAAa;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;gBAAC,MAAM;YAChE,KAAK,YAAY;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;gBAAC,MAAM;YAC9D,KAAK,YAAY;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;gBAAC,MAAM;QAClE,CAAC;IACL,CAAC;IAED,cAAc,CAAC,UAAkB,EAAE,YAAoB,EAAE,mBAA2B,EAAE,gBAAuD;QACzI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,GAAG,YAAY,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5G,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;QAChE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,GAAG,gBAAgB,CAAC;IACnE,CAAC;IAED,uBAAuB,CAAC,QAAsM;QAC1N,IAAI,CAAC,OAAO,CAAC,UAAU,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC9C,CAAC;IAED,mBAAmB;QACf,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;IACnC,CAAC;IAED,qBAAqB;QACjB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IACrC,CAAC;IAED,cAAc;QACV,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;IACxC,CAAC;IAED,gBAAgB;QACZ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;IAC1C,CAAC;IAED,uBAAuB,CAAC,MAAc;QAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;IACnD,CAAC;IAED,iBAAiB,CAAC,MAAc;QAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;IACnD,CAAC;IAED,qBAAqB;QACjB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;IAC/C,CAAC;IAED,sBAAsB;QAClB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;IAC5C,CAAC;IAED,uBAAuB;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;IAC7C,CAAC;IAED,YAAY,CAAC,SAAiB,EAAE,YAAoB,EAAE,iBAAyB,EAAE,YAAoB,EAAE,UAAkB,EAAE,WAAmB,EAAE,SAAiB;QAC7J,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IAC3H,CAAC;IAED,kBAAkB,CAAC,KAWlB;QACG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,GAAG,KAAK,CAAC,aAAa,GAAG,CAAC;YAClE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,GAAG,KAAK,CAAC,eAAe,GAAG,CAAC;YACnE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,4BAA4B,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC;YAClE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACrE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,2BAA2B,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC;YACjE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACvE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,KAAK,CAAC,gBAAgB,CAAC;QACjE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,GAAG,KAAK,CAAC,mBAAmB,CAAC;IAC3E,CAAC;IAED,UAAU;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC/B,CAAC;CACJ;AA3HD,sDA2HC"}

package/dist/attack/report.d.ts

@@ -4,6 +4,8 @@ export interface ReportedAgentFinding extends AgentFinding {
     rule?: string;
     reason?: string;
 }
+export type ReportableAgentFinding = AgentFinding & Partial<Pick<ReportedAgentFinding, 'confirmation' | 'rule' | 'reason'>>;
+export declare const SUSPECTED_FINDING_REASON = "Agent-reported finding (deterministic verification not yet implemented)";
 export interface AttackReport {
     status: AgentRunStatus;
     findings: ReportedAgentFinding[];
@@ -13,4 +15,4 @@ export interface AttackReport {
     costSpentUsd: number;
 }
 export declare function redactText(text: string): string;
-export declare function buildReport(status: AgentRunStatus, findings: AgentFinding[], transcript: AgentTranscriptStep[], stepsUsed: number, costSpentUsd: number, summary?: string): AttackReport;
+export declare function buildReport(status: AgentRunStatus, findings: ReportableAgentFinding[], transcript: AgentTranscriptStep[], stepsUsed: number, costSpentUsd: number, summary?: string): AttackReport;

package/dist/attack/report.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SUSPECTED_FINDING_REASON = void 0;
 exports.redactText = redactText;
 exports.buildReport = buildReport;
+exports.SUSPECTED_FINDING_REASON = 'Agent-reported finding (deterministic verification not yet implemented)';
 const JWT_RE = /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g;
 const API_KEY_RE = /\b[A-Za-z0-9]{32,}\b/g;
 const EMAIL_RE = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
@@ -18,8 +20,8 @@ function buildReport(status, findings, transcript, stepsUsed, costSpentUsd, summ
         status,
         findings: findings.map((f) => ({
             ...f,
-            confirmation: 'suspected',
-            reason: 'Agent-reported finding (deterministic verification not yet implemented)',
+            confirmation: f.confirmation ?? 'suspected',
+            reason: f.reason ?? exports.SUSPECTED_FINDING_REASON,
         })),
         transcript: transcript.map((step) => ({
             action: {

package/dist/attack/report.js.map

@@ -1 +1 @@
-{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/attack/report.ts"],"names":[],"mappings":";;AAsBA,gCAMC;AAED,kCA8BC;AA3CD,MAAM,MAAM,GAAG,oDAAoD,CAAC;AACpE,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAC3C,MAAM,QAAQ,GAAG,iDAAiD,CAAC;AACnE,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAE/C,SAAgB,UAAU,CAAC,IAAY;IACnC,OAAO,IAAI;SACN,OAAO,CAAC,SAAS,EAAE,mBAAmB,CAAC;SACvC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC;SACjC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC;SACrC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACpI,CAAC;AAED,SAAgB,WAAW,CACvB,MAAsB,EACtB,QAAwB,EACxB,UAAiC,EACjC,SAAiB,EACjB,YAAoB,EACpB,OAAgB;IAEhB,OAAO;QACH,MAAM;QACN,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3B,GAAG,CAAC;YACJ,YAAY,EAAE,WAAoB;YAClC,MAAM,EAAE,yEAAyE;SACpF,CAAC,CAAC;QACH,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClC,MAAM,EAAE;gBACJ,GAAG,IAAI,CAAC,MAAM;gBACd,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;aAC9C;YACD,WAAW,EAAE;gBACT,GAAG,IAAI,CAAC,WAAW;gBACnB,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;gBAChD,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;aAC1C;SACJ,CAAC,CAAC;QACH,OAAO;QACP,SAAS;QACT,YAAY;KACf,CAAC;AACN,CAAC;AAED,SAAS,aAAa,CAAC,OAAgC;IACnD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,IAAI,yCAAyC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;QAC1B,CAAC;aAAM,CAAC;YACJ,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/attack/report.ts"],"names":[],"mappings":";;;AA0BA,gCAMC;AAED,kCA8BC;AAtDY,QAAA,wBAAwB,GAAG,yEAAyE,CAAC;AAWlH,MAAM,MAAM,GAAG,oDAAoD,CAAC;AACpE,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAC3C,MAAM,QAAQ,GAAG,iDAAiD,CAAC;AACnE,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAE/C,SAAgB,UAAU,CAAC,IAAY;IACnC,OAAO,IAAI;SACN,OAAO,CAAC,SAAS,EAAE,mBAAmB,CAAC;SACvC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC;SACjC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC;SACrC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACpI,CAAC;AAED,SAAgB,WAAW,CACvB,MAAsB,EACtB,QAAkC,EAClC,UAAiC,EACjC,SAAiB,EACjB,YAAoB,EACpB,OAAgB;IAEhB,OAAO;QACH,MAAM;QACN,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3B,GAAG,CAAC;YACJ,YAAY,EAAE,CAAC,CAAC,YAAY,IAAK,WAAqB;YACtD,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,gCAAwB;SAC/C,CAAC,CAAC;QACH,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClC,MAAM,EAAE;gBACJ,GAAG,IAAI,CAAC,MAAM;gBACd,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;aAC9C;YACD,WAAW,EAAE;gBACT,GAAG,IAAI,CAAC,WAAW;gBACnB,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;gBAChD,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;aAC1C;SACJ,CAAC,CAAC;QACH,OAAO;QACP,SAAS;QACT,YAAY;KACf,CAAC;AACN,CAAC;AAED,SAAS,aAAa,CAAC,OAAgC;IACnD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,IAAI,yCAAyC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;QAC1B,CAAC;aAAM,CAAC;YACJ,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/attack/runtimeProbe.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Runtime probe engine — executes a small baseline + attack HTTP plan against
+ * the user's local dev server (127.0.0.1) and applies deterministic rules for
+ * a PROVEN / UNPROVEN / INCONCLUSIVE verdict.
+ *
+ * Fires when sandbox verification cannot exercise an HTTP-endpoint-shaped
+ * finding (e.g. "Effect-TS module requires full runtime", "Test timed out
+ * after 12 rounds"): the probe replays the decisive requests against the
+ * real listener instead of a sandboxed boot.
+ */
+import type { AgentHttpExpect } from './protocol';
+export interface ProbeRequest {
+    role: 'baseline' | 'attack';
+    method: string;
+    path: string;
+    headers?: Record<string, string>;
+    body?: unknown;
+    expect?: AgentHttpExpect;
+}
+export interface ProbePlan {
+    host: string;
+    port: number;
+    requests: ProbeRequest[];
+}
+export interface ProbeRequestObservation {
+    role: 'baseline' | 'attack';
+    method: string;
+    path: string;
+    statusCode: number;
+    latencyMs: number;
+}
+export interface ProbeResult {
+    verdict: 'PROVEN' | 'UNPROVEN' | 'INCONCLUSIVE';
+    rule?: string;
+    reason: string;
+    baselineStatus?: number;
+    attackStatus?: number;
+    evidence: string;
+    requests: ProbeRequestObservation[];
+}
+export interface DevServerTarget {
+    host: string;
+    port: number;
+    source: 'config' | 'env' | 'autodetect';
+}
+/** Vulnerability types a runtime probe can exercise (pocRouter HTTP list + xss). */
+export declare const PROBE_ELIGIBLE_TYPES: ReadonlySet<string>;
+/** URL-encode the path so SQLi/XSS payloads with spaces/quotes survive the request. */
+export declare function encodeProbePath(rawPath: string): string;
+export declare function detectDevServer(workspaceRoot: string, opts?: {
+    candidatePorts?: number[];
+}): Promise<DevServerTarget | null>;
+export declare function executeProbePlan(plan: ProbePlan, opts?: {
+    signal?: AbortSignal;
+}): Promise<ProbeResult>;
+export interface ProbeEndpointCandidate {
+    method: string;
+    path: string;
+    line: number;
+    [key: string]: unknown;
+}
+export declare function matchEndpointForFinding(finding: {
+    type: string;
+    line: number;
+    lineEnd?: number;
+}, endpointContext: unknown[] | undefined): ProbeEndpointCandidate | null;
+export declare function isProbeEligible(finding: {
+    type: string;
+    line: number;
+    lineEnd?: number;
+}, verifyReason: string, endpointContext: unknown[] | undefined): boolean;