@veraxhq/verax 0.2.0 → 0.3.0

package/src/cli/commands/security-check.js

@@ -0,0 +1,211 @@
+/**
+ * PHASE 21.8 — Security Check CLI Command
+ * 
+ * Checks security baseline: secrets, vulnerabilities, supply-chain.
+ * Exit codes: 0 = SECURITY-OK, 6 = SECURITY-BLOCKED, 70 = Internal corruption
+ */
+
+import { scanSecrets, writeSecretsReport } from '../../verax/core/security/secrets.scan.js';
+import { scanVulnerabilities, writeVulnReport } from '../../verax/core/security/vuln.scan.js';
+import { evaluateSupplyChainPolicy, writeSupplyChainReport } from '../../verax/core/security/supplychain.policy.js';
+import { writeSecurityReport } from '../../verax/core/security/security-report.js';
+import { resolve } from 'path';
+import { mkdirSync, existsSync } from 'fs';
+
+/**
+ * Security check command
+ * 
+ * @param {Object} options - Options
+ * @param {boolean} [options.json] - Output as JSON
+ */
+export async function securityCheckCommand(options = {}) {
+  const { json = false } = options;
+  const projectDir = resolve(process.cwd());
+  
+  const status = {
+    secrets: { ok: false, hasSecrets: false, blockers: [], tool: 'VERAX_SECRETS_SCANNER' },
+    vulnerabilities: { ok: false, blocking: false, blockers: [], warnings: [], tool: null, availability: 'UNKNOWN' },
+    supplychain: { ok: false, violations: [], blockers: [], tool: 'VERAX_SUPPLYCHAIN_POLICY' }
+  };
+  
+  // 1. Scan for secrets
+  try {
+    const secretsResult = await scanSecrets(projectDir);
+    writeSecretsReport(projectDir, secretsResult);
+    
+    status.secrets.ok = secretsResult.ok;
+    status.secrets.hasSecrets = secretsResult.hasSecrets;
+    
+    if (secretsResult.hasSecrets) {
+      const critical = secretsResult.findings.filter(f => f.severity === 'CRITICAL');
+      const high = secretsResult.findings.filter(f => f.severity === 'HIGH');
+      
+      if (critical.length > 0) {
+        status.secrets.blockers.push(`${critical.length} CRITICAL secret(s) detected`);
+      }
+      if (high.length > 0) {
+        status.secrets.blockers.push(`${high.length} HIGH severity secret(s) detected`);
+      }
+      
+      // Add sample findings (first 3)
+      const sampleFindings = secretsResult.findings.slice(0, 3).map(f => 
+        `${f.type} in ${f.file}:${f.line}`
+      );
+      status.secrets.blockers.push(`Sample findings: ${sampleFindings.join(', ')}`);
+    }
+  } catch (error) {
+    status.secrets.blockers.push(`Secrets scan failed: ${error.message}`);
+  }
+  
+  // 2. Scan vulnerabilities
+  let vulnResult = null;
+  try {
+    vulnResult = await scanVulnerabilities(projectDir);
+    writeVulnReport(projectDir, vulnResult);
+    
+    status.vulnerabilities.ok = !vulnResult.blocking;
+    status.vulnerabilities.blocking = vulnResult.blocking;
+    status.vulnerabilities.tool = vulnResult.tool || null;
+    status.vulnerabilities.availability = vulnResult.availability || 'UNKNOWN';
+    status.vulnerabilities.osvAvailable = vulnResult.osvAvailable || false;
+    
+    if (vulnResult.availability === 'NOT_AVAILABLE') {
+      status.vulnerabilities.warnings.push('OSV scanner not available, using npm audit fallback');
+    }
+    
+    if (vulnResult.blocking) {
+      if (vulnResult.summary.critical > 0) {
+        status.vulnerabilities.blockers.push(`${vulnResult.summary.critical} CRITICAL vulnerability/vulnerabilities`);
+      }
+      if (vulnResult.summary.high > 0) {
+        status.vulnerabilities.blockers.push(`${vulnResult.summary.high} HIGH severity vulnerability/vulnerabilities`);
+      }
+    }
+    
+    if (vulnResult.summary.medium > 0 && !vulnResult.blocking) {
+      status.vulnerabilities.warnings.push(`${vulnResult.summary.medium} MEDIUM severity vulnerability/vulnerabilities (non-blocking)`);
+    }
+  } catch (error) {
+    status.vulnerabilities.blockers.push(`Vulnerability scan failed: ${error.message}`);
+  }
+  
+  // 3. Check supply-chain policy
+  let supplyChainResult = null;
+  try {
+    supplyChainResult = await evaluateSupplyChainPolicy(projectDir);
+    writeSupplyChainReport(projectDir, supplyChainResult);
+    
+    status.supplychain.ok = supplyChainResult.ok;
+    status.supplychain.violations = supplyChainResult.violations;
+    
+    if (!supplyChainResult.ok) {
+      for (const violation of supplyChainResult.violations) {
+        status.supplychain.blockers.push(violation.message);
+      }
+    }
+  } catch (error) {
+    status.supplychain.blockers.push(`Supply-chain check failed: ${error.message}`);
+  }
+  
+  // Determine overall status
+  const allOk = status.secrets.ok && status.vulnerabilities.ok && status.supplychain.ok;
+  
+  // Write unified security report
+  let secretsReport = null;
+  try {
+    const secretsPath = resolve(projectDir, 'release', 'security.secrets.report.json');
+    if (existsSync(secretsPath)) {
+      const { readFileSync } = await import('fs');
+      secretsReport = JSON.parse(readFileSync(secretsPath, 'utf-8'));
+    }
+  } catch {
+    // Ignore
+  }
+  
+  let vulnReportData = vulnResult;
+  let supplyChainReportData = supplyChainResult;
+  
+  const unifiedReport = {
+    securityOk: allOk,
+    status,
+    summary: {
+      secrets: status.secrets.ok ? 'OK' : 'BLOCKED',
+      vulnerabilities: status.vulnerabilities.ok ? 'OK' : (status.vulnerabilities.blocking ? 'BLOCKED' : (status.vulnerabilities.availability === 'NOT_AVAILABLE' ? 'NOT_AVAILABLE' : 'WARN')),
+      supplychain: status.supplychain.ok ? 'OK' : 'BLOCKED'
+    },
+    secretsReport,
+    vulnReport: vulnReportData,
+    supplyChainReport: supplyChainReportData
+  };
+  
+  const unifiedReportPath = writeSecurityReport(projectDir, unifiedReport);
+  const hasInternalCorruption = 
+    status.secrets.blockers.some(b => b.includes('corruption') || b.includes('Internal')) ||
+    status.vulnerabilities.blockers.some(b => b.includes('corruption')) ||
+    status.supplychain.blockers.some(b => b.includes('corruption'));
+  
+  // Output
+  if (json) {
+    console.log(JSON.stringify({
+      securityOk: allOk,
+      status,
+      summary: {
+        secrets: status.secrets.ok ? 'OK' : 'BLOCKED',
+        vulnerabilities: status.vulnerabilities.ok ? 'OK' : (status.vulnerabilities.blocking ? 'BLOCKED' : (status.vulnerabilities.availability === 'NOT_AVAILABLE' ? 'NOT_AVAILABLE' : 'WARN')),
+        supplychain: status.supplychain.ok ? 'OK' : 'BLOCKED'
+      },
+      unifiedReportPath: unifiedReportPath
+    }, null, 2));
+  } else {
+    console.log('\n' + '='.repeat(80));
+    console.log('SECURITY BASELINE CHECK');
+    console.log('='.repeat(80));
+    
+    console.log(`\nSecrets: ${status.secrets.ok ? '✅ OK' : '❌ BLOCKED'}`);
+    if (status.secrets.blockers.length > 0) {
+      for (const blocker of status.secrets.blockers) {
+        console.log(`  - ${blocker}`);
+      }
+    }
+    
+    console.log(`\nVulnerabilities: ${status.vulnerabilities.ok ? '✅ OK' : (status.vulnerabilities.blocking ? '❌ BLOCKED' : '⚠️  WARN')}`);
+    if (status.vulnerabilities.blockers.length > 0) {
+      for (const blocker of status.vulnerabilities.blockers) {
+        console.log(`  - ${blocker}`);
+      }
+    }
+    if (status.vulnerabilities.warnings.length > 0) {
+      for (const warning of status.vulnerabilities.warnings) {
+        console.log(`  ⚠️  ${warning}`);
+      }
+    }
+    
+    console.log(`\nSupply-chain: ${status.supplychain.ok ? '✅ OK' : '❌ BLOCKED'}`);
+    if (status.supplychain.blockers.length > 0) {
+      for (const blocker of status.supplychain.blockers) {
+        console.log(`  - ${blocker}`);
+      }
+    }
+    
+    console.log(`\nOverall: ${allOk ? '✅ SECURITY-OK' : '❌ SECURITY-BLOCKED'}`);
+    console.log(`\nSee unified report: ${unifiedReportPath}`);
+    console.log('='.repeat(80) + '\n');
+  }
+  
+  // Exit codes: 0 = SECURITY-OK, 6 = SECURITY-BLOCKED, 70 = Internal corruption
+  // NOT_AVAILABLE tools exit 0 only if policy allows (strict mode would exit 2)
+  const hasNotAvailable = status.vulnerabilities.availability === 'NOT_AVAILABLE';
+  const strictMode = process.env.VERAX_SECURITY_STRICT === '1';
+  
+  if (allOk) {
+    process.exit(0);
+  } else if (hasNotAvailable && !strictMode) {
+    // NOT_AVAILABLE is not a blocker unless strict mode
+    process.exit(0);
+  } else if (hasInternalCorruption) {
+    process.exit(70);
+  } else {
+    process.exit(6);
+  }
+}
+

package/src/cli/commands/truth.js

@@ -0,0 +1,114 @@
+/**
+ * PHASE 21.11 — Truth Command
+ * 
+ * `verax truth` - Shows truth certificate summary
+ */
+
+import { resolve } from 'path';
+import { findLatestRunId } from '../util/run-resolver.js';
+import { generateTruthCertificate, loadTruthCertificate } from '../../verax/core/truth/truth.certificate.js';
+
+/**
+ * Truth command
+ * 
+ * @param {string} projectDir - Project directory
+ * @param {Object} options - Command options
+ */
+export async function truthCommand(projectDir, options = {}) {
+  const { json = false, runId: runIdOpt = null } = options;
+  
+  const runId = runIdOpt || findLatestRunId(projectDir);
+  
+  if (!runId) {
+    if (json) {
+      console.log(JSON.stringify({
+        error: 'NO_RUNS_FOUND',
+        message: 'No runs found. Run a scan first.'
+      }, null, 2));
+    } else {
+      console.log('\n=== Truth Certificate ===\n');
+      console.log('Error: No runs found. Run a scan first.\n');
+    }
+    return;
+  }
+  
+  // Try to load existing certificate, otherwise generate
+  let certificate = loadTruthCertificate(projectDir, runId);
+  
+  if (!certificate) {
+    certificate = await generateTruthCertificate(projectDir, runId);
+    if (certificate) {
+      const { writeTruthCertificate } = await import('../../verax/core/truth/truth.certificate.js');
+      writeTruthCertificate(projectDir, runId, certificate);
+    }
+  }
+  
+  if (!certificate) {
+    if (json) {
+      console.log(JSON.stringify({
+        error: 'CERTIFICATE_GENERATION_FAILED',
+        message: 'Failed to generate truth certificate'
+      }, null, 2));
+    } else {
+      console.log('\n=== Truth Certificate ===\n');
+      console.log('Error: Failed to generate truth certificate\n');
+    }
+    return;
+  }
+  
+  if (json) {
+    console.log(JSON.stringify(certificate, null, 2));
+  } else {
+    console.log('\n=== Truth Certificate ===\n');
+    console.log(`Run ID: ${certificate.runId}`);
+    console.log(`URL: ${certificate.url || 'N/A'}`);
+    console.log(`Generated: ${certificate.generatedAt}`);
+    
+    console.log('\nEvidence Law:');
+    console.log(`  Status: ${certificate.evidenceLaw.status}`);
+    console.log(`  Violated: ${certificate.evidenceLaw.violated ? 'YES' : 'NO'}`);
+    
+    console.log('\nDeterminism:');
+    console.log(`  Verdict: ${certificate.determinism.verdict}`);
+    console.log(`  Message: ${certificate.determinism.message}`);
+    
+    console.log('\nFailures:');
+    console.log(`  Total: ${certificate.failures.total}`);
+    console.log(`  Blocking: ${certificate.failures.blocking ? 'YES' : 'NO'}`);
+    console.log(`  Degraded: ${certificate.failures.degraded ? 'YES' : 'NO'}`);
+    console.log(`  By Severity: ${JSON.stringify(certificate.failures.bySeverity)}`);
+    
+    console.log('\nGA:');
+    console.log(`  Verdict: ${certificate.ga.verdict}`);
+    console.log(`  Ready: ${certificate.ga.ready ? 'YES' : 'NO'}`);
+    console.log(`  Blockers: ${certificate.ga.blockers}`);
+    console.log(`  Warnings: ${certificate.ga.warnings}`);
+    
+    console.log('\nSecurity:');
+    console.log(`  Overall: ${certificate.security.overall}`);
+    console.log(`  Secrets: ${certificate.security.secrets}`);
+    console.log(`  Vulnerabilities: ${certificate.security.vulnerabilities}`);
+    
+    console.log('\nPerformance:');
+    console.log(`  Verdict: ${certificate.performance.verdict}`);
+    console.log(`  OK: ${certificate.performance.ok ? 'YES' : 'NO'}`);
+    console.log(`  Violations: ${certificate.performance.violations}`);
+    
+    console.log('\nBaseline:');
+    console.log(`  Hash: ${certificate.baseline.hash || 'N/A'}`);
+    console.log(`  Frozen: ${certificate.baseline.frozen ? 'YES' : 'NO'}`);
+    console.log(`  Version: ${certificate.baseline.version || 'N/A'}`);
+    
+    console.log('\nProvenance:');
+    console.log(`  Hash: ${certificate.provenance.hash || 'N/A'}`);
+    console.log(`  Version: ${certificate.provenance.version || 'N/A'}`);
+    
+    console.log('\nOverall Verdict:');
+    console.log(`  Status: ${certificate.overallVerdict.status}`);
+    if (certificate.overallVerdict.reasons.length > 0) {
+      console.log(`  Reasons: ${certificate.overallVerdict.reasons.join('; ')}`);
+    }
+    console.log('');
+  }
+}
+