avorelo 0.1.0 → 0.3.0

package/scripts/lib/security-scan.js

@@ -1,384 +0,0 @@
-"use strict";
-
-const fs = require("fs");
-const path = require("path");
-
-const BIDI_CHARS = ["\u202A", "\u202B", "\u202D", "\u202E", "\u202C", "\u2066", "\u2067", "\u2068", "\u2069"];
-
-function detectRiskyBash(cmd) {
-  const c = String(cmd || "").toLowerCase();
-  if (/(curl|wget).*(\||&&|;)\s*(bash|sh)/i.test(c) || /(curl|wget)\s+\S+\s*\|\s*(bash|sh)/i.test(c)) {
-    return { code: "SEC_CURL_PIPE_SH", severity: "high", message: "Blocked: piping remote script into shell is high risk." };
-  }
-  if (/rm\s+-rf\s+\/(\s|$)/i.test(c) || /^rm\s+-rf\s+\/$/i.test(c)) {
-    return { code: "SEC_RM_RF_ROOT", severity: "high", message: "Blocked: destructive rm -rf / pattern." };
-  }
-  if (/chmod\s+777/i.test(c)) {
-    return { code: "SEC_CHMOD_777", severity: "medium", message: "Warning: chmod 777 is often unsafe. Consider least privilege." };
-  }
-  return null;
-}
-
-function sourceTypeForPath(pathHint) {
-  const p = String(pathHint || "").replace(/\\/g, "/");
-  if (p.startsWith("skills/")) return "skill";
-  if (p.startsWith("agents/")) return "agent";
-  if (p.startsWith("hooks/")) return "hook";
-  if (p.startsWith("scripts/")) return "script";
-  return "config";
-}
-
-function clamp(value, min, max) {
-  return Math.max(min, Math.min(max, value));
-}
-
-function isLikelyCommentLine(line) {
-  return /^\s*(#|\/\/|\/\*|\*|<!--)/.test(String(line || ""));
-}
-
-function hasPinnedGitRef(line) {
-  return /#[0-9a-f]{40}\b/i.test(String(line || ""));
-}
-
-function withVerificationRationale(message, verifyHint) {
-  return `${message}. Verify: ${verifyHint}`;
-}
-
-function mkFinding(id, severity, file, line, snippet, confidence, rationale) {
-  return {
-    id,
-    severity,
-    file,
-    line,
-    snippet,
-    confidence: clamp(Number.isFinite(Number(confidence)) ? Number(confidence) : 0.5, 0.05, 1),
-    rationale,
-    sourceType: sourceTypeForPath(file),
-    trustLevel: "unknown",
-    remediationState: "detected",
-    suppressed: false,
-    suppressedBy: null,
-  };
-}
-
-function pathMatches(pathHint, pattern) {
-  if (!pattern) return false;
-  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-  return new RegExp(`^${escaped}$`, "i").test(pathHint.replace(/\\/g, "/"));
-}
-
-function applyAllowlist(findings, allowlist = { reasonCodes: [], pathPatterns: [] }) {
-  return findings.map((f) => {
-    const byCode = (allowlist.reasonCodes || []).find((c) => c === f.id);
-    if (byCode) {
-      return {
-        ...f,
-        suppressed: true,
-        suppressedBy: { type: "reasonCode", value: byCode },
-        rationale: `${f.rationale}; suppressed by allowlist reason code`,
-      };
-    }
-
-    const byPath = (allowlist.pathPatterns || []).find((p) => pathMatches(f.file || "", p));
-    if (byPath) {
-      return {
-        ...f,
-        suppressed: true,
-        suppressedBy: { type: "pathPattern", value: byPath },
-        rationale: `${f.rationale}; suppressed by allowlist path pattern`,
-      };
-    }
-
-    return f;
-  });
-}
-
-function toHighlights(findings) {
-  return findings.slice(0, 10).map((f) => ({
-    id: f.id,
-    severity: f.severity,
-    confidence: f.confidence,
-    path: f.file,
-    line: f.line,
-    snippet: f.snippet,
-    rationale: f.rationale,
-    sourceType: f.sourceType,
-    trustLevel: f.trustLevel,
-    remediationState: f.remediationState,
-    suppressed: f.suppressed,
-    suppressedBy: f.suppressedBy,
-  }));
-}
-
-function suppressionAuditFromFindings(findings) {
-  return findings
-    .filter((f) => f.suppressed)
-    .map((f) => ({
-      findingId: f.id,
-      file: f.file,
-      line: f.line,
-      source: f.suppressedBy,
-      rationale: f.rationale,
-    }));
-}
-
-function weightedRiskScore(activeFindings) {
-  if (!activeFindings.length) return 0;
-
-  const severityPoints = { high: 55, medium: 30, low: 15 };
-  let score = activeFindings.reduce((sum, f) => {
-    const base = severityPoints[f.severity] || severityPoints.low;
-    const confidence = clamp(Number(f.confidence || 0.5), 0.1, 1);
-    return sum + base * confidence;
-  }, 0);
-
-  if (activeFindings.some((f) => f.severity === "high")) score += 15;
-
-  const uniqueReasons = new Set(activeFindings.map((f) => f.id)).size;
-  if (uniqueReasons >= 3) score += 8;
-
-  if (activeFindings.some((f) => ["SEC_PRIVATE_KEY", "SEC_CURL_PIPE_SH"].includes(f.id))) {
-    score = Math.max(score, 90);
-  }
-
-  return Math.min(98, Math.round(score));
-}
-
-function scanTextForSecurity({ text, pathHint, allowlist }) {
-  const lines = String(text || "").split("\n");
-  let findings = [];
-
-  lines.forEach((ln, idx) => {
-    const n = idx + 1;
-    const lower = String(ln || "").toLowerCase();
-    const snip = String(ln || "").trim().slice(0, 160);
-    const commentLine = isLikelyCommentLine(ln);
-
-    if (lower.includes("eval(") || lower.includes("new function(")) {
-      const confidence = commentLine ? 0.55 : 0.95;
-      const severity = commentLine ? "medium" : "high";
-      findings.push(
-        mkFinding(
-          "SEC_EVAL",
-          severity,
-          pathHint,
-          n,
-          snip,
-          confidence,
-          withVerificationRationale("Dynamic code execution pattern", "confirm whether untrusted input can reach this call")
-        )
-      );
-    }
-
-    if (/(curl|wget).*(\||&&|;)\s*(bash|sh)/i.test(ln)) {
-      findings.push(
-        mkFinding(
-          "SEC_CURL_PIPE_SH",
-          "high",
-          pathHint,
-          n,
-          snip,
-          commentLine ? 0.62 : 0.99,
-          withVerificationRationale("Remote script piped into shell", "replace with downloaded and checksum-verified local script")
-        )
-      );
-    }
-
-    const hasRemoteFetch =
-      /(fetch|axios(\.(get|post|request))?|invoke-webrequest|invoke-restmethod|curl|wget)\s*\(?\s*["']?https?:\/\//i.test(ln) ||
-      /(curl|wget)\s+https?:\/\//i.test(ln);
-    if (hasRemoteFetch) {
-      findings.push(
-        mkFinding(
-          "SEC_REMOTE_FETCH",
-          "medium",
-          pathHint,
-          n,
-          snip,
-          commentLine ? 0.45 : 0.78,
-          withVerificationRationale("Remote fetch pattern detected", "ensure source is trusted, pinned, and checksum-verified")
-        )
-      );
-    }
-
-    const hasRemoteInclude =
-      /(source|include|require|import)\s+.*https?:\/\//i.test(ln) || /(from\s+["']https?:\/\/)/i.test(ln);
-    if (hasRemoteInclude) {
-      findings.push(
-        mkFinding(
-          "SEC_REMOTE_INCLUDE",
-          commentLine ? "medium" : "high",
-          pathHint,
-          n,
-          snip,
-          commentLine ? 0.52 : 0.9,
-          withVerificationRationale("Remote include/import pattern", "vendor locally or pin immutable artifact reference")
-        )
-      );
-    }
-
-    const hasGitDep = /git\+https?:\/\//i.test(ln) || /github\.com\/.+\/(main|master)\.zip/i.test(ln);
-    const movingRef = /#(main|master|head|latest)\b/i.test(ln) || (!/#/.test(ln) && /git\+https?:\/\//i.test(ln));
-    if (hasGitDep && movingRef && !hasPinnedGitRef(ln)) {
-      findings.push(
-        mkFinding(
-          "SEC_UNPINNED_GIT_DEP",
-          "medium",
-          pathHint,
-          n,
-          snip,
-          commentLine ? 0.5 : 0.84,
-          withVerificationRationale("Unpinned git dependency pattern", "pin to immutable commit SHA")
-        )
-      );
-    }
-
-    if (/(permissions?|permission_budget)\s*:\s*(\*|all|full|write|network|shell)\b/i.test(ln)) {
-      findings.push(
-        mkFinding(
-          "SEC_OVERBROAD_PERMISSION",
-          "medium",
-          pathHint,
-          n,
-          snip,
-          commentLine ? 0.5 : 0.82,
-          withVerificationRationale("Overbroad permission budget pattern", "narrow to least privilege needed for this task")
-        )
-      );
-    }
-
-    if (ln.includes("BEGIN PRIVATE KEY")) {
-      findings.push(
-        mkFinding(
-          "SEC_PRIVATE_KEY",
-          "high",
-          pathHint,
-          n,
-          "BEGIN PRIVATE KEY",
-          0.99,
-          withVerificationRationale("Private key material detected", "remove key material and rotate affected credentials")
-        )
-      );
-    }
-
-    if (BIDI_CHARS.some((ch) => ln.includes(ch))) {
-      findings.push(
-        mkFinding(
-          "SEC_BIDI_UNICODE",
-          "medium",
-          pathHint,
-          n,
-          snip,
-          0.88,
-          withVerificationRationale("Bidirectional Unicode control character", "inspect hidden characters and normalize text")
-        )
-      );
-    }
-
-    if (/ghp_[A-Za-z0-9]{20,}/.test(ln)) {
-      findings.push(
-        mkFinding(
-          "SEC_GH_TOKEN",
-          "high",
-          pathHint,
-          n,
-          "Possible GitHub token pattern",
-          0.92,
-          withVerificationRationale("Likely GitHub token", "remove token and rotate immediately")
-        )
-      );
-    }
-  });
-
-  findings = applyAllowlist(findings, allowlist);
-  const activeFindings = findings.filter((f) => !f.suppressed);
-
-  const reasonCounts = {};
-  activeFindings.forEach((f) => {
-    reasonCounts[f.id] = (reasonCounts[f.id] || 0) + 1;
-  });
-
-  const topReasons = Object.keys(reasonCounts)
-    .sort((a, b) => {
-      if (reasonCounts[b] !== reasonCounts[a]) return reasonCounts[b] - reasonCounts[a];
-      return a.localeCompare(b);
-    })
-    .slice(0, 3);
-
-  const riskScore = weightedRiskScore(activeFindings);
-
-  return {
-    riskScore,
-    topReasons,
-    highlights: toHighlights(findings),
-    findingsCount: findings.length,
-    activeFindingsCount: activeFindings.length,
-    suppressionAudit: suppressionAuditFromFindings(findings),
-  };
-}
-
-function runBaselineSecurityScan({ cwd, allowlist }) {
-  const targets = [".claude-plugin/plugin.json", "hooks/hooks.json"];
-  const skillRoot = path.join(cwd, "skills");
-  if (fs.existsSync(skillRoot)) targets.push("skills");
-  const agentRoot = path.join(cwd, "agents");
-  if (fs.existsSync(agentRoot)) targets.push("agents");
-  const scriptsRoot = path.join(cwd, "scripts");
-  if (fs.existsSync(scriptsRoot)) targets.push("scripts");
-
-  let findings = [];
-
-  function scanFile(rel) {
-    const abs = path.join(cwd, rel);
-    try {
-      const txt = fs.readFileSync(abs, "utf8");
-      const rep = scanTextForSecurity({ text: txt, pathHint: rel.replace(/\\/g, "/"), allowlist });
-      rep.highlights.forEach((h) => findings.push({ ...h }));
-    } catch {
-      // fail-open
-    }
-  }
-
-  function walk(relDir) {
-    const absDir = path.join(cwd, relDir);
-    const entries = fs.readdirSync(absDir, { withFileTypes: true });
-    entries.forEach((e) => {
-      const rel = path.join(relDir, e.name);
-      if (e.isDirectory()) return walk(rel);
-      if (e.isFile() && (rel.endsWith(".md") || rel.endsWith(".json") || rel.endsWith(".js") || rel.endsWith(".ts"))) {
-        scanFile(rel);
-      }
-    });
-  }
-
-  targets.forEach((t) => {
-    const abs = path.join(cwd, t);
-    if (!fs.existsSync(abs)) return;
-    const st = fs.statSync(abs);
-    if (st.isDirectory()) walk(t);
-    else scanFile(t);
-  });
-
-  const active = findings.filter((f) => !f.suppressed);
-  const reasonCounts = {};
-  active.forEach((f) => {
-    reasonCounts[f.id] = (reasonCounts[f.id] || 0) + 1;
-  });
-
-  const topReasons = Object.keys(reasonCounts)
-    .sort((a, b) => {
-      if (reasonCounts[b] !== reasonCounts[a]) return reasonCounts[b] - reasonCounts[a];
-      return a.localeCompare(b);
-    })
-    .slice(0, 3);
-
-  const riskScore = weightedRiskScore(active);
-  return { riskScore, topReasons, highlights: findings.slice(0, 10) };
-}
-
-module.exports = {
-  detectRiskyBash,
-  scanTextForSecurity,
-  runBaselineSecurityScan,
-  weightedRiskScore,
-};