bmad-plus 0.20.0 → 0.22.0

package/src/bmad-plus/packs/pack-seo/scripts/seo_fetch.py

@@ -3,7 +3,8 @@
 SEO Fetch — Secure HTTP page fetcher for SEO analysis.
 
 Features:
-- SSRF protection (blocks private/loopback/reserved IPs)
+- SSRF protection (blocks private/loopback/reserved IPs, re-checked on every
+  redirect hop, connection pinned to the validated address)
 - Multi-UA support (standard, Googlebot, GPTBot, ClaudeBot)
 - Redirect chain tracking
 - Cookie handling
@@ -16,12 +17,16 @@ License: MIT
 import argparse
 import ipaddress
 import json
+import os
 import socket
 import sys
+import time
 from urllib.parse import urljoin, urlparse
 
 try:
     import requests
+    from requests.adapters import DEFAULT_POOLBLOCK, HTTPAdapter
+    from urllib3 import PoolManager
 except ImportError:
     print("Error: requests library required. Install: pip install requests", file=sys.stderr)
     sys.exit(1)
@@ -61,10 +66,37 @@ DEFAULT_HEADERS = {
 
 # ── Security: SSRF Prevention ──────────────────────────────────────
 
+ALLOWED_SCHEMES = frozenset({"http", "https"})
+
+# RFC 6052 well-known NAT64 prefix: the last 32 bits are the IPv4 host the
+# translator will reach, so the address is only as safe as that IPv4 host.
+_NAT64_PREFIX = ipaddress.ip_network("64:ff9b::/96")
+
+
+class UnsafeURLError(requests.exceptions.InvalidURL):
+    """A URL, or the address it resolves to, must never be fetched."""
+
+
 def _ip_is_blocked(ip: "ipaddress._BaseAddress") -> bool:
-    """Return True if an IP falls in any range that must never be reached."""
+    """Return True if an IP falls in any range that must never be reached.
+
+    Anything that is not globally routable is refused: private, loopback,
+    link-local (cloud metadata at 169.254.169.254), carrier-grade NAT
+    (100.64.0.0/10, e.g. Alibaba metadata at 100.100.100.200), documentation
+    and benchmarking ranges, multicast and reserved space. IPv6 forms that
+    embed an IPv4 destination are judged by that destination.
+    """
+    if ip.version == 6:
+        embedded = ip.ipv4_mapped
+        if embedded is None and ip in _NAT64_PREFIX:
+            embedded = ipaddress.IPv4Address(int(ip) & 0xFFFFFFFF)
+        if embedded is not None:
+            return _ip_is_blocked(embedded)
+        if ip.is_site_local:
+            return True
     return bool(
-        ip.is_private
+        not ip.is_global
+        or ip.is_private
         or ip.is_loopback
         or ip.is_reserved
         or ip.is_link_local
@@ -73,47 +105,152 @@ def _ip_is_blocked(ip: "ipaddress._BaseAddress") -> bool:
     )
 
 
-def is_safe_url(url: str) -> bool:
-    """Block requests to private, loopback, and reserved IP addresses.
+def check_url(url: str) -> str:
+    """Apply the URL-level rules and return the hostname, without resolving it.
 
-    Fails CLOSED: a missing host, a non-HTTP(S) scheme, a DNS resolution
-    error, or an unparseable/blocked address all cause the URL to be
-    rejected. Every resolved address (IPv4 and IPv6) must be public.
+    Fails CLOSED with UnsafeURLError: a scheme outside http/https, embedded
+    credentials, a missing host or an invalid port rejects the URL.
     """
     parsed = urlparse(url)
+    if parsed.scheme not in ALLOWED_SCHEMES:
+        raise UnsafeURLError(f"scheme not allowed: {parsed.scheme or '(none)'}")
+    # "user:pass@" would be sent as an Authorization header and makes
+    # "https://trusted.example@evil.example/" style URLs misleading.
+    if parsed.username is not None or parsed.password is not None:
+        raise UnsafeURLError("credentials in URL are not allowed")
     hostname = parsed.hostname
-
     if not hostname:
-        return False
+        raise UnsafeURLError("URL has no host")
+    try:
+        parsed.port
+    except ValueError:
+        raise UnsafeURLError("URL has an invalid port") from None
+    return hostname
 
-    if parsed.scheme not in ("http", "https"):
-        return False
 
+def resolve_public_address(hostname: str) -> str:
+    """Resolve a hostname and return the public address to connect to.
+
+    Fails CLOSED with UnsafeURLError on a DNS error or when any resolved
+    address (IPv4 or IPv6) is not public: every address the name resolves to
+    must be public, so the returned one is safe whichever the resolver would
+    have preferred.
+    """
     try:
-        # Resolve ALL IP addresses (IPv4 and IPv6) via getaddrinfo
         addrinfo = socket.getaddrinfo(hostname, None)
-    except socket.gaierror:
-        return False  # Fail closed: unresolvable host is treated as unsafe
-
-    if not addrinfo:
-        return False  # Fail closed: no addresses resolved
+    except (socket.gaierror, UnicodeError):
+        raise UnsafeURLError(f"cannot resolve host {hostname}") from None
 
+    addresses = []
     for entry in addrinfo:
-        ip_str = entry[4][0]  # sockaddr[0] contains the IP string
         try:
-            ip = ipaddress.ip_address(ip_str)
+            ip = ipaddress.ip_address(entry[4][0])
         except ValueError:
-            return False  # Fail closed: unparseable address
-        # IPv4-mapped IPv6 (::ffff:a.b.c.d) must be checked as its IPv4 form
-        mapped = getattr(ip, "ipv4_mapped", None)
-        if mapped is not None and _ip_is_blocked(mapped):
-            return False
+            raise UnsafeURLError(f"{hostname} resolved to an unparseable address") from None
         if _ip_is_blocked(ip):
-            return False
+            raise UnsafeURLError(f"{hostname} resolves to a private/internal address ({ip})")
+        addresses.append(ip)
+    if not addresses:
+        raise UnsafeURLError(f"cannot resolve host {hostname}")
+
+    # A pinned connection cannot fall back to another address, and IPv6 routes
+    # are often missing in containers and CI: prefer IPv4 on dual-stack hosts.
+    preferred = next((ip for ip in addresses if ip.version == 4), addresses[0])
+    return str(preferred)
+
 
+def resolve_target(url: str) -> "tuple[str, str]":
+    """Validate a URL and return ``(hostname, address)`` to connect to.
+
+    Combines check_url() and resolve_public_address(); see their rules.
+    """
+    hostname = check_url(url)
+    return hostname, resolve_public_address(hostname)
+
+
+def is_safe_url(url: str) -> bool:
+    """Return True when resolve_target() accepts the URL (see its rules)."""
+    try:
+        resolve_target(url)
+    except UnsafeURLError:
+        return False
     return True
 
 
+class _PinnedPoolManager(PoolManager):
+    """urllib3 pool manager that only opens pools on validated IP literals.
+
+    Every requests version reaches the network through
+    PoolManager.connection_from_host (directly, or via connection_from_url),
+    whatever adapter hook it calls first. Validating here, instead of in a
+    requests hook that has been renamed across releases, keeps the guard
+    closed on old and future requests versions alike.
+    """
+
+    def connection_from_host(self, host, port=None, scheme="http", pool_kwargs=None):
+        hostname = (host or "").strip("[]")
+        if not hostname:
+            raise UnsafeURLError("URL has no host")
+        address = resolve_public_address(hostname)
+        if scheme == "https":
+            pool_kwargs = dict(pool_kwargs or {})
+            pool_kwargs["server_hostname"] = hostname
+            pool_kwargs["assert_hostname"] = hostname
+        return super().connection_from_host(
+            address, port=port, scheme=scheme, pool_kwargs=pool_kwargs
+        )
+
+
+class PinnedAddressAdapter(HTTPAdapter):
+    """Transport adapter that connects to the exact address it validated.
+
+    A plain requests call resolves the host again when urllib3 opens the
+    socket, so a hostile DNS server can answer a public address to the SSRF
+    check and a private one to the connection (DNS rebinding). This adapter's
+    pool manager resolves and validates each host itself, then opens the
+    connection pool on that IP literal. The Host header, TLS SNI and the
+    certificate hostname check still use the original name, so HTTPS
+    verification is unchanged. Proxies are refused: a proxy would resolve the
+    name itself and bypass the pinned address.
+    """
+
+    def init_poolmanager(self, connections, maxsize, block=DEFAULT_POOLBLOCK, **pool_kwargs):
+        super().init_poolmanager(connections, maxsize, block, **pool_kwargs)
+        # Rebuild with the exact settings requests chose for this version.
+        self.poolmanager = _PinnedPoolManager(
+            num_pools=connections, **self.poolmanager.connection_pool_kw
+        )
+
+    def proxy_manager_for(self, proxy, **proxy_kwargs):
+        raise UnsafeURLError("proxies are not supported by the pinned transport")
+
+    def send(self, request, **kwargs):
+        check_url(request.url)
+        # urllib3 would derive Host from the pool's IP literal; keep the name.
+        if "Host" not in request.headers:
+            request.headers["Host"] = urlparse(request.url).netloc.rpartition("@")[2]
+        return super().send(request, **kwargs)
+
+
+def create_session() -> requests.Session:
+    """Build a requests session whose every connection is SSRF-checked and pinned.
+
+    Environment proxies and ~/.netrc credentials are ignored: a proxy defeats
+    address pinning and netrc would attach credentials to attacker-chosen hosts.
+    A custom CA bundle named by REQUESTS_CA_BUNDLE or CURL_CA_BUNDLE (corporate
+    TLS inspection) is still honoured, since it does not weaken pinning.
+    """
+    session = requests.Session()
+    session.trust_env = False
+    ca_bundle = os.environ.get("REQUESTS_CA_BUNDLE") or os.environ.get("CURL_CA_BUNDLE")
+    if ca_bundle:
+        session.verify = ca_bundle
+    adapter = PinnedAddressAdapter()
+    session.mount("http://", adapter)
+    session.mount("https://", adapter)
+    return session
+
+
 # ── Core Fetcher ───────────────────────────────────────────────────
 
 def fetch_page(
@@ -147,37 +284,24 @@ def fetch_page(
         url = f"https://{url}"
         parsed = urlparse(url)
 
-    if parsed.scheme not in ("http", "https"):
+    if parsed.scheme not in ALLOWED_SCHEMES:
         result["error"] = f"Invalid URL scheme: {parsed.scheme}"
         return result
 
-    # SSRF check
-    if not is_safe_url(url):
-        resolved = "unknown"
-        try:
-            # Use getaddrinfo for consistent multi-address resolution
-            addrinfo = socket.getaddrinfo(parsed.hostname, None)
-            resolved = ", ".join(set(entry[4][0] for entry in addrinfo))
-        except Exception:
-            pass
-        result["error"] = f"Blocked: URL resolves to private/internal IP ({resolved})"
-        return result
-
+    current_url = url
     try:
-        session = requests.Session()
+        session = create_session()
 
         headers = dict(DEFAULT_HEADERS)
         ua_string = USER_AGENTS.get(user_agent, user_agent)
         headers["User-Agent"] = ua_string
 
-        import time
         start = time.monotonic()
 
-        # Follow redirects manually so is_safe_url() runs on EVERY hop.
-        # Letting requests follow redirects internally would allow a
-        # public URL to redirect (302) to an internal/metadata endpoint
-        # (redirect-based SSRF), bypassing the initial check.
-        current_url = url
+        # Follow redirects manually so every hop goes back through the pinned
+        # adapter, which validates the target before connecting. Letting
+        # requests follow redirects internally would hide the hop count and
+        # the chain; the adapter still guards each connection either way.
         redirect_chain = []
         hops = 0
         response = None
@@ -198,19 +322,9 @@ def fetch_page(
                 break
 
             next_url = urljoin(current_url, location)
-            next_parsed = urlparse(next_url)
-
-            if next_parsed.scheme not in ("http", "https"):
-                result["error"] = (
-                    f"Blocked redirect to non-HTTP(S) scheme: {next_parsed.scheme}"
-                )
-                return result
-
-            # Re-validate the redirect target (blocks redirect-based SSRF)
-            if not is_safe_url(next_url):
-                result["error"] = (
-                    f"Blocked: redirect to private/internal URL ({next_url})"
-                )
+            next_scheme = urlparse(next_url).scheme
+            if next_scheme not in ALLOWED_SCHEMES:
+                result["error"] = f"Blocked redirect to non-HTTP(S) scheme: {next_scheme}"
                 return result
 
             hops += 1
@@ -221,6 +335,7 @@ def fetch_page(
             redirect_chain.append(
                 {"url": current_url, "status": response.status_code}
             )
+            response.close()
             current_url = next_url
 
         elapsed_ms = round((time.monotonic() - start) * 1000)
@@ -233,6 +348,11 @@ def fetch_page(
         result["response_time_ms"] = elapsed_ms
         result["redirect_chain"] = redirect_chain
 
+    except UnsafeURLError as e:
+        if current_url == url:
+            result["error"] = f"Blocked: {e}"
+        else:
+            result["error"] = f"Blocked: redirect to private/internal URL ({current_url}): {e}"
     except requests.exceptions.Timeout:
         result["error"] = f"Request timed out after {timeout}s"
     except requests.exceptions.TooManyRedirects:

package/src/bmad-plus/packs/pack-seo/scripts/seo_report.py

@@ -3,7 +3,7 @@
 SEO Report — Professional HTML audit report generator.
 
 Features:
-- Single-file HTML with inline CSS (no external deps)
+- Single-file HTML with inline CSS and system fonts: opening it requests nothing
 - SVG radar chart for score visualization
 - Color-coded issue cards (Critical/High/Medium/Low)
 - Quick Wins section
@@ -67,8 +67,8 @@ def generate_radar_svg(scores: dict, size: int = 300) -> str:
         svg_parts.append(f'<line x1="{cx}" y1="{cy}" x2="{x2}" y2="{y2}" stroke="#e2e8f0" stroke-width="1"/>')
 
         lx, ly = point(angle, radius + 20)
-        label = short_labels.get(categories[i], categories[i][:6])
-        svg_parts.append(f'<text x="{lx}" y="{ly}" text-anchor="middle" font-size="11" fill="#64748b" font-family="Inter,sans-serif">{label}</text>')
+        label = html.escape(short_labels.get(categories[i], str(categories[i])[:6]))
+        svg_parts.append(f'<text x="{lx}" y="{ly}" text-anchor="middle" font-size="11" fill="#64748b">{label}</text>')
 
     # Data polygon
     data_points = []
@@ -203,11 +203,10 @@ def generate_html_report(audit_data: dict) -> str:
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>SEO Audit Report — {domain_esc}</title>
     <style>
-        @import url('https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap');
-
+        /* Installed faces only: opening the report asks nothing of any server. */
         * {{ margin: 0; padding: 0; box-sizing: border-box; }}
         body {{
-            font-family: 'Inter', -apple-system, sans-serif;
+            font-family: system-ui, "Segoe UI", Roboto, "Helvetica Neue", "Noto Sans", "Liberation Sans", Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Noto Color Emoji";
             background: #f8fafc;
             color: #1e293b;
             line-height: 1.6;

package/src/bmad-plus/packs/pack-seo/scripts/seo_screenshot.py

@@ -7,16 +7,57 @@ Features:
 - Above-the-fold element detection
 - Full-page capture option
 - PNG output with configurable quality
-
-Requires: playwright (pip install playwright && playwright install chromium)
+- SSRF protection shared with seo_fetch.py: the target is validated once and
+  Chromium is pinned to that address, so the browser reaches the audited host
+  and nothing else
+
+Network policy. Chromium resolves names itself, so validating the URL is not
+enough: a DNS-rebinding answer, a redirect or any subresource could take it
+to an internal address. The browser is therefore confined by three guards:
+
+1. Resolver pinning: --host-resolver-rules maps the audited host to the
+   address seo_fetch validated and makes every other name unresolvable.
+2. Proxy trap: every request except those for the audited host goes to a
+   proxy whose name cannot resolve, so it fails even when it names an IP
+   literal, loopback included (the bypass list drops Chromium's implicit
+   loopback bypass).
+3. Interception: each request and WebSocket the page opens is checked
+   before it leaves; anything outside the audited host is aborted.
+
+Playwright routes only the first URL of a redirect chain, so the hops of a
+redirect (of the page or of a subresource) are held by guards 1 and 2, each
+of which holds on its own. Every request a guard stops, redirect hops
+included, is reported in ``blocked_requests``.
+
+Third-party subresources (CDN images, fonts, analytics, embeds) are blocked,
+not validated one by one: the resolver rules are fixed at launch, so a host
+discovered while rendering could not be pinned, and a capture that contacted
+it would send the auditor's IP address to parties nobody chose. The
+screenshot shows the page as its own host serves it. A redirect to another
+host fails the capture; capture the final URL instead. Service workers are
+blocked and WebRTC may not open UDP sockets of its own.
+
+Requires: playwright >= 1.48 (pip install playwright && playwright install chromium)
 
 Author: Laurent Rochetta
 License: MIT
 """
 
 import argparse
+import ipaddress
+import re
 import sys
+from urllib.parse import urlparse
+
+import seo_fetch
 
+# The proxy that non-audited requests are sent to. ".invalid" never resolves
+# (RFC 6761) and the resolver rules refuse every name but the audited host.
+TRAP_PROXY = "http://blocked.invalid:9"
+LOCAL_SCHEMES = frozenset({"about", "blob", "data"})
+NETWORK_SCHEMES = frozenset({"http", "https", "ws", "wss"})
+_HOSTNAME = re.compile(r"[a-z0-9_-]+(?:\.[a-z0-9_-]+)*\.?")
+_MAX_REPORTED = 50
 
 VIEWPORTS = {
     "mobile": {"width": 375, "height": 812, "device_scale_factor": 3, "is_mobile": True},
@@ -26,6 +67,93 @@ VIEWPORTS = {
 }
 
 
+class CaptureError(RuntimeError):
+    """The page could not be loaded under the network policy."""
+
+
+def pin_target(url: str) -> "tuple[str, str, str]":
+    """Validate a URL with seo_fetch's rules and return ``(url, host, address)``.
+
+    ``host`` is the name as Chromium will send it (lowercase ASCII, IDNA
+    encoded, no brackets) and ``address`` the public address it is pinned to.
+    Raises seo_fetch.UnsafeURLError on anything seo_fetch would refuse, and on
+    a host that cannot be written safely into a resolver rule.
+    """
+    if not urlparse(url).scheme:
+        url = f"https://{url}"
+    hostname, address = seo_fetch.resolve_target(url)
+    try:
+        host = hostname.encode("idna").decode("ascii").lower()
+    except UnicodeError:
+        raise seo_fetch.UnsafeURLError(f"host name cannot be encoded: {hostname}") from None
+    try:
+        ipaddress.ip_address(host)
+    except ValueError:
+        if not _HOSTNAME.fullmatch(host):
+            raise seo_fetch.UnsafeURLError(f"unsupported host name: {hostname}") from None
+    return url, host, address
+
+
+def isolation_options(host: str, address: str) -> dict:
+    """Chromium launch options that confine the browser to ``host`` at ``address``."""
+    pinned = f"[{address}]" if ":" in address else address
+    rule_host = f"[{host}]" if ":" in host else host
+    return {
+        "args": [
+            f"--host-resolver-rules=MAP {rule_host} {pinned}, MAP * ~NOTFOUND",
+            "--force-webrtc-ip-handling-policy=disable_non_proxied_udp",
+            "--webrtc-ip-handling-policy=disable_non_proxied_udp",
+            "--dns-prefetch-disable",
+            # The last matching bypass rule wins: "<-loopback>" first drops
+            # Chromium's implicit loopback bypass without overriding the host.
+            f"--proxy-server={TRAP_PROXY}",
+            f"--proxy-bypass-list=<-loopback>;{rule_host}",
+        ],
+    }
+
+
+class RequestGuard:
+    """Let through the requests of one host; abort and record all others."""
+
+    def __init__(self, host: str):
+        self.host = host
+        self.blocked: "list[str]" = []
+
+    def allows(self, url: str) -> bool:
+        parsed = urlparse(url)
+        if parsed.scheme in LOCAL_SCHEMES:
+            return True
+        return parsed.scheme in NETWORK_SCHEMES and parsed.hostname == self.host
+
+    def _refuse(self, url: str) -> None:
+        if url not in self.blocked and len(self.blocked) < _MAX_REPORTED:
+            self.blocked.append(url)
+
+    def on_request(self, route) -> None:
+        url = route.request.url
+        if self.allows(url):
+            route.continue_()
+        else:
+            self._refuse(url)
+            route.abort("blockedbyclient")
+
+    def on_request_failed(self, request) -> None:
+        # A redirect hop off the host never reaches on_request: the resolver
+        # rules or the trap proxy stop it, and it fails here instead.
+        if not self.allows(request.url):
+            self._refuse(request.url)
+
+    def on_websocket(self, ws) -> None:
+        # A route that is not connected to the server stays a local mock:
+        # nothing leaves the browser. It is not closed, because Playwright
+        # runs this handler on its event loop, where the synchronous close()
+        # would wait for itself forever.
+        if self.allows(ws.url):
+            ws.connect_to_server()
+        else:
+            self._refuse(ws.url)
+
+
 def capture_screenshot(
     url: str,
     output: str = "screenshot.png",
@@ -42,8 +170,15 @@ def capture_screenshot(
         viewport: Viewport preset (mobile, tablet, desktop, desktop-hd)
         full_page: Capture full page scroll or just viewport
         wait_ms: Wait time after page load (ms)
+
+    Raises seo_fetch.UnsafeURLError before any browser starts when the URL
+    breaks seo_fetch's rules, and CaptureError when the page cannot load
+    under the network policy (see the module docstring).
     """
+    url, host, address = pin_target(url)
     try:
+        from playwright.sync_api import Error as PlaywrightError
+        from playwright.sync_api import TimeoutError as PlaywrightTimeoutError
         from playwright.sync_api import sync_playwright
     except ImportError:
         print(
@@ -55,9 +190,15 @@ def capture_screenshot(
 
     vp = VIEWPORTS.get(viewport, VIEWPORTS["desktop"])
 
+    guard = RequestGuard(host)
+
+    # Leaving the block stops the Playwright driver, which ends the browser
+    # on every path, errors included.
     with sync_playwright() as p:
-        browser = p.chromium.launch(headless=True)
+        browser = p.chromium.launch(headless=True, **isolation_options(host, address))
         context = browser.new_context(
+            service_workers="block",
+            accept_downloads=False,
             viewport={"width": vp["width"], "height": vp["height"]},
             device_scale_factor=vp["device_scale_factor"],
             is_mobile=vp["is_mobile"],
@@ -70,13 +211,24 @@ def capture_screenshot(
             ),
         )
 
+        if not hasattr(context, "route_web_socket"):
+            raise CaptureError("Playwright 1.48 or later is required to guard WebSockets")
+        context.route("**/*", guard.on_request)
+        context.route_web_socket("**/*", guard.on_websocket)
+        context.on("requestfailed", guard.on_request_failed)
         page = context.new_page()
 
         try:
-            page.goto(url, wait_until="networkidle", timeout=30000)
-        except Exception:
-            # Fallback: wait for load event instead
-            page.goto(url, wait_until="load", timeout=30000)
+            try:
+                page.goto(url, wait_until="networkidle", timeout=30000)
+            except PlaywrightTimeoutError:
+                # Fallback: wait for load event instead
+                page.goto(url, wait_until="load", timeout=30000)
+        except PlaywrightError as e:
+            raise CaptureError(
+                f"{url} did not load under the network policy (a redirect to another host"
+                f" or a non-public address is refused): {e.message.splitlines()[0]}"
+            ) from None
 
         # Wait for dynamic content
         page.wait_for_timeout(wait_ms)
@@ -148,6 +300,7 @@ def capture_screenshot(
 
         browser.close()
 
+    metrics["blocked_requests"] = guard.blocked
     return metrics
 
 
@@ -172,13 +325,20 @@ def main():
 
     import json
 
-    metrics = capture_screenshot(
-        url=args.url,
-        output=args.output,
-        viewport=args.viewport,
-        full_page=args.full,
-        wait_ms=args.wait,
-    )
+    try:
+        metrics = capture_screenshot(
+            url=args.url,
+            output=args.output,
+            viewport=args.viewport,
+            full_page=args.full,
+            wait_ms=args.wait,
+        )
+    except seo_fetch.UnsafeURLError as e:
+        print(f"Error: Blocked: {e}", file=sys.stderr)
+        sys.exit(1)
+    except CaptureError as e:
+        print(f"Error: {e}", file=sys.stderr)
+        sys.exit(1)
 
     print(f"Screenshot saved: {args.output}", file=sys.stderr)
 
@@ -196,6 +356,8 @@ def main():
         print(f"  Horizontal scroll: {'⚠️ YES' if metrics['has_horizontal_scroll'] else '✅ No'}")
         print(f"  Body font size: {metrics['body_font_size_px']}px {'✅' if metrics['body_font_size_px'] >= 16 else '⚠️ <16px'}")
         print(f"  DOM elements: {metrics['dom_element_count']:,}")
+        if metrics["blocked_requests"]:
+            print(f"  Blocked requests (not the audited host): {len(metrics['blocked_requests'])}")
 
 
 if __name__ == "__main__":

package/src/bmad-plus/packs/pack-shield/README.md

@@ -88,6 +88,18 @@ Pack Shield transforms BMAD+ into a comprehensive GRC (Governance, Risk & Compli
 - `shared/cross-framework-mapper.md` — Control mapping between frameworks
 - `shared/gap-analysis-template.md` — Standardized gap analysis format
 - `shared/audit-report-template.md` — Compliance audit report format
+- `shared/assurance-case.md` + `shared/assurance-case-template.yaml` — Security assurance case bound to executed checks
+- `shared/ai-processing-register.md` + `shared/ai-processing-register-template.yaml` — Register of the AI tools a project uses
+
+## Evidence & AI Tooling
+
+These capabilities are backed by BMAD+ CLI commands, so their results are verified by code:
+
+| Capability | Command | Behaviour |
+|------------|---------|-----------|
+| Security assurance case | `bmad-plus assurance init <case>`, `run <case>`, then `verify <case> --ledger-head <head>` | Claims → arguments → evidence; evidence is only a check that ran, recorded in a hash-chained ledger with its exit code, output digest and the digests of the artifacts it wrote. Missing, failed or stale evidence (other commit, uncommitted changes or untracked files, changed command or artifact, too old) leaves the claim unsupported. `BMAD_PLUS_ASSURANCE_KEY` authenticates every record and `--ledger-head` catches removed runs; without them the ledger shows accidental edits only. `--emit-check` writes a CI check result. |
+| AI processing register | `bmad-plus ai-register init`, `bmad-plus ai-register check` | Compares `_bmad/ai-processing-register.yaml` with the AI integrations found in the project (BMAD+ adapters, tool folders, MCP servers) and warns about any not registered. Soft gate: warnings never fail; `bmad-plus doctor` reports the same. |
+| Compliance review rules | `bmad-plus review scope`, `bmad-plus review rules <path>` | `review-rules/` adds path-scoped checklists (access control, personal data, cryptography, logging, AI integrations, change and supply chain) in the `compliance` group, each tagged with the controls it examines, e.g. `ISO27001:A.8.5`, `SOC2:CC8.1`, `GDPR:Art.32`. The review checklist opens with the controls the change touches, `scope.json` records them per file, and a finding may name the ones it breaks in `controls`. A project replaces or disables them in `_bmad/review-rules.yaml`. |
 
 ## Reference Files
 - `references/` — 79 regulatory reference files extracted from upstream skills

package/src/bmad-plus/packs/pack-shield/SKILL.md

@@ -56,6 +56,11 @@ Shield transforms BMAD+ into a comprehensive GRC (Governance, Risk & Compliance)
 - Privacy Notice/Policy/Cookie Generators
 - AI Act Classifier, Roles, FRIA, Incident Reporting
 
+### Evidence & AI Tooling
+- **Security assurance case** — claims, arguments and evidence, where evidence is only a check that ran at the commit concerned (`bmad-plus assurance run|verify`)
+- **AI processing register** — the AI tools a project uses, their data, legal basis, retention and transfers, with a soft gate on unregistered tools (`bmad-plus ai-register check`, `bmad-plus doctor`)
+- **Compliance review rules** — path-scoped review checklists tagged with ISO 27001, SOC 2, GDPR, NIS2, NIST 800-53 and EU AI Act controls, so a review lists the controls a change touches
+
 ## Activation
 
 To use Shield, include this pack in your BMAD+ installation:
@@ -75,7 +80,8 @@ Then invoke the orchestrator from any conversation:
 - `shield-orchestrator.md` — Intelligent routing entry point
 - `categories/` — Framework-specific agent prompts
 - `references/` — 79 regulatory reference files
-- `shared/` — Cross-framework mapper, gap analysis & audit templates
+- `shared/` — Cross-framework mapper, gap analysis & audit templates; assurance case and AI processing register procedures with their templates
+- `review-rules/` — Control-tagged review rules, loaded by `bmad-plus review` once the pack is installed
 
 ## Attribution