avorelo 0.3.8 → 0.4.0-rc.2

package/scripts/lib/supply-chain-guard.js

@@ -0,0 +1,219 @@
+"use strict";
+
+const { safeReadJson } = require("./fsx");
+const {
+  buildGuardReportSkeleton,
+  finalizeGuardReport,
+  makeEvidenceRef,
+  makeFinding,
+  readChangedFiles,
+  readText,
+  sanitizeText,
+  scanWorkspace,
+  unique,
+  writeGuardReport,
+} = require("./guard-suite-common");
+
+const CONTRACT = "avorelo.supplyChainGuard.v1";
+const REPORT_DIR_REL = ".claude/cco/reports/supply-chain-guard";
+const REPORT_JSON_REL = `${REPORT_DIR_REL}/latest-report.json`;
+const LOCKFILE_RE = /^(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb)$/i;
+const RISKY_DEP_RE = /\b(git\+|github:|https?:\/\/|workspace:\*|latest)\b/i;
+const INSTALL_SCRIPT_RE = /\b(preinstall|postinstall)\b/i;
+const RISKY_SCRIPT_RE = /\b(curl|wget|Invoke-WebRequest|iwr|powershell|bash)\b/i;
+
+function buildSupplyChainGuard(cwd = process.cwd(), options = {}) {
+  const startMs = Date.now();
+  const changedFiles = readChangedFiles(cwd, options.changedFiles);
+  const packageJson = safeReadJson(cwd, "package.json", {});
+  const scanState = scanWorkspace(cwd, { maxFiles: 300, maxFileBytes: 128 * 1024 });
+  const report = buildGuardReportSkeleton(CONTRACT, "Supply Chain Guard");
+  const findings = [];
+  const surfacesDetected = [];
+  const safeActions = [];
+
+  const hasPackageJson = scanState.files.some((file) => file.relPath === "package.json");
+  const lockfiles = scanState.files.filter((file) => LOCKFILE_RE.test(file.relPath));
+
+  if (hasPackageJson) {
+    surfacesDetected.push("package_manifest");
+  }
+  if (lockfiles.length > 0) {
+    surfacesDetected.push("lockfile");
+    findings.push(makeFinding(
+      "supply-chain-lockfile",
+      "info",
+      "SUPPLY_CHAIN_LOCKFILE_FOUND",
+      "Lockfile found",
+      "A package lockfile was found locally.",
+      lockfiles.map((file) => makeEvidenceRef(file.relPath, "lockfile", "dependency-lock")).slice(0, 2),
+      "Keep the lockfile current with package changes."
+    ));
+  }
+
+  const pkgText = scanState.files.find((file) => file.relPath === "package.json");
+  const pkgRaw = pkgText ? readText(pkgText, scanState) : null;
+  const deps = {
+    ...(packageJson.dependencies || {}),
+    ...(packageJson.devDependencies || {}),
+    ...(packageJson.optionalDependencies || {}),
+  };
+  const depEntries = Object.entries(deps);
+  if (depEntries.length > 0) surfacesDetected.push("dependencies");
+
+  const riskyDeps = depEntries.filter(([, version]) => RISKY_DEP_RE.test(String(version || "")));
+  if (riskyDeps.length > 0) {
+    findings.push(makeFinding(
+      "supply-chain-risky-dependency",
+      "warn",
+      "SUPPLY_CHAIN_RISKY_DEPENDENCY",
+      "Risky dependency source found",
+      "One or more dependencies use a non-pinned or remote source.",
+      [makeEvidenceRef("package.json", "manifest", riskyDeps[0][0])],
+      "Pin risky dependency sources before treating the supply chain as trusted."
+    ));
+    safeActions.push("Pin risky dependency sources before treating the supply chain as trusted.");
+  }
+
+  if (pkgRaw && INSTALL_SCRIPT_RE.test(pkgRaw) && RISKY_SCRIPT_RE.test(pkgRaw)) {
+    findings.push(makeFinding(
+      "supply-chain-install-script",
+      "block",
+      "SUPPLY_CHAIN_INSTALL_SCRIPT_RISK",
+      "Risky install-time script found",
+      "A package install-time script appears able to fetch or execute remote content.",
+      [makeEvidenceRef("package.json", "manifest", "install-script-risk")],
+      "Remove or review the risky install-time script before trusting this package surface."
+    ));
+    safeActions.push("Remove or review the risky install-time script before trusting this package surface.");
+  }
+
+  if (hasPackageJson && lockfiles.length === 0) {
+    findings.push(makeFinding(
+      "supply-chain-missing-lockfile",
+      "warn",
+      "SUPPLY_CHAIN_LOCKFILE_MISSING",
+      "Lockfile missing",
+      "A package manifest was found without a lockfile.",
+      [makeEvidenceRef("package.json", "manifest", "missing-lockfile")],
+      "Add or restore a lockfile before trusting dependency changes."
+    ));
+    safeActions.push("Add or restore a lockfile before trusting dependency changes.");
+  }
+
+  if (findings.length === 0 && hasPackageJson) {
+    findings.push(makeFinding(
+      "supply-chain-surface-found",
+      "info",
+      "SUPPLY_CHAIN_SURFACE_FOUND",
+      "Supply-chain surface found",
+      "Package manifest and dependency surfaces were found locally.",
+      [makeEvidenceRef("package.json", "manifest", "package-manifest")],
+      "Keep package and dependency evidence current."
+    ));
+  }
+
+  if (findings.length === 0) {
+    findings.push(makeFinding(
+      "supply-chain-no-evidence",
+      "warn",
+      "SUPPLY_CHAIN_NO_EVIDENCE",
+      "No supply-chain evidence found",
+      "No package or dependency surface was found locally.",
+      [],
+      "Add a package manifest or dependency surface and rerun the guard."
+    ));
+    safeActions.push("Add a package manifest or dependency surface and rerun the guard.");
+  }
+
+  report.findings = findings.sort((left, right) => (right.severity === "block" ? 3 : right.severity === "warn" ? 2 : 1) - (left.severity === "block" ? 3 : left.severity === "warn" ? 2 : 1));
+  report.surfaceEvidence.surfacesDetected = unique(surfacesDetected);
+  report.summary.text = report.findings[0]?.message || "No relevant supply-chain evidence found locally.";
+  report.summary.safeNextAction = safeActions[0]
+    || report.findings.find((finding) => finding.severity !== "info")?.safeNextAction
+    || report.findings[0]?.safeNextAction
+    || "Keep package and dependency evidence current.";
+  report.productHome.cardSource = "supplyChainGuard";
+  report.productHome.found = unique(report.findings.filter((finding) => finding.severity === "info").slice(0, 2).map((finding) => finding.title));
+  report.productHome.fixedOrPrepared = [];
+  report.productHome.savedOrProved = unique(report.findings.filter((finding) => finding.severity === "info").slice(0, 2).map((finding) => finding.title));
+  report.productHome.forReview = unique(report.findings.filter((finding) => finding.severity !== "info").slice(0, 3).map((finding) => finding.title));
+  report.valueProof.measurementType = "heuristic";
+  report.valueProof.publicClaimAllowed = false;
+  report.valueProof.evidenceRefs = unique([
+    ...report.findings.flatMap((finding) => (finding.evidenceRefs || []).map((ref) => ref.path)),
+    REPORT_JSON_REL,
+  ]).slice(0, 4);
+  report.valueProof.caveat = "This guard checks local package and dependency signals only. It does not call registries, run npm audit, or certify supply-chain safety.";
+
+  finalizeGuardReport(report, scanState, {
+    changedFiles,
+    durationMs: Date.now() - startMs,
+    packageName: packageJson.name,
+  });
+
+  if (report.status === "no_data") {
+    report.summary.text = "No relevant supply-chain evidence found locally.";
+    report.summary.safeNextAction = "Add a package manifest or dependency surface and rerun the guard.";
+  }
+
+  return report;
+}
+
+function generateSupplyChainGuard(cwd = process.cwd(), options = {}) {
+  const report = buildSupplyChainGuard(cwd, options);
+  const writeResult = writeGuardReport(cwd, REPORT_JSON_REL, report, options);
+  return { report, ...writeResult };
+}
+
+function readLatestSupplyChainGuard(cwd = process.cwd()) {
+  return safeReadJson(cwd, REPORT_JSON_REL, null);
+}
+
+function buildSupplyChainGuardSurface(cwd = process.cwd(), options = {}) {
+  const report = readLatestSupplyChainGuard(cwd)
+    || (options.buildIfMissing ? buildSupplyChainGuard(cwd, options) : null);
+
+  if (!report) {
+    return {
+      status: "not_run",
+      showInStatus: false,
+      showInDashboard: false,
+      nextBestAction: "Run `avorelo supply-chain-guard --text`.",
+      statusLine: "Supply-chain guard: NOT RUN",
+      evidenceRef: REPORT_JSON_REL,
+    };
+  }
+
+  return {
+    status: report.status,
+    showInStatus: false,
+    showInDashboard: false,
+    nextBestAction: report.summary.safeNextAction,
+    statusLine: `Supply-chain guard: ${String(report.status).toUpperCase()} · next: ${sanitizeText(report.summary.safeNextAction, 120) || "review local evidence"}`,
+    evidenceRef: REPORT_JSON_REL,
+    reasonCodes: unique(report.findings.map((finding) => finding.reasonCode)).slice(0, 8),
+  };
+}
+
+function formatSupplyChainGuardText(report) {
+  return [
+    "Avorelo Supply-Chain Guard",
+    `Status: ${String(report.status || "no_data").toUpperCase()}`,
+    `Summary: ${report.summary.text}`,
+    `Surfaces: ${report.surfaceEvidence.surfacesDetected.length > 0 ? report.surfaceEvidence.surfacesDetected.join(", ") : "none"}`,
+    `Top reason codes: ${unique(report.findings.map((finding) => finding.reasonCode)).slice(0, 5).join(", ") || "none"}`,
+    `Safe next action: ${report.summary.safeNextAction}`,
+  ].join("\n");
+}
+
+module.exports = {
+  CONTRACT,
+  REPORT_DIR_REL,
+  REPORT_JSON_REL,
+  buildSupplyChainGuard,
+  buildSupplyChainGuardSurface,
+  formatSupplyChainGuardText,
+  generateSupplyChainGuard,
+  readLatestSupplyChainGuard,
+};