aura-security 0.4.0

package/dist/agents/scanners/gitleaks.js

@@ -0,0 +1,155 @@
+/**
+ * Aura Protocol - Gitleaks Agent
+ *
+ * Scans for secrets and API keys using gitleaks.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { BaseAgent } from '../base.js';
+const CONFIG = {
+    id: 'gitleaks',
+    name: 'Gitleaks',
+    role: 'scanner',
+    description: 'Detect secrets and API keys in code',
+    enabled: true,
+    externalTool: 'gitleaks',
+};
+const CAPABILITIES = {
+    fileTypes: ['*'],
+    languages: ['*'],
+    requiresExternalTool: true,
+    supportsParallel: true,
+};
+// Files to skip (lock files, generated files)
+const SKIP_FILES = [
+    'package-lock.json',
+    'yarn.lock',
+    'pnpm-lock.yaml',
+    'composer.lock',
+    'Gemfile.lock',
+    'poetry.lock',
+    'Cargo.lock',
+    'go.sum',
+];
+// Rules to skip entirely (too many false positives)
+const SKIP_RULES = ['aws-secret-access-key'];
+export class GitleaksAgent extends BaseAgent {
+    constructor() {
+        super(CONFIG, CAPABILITIES);
+    }
+    async execute(context) {
+        const startTime = Date.now();
+        this.status = 'running';
+        const findings = [];
+        try {
+            context.log('info', `Gitleaks scanning: ${context.targetPath}`);
+            // Create temp config to exclude lock files
+            const tempConfigPath = path.join(context.targetPath, '.gitleaks-temp.toml');
+            const configContent = `
+[allowlist]
+paths = [
+  ${SKIP_FILES.map((f) => `"**/${f}"`).join(',\n  ')}
+]
+`;
+            fs.writeFileSync(tempConfigPath, configContent);
+            // Run gitleaks
+            const { stdout, stderr, exitCode } = await this.executeCommand('gitleaks', [
+                'detect',
+                '--source',
+                context.targetPath,
+                '--report-format',
+                'json',
+                '--report-path',
+                '/dev/stdout',
+                '--config',
+                tempConfigPath,
+                '--no-git',
+                '--exit-code',
+                '0',
+            ], { cwd: context.targetPath, timeout: 300000 });
+            // Clean up temp config
+            try {
+                fs.unlinkSync(tempConfigPath);
+            }
+            catch {
+                // Ignore cleanup errors
+            }
+            if (stdout.trim()) {
+                try {
+                    const results = JSON.parse(stdout);
+                    for (const result of results) {
+                        // Skip rules with too many false positives
+                        if (SKIP_RULES.includes(result.RuleID)) {
+                            continue;
+                        }
+                        // Skip lock files
+                        if (SKIP_FILES.some((f) => result.File.endsWith(f))) {
+                            continue;
+                        }
+                        const finding = this.createFinding('gitleaks', {
+                            type: 'secret',
+                            severity: this.getSeverity(result),
+                            title: result.Description || result.RuleID,
+                            description: `Secret detected: ${result.RuleID}`,
+                            file: result.File,
+                            line: result.StartLine,
+                            metadata: {
+                                ruleId: result.RuleID,
+                                match: this.maskSecret(result.Match),
+                                entropy: result.Entropy,
+                            },
+                        });
+                        findings.push(finding);
+                        context.addFinding(finding);
+                    }
+                }
+                catch (parseError) {
+                    context.log('warn', `Failed to parse gitleaks output: ${parseError}`);
+                }
+            }
+            this.status = 'complete';
+            context.log('info', `Gitleaks found ${findings.length} secrets`);
+            return {
+                agentId: this.config.id,
+                agentName: this.config.name,
+                status: 'success',
+                findings,
+                duration: Date.now() - startTime,
+            };
+        }
+        catch (error) {
+            this.status = 'error';
+            const errorMsg = error instanceof Error ? error.message : String(error);
+            context.log('error', `Gitleaks error: ${errorMsg}`);
+            return {
+                agentId: this.config.id,
+                agentName: this.config.name,
+                status: 'error',
+                findings,
+                duration: Date.now() - startTime,
+                error: errorMsg,
+            };
+        }
+    }
+    getSeverity(result) {
+        // High entropy secrets are more likely to be real
+        if (result.Entropy && result.Entropy > 4.5) {
+            return 'critical';
+        }
+        // Certain rule types are more critical
+        const criticalRules = ['private-key', 'aws-access-key', 'github-pat', 'stripe-api-key'];
+        if (criticalRules.some((r) => result.RuleID.toLowerCase().includes(r))) {
+            return 'critical';
+        }
+        const highRules = ['api-key', 'token', 'password', 'secret'];
+        if (highRules.some((r) => result.RuleID.toLowerCase().includes(r))) {
+            return 'high';
+        }
+        return 'medium';
+    }
+    maskSecret(secret) {
+        if (secret.length <= 8)
+            return '***';
+        return secret.slice(0, 4) + '...' + secret.slice(-4);
+    }
+}

package/dist/agents/scanners/grype.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Aura Protocol - Grype Agent
+ *
+ * Vulnerability scanner for container images and filesystems.
+ */
+import { BaseAgent } from '../base.js';
+import { AgentResult } from '../types.js';
+import { ZoneContext } from '../../zones/types.js';
+export declare class GrypeAgent extends BaseAgent {
+    constructor();
+    execute(context: ZoneContext): Promise<AgentResult>;
+    private mapSeverity;
+    private getCvssScore;
+}

package/dist/agents/scanners/grype.js

@@ -0,0 +1,109 @@
+/**
+ * Aura Protocol - Grype Agent
+ *
+ * Vulnerability scanner for container images and filesystems.
+ */
+import { BaseAgent } from '../base.js';
+const CONFIG = {
+    id: 'grype',
+    name: 'Grype',
+    role: 'scanner',
+    description: 'Vulnerability scanner for container images and filesystems',
+    enabled: true,
+    externalTool: 'grype',
+};
+const CAPABILITIES = {
+    fileTypes: ['*'],
+    languages: ['*'],
+    requiresExternalTool: true,
+    supportsParallel: true,
+};
+export class GrypeAgent extends BaseAgent {
+    constructor() {
+        super(CONFIG, CAPABILITIES);
+    }
+    async execute(context) {
+        const startTime = Date.now();
+        this.status = 'running';
+        const findings = [];
+        try {
+            context.log('info', `Grype scanning: ${context.targetPath}`);
+            // Run grype
+            const { stdout, stderr, exitCode } = await this.executeCommand('grype', ['dir:' + context.targetPath, '-o', 'json', '--by-cve'], { cwd: context.targetPath, timeout: 300000 });
+            if (stdout.trim()) {
+                try {
+                    const output = JSON.parse(stdout);
+                    if (output.matches) {
+                        for (const match of output.matches) {
+                            const finding = this.createFinding('grype', {
+                                type: 'vulnerability',
+                                severity: this.mapSeverity(match.vulnerability.severity),
+                                title: `${match.artifact.name}: ${match.vulnerability.id}`,
+                                description: match.vulnerability.description ||
+                                    `Vulnerability in ${match.artifact.name}@${match.artifact.version}`,
+                                file: match.artifact.locations?.[0]?.path,
+                                metadata: {
+                                    vulnerabilityId: match.vulnerability.id,
+                                    package: match.artifact.name,
+                                    version: match.artifact.version,
+                                    type: match.artifact.type,
+                                    fixVersions: match.vulnerability.fix?.versions,
+                                    fixState: match.vulnerability.fix?.state,
+                                    cvssScore: this.getCvssScore(match),
+                                    references: match.vulnerability.urls?.slice(0, 3),
+                                },
+                            });
+                            findings.push(finding);
+                            context.addFinding(finding);
+                        }
+                    }
+                }
+                catch (parseError) {
+                    context.log('warn', `Failed to parse grype output: ${parseError}`);
+                }
+            }
+            this.status = 'complete';
+            context.log('info', `Grype found ${findings.length} vulnerabilities`);
+            return {
+                agentId: this.config.id,
+                agentName: this.config.name,
+                status: 'success',
+                findings,
+                duration: Date.now() - startTime,
+            };
+        }
+        catch (error) {
+            this.status = 'error';
+            const errorMsg = error instanceof Error ? error.message : String(error);
+            context.log('error', `Grype error: ${errorMsg}`);
+            return {
+                agentId: this.config.id,
+                agentName: this.config.name,
+                status: 'error',
+                findings,
+                duration: Date.now() - startTime,
+                error: errorMsg,
+            };
+        }
+    }
+    mapSeverity(grypeSeverity) {
+        switch (grypeSeverity.toLowerCase()) {
+            case 'critical':
+                return 'critical';
+            case 'high':
+                return 'high';
+            case 'medium':
+                return 'medium';
+            case 'low':
+                return 'low';
+            default:
+                return 'info';
+        }
+    }
+    getCvssScore(match) {
+        if (!match.vulnerability.cvss || match.vulnerability.cvss.length === 0) {
+            return undefined;
+        }
+        return match.vulnerability.cvss[0].metrics.baseScore;
+    }
+}

package/dist/agents/scanners/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Aura Protocol - Scanner Agents
+ *
+ * Export all scanner agents.
+ */
+export { GitleaksAgent } from './gitleaks.js';
+export { TrivyAgent } from './trivy.js';
+export { SemgrepAgent } from './semgrep.js';
+export { GrypeAgent } from './grype.js';
+export { NpmAuditAgent } from './npm-audit.js';
+import { Agent } from '../types.js';
+/**
+ * Create all scanner agents
+ */
+export declare function createScannerAgents(): Agent[];

package/dist/agents/scanners/index.js

@@ -0,0 +1,27 @@
+/**
+ * Aura Protocol - Scanner Agents
+ *
+ * Export all scanner agents.
+ */
+export { GitleaksAgent } from './gitleaks.js';
+export { TrivyAgent } from './trivy.js';
+export { SemgrepAgent } from './semgrep.js';
+export { GrypeAgent } from './grype.js';
+export { NpmAuditAgent } from './npm-audit.js';
+import { GitleaksAgent } from './gitleaks.js';
+import { TrivyAgent } from './trivy.js';
+import { SemgrepAgent } from './semgrep.js';
+import { GrypeAgent } from './grype.js';
+import { NpmAuditAgent } from './npm-audit.js';
+/**
+ * Create all scanner agents
+ */
+export function createScannerAgents() {
+    return [
+        new GitleaksAgent(),
+        new TrivyAgent(),
+        new SemgrepAgent(),
+        new GrypeAgent(),
+        new NpmAuditAgent(),
+    ];
+}

package/dist/agents/scanners/npm-audit.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Aura Protocol - NPM Audit Agent
+ *
+ * Audit npm packages for vulnerabilities.
+ */
+import { BaseAgent } from '../base.js';
+import { AgentResult } from '../types.js';
+import { ZoneContext } from '../../zones/types.js';
+export declare class NpmAuditAgent extends BaseAgent {
+    constructor();
+    execute(context: ZoneContext): Promise<AgentResult>;
+    private mapSeverity;
+}

package/dist/agents/scanners/npm-audit.js

@@ -0,0 +1,129 @@
+/**
+ * Aura Protocol - NPM Audit Agent
+ *
+ * Audit npm packages for vulnerabilities.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { BaseAgent } from '../base.js';
+const CONFIG = {
+    id: 'npm-audit',
+    name: 'NPM Audit',
+    role: 'scanner',
+    description: 'Audit npm packages for vulnerabilities',
+    enabled: true,
+    externalTool: 'npm',
+};
+const CAPABILITIES = {
+    fileTypes: ['package.json', 'package-lock.json'],
+    languages: ['javascript', 'typescript'],
+    requiresExternalTool: true,
+    supportsParallel: true,
+};
+export class NpmAuditAgent extends BaseAgent {
+    constructor() {
+        super(CONFIG, CAPABILITIES);
+    }
+    async execute(context) {
+        const startTime = Date.now();
+        this.status = 'running';
+        const findings = [];
+        try {
+            // Check if package.json exists
+            const packageJsonPath = path.join(context.targetPath, 'package.json');
+            if (!fs.existsSync(packageJsonPath)) {
+                context.log('info', 'No package.json found, skipping npm audit');
+                this.status = 'complete';
+                return {
+                    agentId: this.config.id,
+                    agentName: this.config.name,
+                    status: 'skipped',
+                    findings: [],
+                    duration: Date.now() - startTime,
+                };
+            }
+            context.log('info', `NPM Audit scanning: ${context.targetPath}`);
+            // Run npm audit
+            const { stdout, stderr, exitCode } = await this.executeCommand('npm', ['audit', '--json'], { cwd: context.targetPath, timeout: 120000 });
+            if (stdout.trim()) {
+                try {
+                    const output = JSON.parse(stdout);
+                    if (output.vulnerabilities) {
+                        for (const [pkgName, vuln] of Object.entries(output.vulnerabilities)) {
+                            // Get details from the 'via' field
+                            let title = `Vulnerability in ${pkgName}`;
+                            let cwe = [];
+                            let url;
+                            for (const via of vuln.via) {
+                                if (typeof via === 'object') {
+                                    title = via.title || title;
+                                    cwe = via.cwe || cwe;
+                                    url = via.url;
+                                    break;
+                                }
+                            }
+                            const finding = this.createFinding('npm-audit', {
+                                type: 'vulnerability',
+                                severity: this.mapSeverity(vuln.severity),
+                                title: `${pkgName}: ${title}`,
+                                description: `${title}. Affects versions: ${vuln.range}`,
+                                file: 'package.json',
+                                metadata: {
+                                    package: pkgName,
+                                    severity: vuln.severity,
+                                    isDirect: vuln.isDirect,
+                                    range: vuln.range,
+                                    cwe,
+                                    url,
+                                    fixAvailable: vuln.fixAvailable,
+                                    effects: vuln.effects,
+                                },
+                            });
+                            findings.push(finding);
+                            context.addFinding(finding);
+                        }
+                    }
+                }
+                catch (parseError) {
+                    context.log('warn', `Failed to parse npm audit output: ${parseError}`);
+                }
+            }
+            this.status = 'complete';
+            context.log('info', `NPM Audit found ${findings.length} vulnerabilities`);
+            return {
+                agentId: this.config.id,
+                agentName: this.config.name,
+                status: 'success',
+                findings,
+                duration: Date.now() - startTime,
+            };
+        }
+        catch (error) {
+            this.status = 'error';
+            const errorMsg = error instanceof Error ? error.message : String(error);
+            context.log('error', `NPM Audit error: ${errorMsg}`);
+            return {
+                agentId: this.config.id,
+                agentName: this.config.name,
+                status: 'error',
+                findings,
+                duration: Date.now() - startTime,
+                error: errorMsg,
+            };
+        }
+    }
+    mapSeverity(npmSeverity) {
+        switch (npmSeverity.toLowerCase()) {
+            case 'critical':
+                return 'critical';
+            case 'high':
+                return 'high';
+            case 'moderate':
+                return 'medium';
+            case 'low':
+                return 'low';
+            default:
+                return 'info';
+        }
+    }
+}

package/dist/agents/scanners/semgrep.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Aura Protocol - Semgrep Agent
+ *
+ * Static analysis for security patterns.
+ */
+import { BaseAgent } from '../base.js';
+import { AgentResult } from '../types.js';
+import { ZoneContext } from '../../zones/types.js';
+export declare class SemgrepAgent extends BaseAgent {
+    constructor();
+    execute(context: ZoneContext): Promise<AgentResult>;
+    private getType;
+    private mapSeverity;
+}

package/dist/agents/scanners/semgrep.js

@@ -0,0 +1,131 @@
+/**
+ * Aura Protocol - Semgrep Agent
+ *
+ * Static analysis for security patterns.
+ */
+import { BaseAgent } from '../base.js';
+const CONFIG = {
+    id: 'semgrep',
+    name: 'Semgrep',
+    role: 'scanner',
+    description: 'Static analysis for security patterns',
+    enabled: true,
+    externalTool: 'semgrep',
+};
+const CAPABILITIES = {
+    fileTypes: ['*.js', '*.ts', '*.py', '*.go', '*.java', '*.rb', '*.php'],
+    languages: ['javascript', 'typescript', 'python', 'go', 'java', 'ruby', 'php'],
+    requiresExternalTool: true,
+    supportsParallel: true,
+};
+export class SemgrepAgent extends BaseAgent {
+    constructor() {
+        super(CONFIG, CAPABILITIES);
+    }
+    async execute(context) {
+        const startTime = Date.now();
+        this.status = 'running';
+        const findings = [];
+        try {
+            context.log('info', `Semgrep scanning: ${context.targetPath}`);
+            // Run semgrep with security ruleset
+            const { stdout, stderr, exitCode } = await this.executeCommand('semgrep', [
+                'scan',
+                '--config',
+                'p/security-audit',
+                '--config',
+                'p/secrets',
+                '--json',
+                '--no-git-ignore',
+                '--exclude',
+                'node_modules',
+                '--exclude',
+                '.git',
+                '--exclude',
+                'dist',
+                '--exclude',
+                'build',
+                context.targetPath,
+            ], { cwd: context.targetPath, timeout: 600000 } // 10 min timeout for semgrep
+            );
+            if (stdout.trim()) {
+                try {
+                    const output = JSON.parse(stdout);
+                    if (output.results) {
+                        for (const result of output.results) {
+                            const finding = this.createFinding('semgrep', {
+                                type: this.getType(result),
+                                severity: this.mapSeverity(result.extra.severity),
+                                title: result.check_id,
+                                description: result.extra.message,
+                                file: result.path,
+                                line: result.start.line,
+                                metadata: {
+                                    checkId: result.check_id,
+                                    category: result.extra.metadata?.category,
+                                    cwe: result.extra.metadata?.cwe,
+                                    owasp: result.extra.metadata?.owasp,
+                                    references: result.extra.metadata?.references?.slice(0, 3),
+                                    endLine: result.end.line,
+                                    column: result.start.col,
+                                },
+                            });
+                            findings.push(finding);
+                            context.addFinding(finding);
+                        }
+                    }
+                    if (output.errors && output.errors.length > 0) {
+                        for (const error of output.errors) {
+                            context.log('warn', `Semgrep error: ${error.message}`);
+                        }
+                    }
+                }
+                catch (parseError) {
+                    context.log('warn', `Failed to parse semgrep output: ${parseError}`);
+                }
+            }
+            this.status = 'complete';
+            context.log('info', `Semgrep found ${findings.length} issues`);
+            return {
+                agentId: this.config.id,
+                agentName: this.config.name,
+                status: 'success',
+                findings,
+                duration: Date.now() - startTime,
+            };
+        }
+        catch (error) {
+            this.status = 'error';
+            const errorMsg = error instanceof Error ? error.message : String(error);
+            context.log('error', `Semgrep error: ${errorMsg}`);
+            return {
+                agentId: this.config.id,
+                agentName: this.config.name,
+                status: 'error',
+                findings,
+                duration: Date.now() - startTime,
+                error: errorMsg,
+            };
+        }
+    }
+    getType(result) {
+        const checkId = result.check_id.toLowerCase();
+        const category = result.extra.metadata?.category?.toLowerCase() || '';
+        if (checkId.includes('secret') || category.includes('secret')) {
+            return 'secret';
+        }
+        return 'vulnerability';
+    }
+    mapSeverity(semgrepSeverity) {
+        switch (semgrepSeverity.toUpperCase()) {
+            case 'ERROR':
+                return 'critical';
+            case 'WARNING':
+                return 'high';
+            case 'INFO':
+                return 'medium';
+            default:
+                return 'low';
+        }
+    }
+}

package/dist/agents/scanners/trivy.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Aura Protocol - Trivy Agent
+ *
+ * Scans for vulnerabilities in dependencies and containers.
+ */
+import { BaseAgent } from '../base.js';
+import { AgentResult } from '../types.js';
+import { ZoneContext } from '../../zones/types.js';
+export declare class TrivyAgent extends BaseAgent {
+    constructor();
+    execute(context: ZoneContext): Promise<AgentResult>;
+    private mapSeverity;
+    private getCvssScore;
+}