@theihtisham/agent-shadow-brain 3.0.0 → 4.0.1

package/dist/brain/security-audit.js

@@ -0,0 +1,340 @@
+// src/brain/security-audit.ts — Deep security audit
+// v3.1.0 — OWASP Top 10 pattern detection via regex-based static analysis
+import * as fs from 'fs';
+import * as path from 'path';
+const IGNORE_DIRS = new Set([
+    'node_modules', '.git', 'dist', 'build', 'out', 'coverage', '.next', '.nuxt', '.cache',
+]);
+const CODE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.py', '.rs', '.go', '.java']);
+const SECURITY_RULES = [
+    // 1. CSRF — missing CSRF token in form submissions
+    {
+        name: 'csrf-missing',
+        category: 'CSRF',
+        owasp: 'A01:2021-Broken Access Control',
+        severity: 'high',
+        patterns: [
+            /<form[^>]*method\s*=\s*["']POST["'][^>]*>/gi,
+        ],
+        description: 'POST form without CSRF token protection',
+        recommendation: 'Add a CSRF token field to all POST forms. Use a CSRF middleware (e.g., csurf for Express) or include a hidden _csrf token field.',
+        falsePositiveFilters: [
+            /csrf/i,
+            /_token/i,
+            /authenticity_token/i,
+        ],
+    },
+    // 2. CORS — overly permissive Access-Control-Allow-Origin
+    {
+        name: 'cors-wildcard',
+        category: 'CORS',
+        owasp: 'A05:2021-Security Misconfiguration',
+        severity: 'high',
+        patterns: [
+            /Access-Control-Allow-Origin\s*[:=]\s*["']\*["']/gi,
+            /cors\s*\(\s*\{\s*origin\s*:\s*["']\*["']/gi,
+            /cors\s*\(\s*\{\s*origin\s*:\s*true/gi,
+        ],
+        description: 'CORS configured to allow all origins (*)',
+        recommendation: 'Restrict CORS to specific trusted origins. Never use wildcard (*) in production.',
+    },
+    // 3. Cookie security — missing flags
+    {
+        name: 'cookie-insecure',
+        category: 'Cookie Security',
+        owasp: 'A07:2021-Identification and Authentication Failures',
+        severity: 'medium',
+        patterns: [
+            /cookie\s*\(\s*["'][^"']+["']\s*,\s*["'][^"']+["']\s*\)/gi,
+            /res\.cookie\s*\(/gi,
+            /document\.cookie\s*=/gi,
+            /Set-Cookie\s*:/gi,
+        ],
+        description: 'Cookie set without httpOnly, secure, or sameSite flags',
+        recommendation: 'Always set httpOnly, secure, and sameSite flags on cookies. Example: res.cookie("name", "value", { httpOnly: true, secure: true, sameSite: "strict" })',
+        falsePositiveFilters: [
+            /httpOnly/i,
+            /secure\s*:\s*true/i,
+            /sameSite/i,
+        ],
+    },
+    // 4. CSP — missing Content-Security-Policy
+    {
+        name: 'csp-missing',
+        category: 'CSP',
+        owasp: 'A05:2021-Security Misconfiguration',
+        severity: 'medium',
+        patterns: [
+            /Content-Security-Policy\s*:/gi,
+            /helmet\s*\(/gi,
+            /csp\s*\(\s*\{/gi,
+        ],
+        description: 'Content-Security-Policy header check',
+        recommendation: 'Set a Content-Security-Policy header to prevent XSS attacks. Use helmet.js for Express apps.',
+        // This rule is inverted: we flag if CSP headers are NOT found (handled in analysis)
+    },
+    // 5. Open redirect
+    {
+        name: 'open-redirect',
+        category: 'Open Redirect',
+        owasp: 'A01:2021-Broken Access Control',
+        severity: 'medium',
+        patterns: [
+            /(?:res|response|ctx)\.redirect\s*\(\s*(?:req|request|ctx)\.(?:query|params|body)\./gi,
+            /(?:res|response|ctx)\.redirect\s*\(\s*(?:req|request)\.(?:query|params)\s*[.[\]]/gi,
+            /redirect\s*\(\s*req\.query\./gi,
+            /window\.location\s*=\s*[^;]*?(?:req|request|ctx)\.(?:query|params)/gi,
+        ],
+        description: 'Potential open redirect via user-controlled input',
+        recommendation: 'Validate redirect URLs against an allowlist. Never redirect to user-supplied URLs without verification.',
+    },
+    // 6. Path traversal
+    {
+        name: 'path-traversal',
+        category: 'Path Traversal',
+        owasp: 'A01:2021-Broken Access Control',
+        severity: 'critical',
+        patterns: [
+            /(?:fs|filesystem|file)\.(?:readFile|readFileSync|writeFile|writeFileSync|unlink|unlinkSync|access|accessSync|stat|statSync)\s*\(\s*(?:req|request|ctx)\.(?:params|query|body)\./gi,
+            /(?:fs|filesystem)\.\w+\s*\(\s*path\.join\s*\(\s*[^,]+,\s*(?:req|request|ctx)\./gi,
+            /\.readFile\s*\(\s*req\.params\./gi,
+            /createReadStream\s*\(\s*(?:req|request|ctx)\./gi,
+        ],
+        description: 'Potential path traversal via unsanitized file operations',
+        recommendation: 'Sanitize and validate all file paths. Use path.resolve() and verify the resolved path is within the intended directory.',
+    },
+    // 7. SSRF — Server-Side Request Forgery
+    {
+        name: 'ssrf',
+        category: 'SSRF',
+        owasp: 'A10:2021-Server-Side Request Forgery',
+        severity: 'critical',
+        patterns: [
+            /(?:fetch|axios|http\.get|https\.get|request)\s*\(\s*(?:req|request|ctx)\.(?:query|params|body)\.\w+/gi,
+            /(?:fetch|axios)\s*\(\s*userInput/gi,
+            /http\.get\s*\(\s*(?:userInput|url|uri)/gi,
+        ],
+        description: 'Potential SSRF via user-controlled URL in server-side request',
+        recommendation: 'Validate URLs against an allowlist of permitted domains. Never pass user input directly to fetch/http requests.',
+    },
+    // 8. XXE — XML External Entity
+    {
+        name: 'xxe',
+        category: 'XXE',
+        owasp: 'A05:2021-Security Misconfiguration',
+        severity: 'critical',
+        patterns: [
+            /enableExternalEntities\s*[:=]\s*true/gi,
+            /XMLReader|SAXParser|DocumentBuilder|xml\.parse|parseXml|parseString/gi,
+        ],
+        description: 'Potential XXE via XML parsing without safe configuration',
+        recommendation: 'Disable external entity processing. Set disallowDoctypeDecl=true for Java parsers or use safe XML libraries.',
+        falsePositiveFilters: [
+            /disallowDoctypeDecl\s*[:=]\s*true/i,
+            /externalEntities\s*[:=]\s*false/i,
+            /noent\s*[:=]\s*false/i,
+        ],
+    },
+    // Bonus: eval and Function constructor
+    {
+        name: 'eval-usage',
+        category: 'Code Injection',
+        owasp: 'A03:2021-Injection',
+        severity: 'critical',
+        patterns: [
+            /(?<![.\w])eval\s*\(/g,
+            /new\s+Function\s*\(/g,
+        ],
+        description: 'Use of eval() or Function constructor — potential code injection',
+        recommendation: 'Never use eval() or new Function(). Use JSON.parse() for data parsing or refactoring for dynamic behavior.',
+    },
+    // Bonus: SQL injection patterns
+    {
+        name: 'sql-injection',
+        category: 'SQL Injection',
+        owasp: 'A03:2021-Injection',
+        severity: 'critical',
+        patterns: [
+            /(?:query|execute|run|raw)\s*\(\s*["'`][^"'`]*(?:\$\{|`\$\{|\+).*["'`]/gi,
+            /(?:query|execute)\s*\(\s*["']SELECT.*\+\s*(?:req|request|ctx|params|user)/gi,
+            /string\s*\+\s*["']\s*(?:SELECT|INSERT|UPDATE|DELETE|DROP)/gi,
+        ],
+        description: 'Potential SQL injection via string concatenation',
+        recommendation: 'Use parameterized queries or an ORM. Never concatenate user input into SQL strings.',
+    },
+];
+export class SecurityAuditor {
+    constructor(projectDir) {
+        this.projectDir = projectDir;
+    }
+    async analyzeProject(maxFiles = 300) {
+        const files = this.collectFiles(this.projectDir, maxFiles);
+        const insights = [];
+        const allIssues = [];
+        for (const filePath of files) {
+            const issues = this.analyzeFile(filePath);
+            allIssues.push(...issues);
+        }
+        // Sort by severity (critical first)
+        const severityOrder = { critical: 0, high: 1, medium: 2, low: 3 };
+        allIssues.sort((a, b) => severityOrder[a.severity] - severityOrder[b.severity]);
+        // Generate individual insights
+        for (const issue of allIssues) {
+            insights.push(this.issueToInsight(issue));
+        }
+        // Summary insight if many issues found
+        const criticalCount = allIssues.filter(i => i.severity === 'critical').length;
+        const highCount = allIssues.filter(i => i.severity === 'high').length;
+        if (criticalCount + highCount > 0) {
+            const categoryCounts = new Map();
+            for (const issue of allIssues) {
+                categoryCounts.set(issue.category, (categoryCounts.get(issue.category) || 0) + 1);
+            }
+            const topCategories = [...categoryCounts.entries()]
+                .sort((a, b) => b[1] - a[1])
+                .slice(0, 5)
+                .map(([cat, count]) => `    - ${cat}: ${count} issues`)
+                .join('\n');
+            insights.push({
+                type: 'security',
+                priority: criticalCount > 0 ? 'critical' : 'high',
+                title: `[security] ${criticalCount + highCount} security issues detected (${criticalCount} critical, ${highCount} high)`,
+                content: `Security audit found ${allIssues.length} total issues across the project.\n` +
+                    `  Critical: ${criticalCount}, High: ${highCount}, ` +
+                    `Medium: ${allIssues.filter(i => i.severity === 'medium').length}, ` +
+                    `Low: ${allIssues.filter(i => i.severity === 'low').length}\n` +
+                    `  Top categories:\n${topCategories}\n` +
+                    `  Review and fix critical/high issues before deploying to production.`,
+                files: [...new Set(allIssues.filter(i => i.severity === 'critical' || i.severity === 'high').map(i => i.file))].slice(0, 20),
+                timestamp: new Date(),
+                confidence: 0.7,
+                metadata: {
+                    totalIssues: allIssues.length,
+                    criticalCount,
+                    highCount,
+                    categories: Object.fromEntries(categoryCounts),
+                },
+            });
+        }
+        return insights;
+    }
+    analyzeFile(filePath) {
+        let content;
+        try {
+            content = fs.readFileSync(filePath, 'utf-8');
+        }
+        catch {
+            return [];
+        }
+        const relPath = path.relative(this.projectDir, filePath);
+        const issues = [];
+        for (const rule of SECURITY_RULES) {
+            for (const pattern of rule.patterns) {
+                pattern.lastIndex = 0;
+                let match;
+                while ((match = pattern.exec(content)) !== null) {
+                    const line = content.substring(0, match.index).split('\n').length;
+                    const lineContent = content.split('\n')[line - 1]?.trim() || match[0];
+                    // Check false positive filters
+                    if (rule.falsePositiveFilters) {
+                        // For cookie rule: check the surrounding context (rest of the line or next few lines)
+                        const contextStart = Math.max(0, match.index - 50);
+                        const contextEnd = Math.min(content.length, match.index + 200);
+                        const context = content.substring(contextStart, contextEnd);
+                        // Special handling for cookie rule: only flag if security flags are NOT present
+                        if (rule.name === 'cookie-insecure') {
+                            const hasSecurityFlags = rule.falsePositiveFilters.some(filter => filter.test(context));
+                            if (hasSecurityFlags)
+                                continue;
+                        }
+                        // For XXE: skip if safety measures are present
+                        if (rule.name === 'xxe' && rule.falsePositiveFilters.length > 0) {
+                            const contextBlock = content.substring(Math.max(0, match.index - 500), Math.min(content.length, match.index + 500));
+                            const hasSafety = rule.falsePositiveFilters.some(filter => filter.test(contextBlock));
+                            if (hasSafety)
+                                continue;
+                        }
+                        // For CSRF: check if form has token
+                        if (rule.name === 'csrf-missing') {
+                            // Find the closing </form> tag
+                            const formEnd = content.indexOf('</form>', match.index);
+                            const formBlock = formEnd !== -1
+                                ? content.substring(match.index, formEnd)
+                                : content.substring(match.index, Math.min(content.length, match.index + 2000));
+                            const hasToken = rule.falsePositiveFilters.some(filter => filter.test(formBlock));
+                            if (hasToken)
+                                continue;
+                        }
+                    }
+                    issues.push({
+                        category: rule.category,
+                        severity: rule.severity,
+                        file: relPath,
+                        line,
+                        match: lineContent,
+                        description: rule.description,
+                        recommendation: rule.recommendation,
+                        owaspCategory: rule.owasp,
+                    });
+                }
+            }
+        }
+        return issues;
+    }
+    issueToInsight(issue) {
+        return {
+            type: 'security',
+            priority: issue.severity,
+            title: `[security] [${issue.category}] ${issue.description} (${issue.file}:${issue.line})`,
+            content: `Security issue in ${issue.file}:${issue.line}\n` +
+                `  Category: ${issue.category}\n` +
+                `  OWASP: ${issue.owaspCategory}\n` +
+                `  Severity: ${issue.severity}\n` +
+                `  Match: ${issue.match.substring(0, 100)}\n` +
+                `  ${issue.description}\n` +
+                `  Recommendation: ${issue.recommendation}`,
+            files: [issue.file],
+            timestamp: new Date(),
+            confidence: 0.7,
+            metadata: {
+                category: issue.category,
+                severity: issue.severity,
+                line: issue.line,
+                owasp: issue.owaspCategory,
+                ruleName: issue.category.toLowerCase().replace(/\s+/g, '-'),
+            },
+        };
+    }
+    collectFiles(dir, maxFiles) {
+        const results = [];
+        const walk = (currentDir, depth) => {
+            if (results.length >= maxFiles || depth > 10)
+                return;
+            let entries;
+            try {
+                entries = fs.readdirSync(currentDir, { withFileTypes: true });
+            }
+            catch {
+                return;
+            }
+            for (const entry of entries) {
+                if (results.length >= maxFiles)
+                    return;
+                if (entry.name.startsWith('.'))
+                    continue;
+                const fullPath = path.join(currentDir, entry.name);
+                if (entry.isDirectory()) {
+                    if (IGNORE_DIRS.has(entry.name))
+                        continue;
+                    walk(fullPath, depth + 1);
+                }
+                else if (entry.isFile() && CODE_EXTENSIONS.has(path.extname(entry.name))) {
+                    results.push(fullPath);
+                }
+            }
+        };
+        walk(dir, 0);
+        return results;
+    }
+}
+//# sourceMappingURL=security-audit.js.map

package/dist/brain/security-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-audit.js","sourceRoot":"","sources":["../../src/brain/security-audit.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,0EAA0E;AAG1E,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ;CACvF,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAwB9F,MAAM,cAAc,GAAmB;IACrC,mDAAmD;IACnD;QACE,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,gCAAgC;QACvC,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE;YACR,6CAA6C;SAC9C;QACD,WAAW,EAAE,yCAAyC;QACtD,cAAc,EAAE,kIAAkI;QAClJ,oBAAoB,EAAE;YACpB,OAAO;YACP,SAAS;YACT,qBAAqB;SACtB;KACF;IACD,0DAA0D;IAC1D;QACE,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,oCAAoC;QAC3C,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE;YACR,mDAAmD;YACnD,4CAA4C;YAC5C,sCAAsC;SACvC;QACD,WAAW,EAAE,0CAA0C;QACvD,cAAc,EAAE,kFAAkF;KACnG;IACD,qCAAqC;IACrC;QACE,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,iBAAiB;QAC3B,KAAK,EAAE,qDAAqD;QAC5D,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE;YACR,0DAA0D;YAC1D,oBAAoB;YACpB,wBAAwB;YACxB,kBAAkB;SACnB;QACD,WAAW,EAAE,wDAAwD;QACrE,cAAc,EAAE,wJAAwJ;QACxK,oBAAoB,EAAE;YACpB,WAAW;YACX,oBAAoB;YACpB,WAAW;SACZ;KACF;IACD,2CAA2C;IAC3C;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,oCAAoC;QAC3C,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE;YACR,+BAA+B;YAC/B,eAAe;YACf,iBAAiB;SAClB;QACD,WAAW,EAAE,sCAAsC;QACnD,cAAc,EAAE,8FAA8F;QAC9G,oFAAoF;KACrF;IACD,mBAAmB;IACnB;QACE,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,eAAe;QACzB,KAAK,EAAE,gCAAgC;QACvC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE;YACR,sFAAsF;YACtF,oFAAoF;YACpF,gCAAgC;YAChC,sEAAsE;SACvE;QACD,WAAW,EAAE,mDAAmD;QAChE,cAAc,EAAE,yGAAyG;KAC1H;IACD,oBAAoB;IACpB;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,gCAAgC;QACvC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE;YACR,mLAAmL;YACnL,kFAAkF;YAClF,mCAAmC;YACnC,iDAAiD;SAClD;QACD,WAAW,EAAE,0DAA0D;QACvE,cAAc,EAAE,yHAAyH;KAC1I;IACD,wCAAwC;IACxC;QACE,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,sCAAsC;QAC7C,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE;YACR,uGAAuG;YACvG,oCAAoC;YACpC,0CAA0C;SAC3C;QACD,WAAW,EAAE,+DAA+D;QAC5E,cAAc,EAAE,iHAAiH;KAClI;IACD,+BAA+B;IAC/B;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,oCAAoC;QAC3C,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE;YACR,wCAAwC;YACxC,uEAAuE;SACxE;QACD,WAAW,EAAE,0DAA0D;QACvE,cAAc,EAAE,8GAA8G;QAC9H,oBAAoB,EAAE;YACpB,oCAAoC;YACpC,kCAAkC;YAClC,uBAAuB;SACxB;KACF;IACD,uCAAuC;IACvC;QACE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,oBAAoB;QAC3B,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE;YACR,sBAAsB;YACtB,sBAAsB;SACvB;QACD,WAAW,EAAE,kEAAkE;QAC/E,cAAc,EAAE,4GAA4G;KAC7H;IACD,gCAAgC;IAChC;QACE,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,eAAe;QACzB,KAAK,EAAE,oBAAoB;QAC3B,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE;YACR,yEAAyE;YACzE,6EAA6E;YAC7E,6DAA6D;SAC9D;QACD,WAAW,EAAE,kDAAkD;QAC/D,cAAc,EAAE,qFAAqF;KACtG;CACF,CAAC;AAEF,MAAM,OAAO,eAAe;IAG1B,YAAY,UAAkB;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,WAAmB,GAAG;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAoB,EAAE,CAAC;QAEtC,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC1C,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;QAC5B,CAAC;QAED,oCAAoC;QACpC,MAAM,aAAa,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1F,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEhF,+BAA+B;QAC/B,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,CAAC;QAED,uCAAuC;QACvC,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;QAC9E,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QACtE,IAAI,aAAa,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;YACjD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;gBAC9B,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,aAAa,GAAG,CAAC,GAAG,cAAc,CAAC,OAAO,EAAE,CAAC;iBAChD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;iBAC3B,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,SAAS,GAAG,KAAK,KAAK,SAAS,CAAC;iBACtD,IAAI,CAAC,IAAI,CAAC,CAAC;YAEd,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;gBACjD,KAAK,EAAE,cAAc,aAAa,GAAG,SAAS,8BAA8B,aAAa,cAAc,SAAS,QAAQ;gBACxH,OAAO,EACL,wBAAwB,SAAS,CAAC,MAAM,qCAAqC;oBAC7E,eAAe,aAAa,WAAW,SAAS,IAAI;oBACpD,WAAW,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,IAAI;oBACpE,QAAQ,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM,IAAI;oBAC9D,sBAAsB,aAAa,IAAI;oBACvC,uEAAuE;gBACzE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC5H,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE;oBACR,WAAW,EAAE,SAAS,CAAC,MAAM;oBAC7B,aAAa;oBACb,SAAS;oBACT,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC;iBAC/C;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,WAAW,CAAC,QAAgB;QAC1B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC;QAE1E,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACzD,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;gBACtB,IAAI,KAA6B,CAAC;gBAClC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBAChD,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;oBAClE,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;oBAEtE,+BAA+B;oBAC/B,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;wBAC9B,sFAAsF;wBACtF,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;wBACnD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;wBAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;wBAE5D,gFAAgF;wBAChF,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;4BACpC,MAAM,gBAAgB,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;4BACxF,IAAI,gBAAgB;gCAAE,SAAS;wBACjC,CAAC;wBACD,+CAA+C;wBAC/C,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BAChE,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CACpC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,EAC9B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAC5C,CAAC;4BACF,MAAM,SAAS,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;4BACtF,IAAI,SAAS;gCAAE,SAAS;wBAC1B,CAAC;wBACD,oCAAoC;wBACpC,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;4BACjC,+BAA+B;4BAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;4BACxD,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,CAAC;gCAC9B,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC;gCACzC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC;4BACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;4BAClF,IAAI,QAAQ;gCAAE,SAAS;wBACzB,CAAC;oBACH,CAAC;oBAED,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,IAAI,EAAE,OAAO;wBACb,IAAI;wBACJ,KAAK,EAAE,WAAW;wBAClB,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;wBACnC,aAAa,EAAE,IAAI,CAAC,KAAK;qBAC1B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,cAAc,CAAC,KAAoB;QACzC,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAoC;YACpD,KAAK,EAAE,eAAe,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG;YAC1F,OAAO,EACL,qBAAqB,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI;gBACjD,eAAe,KAAK,CAAC,QAAQ,IAAI;gBACjC,YAAY,KAAK,CAAC,aAAa,IAAI;gBACnC,eAAe,KAAK,CAAC,QAAQ,IAAI;gBACjC,YAAY,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI;gBAC7C,KAAK,KAAK,CAAC,WAAW,IAAI;gBAC1B,qBAAqB,KAAK,CAAC,cAAc,EAAE;YAC7C,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;YACnB,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,UAAU,EAAE,GAAG;YACf,QAAQ,EAAE;gBACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,aAAa;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aAC5D;SACF,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,GAAW,EAAE,QAAgB;QAChD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,UAAkB,EAAE,KAAa,EAAQ,EAAE;YACvD,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ,IAAI,KAAK,GAAG,EAAE;gBAAE,OAAO;YACrD,IAAI,OAAoB,CAAC;YACzB,IAAI,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO;YAAC,CAAC;YACxF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ;oBAAE,OAAO;gBACvC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;oBACxB,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;wBAAE,SAAS;oBAC1C,IAAI,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC5B,CAAC;qBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBAC3E,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACb,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/brain/self-evolution.d.ts

@@ -0,0 +1,53 @@
+import { GeneticRule, EvolutionSnapshot, SelfEvolutionConfig, BrainInsight } from '../types.js';
+/**
+ * Self-Evolution Engine — rules that write themselves.
+ *
+ * Genetic Representation:
+ *   Each rule = chromosome of floats encoding severity weight,
+ *   confidence threshold, file pattern hash, category encoding, etc.
+ *
+ * Fitness: accuracy × coverage × (1 / falsePositiveRate)
+ * Selection: Tournament (k=5)
+ * Crossover: Single-point at random position
+ * Mutation: Gaussian noise σ = 0.1 × mutationRate
+ *
+ * Meta-Learning: Tracks which (rule, project_type, language) combos work best.
+ * Bayesian updating of weights per strategy.
+ */
+export declare class SelfEvolution {
+    private config;
+    private population;
+    private generation;
+    private metaLogs;
+    private eliteArchive;
+    private fitnessHistory;
+    constructor(config?: Partial<SelfEvolutionConfig>);
+    /** Run one evolution generation */
+    evolve(insights?: BrainInsight[]): Promise<EvolutionSnapshot>;
+    /** Evaluate rule fitness based on insight history */
+    evaluateFitness(rule: GeneticRule, insights: BrainInsight[]): number;
+    /** Tournament selection (k=5) */
+    private tournamentSelect;
+    /** Single-point crossover */
+    crossover(a: GeneticRule, b: GeneticRule): [GeneticRule, GeneticRule];
+    /** Gaussian mutation */
+    mutate(rule: GeneticRule): GeneticRule;
+    private initializePopulation;
+    /** Update meta-learning log with strategy outcome */
+    updateMetaLearning(strategy: string, outcome: boolean, category?: string): void;
+    /** Get best evolved rules for a category */
+    getBestRules(category: string, topN?: number): GeneticRule[];
+    /** Get current generation info */
+    getGeneration(): number;
+    getPopulationSize(): number;
+    getFitnessHistory(): Array<{
+        gen: number;
+        best: number;
+        avg: number;
+    }>;
+    /** Get a snapshot of the current evolution state */
+    getSnapshot(): EvolutionSnapshot;
+    private saveToDisk;
+    private loadFromDisk;
+}
+//# sourceMappingURL=self-evolution.d.ts.map

package/dist/brain/self-evolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-evolution.d.ts","sourceRoot":"","sources":["../../src/brain/self-evolution.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAmB,mBAAmB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAajH;;;;;;;;;;;;;;GAcG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,UAAU,CAAqB;IACvC,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,QAAQ,CAAyB;IACzC,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,cAAc,CAAyD;gBAEnE,MAAM,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC;IAOjD,mCAAmC;IAC7B,MAAM,CAAC,QAAQ,GAAE,YAAY,EAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA+DvE,qDAAqD;IACrD,eAAe,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM;IAuCpE,iCAAiC;IACjC,OAAO,CAAC,gBAAgB;IAWxB,6BAA6B;IAC7B,SAAS,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,WAAW,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC;IAYrE,wBAAwB;IACxB,MAAM,CAAC,IAAI,EAAE,WAAW,GAAG,WAAW;IAsBtC,OAAO,CAAC,oBAAoB;IAkB5B,qDAAqD;IACrD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,GAAE,MAAkB,GAAG,IAAI;IAqB1F,4CAA4C;IAC5C,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,MAAW,GAAG,WAAW,EAAE;IAkBhE,kCAAkC;IAClC,aAAa,IAAI,MAAM;IACvB,iBAAiB,IAAI,MAAM;IAC3B,iBAAiB,IAAI,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAEtE,oDAAoD;IACpD,WAAW,IAAI,iBAAiB;YAelB,UAAU;IAwBxB,OAAO,CAAC,YAAY;CAqBrB"}