chainwall 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +278 -0
- package/commands/security-scan.md +35 -0
- package/dist/auditor/access-mapper.d.ts +3 -0
- package/dist/auditor/access-mapper.d.ts.map +1 -0
- package/dist/auditor/access-mapper.js +15 -0
- package/dist/auditor/access-mapper.js.map +1 -0
- package/dist/auditor/cli-detector.d.ts +7 -0
- package/dist/auditor/cli-detector.d.ts.map +1 -0
- package/dist/auditor/cli-detector.js +63 -0
- package/dist/auditor/cli-detector.js.map +1 -0
- package/dist/auditor/cross-reference.d.ts +4 -0
- package/dist/auditor/cross-reference.d.ts.map +1 -0
- package/dist/auditor/cross-reference.js +16 -0
- package/dist/auditor/cross-reference.js.map +1 -0
- package/dist/auditor/env-auditor.d.ts +9 -0
- package/dist/auditor/env-auditor.d.ts.map +1 -0
- package/dist/auditor/env-auditor.js +83 -0
- package/dist/auditor/env-auditor.js.map +1 -0
- package/dist/auditor/mcp-analyzer.d.ts +11 -0
- package/dist/auditor/mcp-analyzer.d.ts.map +1 -0
- package/dist/auditor/mcp-analyzer.js +145 -0
- package/dist/auditor/mcp-analyzer.js.map +1 -0
- package/dist/auditor/mcp-detector.d.ts +17 -0
- package/dist/auditor/mcp-detector.d.ts.map +1 -0
- package/dist/auditor/mcp-detector.js +86 -0
- package/dist/auditor/mcp-detector.js.map +1 -0
- package/dist/auditor/remediation.d.ts +26 -0
- package/dist/auditor/remediation.d.ts.map +1 -0
- package/dist/auditor/remediation.js +222 -0
- package/dist/auditor/remediation.js.map +1 -0
- package/dist/auditor/tool-detector.d.ts +15 -0
- package/dist/auditor/tool-detector.d.ts.map +1 -0
- package/dist/auditor/tool-detector.js +241 -0
- package/dist/auditor/tool-detector.js.map +1 -0
- package/dist/auditor/types.d.ts +31 -0
- package/dist/auditor/types.d.ts.map +1 -0
- package/dist/auditor/types.js +2 -0
- package/dist/auditor/types.js.map +1 -0
- package/dist/auditor/vscode-extension-scanner.d.ts +8 -0
- package/dist/auditor/vscode-extension-scanner.d.ts.map +1 -0
- package/dist/auditor/vscode-extension-scanner.js +51 -0
- package/dist/auditor/vscode-extension-scanner.js.map +1 -0
- package/dist/cli.d.ts +3 -0
- package/dist/cli.d.ts.map +1 -0
- package/dist/cli.js +159 -0
- package/dist/cli.js.map +1 -0
- package/dist/commands/audit.d.ts +8 -0
- package/dist/commands/audit.d.ts.map +1 -0
- package/dist/commands/audit.js +151 -0
- package/dist/commands/audit.js.map +1 -0
- package/dist/commands/init.d.ts +2 -0
- package/dist/commands/init.d.ts.map +1 -0
- package/dist/commands/init.js +34 -0
- package/dist/commands/init.js.map +1 -0
- package/dist/commands/remediate-cli.d.ts +3 -0
- package/dist/commands/remediate-cli.d.ts.map +1 -0
- package/dist/commands/remediate-cli.js +96 -0
- package/dist/commands/remediate-cli.js.map +1 -0
- package/dist/commands/scan.d.ts +11 -0
- package/dist/commands/scan.d.ts.map +1 -0
- package/dist/commands/scan.js +138 -0
- package/dist/commands/scan.js.map +1 -0
- package/dist/commands/watch.d.ts +6 -0
- package/dist/commands/watch.d.ts.map +1 -0
- package/dist/commands/watch.js +203 -0
- package/dist/commands/watch.js.map +1 -0
- package/dist/config.d.ts +19 -0
- package/dist/config.d.ts.map +1 -0
- package/dist/config.js +235 -0
- package/dist/config.js.map +1 -0
- package/dist/mcp-server/index.d.ts +3 -0
- package/dist/mcp-server/index.d.ts.map +1 -0
- package/dist/mcp-server/index.js +69 -0
- package/dist/mcp-server/index.js.map +1 -0
- package/dist/mcp-server/schemas.d.ts +13 -0
- package/dist/mcp-server/schemas.d.ts.map +1 -0
- package/dist/mcp-server/schemas.js +13 -0
- package/dist/mcp-server/schemas.js.map +1 -0
- package/dist/mcp-server/tools/audit-status.d.ts +3 -0
- package/dist/mcp-server/tools/audit-status.d.ts.map +1 -0
- package/dist/mcp-server/tools/audit-status.js +46 -0
- package/dist/mcp-server/tools/audit-status.js.map +1 -0
- package/dist/mcp-server/tools/check-command.d.ts +4 -0
- package/dist/mcp-server/tools/check-command.d.ts.map +1 -0
- package/dist/mcp-server/tools/check-command.js +30 -0
- package/dist/mcp-server/tools/check-command.js.map +1 -0
- package/dist/mcp-server/tools/scan-content.d.ts +4 -0
- package/dist/mcp-server/tools/scan-content.d.ts.map +1 -0
- package/dist/mcp-server/tools/scan-content.js +18 -0
- package/dist/mcp-server/tools/scan-content.js.map +1 -0
- package/dist/mcp-server/tools/scan-file.d.ts +4 -0
- package/dist/mcp-server/tools/scan-file.d.ts.map +1 -0
- package/dist/mcp-server/tools/scan-file.js +48 -0
- package/dist/mcp-server/tools/scan-file.js.map +1 -0
- package/dist/mcp-server/types.d.ts +15 -0
- package/dist/mcp-server/types.d.ts.map +1 -0
- package/dist/mcp-server/types.js +2 -0
- package/dist/mcp-server/types.js.map +1 -0
- package/dist/reporter/audit-report.d.ts +4 -0
- package/dist/reporter/audit-report.d.ts.map +1 -0
- package/dist/reporter/audit-report.js +186 -0
- package/dist/reporter/audit-report.js.map +1 -0
- package/dist/reporter/json-report.d.ts +3 -0
- package/dist/reporter/json-report.d.ts.map +1 -0
- package/dist/reporter/json-report.js +4 -0
- package/dist/reporter/json-report.js.map +1 -0
- package/dist/reporter/remediation-text.d.ts +3 -0
- package/dist/reporter/remediation-text.d.ts.map +1 -0
- package/dist/reporter/remediation-text.js +12 -0
- package/dist/reporter/remediation-text.js.map +1 -0
- package/dist/reporter/risk-scorer.d.ts +8 -0
- package/dist/reporter/risk-scorer.d.ts.map +1 -0
- package/dist/reporter/risk-scorer.js +40 -0
- package/dist/reporter/risk-scorer.js.map +1 -0
- package/dist/reporter/sarif-report.d.ts +3 -0
- package/dist/reporter/sarif-report.d.ts.map +1 -0
- package/dist/reporter/sarif-report.js +80 -0
- package/dist/reporter/sarif-report.js.map +1 -0
- package/dist/reporter/shared.d.ts +11 -0
- package/dist/reporter/shared.d.ts.map +1 -0
- package/dist/reporter/shared.js +85 -0
- package/dist/reporter/shared.js.map +1 -0
- package/dist/reporter/summary-generator.d.ts +16 -0
- package/dist/reporter/summary-generator.d.ts.map +1 -0
- package/dist/reporter/summary-generator.js +89 -0
- package/dist/reporter/summary-generator.js.map +1 -0
- package/dist/reporter/terminal-report.d.ts +4 -0
- package/dist/reporter/terminal-report.d.ts.map +1 -0
- package/dist/reporter/terminal-report.js +135 -0
- package/dist/reporter/terminal-report.js.map +1 -0
- package/dist/rules/crypto-rules.d.ts +3 -0
- package/dist/rules/crypto-rules.d.ts.map +1 -0
- package/dist/rules/crypto-rules.js +252 -0
- package/dist/rules/crypto-rules.js.map +1 -0
- package/dist/rules/default-rules.d.ts +9 -0
- package/dist/rules/default-rules.d.ts.map +1 -0
- package/dist/rules/default-rules.js +1319 -0
- package/dist/rules/default-rules.js.map +1 -0
- package/dist/rules/index.d.ts +7 -0
- package/dist/rules/index.d.ts.map +1 -0
- package/dist/rules/index.js +7 -0
- package/dist/rules/index.js.map +1 -0
- package/dist/rules/injection-rules.d.ts +8 -0
- package/dist/rules/injection-rules.d.ts.map +1 -0
- package/dist/rules/injection-rules.js +108 -0
- package/dist/rules/injection-rules.js.map +1 -0
- package/dist/rules/types.d.ts +52 -0
- package/dist/rules/types.d.ts.map +1 -0
- package/dist/rules/types.js +2 -0
- package/dist/rules/types.js.map +1 -0
- package/dist/scanner/filesystem-scanner.d.ts +26 -0
- package/dist/scanner/filesystem-scanner.d.ts.map +1 -0
- package/dist/scanner/filesystem-scanner.js +369 -0
- package/dist/scanner/filesystem-scanner.js.map +1 -0
- package/dist/scanner/injection-scanner.d.ts +12 -0
- package/dist/scanner/injection-scanner.d.ts.map +1 -0
- package/dist/scanner/injection-scanner.js +136 -0
- package/dist/scanner/injection-scanner.js.map +1 -0
- package/dist/scanner/permission-checker.d.ts +4 -0
- package/dist/scanner/permission-checker.d.ts.map +1 -0
- package/dist/scanner/permission-checker.js +37 -0
- package/dist/scanner/permission-checker.js.map +1 -0
- package/dist/scanner/redact.d.ts +3 -0
- package/dist/scanner/redact.d.ts.map +1 -0
- package/dist/scanner/redact.js +17 -0
- package/dist/scanner/redact.js.map +1 -0
- package/dist/scanner/rule-engine.d.ts +9 -0
- package/dist/scanner/rule-engine.d.ts.map +1 -0
- package/dist/scanner/rule-engine.js +129 -0
- package/dist/scanner/rule-engine.js.map +1 -0
- package/dist/scanner/system-targets.d.ts +17 -0
- package/dist/scanner/system-targets.d.ts.map +1 -0
- package/dist/scanner/system-targets.js +81 -0
- package/dist/scanner/system-targets.js.map +1 -0
- package/dist/tui/App.d.ts +6 -0
- package/dist/tui/App.d.ts.map +1 -0
- package/dist/tui/App.js +224 -0
- package/dist/tui/App.js.map +1 -0
- package/dist/tui/components/BootSequence.d.ts +6 -0
- package/dist/tui/components/BootSequence.d.ts.map +1 -0
- package/dist/tui/components/BootSequence.js +40 -0
- package/dist/tui/components/BootSequence.js.map +1 -0
- package/dist/tui/components/BorderedSection.d.ts +12 -0
- package/dist/tui/components/BorderedSection.d.ts.map +1 -0
- package/dist/tui/components/BorderedSection.js +7 -0
- package/dist/tui/components/BorderedSection.js.map +1 -0
- package/dist/tui/components/ErrorBoundary.d.ts +18 -0
- package/dist/tui/components/ErrorBoundary.d.ts.map +1 -0
- package/dist/tui/components/ErrorBoundary.js +36 -0
- package/dist/tui/components/ErrorBoundary.js.map +1 -0
- package/dist/tui/components/FirstUseHint.d.ts +7 -0
- package/dist/tui/components/FirstUseHint.d.ts.map +1 -0
- package/dist/tui/components/FirstUseHint.js +20 -0
- package/dist/tui/components/FirstUseHint.js.map +1 -0
- package/dist/tui/components/Footer.d.ts +10 -0
- package/dist/tui/components/Footer.d.ts.map +1 -0
- package/dist/tui/components/Footer.js +51 -0
- package/dist/tui/components/Footer.js.map +1 -0
- package/dist/tui/components/MetricCard.d.ts +11 -0
- package/dist/tui/components/MetricCard.d.ts.map +1 -0
- package/dist/tui/components/MetricCard.js +8 -0
- package/dist/tui/components/MetricCard.js.map +1 -0
- package/dist/tui/components/Panel.d.ts +15 -0
- package/dist/tui/components/Panel.d.ts.map +1 -0
- package/dist/tui/components/Panel.js +25 -0
- package/dist/tui/components/Panel.js.map +1 -0
- package/dist/tui/components/RemediationMenu.d.ts +10 -0
- package/dist/tui/components/RemediationMenu.d.ts.map +1 -0
- package/dist/tui/components/RemediationMenu.js +84 -0
- package/dist/tui/components/RemediationMenu.js.map +1 -0
- package/dist/tui/components/RiskGauge.d.ts +7 -0
- package/dist/tui/components/RiskGauge.d.ts.map +1 -0
- package/dist/tui/components/RiskGauge.js +55 -0
- package/dist/tui/components/RiskGauge.js.map +1 -0
- package/dist/tui/components/ScrollableList.d.ts +11 -0
- package/dist/tui/components/ScrollableList.d.ts.map +1 -0
- package/dist/tui/components/ScrollableList.js +14 -0
- package/dist/tui/components/ScrollableList.js.map +1 -0
- package/dist/tui/components/Section.d.ts +9 -0
- package/dist/tui/components/Section.d.ts.map +1 -0
- package/dist/tui/components/Section.js +7 -0
- package/dist/tui/components/Section.js.map +1 -0
- package/dist/tui/components/SectionHeader.d.ts +8 -0
- package/dist/tui/components/SectionHeader.d.ts.map +1 -0
- package/dist/tui/components/SectionHeader.js +15 -0
- package/dist/tui/components/SectionHeader.js.map +1 -0
- package/dist/tui/components/SeverityBadge.d.ts +5 -0
- package/dist/tui/components/SeverityBadge.d.ts.map +1 -0
- package/dist/tui/components/SeverityBadge.js +7 -0
- package/dist/tui/components/SeverityBadge.js.map +1 -0
- package/dist/tui/components/Sidebar.d.ts +2 -0
- package/dist/tui/components/Sidebar.d.ts.map +1 -0
- package/dist/tui/components/Sidebar.js +40 -0
- package/dist/tui/components/Sidebar.js.map +1 -0
- package/dist/tui/components/StatusIndicator.d.ts +8 -0
- package/dist/tui/components/StatusIndicator.d.ts.map +1 -0
- package/dist/tui/components/StatusIndicator.js +15 -0
- package/dist/tui/components/StatusIndicator.js.map +1 -0
- package/dist/tui/components/Table.d.ts +21 -0
- package/dist/tui/components/Table.d.ts.map +1 -0
- package/dist/tui/components/Table.js +38 -0
- package/dist/tui/components/Table.js.map +1 -0
- package/dist/tui/components/Transition.d.ts +8 -0
- package/dist/tui/components/Transition.d.ts.map +1 -0
- package/dist/tui/components/Transition.js +38 -0
- package/dist/tui/components/Transition.js.map +1 -0
- package/dist/tui/components/WelcomeScreen.d.ts +6 -0
- package/dist/tui/components/WelcomeScreen.d.ts.map +1 -0
- package/dist/tui/components/WelcomeScreen.js +14 -0
- package/dist/tui/components/WelcomeScreen.js.map +1 -0
- package/dist/tui/educational.d.ts +32 -0
- package/dist/tui/educational.d.ts.map +1 -0
- package/dist/tui/educational.js +117 -0
- package/dist/tui/educational.js.map +1 -0
- package/dist/tui/hooks/useAudit.d.ts +24 -0
- package/dist/tui/hooks/useAudit.d.ts.map +1 -0
- package/dist/tui/hooks/useAudit.js +263 -0
- package/dist/tui/hooks/useAudit.js.map +1 -0
- package/dist/tui/hooks/useConfig.d.ts +18 -0
- package/dist/tui/hooks/useConfig.d.ts.map +1 -0
- package/dist/tui/hooks/useConfig.js +85 -0
- package/dist/tui/hooks/useConfig.js.map +1 -0
- package/dist/tui/hooks/useHookStatus.d.ts +10 -0
- package/dist/tui/hooks/useHookStatus.d.ts.map +1 -0
- package/dist/tui/hooks/useHookStatus.js +59 -0
- package/dist/tui/hooks/useHookStatus.js.map +1 -0
- package/dist/tui/hooks/useLogs.d.ts +42 -0
- package/dist/tui/hooks/useLogs.d.ts.map +1 -0
- package/dist/tui/hooks/useLogs.js +105 -0
- package/dist/tui/hooks/useLogs.js.map +1 -0
- package/dist/tui/hooks/useScan.d.ts +39 -0
- package/dist/tui/hooks/useScan.d.ts.map +1 -0
- package/dist/tui/hooks/useScan.js +255 -0
- package/dist/tui/hooks/useScan.js.map +1 -0
- package/dist/tui/hooks/useTerminalSize.d.ts +10 -0
- package/dist/tui/hooks/useTerminalSize.d.ts.map +1 -0
- package/dist/tui/hooks/useTerminalSize.js +27 -0
- package/dist/tui/hooks/useTerminalSize.js.map +1 -0
- package/dist/tui/index.d.ts +2 -0
- package/dist/tui/index.d.ts.map +1 -0
- package/dist/tui/index.js +8 -0
- package/dist/tui/index.js.map +1 -0
- package/dist/tui/screens/AuditPanel.d.ts +7 -0
- package/dist/tui/screens/AuditPanel.d.ts.map +1 -0
- package/dist/tui/screens/AuditPanel.js +467 -0
- package/dist/tui/screens/AuditPanel.js.map +1 -0
- package/dist/tui/screens/LogsPanel.d.ts +2 -0
- package/dist/tui/screens/LogsPanel.d.ts.map +1 -0
- package/dist/tui/screens/LogsPanel.js +127 -0
- package/dist/tui/screens/LogsPanel.js.map +1 -0
- package/dist/tui/screens/OverviewPanel.d.ts +2 -0
- package/dist/tui/screens/OverviewPanel.d.ts.map +1 -0
- package/dist/tui/screens/OverviewPanel.js +84 -0
- package/dist/tui/screens/OverviewPanel.js.map +1 -0
- package/dist/tui/screens/ScanPanel.d.ts +2 -0
- package/dist/tui/screens/ScanPanel.d.ts.map +1 -0
- package/dist/tui/screens/ScanPanel.js +188 -0
- package/dist/tui/screens/ScanPanel.js.map +1 -0
- package/dist/tui/screens/ScanResultsPanel.d.ts +2 -0
- package/dist/tui/screens/ScanResultsPanel.d.ts.map +1 -0
- package/dist/tui/screens/ScanResultsPanel.js +394 -0
- package/dist/tui/screens/ScanResultsPanel.js.map +1 -0
- package/dist/tui/screens/SettingsPanel.d.ts +2 -0
- package/dist/tui/screens/SettingsPanel.d.ts.map +1 -0
- package/dist/tui/screens/SettingsPanel.js +353 -0
- package/dist/tui/screens/SettingsPanel.js.map +1 -0
- package/dist/tui/state.d.ts +35 -0
- package/dist/tui/state.d.ts.map +1 -0
- package/dist/tui/state.js +13 -0
- package/dist/tui/state.js.map +1 -0
- package/dist/tui/theme.d.ts +58 -0
- package/dist/tui/theme.d.ts.map +1 -0
- package/dist/tui/theme.js +80 -0
- package/dist/tui/theme.js.map +1 -0
- package/dist/version.d.ts +2 -0
- package/dist/version.d.ts.map +1 -0
- package/dist/version.js +5 -0
- package/dist/version.js.map +1 -0
- package/hooks/audit-logger.sh +74 -0
- package/hooks/detection-lib.sh +301 -0
- package/hooks/git-pre-commit.sh +195 -0
- package/hooks/git-pre-push.sh +125 -0
- package/hooks/git-safety.sh +152 -0
- package/hooks/security-scanner.sh +527 -0
- package/install.sh +543 -0
- package/package.json +67 -0
- package/patterns/credentials.yaml +317 -0
- package/patterns/dangerous-commands.yaml +167 -0
- package/patterns/pii.yaml +95 -0
- package/patterns/prompt-injection.yaml +131 -0
- package/patterns/supply-chain.yaml +119 -0
- package/rules/AGENTS.md +60 -0
- package/rules/SECURITY-RULES.md +177 -0
- package/rules/claude.md +9 -0
- package/rules/clinerules +29 -0
- package/rules/continuerules +29 -0
- package/rules/copilot-instructions.md +9 -0
- package/rules/cursor-security.mdc +14 -0
- package/rules/gemini.md +9 -0
- package/rules/kiro-security.md +29 -0
- package/rules/roocode-security.md +29 -0
- package/rules/trae-security.md +29 -0
- package/rules/windsurfrules +9 -0
- package/skill/llm-antivirus/SKILL.md +73 -0
- package/skill/llm-antivirus/references/threat-patterns.yaml +82 -0
- package/skill/llm-antivirus/scripts/security-audit.sh +244 -0
- package/uninstall.sh +215 -0
|
@@ -0,0 +1,151 @@
|
|
|
1
|
+
import { resolve } from 'node:path';
|
|
2
|
+
import { existsSync, statSync } from 'node:fs';
|
|
3
|
+
import { homedir } from 'node:os';
|
|
4
|
+
import ora from 'ora';
|
|
5
|
+
import { loadConfig } from '../config.js';
|
|
6
|
+
import { allRules } from '../rules/index.js';
|
|
7
|
+
import { walkFiles, walkSystemTargets } from '../scanner/filesystem-scanner.js';
|
|
8
|
+
import { createRuleEngine } from '../scanner/rule-engine.js';
|
|
9
|
+
import { calculateRiskScore } from '../reporter/risk-scorer.js';
|
|
10
|
+
import { detectInstalledTools } from '../auditor/tool-detector.js';
|
|
11
|
+
import { crossReference } from '../auditor/cross-reference.js';
|
|
12
|
+
import { printAuditReport, printJsonAuditReport } from '../reporter/audit-report.js';
|
|
13
|
+
export async function runAudit(targetDir, options) {
|
|
14
|
+
const isDefaultDir = targetDir === '.';
|
|
15
|
+
const resolvedTarget = resolve(targetDir);
|
|
16
|
+
if (!isDefaultDir && (!existsSync(resolvedTarget) || !statSync(resolvedTarget).isDirectory())) {
|
|
17
|
+
console.error(`chainwall: ${resolvedTarget} is not a valid directory`);
|
|
18
|
+
process.exitCode = 1;
|
|
19
|
+
return;
|
|
20
|
+
}
|
|
21
|
+
const config = loadConfig(isDefaultDir ? undefined : resolvedTarget);
|
|
22
|
+
const startTime = Date.now();
|
|
23
|
+
// Determine scan scope:
|
|
24
|
+
// - default (no dir, no --deep): system targets only — no recursive walk
|
|
25
|
+
// - explicit dir: walk that dir + system targets
|
|
26
|
+
// - --deep: walk homedir + system targets (old behavior)
|
|
27
|
+
// - explicit dir + --deep: use explicit dir, warn about --deep being ignored
|
|
28
|
+
if (!isDefaultDir && options.deep) {
|
|
29
|
+
console.error('chainwall: --deep is ignored when an explicit directory is provided');
|
|
30
|
+
}
|
|
31
|
+
const shouldWalk = !isDefaultDir || options.deep;
|
|
32
|
+
const walkDir = !isDefaultDir ? resolve(targetDir) : options.deep ? homedir() : resolve(targetDir);
|
|
33
|
+
const outputFormat = options.format || (options.json ? 'json' : 'text');
|
|
34
|
+
const spinner = (outputFormat === 'json' || outputFormat === 'sarif' || !process.stdout.isTTY) ? null : ora('Detecting AI tools...').start();
|
|
35
|
+
const tools = detectInstalledTools();
|
|
36
|
+
if (spinner)
|
|
37
|
+
spinner.text = `Found ${tools.length} AI tool(s).${shouldWalk ? ' Scanning files...' : ' Running targeted system audit...'}`;
|
|
38
|
+
const rules = allRules;
|
|
39
|
+
const engine = createRuleEngine({ rules, config });
|
|
40
|
+
const findings = [];
|
|
41
|
+
const stats = { filesScanned: 0, filesSkipped: 0 };
|
|
42
|
+
if (shouldWalk) {
|
|
43
|
+
for await (const file of walkFiles(walkDir, stats)) {
|
|
44
|
+
const fileFindings = engine.scanFile(file.path, file.content);
|
|
45
|
+
findings.push(...fileFindings);
|
|
46
|
+
if (spinner && stats.filesScanned % 100 === 0) {
|
|
47
|
+
spinner.text = `Scanned ${stats.filesScanned} files... (${findings.length} findings)`;
|
|
48
|
+
}
|
|
49
|
+
}
|
|
50
|
+
}
|
|
51
|
+
// System scan — always included for comprehensive audit
|
|
52
|
+
if (spinner)
|
|
53
|
+
spinner.text = 'System scan: targeting credential locations...';
|
|
54
|
+
const { getSystemTargets, getPermissionTargets } = await import('../scanner/system-targets.js');
|
|
55
|
+
const { checkPermissions } = await import('../scanner/permission-checker.js');
|
|
56
|
+
const systemFindings = [];
|
|
57
|
+
const targets = getSystemTargets();
|
|
58
|
+
for await (const file of walkSystemTargets(targets, stats)) {
|
|
59
|
+
const fileFindings = engine.scanFile(file.path, file.content);
|
|
60
|
+
systemFindings.push(...fileFindings);
|
|
61
|
+
}
|
|
62
|
+
const permFindings = await checkPermissions(getPermissionTargets());
|
|
63
|
+
systemFindings.push(...permFindings);
|
|
64
|
+
findings.push(...systemFindings);
|
|
65
|
+
// MCP detection
|
|
66
|
+
if (spinner)
|
|
67
|
+
spinner.text = 'Detecting MCP servers...';
|
|
68
|
+
const { detectMCPServers } = await import('../auditor/mcp-detector.js');
|
|
69
|
+
const mcpResult = detectMCPServers();
|
|
70
|
+
const mcpServers = mcpResult.servers;
|
|
71
|
+
const mcpConfigFiles = mcpResult.configFiles;
|
|
72
|
+
// VS Code extensions
|
|
73
|
+
if (spinner)
|
|
74
|
+
spinner.text = 'Scanning VS Code extensions...';
|
|
75
|
+
const { scanVSCodeExtensions } = await import('../auditor/vscode-extension-scanner.js');
|
|
76
|
+
const vsCodeExtensions = scanVSCodeExtensions();
|
|
77
|
+
// CLI detection
|
|
78
|
+
if (spinner)
|
|
79
|
+
spinner.text = 'Detecting AI CLI tools...';
|
|
80
|
+
const { detectAICLIs } = await import('../auditor/cli-detector.js');
|
|
81
|
+
const detectedCLIs = detectAICLIs();
|
|
82
|
+
// Environment variable audit
|
|
83
|
+
if (spinner)
|
|
84
|
+
spinner.text = 'Auditing environment variables...';
|
|
85
|
+
const { auditEnvironment } = await import('../auditor/env-auditor.js');
|
|
86
|
+
const envExposures = auditEnvironment();
|
|
87
|
+
// Prompt injection scan
|
|
88
|
+
if (spinner)
|
|
89
|
+
spinner.text = 'Scanning for prompt injection...';
|
|
90
|
+
const { scanInstructionFiles } = await import('../scanner/injection-scanner.js');
|
|
91
|
+
for await (const finding of scanInstructionFiles()) {
|
|
92
|
+
findings.push(finding);
|
|
93
|
+
}
|
|
94
|
+
if (spinner)
|
|
95
|
+
spinner.text = 'Mapping access...';
|
|
96
|
+
const { score, label } = calculateRiskScore(findings);
|
|
97
|
+
const scanResult = {
|
|
98
|
+
findings,
|
|
99
|
+
filesScanned: stats.filesScanned,
|
|
100
|
+
filesSkipped: stats.filesSkipped,
|
|
101
|
+
scanDurationMs: Date.now() - startTime,
|
|
102
|
+
riskScore: score,
|
|
103
|
+
riskLabel: label,
|
|
104
|
+
};
|
|
105
|
+
// Workspace root for access scoping: use actual project dir (cwd or explicit),
|
|
106
|
+
// not the scan directory (which may be homedir for full audits).
|
|
107
|
+
// Workspace-scoped tools should only reach files within the project.
|
|
108
|
+
const workspaceRoot = resolve(targetDir);
|
|
109
|
+
const exposures = crossReference(tools, findings, workspaceRoot);
|
|
110
|
+
const exposedSet = new Set();
|
|
111
|
+
for (const exp of exposures) {
|
|
112
|
+
for (const f of exp.exposedFindings) {
|
|
113
|
+
exposedSet.add(`${f.filePath}:${f.line}`);
|
|
114
|
+
}
|
|
115
|
+
}
|
|
116
|
+
const durationMs = Date.now() - startTime;
|
|
117
|
+
const result = {
|
|
118
|
+
tools,
|
|
119
|
+
exposures,
|
|
120
|
+
scanResult,
|
|
121
|
+
totalExposed: exposedSet.size,
|
|
122
|
+
durationMs,
|
|
123
|
+
mcpServers,
|
|
124
|
+
mcpConfigFiles,
|
|
125
|
+
vsCodeExtensions,
|
|
126
|
+
detectedCLIs,
|
|
127
|
+
systemFindings,
|
|
128
|
+
envExposures,
|
|
129
|
+
};
|
|
130
|
+
if (spinner)
|
|
131
|
+
spinner.stop();
|
|
132
|
+
if (outputFormat === 'sarif') {
|
|
133
|
+
const { generateSarifReport } = await import('../reporter/sarif-report.js');
|
|
134
|
+
console.log(JSON.stringify(generateSarifReport(scanResult), null, 2));
|
|
135
|
+
}
|
|
136
|
+
else if (outputFormat === 'json') {
|
|
137
|
+
printJsonAuditReport(result);
|
|
138
|
+
}
|
|
139
|
+
else {
|
|
140
|
+
printAuditReport(result);
|
|
141
|
+
}
|
|
142
|
+
// Interactive remediation mode
|
|
143
|
+
if (options.remediate && outputFormat !== 'json' && outputFormat !== 'sarif') {
|
|
144
|
+
const { runInteractiveRemediation } = await import('./remediate-cli.js');
|
|
145
|
+
await runInteractiveRemediation(result);
|
|
146
|
+
}
|
|
147
|
+
if (findings.some((f) => f.severity === 'critical' || f.severity === 'high')) {
|
|
148
|
+
process.exitCode = 1;
|
|
149
|
+
}
|
|
150
|
+
}
|
|
151
|
+
//# sourceMappingURL=audit.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/commands/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAWrF,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,SAAiB,EAAE,OAAqB;IACrE,MAAM,YAAY,GAAG,SAAS,KAAK,GAAG,CAAC;IACvC,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAE1C,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC9F,OAAO,CAAC,KAAK,CAAC,cAAc,cAAc,2BAA2B,CAAC,CAAC;QACvE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,wBAAwB;IACxB,yEAAyE;IACzE,iDAAiD;IACjD,yDAAyD;IACzD,6EAA6E;IAC7E,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IACjD,MAAM,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEnG,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,MAAM,IAAI,YAAY,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,KAAK,EAAE,CAAC;IAE7I,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAC;IACrC,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,GAAG,SAAS,KAAK,CAAC,MAAM,eAAe,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,mCAAmC,EAAE,CAAC;IAE1I,MAAM,KAAK,GAAG,QAAQ,CAAC;IACvB,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAEnD,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAc,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAE9D,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YACnD,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;YAE/B,IAAI,OAAO,IAAI,KAAK,CAAC,YAAY,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC;gBAC9C,OAAO,CAAC,IAAI,GAAG,WAAW,KAAK,CAAC,YAAY,cAAc,QAAQ,CAAC,MAAM,YAAY,CAAC;YACxF,CAAC;QACH,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,GAAG,gDAAgD,CAAC;IAE7E,MAAM,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IAChG,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAE9E,MAAM,cAAc,GAAkB,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9D,cAAc,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACpE,cAAc,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IACrC,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;IAEjC,gBAAgB;IAChB,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACvD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC;IACrC,MAAM,cAAc,GAAG,SAAS,CAAC,WAAW,CAAC;IAE7C,qBAAqB;IACrB,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC7D,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,wCAAwC,CAAC,CAAC;IACxF,MAAM,gBAAgB,GAAG,oBAAoB,EAAE,CAAC;IAEhD,gBAAgB;IAChB,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,GAAG,2BAA2B,CAAC;IACxD,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,YAAY,EAAE,CAAC;IAEpC,6BAA6B;IAC7B,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAChE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACvE,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAC;IAExC,wBAAwB;IACxB,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,GAAG,kCAAkC,CAAC;IAC/D,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;IACjF,IAAI,KAAK,EAAE,MAAM,OAAO,IAAI,oBAAoB,EAAE,EAAE,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAEhD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,UAAU,GAAe;QAC7B,QAAQ;QACR,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QACtC,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,KAAK;KACjB,CAAC;IAEF,+EAA+E;IAC/E,iEAAiE;IACjE,qEAAqE;IACrE,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAEjE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;YACpC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAE1C,MAAM,MAAM,GAAgB;QAC1B,KAAK;QACL,SAAS;QACT,UAAU;QACV,YAAY,EAAE,UAAU,CAAC,IAAI;QAC7B,UAAU;QACV,UAAU;QACV,cAAc;QACd,gBAAgB;QAChB,YAAY;QACZ,cAAc;QACd,YAAY;KACb,CAAC;IAEF,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAE5B,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;SAAM,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QACnC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED,+BAA+B;IAC/B,IAAI,OAAO,CAAC,SAAS,IAAI,YAAY,KAAK,MAAM,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;QAC7E,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACzE,MAAM,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC;QAC7E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAMA,wBAAgB,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CA4BhD"}
|
|
@@ -0,0 +1,34 @@
|
|
|
1
|
+
import { execFileSync } from 'node:child_process';
|
|
2
|
+
import { resolve, join, dirname } from 'node:path';
|
|
3
|
+
import { fileURLToPath } from 'node:url';
|
|
4
|
+
import { existsSync } from 'node:fs';
|
|
5
|
+
import chalk from 'chalk';
|
|
6
|
+
export function runInit(targetDir) {
|
|
7
|
+
const __filename = fileURLToPath(import.meta.url);
|
|
8
|
+
const __dirname = dirname(__filename);
|
|
9
|
+
const repoRoot = resolve(__dirname, '..', '..');
|
|
10
|
+
const installScript = join(repoRoot, 'install.sh');
|
|
11
|
+
const target = targetDir ? resolve(targetDir) : process.cwd();
|
|
12
|
+
if (!existsSync(installScript)) {
|
|
13
|
+
console.error(`install.sh not found at ${installScript}`);
|
|
14
|
+
console.error('Run this command from the ChainWall repository root.');
|
|
15
|
+
process.exitCode = 1;
|
|
16
|
+
return;
|
|
17
|
+
}
|
|
18
|
+
try {
|
|
19
|
+
execFileSync('bash', [installScript, target], {
|
|
20
|
+
stdio: 'inherit',
|
|
21
|
+
});
|
|
22
|
+
console.log('');
|
|
23
|
+
console.log(chalk.bold('Verify your setup:'));
|
|
24
|
+
console.log(chalk.dim(` chainwall scan ${target === process.cwd() ? '.' : target} # scan for existing secrets`));
|
|
25
|
+
console.log(chalk.dim(` chainwall audit # check AI tool exposure`));
|
|
26
|
+
console.log(chalk.dim(` chainwall # launch interactive TUI`));
|
|
27
|
+
console.log('');
|
|
28
|
+
}
|
|
29
|
+
catch (err) {
|
|
30
|
+
console.error('Init failed. Check the output above for details.');
|
|
31
|
+
process.exitCode = 1;
|
|
32
|
+
}
|
|
33
|
+
}
|
|
34
|
+
//# sourceMappingURL=init.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,UAAU,OAAO,CAAC,SAAkB;IACxC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAE9D,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,2BAA2B,aAAa,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACtE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,YAAY,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE;YAC5C,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,MAAM,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,gCAAgC,CAAC,CAAC,CAAC;QACpH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAClE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"remediate-cli.d.ts","sourceRoot":"","sources":["../../src/commands/remediate-cli.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AASvD,wBAAsB,yBAAyB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAwGlF"}
|
|
@@ -0,0 +1,96 @@
|
|
|
1
|
+
import { createInterface } from 'node:readline';
|
|
2
|
+
import chalk from 'chalk';
|
|
3
|
+
import { getActionsForMCPServer, getActionsForVSCodeExtension, getActionsForEnvExposure, getActionsForPermissionFinding, } from '../auditor/remediation.js';
|
|
4
|
+
export async function runInteractiveRemediation(result) {
|
|
5
|
+
const allActions = [];
|
|
6
|
+
// Collect all available actions
|
|
7
|
+
if (result.mcpServers) {
|
|
8
|
+
for (const server of result.mcpServers) {
|
|
9
|
+
allActions.push(...getActionsForMCPServer(server));
|
|
10
|
+
}
|
|
11
|
+
}
|
|
12
|
+
if (result.vsCodeExtensions) {
|
|
13
|
+
for (const ext of result.vsCodeExtensions) {
|
|
14
|
+
allActions.push(...getActionsForVSCodeExtension(ext));
|
|
15
|
+
}
|
|
16
|
+
}
|
|
17
|
+
if (result.envExposures) {
|
|
18
|
+
for (const env of result.envExposures) {
|
|
19
|
+
allActions.push(...getActionsForEnvExposure(env));
|
|
20
|
+
}
|
|
21
|
+
}
|
|
22
|
+
// Permission findings from system scan
|
|
23
|
+
for (const f of result.systemFindings) {
|
|
24
|
+
allActions.push(...getActionsForPermissionFinding(f));
|
|
25
|
+
}
|
|
26
|
+
if (allActions.length === 0) {
|
|
27
|
+
console.log('');
|
|
28
|
+
console.log(chalk.green('No remediation actions available.'));
|
|
29
|
+
return;
|
|
30
|
+
}
|
|
31
|
+
console.log('');
|
|
32
|
+
console.log(chalk.bold('Available Remediation Actions'));
|
|
33
|
+
console.log(chalk.dim('\u2500'.repeat(50)));
|
|
34
|
+
console.log('');
|
|
35
|
+
for (let i = 0; i < allActions.length; i++) {
|
|
36
|
+
const action = allActions[i];
|
|
37
|
+
const badge = action.riskLevel === 'caution'
|
|
38
|
+
? chalk.yellow('[CAUTION]')
|
|
39
|
+
: chalk.green('[SAFE]');
|
|
40
|
+
console.log(` ${chalk.bold(String(i + 1))}. ${badge} ${action.label}`);
|
|
41
|
+
console.log(chalk.dim(` ${action.description}`));
|
|
42
|
+
}
|
|
43
|
+
console.log('');
|
|
44
|
+
console.log(chalk.dim('Enter a number to execute, or q to skip.'));
|
|
45
|
+
const rl = createInterface({
|
|
46
|
+
input: process.stdin,
|
|
47
|
+
output: process.stdout,
|
|
48
|
+
});
|
|
49
|
+
const question = (prompt) => {
|
|
50
|
+
return new Promise((resolve) => {
|
|
51
|
+
rl.question(prompt, resolve);
|
|
52
|
+
});
|
|
53
|
+
};
|
|
54
|
+
try {
|
|
55
|
+
while (true) {
|
|
56
|
+
const answer = await question(chalk.bold('\n> '));
|
|
57
|
+
const trimmed = answer.trim().toLowerCase();
|
|
58
|
+
if (trimmed === 'q' || trimmed === 'quit' || trimmed === '') {
|
|
59
|
+
break;
|
|
60
|
+
}
|
|
61
|
+
const num = parseInt(trimmed, 10);
|
|
62
|
+
if (isNaN(num) || num < 1 || num > allActions.length) {
|
|
63
|
+
console.log(chalk.dim(`Enter 1-${allActions.length} or q to quit.`));
|
|
64
|
+
continue;
|
|
65
|
+
}
|
|
66
|
+
const action = allActions[num - 1];
|
|
67
|
+
// Caution actions require confirmation
|
|
68
|
+
if (action.riskLevel === 'caution') {
|
|
69
|
+
const confirm = await question(chalk.yellow(` This will modify ${action.target}. Type "yes" to proceed: `));
|
|
70
|
+
if (confirm.trim().toLowerCase() !== 'yes') {
|
|
71
|
+
console.log(chalk.dim(' Cancelled.'));
|
|
72
|
+
continue;
|
|
73
|
+
}
|
|
74
|
+
}
|
|
75
|
+
try {
|
|
76
|
+
const result = await action.execute();
|
|
77
|
+
if (result.success) {
|
|
78
|
+
console.log(chalk.green(` \u2713 ${result.message}`));
|
|
79
|
+
if (result.backupPath) {
|
|
80
|
+
console.log(chalk.dim(` Backup: ${result.backupPath}`));
|
|
81
|
+
}
|
|
82
|
+
}
|
|
83
|
+
else {
|
|
84
|
+
console.log(chalk.red(` \u2717 ${result.message}`));
|
|
85
|
+
}
|
|
86
|
+
}
|
|
87
|
+
catch (err) {
|
|
88
|
+
console.log(chalk.red(` Error: ${err instanceof Error ? err.message : String(err)}`));
|
|
89
|
+
}
|
|
90
|
+
}
|
|
91
|
+
}
|
|
92
|
+
finally {
|
|
93
|
+
rl.close();
|
|
94
|
+
}
|
|
95
|
+
}
|
|
96
|
+
//# sourceMappingURL=remediate-cli.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"remediate-cli.js","sourceRoot":"","sources":["../../src/commands/remediate-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAC5B,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,MAAmB;IACjE,MAAM,UAAU,GAAwB,EAAE,CAAC;IAE3C,gCAAgC;IAChC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACvC,UAAU,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC1C,UAAU,CAAC,IAAI,CAAC,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC,GAAG,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,KAAK,SAAS;YAC1C,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;YAC3B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC,CAAC;IAEnE,MAAM,EAAE,GAAG,eAAe,CAAC;QACzB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAmB,EAAE;QACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAClD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAE5C,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;gBAC5D,MAAM;YACR,CAAC;YAED,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAClC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;gBACrD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,UAAU,CAAC,MAAM,gBAAgB,CAAC,CAAC,CAAC;gBACrE,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YAEnC,uCAAuC;YACvC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,MAAM,CAAC,MAAM,2BAA2B,CAAC,CAAC,CAAC;gBAC7G,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;oBAC3C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;oBACvC,SAAS;gBACX,CAAC;YACH,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;gBACtC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;oBACvD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;wBACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;oBAC3D,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
export interface ScanOptions {
|
|
2
|
+
json?: boolean;
|
|
3
|
+
cryptoOnly?: boolean;
|
|
4
|
+
verbose?: boolean;
|
|
5
|
+
system?: boolean;
|
|
6
|
+
format?: string;
|
|
7
|
+
includeTests?: boolean;
|
|
8
|
+
grouped?: boolean;
|
|
9
|
+
}
|
|
10
|
+
export declare function runScan(targetDir: string, options: ScanOptions): Promise<void>;
|
|
11
|
+
//# sourceMappingURL=scan.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/commands/scan.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAsB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAyIpF"}
|
|
@@ -0,0 +1,138 @@
|
|
|
1
|
+
import { resolve } from 'node:path';
|
|
2
|
+
import { existsSync, statSync } from 'node:fs';
|
|
3
|
+
import ora from 'ora';
|
|
4
|
+
import chalk from 'chalk';
|
|
5
|
+
import { loadConfig } from '../config.js';
|
|
6
|
+
import { allRules, cryptoRules } from '../rules/index.js';
|
|
7
|
+
import { walkFiles, walkSystemTargets } from '../scanner/filesystem-scanner.js';
|
|
8
|
+
import { createRuleEngine } from '../scanner/rule-engine.js';
|
|
9
|
+
import { calculateRiskScore } from '../reporter/risk-scorer.js';
|
|
10
|
+
import { printTerminalReport, printGroupedReport } from '../reporter/terminal-report.js';
|
|
11
|
+
import { printJsonReport } from '../reporter/json-report.js';
|
|
12
|
+
import { detectInstalledTools } from '../auditor/tool-detector.js';
|
|
13
|
+
export async function runScan(targetDir, options) {
|
|
14
|
+
const isDefaultDir = targetDir === '.';
|
|
15
|
+
const dir = resolve(targetDir);
|
|
16
|
+
if (!isDefaultDir && (!existsSync(dir) || !statSync(dir).isDirectory())) {
|
|
17
|
+
console.error(`chainwall: ${dir} is not a valid directory`);
|
|
18
|
+
process.exitCode = 1;
|
|
19
|
+
return;
|
|
20
|
+
}
|
|
21
|
+
const config = loadConfig(dir);
|
|
22
|
+
const rules = options.cryptoOnly ? cryptoRules : allRules;
|
|
23
|
+
const engine = createRuleEngine({ rules, config });
|
|
24
|
+
const spinner = (options.json || !process.stdout.isTTY) ? null : ora('Scanning files...').start();
|
|
25
|
+
const startTime = Date.now();
|
|
26
|
+
const findings = [];
|
|
27
|
+
const stats = { filesScanned: 0, filesSkipped: 0 };
|
|
28
|
+
if (options.system) {
|
|
29
|
+
// --system flag: system targets only
|
|
30
|
+
if (spinner)
|
|
31
|
+
spinner.text = 'System scan: targeting credential locations...';
|
|
32
|
+
const { getSystemTargets, getPermissionTargets } = await import('../scanner/system-targets.js');
|
|
33
|
+
const { checkPermissions } = await import('../scanner/permission-checker.js');
|
|
34
|
+
const targets = getSystemTargets();
|
|
35
|
+
for await (const file of walkSystemTargets(targets, stats)) {
|
|
36
|
+
const fileFindings = engine.scanFile(file.path, file.content);
|
|
37
|
+
findings.push(...fileFindings);
|
|
38
|
+
if (spinner && stats.filesScanned % 50 === 0) {
|
|
39
|
+
spinner.text = `System scan: ${stats.filesScanned} files... (${findings.length} findings)`;
|
|
40
|
+
}
|
|
41
|
+
}
|
|
42
|
+
// Permission checks
|
|
43
|
+
if (spinner)
|
|
44
|
+
spinner.text = 'Checking file permissions...';
|
|
45
|
+
const permFindings = await checkPermissions(getPermissionTargets());
|
|
46
|
+
findings.push(...permFindings);
|
|
47
|
+
}
|
|
48
|
+
else if (isDefaultDir) {
|
|
49
|
+
// No args: scan cwd + system targets + permissions
|
|
50
|
+
const scanRoot = dir;
|
|
51
|
+
if (spinner)
|
|
52
|
+
spinner.text = `Scanning ${scanRoot}...`;
|
|
53
|
+
const walkOpts = {
|
|
54
|
+
maxDepth: 10,
|
|
55
|
+
maxFiles: 50_000,
|
|
56
|
+
extraSkipDirs: config.skipDirs,
|
|
57
|
+
includeTests: options.includeTests,
|
|
58
|
+
};
|
|
59
|
+
for await (const file of walkFiles(scanRoot, stats, undefined, walkOpts)) {
|
|
60
|
+
const fileFindings = engine.scanFile(file.path, file.content);
|
|
61
|
+
findings.push(...fileFindings);
|
|
62
|
+
if (spinner && stats.filesScanned % 100 === 0) {
|
|
63
|
+
spinner.text = `Scanned ${stats.filesScanned} files... (${findings.length} findings)`;
|
|
64
|
+
}
|
|
65
|
+
}
|
|
66
|
+
// System targets
|
|
67
|
+
if (spinner)
|
|
68
|
+
spinner.text = 'System scan: targeting credential locations...';
|
|
69
|
+
const { getSystemTargets, getPermissionTargets } = await import('../scanner/system-targets.js');
|
|
70
|
+
const { checkPermissions } = await import('../scanner/permission-checker.js');
|
|
71
|
+
for await (const file of walkSystemTargets(getSystemTargets(), stats)) {
|
|
72
|
+
const fileFindings = engine.scanFile(file.path, file.content);
|
|
73
|
+
findings.push(...fileFindings);
|
|
74
|
+
}
|
|
75
|
+
if (spinner)
|
|
76
|
+
spinner.text = 'Checking file permissions...';
|
|
77
|
+
const permFindings = await checkPermissions(getPermissionTargets());
|
|
78
|
+
findings.push(...permFindings);
|
|
79
|
+
}
|
|
80
|
+
else {
|
|
81
|
+
// Explicit dir: scan only that directory
|
|
82
|
+
const walkOpts = {
|
|
83
|
+
extraSkipDirs: config.skipDirs,
|
|
84
|
+
includeTests: options.includeTests,
|
|
85
|
+
};
|
|
86
|
+
for await (const file of walkFiles(dir, stats, undefined, walkOpts)) {
|
|
87
|
+
const fileFindings = engine.scanFile(file.path, file.content);
|
|
88
|
+
findings.push(...fileFindings);
|
|
89
|
+
if (spinner && stats.filesScanned % 100 === 0) {
|
|
90
|
+
spinner.text = `Scanned ${stats.filesScanned} files... (${findings.length} findings)`;
|
|
91
|
+
}
|
|
92
|
+
}
|
|
93
|
+
}
|
|
94
|
+
// Prompt injection scan
|
|
95
|
+
if (spinner)
|
|
96
|
+
spinner.text = 'Scanning for prompt injection...';
|
|
97
|
+
const { scanInstructionFiles } = await import('../scanner/injection-scanner.js');
|
|
98
|
+
for await (const finding of scanInstructionFiles()) {
|
|
99
|
+
findings.push(finding);
|
|
100
|
+
}
|
|
101
|
+
const scanDurationMs = Date.now() - startTime;
|
|
102
|
+
const { score, label } = calculateRiskScore(findings);
|
|
103
|
+
const result = {
|
|
104
|
+
findings,
|
|
105
|
+
filesScanned: stats.filesScanned,
|
|
106
|
+
filesSkipped: stats.filesSkipped,
|
|
107
|
+
scanDurationMs,
|
|
108
|
+
riskScore: score,
|
|
109
|
+
riskLabel: label,
|
|
110
|
+
};
|
|
111
|
+
if (spinner)
|
|
112
|
+
spinner.stop();
|
|
113
|
+
const outputFormat = options.format || (options.json ? 'json' : 'text');
|
|
114
|
+
if (outputFormat === 'sarif') {
|
|
115
|
+
const { generateSarifReport } = await import('../reporter/sarif-report.js');
|
|
116
|
+
console.log(JSON.stringify(generateSarifReport(result), null, 2));
|
|
117
|
+
}
|
|
118
|
+
else if (outputFormat === 'json') {
|
|
119
|
+
printJsonReport(result);
|
|
120
|
+
}
|
|
121
|
+
else if (options.grouped) {
|
|
122
|
+
printGroupedReport(result, options.verbose ?? false);
|
|
123
|
+
}
|
|
124
|
+
else {
|
|
125
|
+
printTerminalReport(result, options.verbose ?? false);
|
|
126
|
+
}
|
|
127
|
+
if (outputFormat !== 'sarif' && outputFormat !== 'json' && !options.json) {
|
|
128
|
+
const tools = detectInstalledTools();
|
|
129
|
+
if (tools.length > 0) {
|
|
130
|
+
console.log(chalk.dim(`${tools.length} AI tool(s) detected. Run 'chainwall audit' for full access map.`));
|
|
131
|
+
console.log('');
|
|
132
|
+
}
|
|
133
|
+
}
|
|
134
|
+
if (findings.some((f) => f.severity === 'critical' || f.severity === 'high')) {
|
|
135
|
+
process.exitCode = 1;
|
|
136
|
+
}
|
|
137
|
+
}
|
|
138
|
+
//# sourceMappingURL=scan.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/commands/scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAanE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,SAAiB,EAAE,OAAoB;IACnE,MAAM,YAAY,GAAG,SAAS,KAAK,GAAG,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAE/B,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,KAAK,CAAC,cAAc,GAAG,2BAA2B,CAAC,CAAC;QAC5D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAE/B,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1D,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAEnD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,KAAK,EAAE,CAAC;IAClG,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAc,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAE9D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,qCAAqC;QACrC,IAAI,OAAO;YAAE,OAAO,CAAC,IAAI,GAAG,gDAAgD,CAAC;QAE7E,MAAM,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QAChG,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAE9E,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;QACnC,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;YAE/B,IAAI,OAAO,IAAI,KAAK,CAAC,YAAY,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC7C,OAAO,CAAC,IAAI,GAAG,gBAAgB,KAAK,CAAC,YAAY,cAAc,QAAQ,CAAC,MAAM,YAAY,CAAC;YAC7F,CAAC;QACH,CAAC;QAED,oBAAoB;QACpB,IAAI,OAAO;YAAE,OAAO,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3D,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,oBAAoB,EAAE,CAAC,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IACjC,CAAC;SAAM,IAAI,YAAY,EAAE,CAAC;QACxB,mDAAmD;QACnD,MAAM,QAAQ,GAAG,GAAG,CAAC;QACrB,IAAI,OAAO;YAAE,OAAO,CAAC,IAAI,GAAG,YAAY,QAAQ,KAAK,CAAC;QAEtD,MAAM,QAAQ,GAAgB;YAC5B,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,MAAM;YAChB,aAAa,EAAE,MAAM,CAAC,QAAQ;YAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC;QACF,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACzE,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;YAE/B,IAAI,OAAO,IAAI,KAAK,CAAC,YAAY,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC;gBAC9C,OAAO,CAAC,IAAI,GAAG,WAAW,KAAK,CAAC,YAAY,cAAc,QAAQ,CAAC,MAAM,YAAY,CAAC;YACxF,CAAC;QACH,CAAC;QAED,iBAAiB;QACjB,IAAI,OAAO;YAAE,OAAO,CAAC,IAAI,GAAG,gDAAgD,CAAC;QAE7E,MAAM,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QAChG,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAE9E,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,OAAO;YAAE,OAAO,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3D,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,oBAAoB,EAAE,CAAC,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,yCAAyC;QACzC,MAAM,QAAQ,GAAgB;YAC5B,aAAa,EAAE,MAAM,CAAC,QAAQ;YAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC;QACF,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpE,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;YAE/B,IAAI,OAAO,IAAI,KAAK,CAAC,YAAY,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC;gBAC9C,OAAO,CAAC,IAAI,GAAG,WAAW,KAAK,CAAC,YAAY,cAAc,QAAQ,CAAC,MAAM,YAAY,CAAC;YACxF,CAAC;QACH,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,GAAG,kCAAkC,CAAC;IAC/D,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;IACjF,IAAI,KAAK,EAAE,MAAM,OAAO,IAAI,oBAAoB,EAAE,EAAE,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAC9C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAEtD,MAAM,MAAM,GAAe;QACzB,QAAQ;QACR,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc;QACd,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,KAAK;KACjB,CAAC;IAEF,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAE5B,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAExE,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;SAAM,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QACnC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;SAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,YAAY,KAAK,OAAO,IAAI,YAAY,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACzE,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,kEAAkE,CAAC,CAAC,CAAC;YAC1G,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC;QAC7E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"watch.d.ts","sourceRoot":"","sources":["../../src/commands/watch.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAwBD,wBAAsB,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA2LtF"}
|