aios-core 1.0.0

package/.aios-core/infrastructure/scripts/security-checker.js

@@ -0,0 +1,359 @@
+/**
+ * Security Checker for AIOS Developer Meta-Agent
+ * Validates generated code and configurations for security vulnerabilities
+ */
+
+const path = require('path');
+const yaml = require('js-yaml');
+
+class SecurityChecker {
+  constructor() {
+    // Patterns that indicate potential security issues
+    this.dangerousPatterns = [
+      /eval\s*\(/gi,
+      /Function\s*\(/gi,
+      /new\s+Function/gi,
+      /setTimeout\s*\([^,]+,/gi,
+      /setInterval\s*\([^,]+,/gi,
+      /require\s*\([^'"]/gi, // Dynamic require
+      /import\s*\(/gi, // Dynamic import
+      /child_process/gi,
+      /exec\s*\(/gi,
+      /spawn\s*\(/gi,
+      /\.\.\/\.\.\//g, // Path traversal
+      /process\.env/gi,
+      /__dirname/gi,
+      /__filename/gi,
+    ];
+
+    // SQL injection patterns
+    this.sqlInjectionPatterns = [
+      /;\s*DROP\s+TABLE/gi,
+      /;\s*DELETE\s+FROM/gi,
+      /UNION\s+SELECT/gi,
+      /OR\s+1\s*=\s*1/gi,
+      /'\s+OR\s+'/gi,
+    ];
+
+    // Command injection patterns
+    this.commandInjectionPatterns = [
+      /[;&|`$()]/g,
+      /\$\{.*\}/g,
+      />|</g,
+    ];
+
+    // Safe patterns that should be allowed
+    this.safePatterns = {
+      'eval': [
+        /\/\*.*eval.*\*\//gs, // eval in comments
+        /\/\/.*eval/g, // eval in single-line comments
+        /".*eval.*"/g, // eval in strings
+        /'.*eval.*'/g,
+      ],
+    };
+  }
+
+  /**
+   * Validate generated code for security vulnerabilities
+   * @param {string} code - The code to validate
+   * @param {string} [language='javascript'] - The programming language
+   * @returns {Object} Validation results with valid flag, errors, warnings, and suggestions
+   */
+  validateCode(code, language = 'javascript') {
+    const results = {
+      valid: true,
+      errors: [],
+      warnings: [],
+      suggestions: [],
+    };
+
+    // Validate input
+    if (!code || typeof code !== 'string') {
+      results.valid = false;
+      results.errors.push({
+        type: 'invalid_input',
+        message: 'Code must be a non-empty string',
+      });
+      return results;
+    }
+
+    // Check for dangerous patterns
+    for (const pattern of this.dangerousPatterns) {
+      const matches = code.match(pattern);
+      if (matches) {
+        // Check if it's in a safe context
+        let isSafe = false;
+        const patternName = pattern.source.split('\\')[0];
+        
+        if (this.safePatterns[patternName]) {
+          for (const safePattern of this.safePatterns[patternName]) {
+            if (code.match(safePattern)) {
+              isSafe = true;
+              break;
+            }
+          }
+        }
+
+        if (!isSafe) {
+          results.valid = false;
+          results.errors.push({
+            type: 'dangerous_pattern',
+            pattern: pattern.source,
+            matches: matches,
+            message: `Dangerous pattern detected: ${matches[0]}`,
+            line: this._getLineNumber(code, matches.index),
+          });
+        }
+      }
+    }
+
+    // Check for SQL injection (if applicable)
+    if (code.includes('SELECT') || code.includes('INSERT') || code.includes('UPDATE')) {
+      for (const pattern of this.sqlInjectionPatterns) {
+        if (pattern.test(code)) {
+          results.valid = false;
+          results.errors.push({
+            type: 'sql_injection',
+            pattern: pattern.source,
+            message: 'Potential SQL injection vulnerability detected',
+          });
+        }
+      }
+    }
+
+    // Validate input sanitization
+    if (code.includes('req.body') || code.includes('req.query') || code.includes('req.params')) {
+      if (!code.includes('sanitize') && !code.includes('validate') && !code.includes('escape')) {
+        results.warnings.push({
+          type: 'input_validation',
+          message: 'User input detected without explicit sanitization',
+        });
+      }
+    }
+
+    return results;
+  }
+
+  /**
+   * Validate YAML configuration for security issues
+   */
+  validateYAML(yamlContent) {
+    const results = {
+      valid: true,
+      errors: [],
+      warnings: [],
+    };
+
+    try {
+      const parsed = yaml.load(yamlContent);
+      
+      // Check for dangerous YAML features
+      if (yamlContent.includes('!!') && !yamlContent.includes('!!str')) {
+        results.warnings.push({
+          type: 'yaml_tags',
+          message: 'YAML tags detected - ensure they are safe',
+        });
+      }
+
+      // Validate structure
+      this.validateYAMLStructure(parsed, results);
+      
+    } catch (error) {
+      results.valid = false;
+      results.errors.push({
+        type: 'yaml_parse',
+        message: `YAML parsing error: ${error.message}`,
+      });
+    }
+
+    return results;
+  }
+
+  /**
+   * Validate YAML structure recursively
+   */
+  validateYAMLStructure(obj, results, path = '') {
+    if (typeof obj === 'object' && obj !== null) {
+      for (const [key, value] of Object.entries(obj)) {
+        const currentPath = path ? `${path}.${key}` : key;
+        
+        // Check for command injection in string values
+        if (typeof value === 'string') {
+          for (const pattern of this.commandInjectionPatterns) {
+            if (pattern.test(value) && !this.isSafeCommandContext(key, value)) {
+              results.warnings.push({
+                type: 'command_injection',
+                path: currentPath,
+                message: `Potential command injection in ${currentPath}`,
+              });
+            }
+          }
+        }
+        
+        // Recurse for nested objects
+        if (typeof value === 'object') {
+          this.validateYAMLStructure(value, results, currentPath);
+        }
+      }
+    }
+  }
+
+  /**
+   * Check if command-like string is in safe context
+   */
+  isSafeCommandContext(key, value) {
+    const safeKeys = ['description', 'comment', 'note', 'help', 'usage'];
+    return safeKeys.some(safe => key.toLowerCase().includes(safe));
+  }
+
+  /**
+   * Validate file paths for security issues
+   */
+  validatePath(filePath) {
+    const results = {
+      valid: true,
+      errors: [],
+    };
+
+    // Normalize the path
+    const normalized = path.normalize(filePath);
+
+    // Check for path traversal
+    if (normalized.includes('..')) {
+      results.valid = false;
+      results.errors.push({
+        type: 'path_traversal',
+        message: 'Path traversal detected',
+      });
+    }
+
+    // Check for absolute paths (unless allowed)
+    if (path.isAbsolute(normalized)) {
+      results.errors.push({
+        type: 'absolute_path',
+        message: 'Absolute path detected - use relative paths',
+      });
+    }
+
+    // Check for sensitive directories
+    const sensitivePatterns = [
+      /node_modules/i,
+      /\.git/i,
+      /\.env/i,
+      /private/i,
+      /secret/i,
+      /config/i,
+    ];
+
+    for (const pattern of sensitivePatterns) {
+      if (pattern.test(normalized)) {
+        results.warnings = results.warnings || [];
+        results.warnings.push({
+          type: 'sensitive_path',
+          message: `Path contains potentially sensitive directory: ${pattern.source}`,
+        });
+      }
+    }
+
+    return results;
+  }
+
+  /**
+   * Validate user input for common security issues
+   */
+  sanitizeInput(input, type = 'general') {
+    if (typeof input !== 'string') {
+      return input;
+    }
+
+    let sanitized = input;
+
+    // Remove null bytes
+    sanitized = sanitized.replace(/\0/g, '');
+
+    // Type-specific sanitization
+    switch (type) {
+      case 'filename':
+        // Allow only alphanumeric, dash, underscore, and dot
+        sanitized = sanitized.replace(/[^a-zA-Z0-9\-_\.]/g, '');
+        break;
+      
+      case 'identifier':
+        // Allow only alphanumeric, dash, and underscore
+        sanitized = sanitized.replace(/[^a-zA-Z0-9\-_]/g, '');
+        break;
+      
+      case 'yaml':
+        // Escape special YAML characters
+        sanitized = sanitized
+          .replace(/:/g, '\\:')
+          .replace(/\|/g, '\\|')
+          .replace(/>/g, '\\>')
+          .replace(/</g, '\\<');
+        break;
+      
+      case 'general':
+      default:
+        // Basic HTML/script escaping
+        sanitized = sanitized
+          .replace(/&/g, '&amp;')
+          .replace(/</g, '&lt;')
+          .replace(/>/g, '&gt;')
+          .replace(/"/g, '&quot;')
+          .replace(/'/g, '&#x27;')
+          .replace(/\//g, '&#x2F;');
+    }
+
+    return sanitized;
+  }
+
+  /**
+   * Generate security report
+   * @param {Array} validations - Array of validation results
+   * @returns {Object} Comprehensive security report
+   */
+  generateReport(validations) {
+    const report = {
+      timestamp: new Date().toISOString(),
+      summary: {
+        totalChecks: 0,
+        passed: 0,
+        failed: 0,
+        warnings: 0,
+      },
+      details: validations,
+    };
+
+    // Calculate summary
+    for (const validation of validations) {
+      report.summary.totalChecks++;
+      if (validation.valid) {
+        report.summary.passed++;
+      } else {
+        report.summary.failed++;
+      }
+      report.summary.warnings += (validation.warnings || []).length;
+    }
+
+    report.summary.securityScore = Math.round(
+      (report.summary.passed / report.summary.totalChecks) * 100,
+    );
+
+    return report;
+  }
+
+  /**
+   * Get line number from string index
+   * @private
+   * @param {string} text - The text to search
+   * @param {number} index - Character index
+   * @returns {number} Line number (1-based)
+   */
+  _getLineNumber(text, index) {
+    if (!text || index === undefined) return null;
+    const lines = text.substring(0, index).split('\n');
+    return lines.length;
+  }
+}
+
+module.exports = SecurityChecker;

package/.aios-core/infrastructure/scripts/spot-check-validator.js

@@ -0,0 +1,149 @@
+#!/usr/bin/env node
+
+/**
+ * Spot-Check Validator
+ * Story: 6.1.7.1 - Task Content Completion
+ * Purpose: Validate 20 random tasks for Phase 1 completion accuracy
+ */
+
+const fs = require('path');
+const path = require('path');
+
+// Configuration
+const TASKS_DIR = path.join(__dirname, '../tasks');
+const SAMPLE_SIZE = 20;
+
+// Load fs module properly
+const fsModule = require('fs');
+
+// Validation checks
+function validateTask(filename, content) {
+  const errors = [];
+  const warnings = [];
+  
+  // 1. Task identifier check
+  if (content.includes('{TODO: task identifier}')) {
+    errors.push('Task identifier not resolved');
+  } else {
+    const taskMatch = content.match(/task:\s*(\w+)\(\)/);
+    if (!taskMatch) {
+      errors.push('Task identifier malformed');
+    }
+  }
+  
+  // 2. Agent assignment check
+  if (content.includes('{TODO: Agent Name}')) {
+    errors.push('Agent assignment not resolved');
+  }
+  
+  // 3. Atomic layer check
+  if (content.includes('{TODO: Atom|Molecule|Organism}')) {
+    errors.push('Atomic layer not resolved');
+  } else {
+    const layerMatch = content.match(/atomic_layer:\s*(\w+)/);
+    if (!layerMatch) {
+      errors.push('Atomic layer malformed');
+    } else {
+      const validLayers = ['Atom', 'Molecule', 'Organism', 'Template', 'Strategy', 'Config'];
+      if (!validLayers.includes(layerMatch[1])) {
+        warnings.push(`Unexpected atomic layer: ${layerMatch[1]}`);
+      }
+    }
+  }
+  
+  // 4. Performance metrics check
+  if (content.includes('{TODO: X minutes}')) {
+    errors.push('Duration metric not resolved');
+  }
+  if (content.includes('{TODO: $X}')) {
+    errors.push('Cost metric not resolved');
+  }
+  
+  // 5. Error strategy check
+  if (content.includes('{TODO: Fail-fast | Graceful degradation | Retry with backoff}')) {
+    errors.push('Error strategy not resolved');
+  }
+  
+  return { errors, warnings };
+}
+
+// Main
+function main() {
+  console.log('🔍 Spot-Check Validator\n');
+  
+  // Get all task files
+  const allFiles = fsModule.readdirSync(TASKS_DIR)
+    .filter(f => f.endsWith('.md') && !f.includes('backup') && !f.includes('.legacy'));
+  
+  // Random sampling
+  const sampled = [];
+  const filesCopy = [...allFiles];
+  for (let i = 0; i < Math.min(SAMPLE_SIZE, filesCopy.length); i++) {
+    const randomIndex = Math.floor(Math.random() * filesCopy.length);
+    sampled.push(filesCopy.splice(randomIndex, 1)[0]);
+  }
+  
+  console.log(`📝 Spot-checking ${sampled.length} random tasks:\n`);
+  
+  const results = {
+    passed: [],
+    failed: [],
+    warnings: [],
+  };
+  
+  // Validate each sampled task
+  sampled.forEach((filename, index) => {
+    const filePath = path.join(TASKS_DIR, filename);
+    const content = fsModule.readFileSync(filePath, 'utf8');
+    const validation = validateTask(filename, content);
+    
+    if (validation.errors.length === 0) {
+      results.passed.push(filename);
+      console.log(`${index + 1}. ✅ ${filename}`);
+      if (validation.warnings.length > 0) {
+        validation.warnings.forEach(w => console.log(`   ⚠️  ${w}`));
+        results.warnings.push({ filename, warnings: validation.warnings });
+      }
+    } else {
+      results.failed.push({ filename, errors: validation.errors });
+      console.log(`${index + 1}. ❌ ${filename}`);
+      validation.errors.forEach(e => console.log(`   ❌ ${e}`));
+    }
+  });
+  
+  // Summary
+  console.log('\n' + '='.repeat(60));
+  console.log('📊 Spot-Check Summary:');
+  console.log(`   ✅ Passed: ${results.passed.length}/${sampled.length}`);
+  console.log(`   ❌ Failed: ${results.failed.length}/${sampled.length}`);
+  console.log(`   ⚠️  Warnings: ${results.warnings.length}`);
+  console.log('='.repeat(60) + '\n');
+  
+  if (results.failed.length > 0) {
+    console.log('Failed tasks:');
+    results.failed.forEach(({ filename, errors }) => {
+      console.log(`  - ${filename}: ${errors.join(', ')}`);
+    });
+    console.log('');
+  }
+  
+  // Save report
+  const reportPath = path.join(__dirname, '../../.ai/mid-point-spot-check-report.json');
+  fsModule.writeFileSync(reportPath, JSON.stringify(results, null, 2), 'utf8');
+  console.log(`📄 Report saved: ${reportPath}\n`);
+  
+  return results;
+}
+
+if (require.main === module) {
+  try {
+    const results = main();
+    process.exit(results.failed.length > 0 ? 1 : 0);
+  } catch (error) {
+    console.error('💥 Fatal error:', error.message);
+    process.exit(1);
+  }
+}
+
+module.exports = { validateTask };
+

package/.aios-core/infrastructure/scripts/status-mapper.js

@@ -0,0 +1,115 @@
+// File: common/utils/status-mapper.js
+
+/**
+ * Status Mapper - Bidirectional status mapping between AIOS and ClickUp
+ *
+ * This module provides utilities for:
+ * - Mapping AIOS story statuses to ClickUp custom field values
+ * - Mapping ClickUp story-status values back to AIOS statuses
+ * - Handling ClickUp-specific statuses (e.g., "Ready for Dev")
+ *
+ * CRITICAL: Stories use ClickUp custom field "story-status", NOT native status.
+ * Epics use the native ClickUp status field (Planning, In Progress, Done).
+ */
+
+const STATUS_MAPPING = {
+  AIOS_TO_CLICKUP: {
+    'Draft': 'Draft',
+    'Ready for Review': 'Ready for Review',
+    'Review': 'Review',
+    'In Progress': 'In Progress',
+    'Done': 'Done',
+    'Blocked': 'Blocked',
+  },
+  CLICKUP_TO_AIOS: {
+    'Draft': 'Draft',
+    'Ready for Dev': 'Ready for Review',  // ClickUp-specific status
+    'Ready for Review': 'Ready for Review',
+    'Review': 'Review',
+    'In Progress': 'In Progress',
+    'Done': 'Done',
+    'Blocked': 'Blocked',
+  },
+};
+
+/**
+ * Maps an AIOS story status to ClickUp story-status custom field value
+ *
+ * @param {string} aiosStatus - Local .md file status
+ * @returns {string} ClickUp story-status value
+ */
+function mapStatusToClickUp(aiosStatus) {
+  const mapped = STATUS_MAPPING.AIOS_TO_CLICKUP[aiosStatus];
+
+  if (!mapped) {
+    console.warn(`Unknown AIOS status: ${aiosStatus}, using as-is`);
+    return aiosStatus;
+  }
+
+  return mapped;
+}
+
+/**
+ * Maps a ClickUp story-status custom field value to AIOS story status
+ *
+ * @param {string} clickupStatus - ClickUp story-status value
+ * @returns {string} Local .md file status
+ */
+function mapStatusFromClickUp(clickupStatus) {
+  const mapped = STATUS_MAPPING.CLICKUP_TO_AIOS[clickupStatus];
+
+  if (!mapped) {
+    console.warn(`Unknown ClickUp status: ${clickupStatus}, using as-is`);
+    return clickupStatus;
+  }
+
+  return mapped;
+}
+
+/**
+ * Validates if a status is a valid AIOS story status
+ *
+ * @param {string} status - Status to validate
+ * @returns {boolean} True if valid
+ */
+function isValidAIOSStatus(status) {
+  return Object.keys(STATUS_MAPPING.AIOS_TO_CLICKUP).includes(status);
+}
+
+/**
+ * Validates if a status is a valid ClickUp story-status value
+ *
+ * @param {string} status - Status to validate
+ * @returns {boolean} True if valid
+ */
+function isValidClickUpStatus(status) {
+  return Object.keys(STATUS_MAPPING.CLICKUP_TO_AIOS).includes(status);
+}
+
+/**
+ * Gets all valid AIOS story statuses
+ *
+ * @returns {string[]} Array of valid statuses
+ */
+function getValidAIOSStatuses() {
+  return Object.keys(STATUS_MAPPING.AIOS_TO_CLICKUP);
+}
+
+/**
+ * Gets all valid ClickUp story-status values
+ *
+ * @returns {string[]} Array of valid statuses
+ */
+function getValidClickUpStatuses() {
+  return Object.keys(STATUS_MAPPING.CLICKUP_TO_AIOS);
+}
+
+module.exports = {
+  mapStatusToClickUp,
+  mapStatusFromClickUp,
+  isValidAIOSStatus,
+  isValidClickUpStatus,
+  getValidAIOSStatuses,
+  getValidClickUpStatuses,
+  STATUS_MAPPING, // Export for testing
+};