@telora/daemon 0.15.37 → 0.15.42

package/dist/security-scan-engine.js

@@ -0,0 +1,202 @@
+/**
+ * Security scan engine.
+ *
+ * Polls security_scan_configs for due scans (cron-due or manual_run_requested_at
+ * set), dispatches pluggable Scanner implementations per IOC class, writes
+ * one security_scan_runs row plus N security_findings rows per execution,
+ * and (downstream) hands findings to security-auto-inject for severity-gated
+ * injection materialization.
+ *
+ * Activation: gated by shouldRunLoop('TELORA_SECURITY_SCAN_LOOP') in
+ * unified-shell.ts. Opt-out semantics match the other daemon loop ticks
+ * (unset/anything-but-'0' = enabled, '0' = disabled). See
+ * docs/runbook-loop-activation.md.
+ *
+ * Pattern reference: verification-engine.ts (pluggable strategies + Deps).
+ *
+ * @module security-scan-engine
+ */
+import { callApi } from './queries/shared.js';
+import { configForProduct } from './config.js';
+import { buildDefaultAutoInjectDeps, processNewFinding, } from './security-auto-inject.js';
+import { resolveStaleFindings, buildDefaultResolutionDeps, } from './security-rescan-resolution.js';
+import { clearOsvCache } from './feeds/osv.js';
+import { clearGhsaCache } from './feeds/ghsa.js';
+// ---------------------------------------------------------------------------
+// Default registry -- scanners self-register here in their own modules
+// ---------------------------------------------------------------------------
+const DEFAULT_REGISTRY = new Map();
+export function registerScanner(scanner) {
+    DEFAULT_REGISTRY.set(scanner.iocClass, scanner);
+}
+export function getRegisteredScanners() {
+    return [...DEFAULT_REGISTRY.values()];
+}
+export async function runScanForConfig(config, trigger, deps) {
+    const runId = await deps.startRun(config.id, trigger);
+    const startedAt = Date.now();
+    const coverage = {};
+    const warnings = [];
+    const counts = { low: 0, medium: 0, high: 0, critical: 0 };
+    let anyFailure = false;
+    let anySuccess = false;
+    // Manual triggers carry the "Refresh feeds" intent: flush the OSV/GHSA
+    // TTL caches so this scan pulls fresh advisory data instead of replaying
+    // the 15-minute window. Scheduled triggers honour the cache to keep
+    // upstream load proportional to scan cadence.
+    if (trigger === 'manual') {
+        deps.clearFeedCaches();
+    }
+    const enabledScanners = deps.scanners.filter((s) => config.enabledIocClasses.includes(s.iocClass));
+    // Per-class observed identifier sets for re-scan resolution. Only
+    // classes whose scanner ran without error contribute -- a failed
+    // scanner can't claim coverage for its class.
+    const observedByClass = new Map();
+    for (const scanner of enabledScanners) {
+        try {
+            const result = await scanner.scan({
+                config,
+                repoPath: deps.resolveCwd(config.productId),
+            });
+            coverage[scanner.iocClass] = result.coverage;
+            anySuccess = true;
+            const observed = new Set();
+            for (const finding of result.findings) {
+                const { findingId } = await deps.writeFinding(runId, config.productId, config.organizationId, finding);
+                counts[finding.severity] = (counts[finding.severity] ?? 0) + 1;
+                observed.add(finding.identifier);
+                // Severity-gated auto-injection. Run per-finding so a failing
+                // injection for one finding does not block the others.
+                if (deps.autoInjectDeps) {
+                    try {
+                        const forInjection = {
+                            id: findingId,
+                            organizationId: config.organizationId,
+                            productId: config.productId,
+                            iocClass: finding.iocClass,
+                            severity: finding.severity,
+                            identifier: finding.identifier,
+                            payload: finding.payload,
+                            status: 'open',
+                            suppression: null,
+                            linkedInjectionId: null,
+                        };
+                        const options = {
+                            autoInjectThreshold: config.autoInjectSeverityThreshold,
+                        };
+                        await processNewFinding(forInjection, options, deps.autoInjectDeps);
+                    }
+                    catch (err) {
+                        warnings.push(`auto-inject ${finding.identifier}: ${err.message}`);
+                    }
+                }
+            }
+            observedByClass.set(scanner.iocClass, observed);
+        }
+        catch (err) {
+            anyFailure = true;
+            warnings.push(`${scanner.iocClass}: ${err.message}`);
+            coverage[scanner.iocClass] = { error: err.message };
+        }
+    }
+    // Re-scan resolution: previously-open findings whose class was
+    // covered by this run but whose identifier did not re-appear are
+    // flipped to 'resolved'. Failures here are non-fatal -- the run
+    // already succeeded for its primary purpose (finding fresh issues).
+    if (deps.resolutionDeps && observedByClass.size > 0) {
+        try {
+            const observedSets = Array.from(observedByClass.entries()).map(([iocClass, identifiers]) => ({ iocClass, identifiers }));
+            const resolved = await resolveStaleFindings(config.productId, observedSets, deps.resolutionDeps);
+            if (resolved.length > 0) {
+                coverage.resolved_findings = resolved.length;
+            }
+        }
+        catch (err) {
+            warnings.push(`resolution: ${err.message}`);
+        }
+    }
+    if (warnings.length > 0) {
+        coverage.warnings = warnings;
+    }
+    const status = anyFailure
+        ? anySuccess
+            ? 'partial'
+            : 'failed'
+        : 'succeeded';
+    await deps.finishRun(runId, {
+        status,
+        coverageSummary: coverage,
+        findingsCountBySeverity: counts,
+        durationMs: Date.now() - startedAt,
+    });
+    if (trigger === 'manual') {
+        await deps.clearManualRunRequest(config.id);
+    }
+}
+// ---------------------------------------------------------------------------
+// Loop tick -- invoked by unified-shell on a fixed cadence
+// ---------------------------------------------------------------------------
+export async function runSecurityScanTick(deps) {
+    const configs = await deps.getDueScanConfigs();
+    for (const config of configs) {
+        if (!config.enabled)
+            continue;
+        const trigger = config.manualRunRequestedAt ? 'manual' : 'schedule';
+        try {
+            await runScanForConfig(config, trigger, deps);
+        }
+        catch {
+            // Per-config failures are swallowed so a single broken product
+            // does not stop the engine from servicing others. The run row
+            // already records the failure status.
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Default Deps -- daemon-side wiring via callApi
+// ---------------------------------------------------------------------------
+export function buildDefaultSecurityScanDeps(config) {
+    const resolveCwd = (productId) => {
+        const product = config.products.find((p) => p.id === productId);
+        if (!product)
+            return config.repoPath;
+        return configForProduct(config, product).repoPath;
+    };
+    return {
+        getDueScanConfigs: async () => {
+            const res = await callApi('daemon_get_due_security_scan_configs', {});
+            return res.items ?? [];
+        },
+        startRun: async (configId, trigger) => {
+            const res = await callApi('daemon_start_security_scan_run', {
+                configId,
+                trigger,
+            });
+            return res.runId;
+        },
+        finishRun: async (runId, update) => {
+            await callApi('daemon_finish_security_scan_run', { runId, ...update });
+        },
+        writeFinding: async (runId, productId, organizationId, finding) => {
+            const res = await callApi('daemon_write_security_finding', {
+                runId,
+                productId,
+                organizationId,
+                ...finding,
+            });
+            return { findingId: res.findingId };
+        },
+        clearManualRunRequest: async (configId) => {
+            await callApi('daemon_clear_manual_scan_request', { configId });
+        },
+        resolveCwd,
+        clearFeedCaches: () => {
+            clearOsvCache();
+            clearGhsaCache();
+        },
+        scanners: getRegisteredScanners(),
+        autoInjectDeps: buildDefaultAutoInjectDeps(),
+        resolutionDeps: buildDefaultResolutionDeps(),
+    };
+}
+//# sourceMappingURL=security-scan-engine.js.map

package/dist/security-scan-engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-scan-engine.js","sourceRoot":"","sources":["../src/security-scan-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,GAIlB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAG3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAiDjD,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E,MAAM,gBAAgB,GAAyB,IAAI,GAAG,EAAE,CAAC;AAEzD,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;AACxC,CAAC;AAmDD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAkB,EAClB,OAA8B,EAC9B,IAAsB;IAEtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAA6B,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACrF,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,UAAU,GAAG,KAAK,CAAC;IAEvB,uEAAuE;IACvE,yEAAyE;IACzE,oEAAoE;IACpE,8CAA8C;IAC9C,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnG,kEAAkE;IAClE,iEAAiE;IACjE,8CAA8C;IAC9C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAuB,CAAC;IACvD,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAChC,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;aAC5C,CAAC,CAAC;YACH,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC7C,UAAU,GAAG,IAAI,CAAC;YAElB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;YACnC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACtC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAC3C,KAAK,EACL,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,cAAc,EACrB,OAAO,CACR,CAAC;gBACF,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC/D,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBAEjC,8DAA8D;gBAC9D,uDAAuD;gBACvD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;oBACxB,IAAI,CAAC;wBACH,MAAM,YAAY,GAAwB;4BACxC,EAAE,EAAE,SAAS;4BACb,cAAc,EAAE,MAAM,CAAC,cAAc;4BACrC,SAAS,EAAE,MAAM,CAAC,SAAS;4BAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;4BAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;4BACxB,MAAM,EAAE,MAAM;4BACd,WAAW,EAAE,IAAI;4BACjB,iBAAiB,EAAE,IAAI;yBACxB,CAAC;wBACF,MAAM,OAAO,GAAsB;4BACjC,mBAAmB,EAAE,MAAM,CAAC,2BAA2B;yBACxD,CAAC;wBACF,MAAM,iBAAiB,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;oBACtE,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,QAAQ,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,UAAU,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;oBAChF,CAAC;gBACH,CAAC;YACH,CAAC;YACD,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,GAAG,IAAI,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;QACjE,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,iEAAiE;IACjE,gEAAgE;IAChE,oEAAoE;IACpE,IAAI,IAAI,CAAC,cAAc,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAwB,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CACjF,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CACzD,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CACzC,MAAM,CAAC,SAAS,EAChB,YAAY,EACZ,IAAI,CAAC,cAAc,CACpB,CAAC;YACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,QAAQ,CAAC,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,eAAgB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,UAAU;QACvB,CAAC,CAAC,UAAU;YACV,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,QAAQ;QACZ,CAAC,CAAC,WAAW,CAAC;IAEhB,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE;QAC1B,MAAM;QACN,eAAe,EAAE,QAAQ;QACzB,uBAAuB,EAAE,MAAM;QAC/B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KACnC,CAAC,CAAC;IAEH,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAsB;IAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC/C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,SAAS;QAC9B,MAAM,OAAO,GAA0B,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;QAC3F,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;YAC/D,8DAA8D;YAC9D,sCAAsC;QACxC,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAE9E,MAAM,UAAU,4BAA4B,CAAC,MAAoB;IAC/D,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAU,EAAE;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;QACrC,OAAO,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;IACpD,CAAC,CAAC;IAEF,OAAO;QACL,iBAAiB,EAAE,KAAK,IAAI,EAAE;YAC5B,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,sCAAsC,EACtC,EAAE,CACH,CAAC;YACF,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACzB,CAAC;QACD,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;YACpC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAoB,gCAAgC,EAAE;gBAC7E,QAAQ;gBACR,OAAO;aACR,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,KAAK,CAAC;QACnB,CAAC;QACD,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACjC,MAAM,OAAO,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE;YAChE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAwB,+BAA+B,EAAE;gBAChF,KAAK;gBACL,SAAS;gBACT,cAAc;gBACd,GAAG,OAAO;aACX,CAAC,CAAC;YACH,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QACtC,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACxC,MAAM,OAAO,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,UAAU;QACV,eAAe,EAAE,GAAG,EAAE;YACpB,aAAa,EAAE,CAAC;YAChB,cAAc,EAAE,CAAC;QACnB,CAAC;QACD,QAAQ,EAAE,qBAAqB,EAAE;QACjC,cAAc,EAAE,0BAA0B,EAAE;QAC5C,cAAc,EAAE,0BAA0B,EAAE;KAC7C,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telora/daemon",
-  "version": "0.15.37",
+  "version": "0.15.42",
   "description": "Agent orchestration daemon for Telora - spawns and manages Claude Code instances",
   "type": "module",
   "bin": {
@@ -35,9 +35,10 @@
   },
   "//testRunner": "Uses Node.js built-in test runner (node:test) via tsx for TypeScript support. The root package uses Vitest; this is a deliberate choice for the daemon package to avoid framework dependencies. See src/__tests__/ for test files.",
   "dependencies": {
-    "@telora/daemon-core": "^0.2.17",
+    "@telora/daemon-core": "^0.2.18",
     "@telora/mcp-products": "^0.22.1",
     "commander": "^14.0.3",
+    "yaml": "^2.4.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {