circle-ir-ai 2.37.17 → 2.39.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +80 -0
- package/dist/trust/passes/tool-poisoning.d.ts.map +1 -1
- package/dist/trust/passes/tool-poisoning.js +92 -0
- package/dist/trust/passes/tool-poisoning.js.map +1 -1
- package/dist/trust/scoring.d.ts +11 -0
- package/dist/trust/scoring.d.ts.map +1 -1
- package/dist/trust/scoring.js +31 -5
- package/dist/trust/scoring.js.map +1 -1
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,86 @@ All notable changes to this project will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [2.39.0] - 2026-07-10
|
|
9
|
+
|
|
10
|
+
### Changed — bump `circle-ir` `3.162.0 → 3.164.0`
|
|
11
|
+
|
|
12
|
+
Core engine bump, validated against the registry package (clean install).
|
|
13
|
+
Unit suite 1368 pass; OWASP 100% / Juliet 100% re-verified. (Corrects a
|
|
14
|
+
pin inconsistency in the pre-publish working tree — package.json had
|
|
15
|
+
drifted to `^3.163.0` while the lockfile pinned 3.162.0; both now pin
|
|
16
|
+
exact `3.164.0`.)
|
|
17
|
+
|
|
18
|
+
### Fixed — trust aggregate now consumes LLM security findings ([cognium-ai#119](https://github.com/cogniumhq/cognium-ai/issues/119), #204 P1)
|
|
19
|
+
|
|
20
|
+
**Root cause.** `llm-security-scan` (the synthetic pass `cognium-ai
|
|
21
|
+
trust --llm` injects) was in `PASS_COMPONENT_MAP` (display-only
|
|
22
|
+
`vulnerability_score`) but **missing from `PASS_CATEGORY_MAP`**, so
|
|
23
|
+
`computeTrustScore` hit its "unknown pass — skip silently" branch and
|
|
24
|
+
excluded it from the weighted composite entirely. The aggregate `score`
|
|
25
|
+
was byte-identical between `--llm` and `--no-llm` even when the LLM
|
|
26
|
+
finding-set differed — the original #119 complaint, still reproducing on
|
|
27
|
+
2.38.0.
|
|
28
|
+
|
|
29
|
+
**Change.**
|
|
30
|
+
- Map `llm-security-scan → code_security` in `PASS_CATEGORY_MAP`.
|
|
31
|
+
- Category averaging is now a **weighted mean** (`PASS_INTRA_CATEGORY_WEIGHT`,
|
|
32
|
+
default 1 → byte-identical to the old simple average when no weighted
|
|
33
|
+
pass is present). `llm-security-scan` carries weight 10 so an
|
|
34
|
+
LLM-discovered SQLi/RCE moves the aggregate meaningfully instead of
|
|
35
|
+
washing out across ~20 maintainability passes and rounding away.
|
|
36
|
+
|
|
37
|
+
**Behavior change (expected).** Trust scores now **drop for repos with
|
|
38
|
+
security findings** — `--llm`/`--no-llm` aggregates diverge when the
|
|
39
|
+
finding-set differs (verified: fixture 97.69 identical → 95.57 vs 94.91).
|
|
40
|
+
This is the point of the fix. Repos with no security findings are
|
|
41
|
+
unaffected.
|
|
42
|
+
|
|
43
|
+
**Tests.** +3 (`tests/trust-scoring.test.ts`) — category-map membership,
|
|
44
|
+
lower-LLM-score-lowers-aggregate, and heavier-than-maintainability
|
|
45
|
+
weighting. Suite 1368 pass / 3 skipped.
|
|
46
|
+
|
|
47
|
+
## [2.38.0] - 2026-07-09
|
|
48
|
+
|
|
49
|
+
### Changed — bump `circle-ir` `3.160.0 → 3.162.0`
|
|
50
|
+
|
|
51
|
+
Core engine bump folded into this release, validated against the
|
|
52
|
+
registry package (clean install, not a local checkout). Unit suite
|
|
53
|
+
1365 pass; full static benchmark suite re-verified (OWASP 100%,
|
|
54
|
+
Juliet 100%, all real-app suites stable).
|
|
55
|
+
|
|
56
|
+
### Added — tool-poisoning pass detects hidden agent-directed directives ([cognium-ai#211](https://github.com/cogniumhq/cognium-ai/issues/211) / LLM04)
|
|
57
|
+
|
|
58
|
+
**Motivation.** The #211 triage showed the `tool-poisoning` pass scored
|
|
59
|
+
0 on a manifest carrying the canonical MCP tool-poisoning attack — an
|
|
60
|
+
`<IMPORTANT>…read ~/.ssh/id_rsa and exfiltrate…</IMPORTANT>` hidden
|
|
61
|
+
directive in a tool description. The pass compared *schema-declared
|
|
62
|
+
capabilities* vs *code-file dangerous sinks*, so it structurally could
|
|
63
|
+
not see an attack whose payload IS the schema description (targeting the
|
|
64
|
+
AI agent, not the human reader).
|
|
65
|
+
|
|
66
|
+
**Change.** New `detectHiddenDirectives()` scans tool-schema/manifest
|
|
67
|
+
files for six hidden-directive shapes — hidden-instruction tags
|
|
68
|
+
(`<IMPORTANT>`/`<SYSTEM>`/…), instruction-override (“ignore previous
|
|
69
|
+
instructions”), concealment (“do not tell the user”), pre-use injected
|
|
70
|
+
instructions, sensitive-file read directives (`~/.ssh`/`id_rsa`/`.env`/
|
|
71
|
+
tokens), and exfiltration directives. Findings carry stable
|
|
72
|
+
`hidden-directive-*` ruleIds and merge into the pass score.
|
|
73
|
+
|
|
74
|
+
**Behavior change.** A poisoned manifest that previously scored VERIFIED
|
|
75
|
+
now emits critical findings and can move the trust tier to BLOCKED.
|
|
76
|
+
Benign manifests stay clean (FP-checked).
|
|
77
|
+
|
|
78
|
+
**Tests.** +3 (`tests/tool-poisoning.test.ts`) — `<IMPORTANT>`+read+exfil
|
|
79
|
+
combo, instruction-override+concealment, and a benign-manifest FP guard.
|
|
80
|
+
E2E: poisoned fixture → 3 criticals / BLOCKED; benign → 0 / VERIFIED.
|
|
81
|
+
Suite 1365 pass / 3 skipped.
|
|
82
|
+
|
|
83
|
+
**Scope (#211 remaining):** LLM01/LLM06 source-code AI-safety (tainted
|
|
84
|
+
input → LLM API sink) needs LLM-sink taint modeling in circle-ir
|
|
85
|
+
(out of this repo's boundary — upstream ticket), and RC1 filename-routing
|
|
86
|
+
widening. This closes the in-boundary LLM04 detection gap only.
|
|
87
|
+
|
|
8
88
|
## [2.37.17] - 2026-07-09
|
|
9
89
|
|
|
10
90
|
### Added — tree-cache hits are no longer silent ([cognium-ai#182](https://github.com/cogniumhq/cognium-ai/issues/182), P5 known-gap)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tool-poisoning.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/tool-poisoning.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,KAAK,eAAe,EAIrB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAMrD,MAAM,WAAW,oBAAoB;IACnC,4DAA4D;IAC5D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,wBAAwB;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/B,oCAAoC;IACpC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;
|
|
1
|
+
{"version":3,"file":"tool-poisoning.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/tool-poisoning.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,KAAK,eAAe,EAIrB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAMrD,MAAM,WAAW,oBAAoB;IACnC,4DAA4D;IAC5D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,wBAAwB;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/B,oCAAoC;IACpC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA0XD,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,eAAe,CAAC,CA+C1B"}
|
|
@@ -41,6 +41,52 @@ const DANGEROUS_SINK_PATTERNS = [
|
|
|
41
41
|
// Crypto / encoding (potential exfiltration)
|
|
42
42
|
{ pattern: /btoa\s*\(|Buffer\.from\s*\(.*base64|base64\.encode/g, type: 'encoding', label: 'Base64 encoding' },
|
|
43
43
|
];
|
|
44
|
+
/**
|
|
45
|
+
* cognium-ai#211 (LLM04) — hidden-directive patterns. The canonical MCP
|
|
46
|
+
* tool-poisoning attack embeds agent-directed instructions inside a tool's
|
|
47
|
+
* *description* so the model executes them without the tool ever running.
|
|
48
|
+
* These target the AGENT, not the human reader — the schema-vs-code
|
|
49
|
+
* capability diff above cannot see them because the payload IS the schema.
|
|
50
|
+
* Each carries a stable ruleId + severity.
|
|
51
|
+
*/
|
|
52
|
+
const HIDDEN_DIRECTIVE_PATTERNS = [
|
|
53
|
+
{
|
|
54
|
+
pattern: /<\s*\/?\s*(important|secret|system|instructions?|admin|hidden|confidential)\s*>/i,
|
|
55
|
+
ruleId: 'hidden-directive-tag',
|
|
56
|
+
label: 'hidden-instruction tag',
|
|
57
|
+
severity: 'critical',
|
|
58
|
+
},
|
|
59
|
+
{
|
|
60
|
+
pattern: /ignore\s+(all\s+)?(previous|prior|above|earlier|the\s+following)\s+(instructions?|prompts?|directions?|rules?)/i,
|
|
61
|
+
ruleId: 'hidden-directive-instruction-override',
|
|
62
|
+
label: 'instruction-override directive',
|
|
63
|
+
severity: 'critical',
|
|
64
|
+
},
|
|
65
|
+
{
|
|
66
|
+
pattern: /do\s+not\s+(tell|mention|inform|reveal|disclose|notify|warn|report)\s+(the\s+)?(user|human|operator|caller)/i,
|
|
67
|
+
ruleId: 'hidden-directive-concealment',
|
|
68
|
+
label: 'concealment directive',
|
|
69
|
+
severity: 'critical',
|
|
70
|
+
},
|
|
71
|
+
{
|
|
72
|
+
pattern: /before\s+(using|calling|invoking|running)\s+(this\s+)?tool/i,
|
|
73
|
+
ruleId: 'hidden-directive-pre-use',
|
|
74
|
+
label: 'pre-use injected instruction',
|
|
75
|
+
severity: 'high',
|
|
76
|
+
},
|
|
77
|
+
{
|
|
78
|
+
pattern: /(read|cat|open|load|access|fetch)\b[^.\n]{0,70}(~\/\.ssh|id_rsa|\/etc\/passwd|\.env\b|\.aws\/credentials|\.git-credentials|private[_-]?key|secret|token|api[_-]?key)/i,
|
|
79
|
+
ruleId: 'hidden-directive-sensitive-read',
|
|
80
|
+
label: 'sensitive-file read directive',
|
|
81
|
+
severity: 'critical',
|
|
82
|
+
},
|
|
83
|
+
{
|
|
84
|
+
pattern: /(exfiltrate|send|upload|post|transmit|leak|forward|copy)\b[^.\n]{0,70}(https?:\/\/|ftp:\/\/|\w+@\w+|external|remote|attacker|evil)/i,
|
|
85
|
+
ruleId: 'hidden-directive-exfiltration',
|
|
86
|
+
label: 'exfiltration directive',
|
|
87
|
+
severity: 'critical',
|
|
88
|
+
},
|
|
89
|
+
];
|
|
44
90
|
/** Declared capability keywords in tool schemas/docs */
|
|
45
91
|
const CAPABILITY_KEYWORDS = {
|
|
46
92
|
network: new Set(['http', 'fetch', 'request', 'api', 'url', 'endpoint', 'webhook', 'socket']),
|
|
@@ -244,6 +290,48 @@ function compareBehaviors(declared, actual, projectPath) {
|
|
|
244
290
|
return findings;
|
|
245
291
|
}
|
|
246
292
|
// ---------------------------------------------------------------------------
|
|
293
|
+
// Hidden-directive detection (cognium-ai#211 / LLM04)
|
|
294
|
+
// ---------------------------------------------------------------------------
|
|
295
|
+
/**
|
|
296
|
+
* Scan tool-schema/manifest files for agent-directed hidden instructions —
|
|
297
|
+
* the tool-poisoning attack the schema-vs-code diff can't see because the
|
|
298
|
+
* payload lives in the description itself. Operates on the full file content
|
|
299
|
+
* (not the 500-char truncation the capability extractor keeps).
|
|
300
|
+
*/
|
|
301
|
+
function detectHiddenDirectives(schemaFiles, projectPath) {
|
|
302
|
+
const findings = [];
|
|
303
|
+
for (const file of schemaFiles) {
|
|
304
|
+
let content;
|
|
305
|
+
try {
|
|
306
|
+
content = fs.readFileSync(file, 'utf-8');
|
|
307
|
+
}
|
|
308
|
+
catch {
|
|
309
|
+
continue;
|
|
310
|
+
}
|
|
311
|
+
const rel = path.relative(projectPath, file);
|
|
312
|
+
for (const { pattern, ruleId, label, severity } of HIDDEN_DIRECTIVE_PATTERNS) {
|
|
313
|
+
// Fresh regex per file so lastIndex state can't leak across iterations.
|
|
314
|
+
const m = new RegExp(pattern.source, pattern.flags).exec(content);
|
|
315
|
+
if (!m)
|
|
316
|
+
continue;
|
|
317
|
+
let line = 1;
|
|
318
|
+
for (let i = 0; i < m.index && i < content.length; i++) {
|
|
319
|
+
if (content[i] === '\n')
|
|
320
|
+
line++;
|
|
321
|
+
}
|
|
322
|
+
findings.push({
|
|
323
|
+
pass: 'tool-poisoning',
|
|
324
|
+
ruleId,
|
|
325
|
+
severity,
|
|
326
|
+
message: `Hidden agent-directed instruction (${label}) in tool schema ${rel}:${line} — classic MCP tool-poisoning (LLM04); instruction targets the AI agent, not the human reader`,
|
|
327
|
+
location: { file: rel, line },
|
|
328
|
+
meta: { attackClass: 'tool-poisoning', signal: label },
|
|
329
|
+
});
|
|
330
|
+
}
|
|
331
|
+
}
|
|
332
|
+
return findings;
|
|
333
|
+
}
|
|
334
|
+
// ---------------------------------------------------------------------------
|
|
247
335
|
// Main pass
|
|
248
336
|
// ---------------------------------------------------------------------------
|
|
249
337
|
export async function toolPoisoningPass(projectPath, options = {}) {
|
|
@@ -271,6 +359,10 @@ export async function toolPoisoningPass(projectPath, options = {}) {
|
|
|
271
359
|
}
|
|
272
360
|
// Step 3: Compare declared vs actual
|
|
273
361
|
const findings = compareBehaviors(declared, actual, projectPath);
|
|
362
|
+
// Step 3b (cognium-ai#211 / LLM04) — scan the schemas themselves for
|
|
363
|
+
// hidden agent-directed directives, the tool-poisoning shape the
|
|
364
|
+
// capability diff structurally can't catch.
|
|
365
|
+
findings.push(...detectHiddenDirectives(schemaFiles, projectPath));
|
|
274
366
|
// Calculate score
|
|
275
367
|
let deduction = 0;
|
|
276
368
|
for (const f of findings) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tool-poisoning.js","sourceRoot":"","sources":["../../../src/trust/passes/tool-poisoning.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAIL,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAkBrB,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa;IAC/D,QAAQ,EAAE,QAAQ,EAAE,UAAU;CAC/B,CAAC,CAAC;AAEH,sDAAsD;AACtD,MAAM,eAAe,GAAG;IACtB,cAAc,EAAE,cAAc,EAAE,aAAa;IAC7C,cAAc,EAAE,cAAc;IAC9B,UAAU,EAAE,WAAW;IACvB,aAAa,EAAE,eAAe;CAC/B,CAAC;AAEF,uCAAuC;AACvC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;AAEpD,2DAA2D;AAC3D,MAAM,uBAAuB,GAAG;IAC9B,qBAAqB;IACrB,EAAE,OAAO,EAAE,+EAA+E,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE;IACpI,EAAE,OAAO,EAAE,mEAAmE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,EAAE;IAC1H,EAAE,OAAO,EAAE,kCAAkC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE;IACnG,qBAAqB;IACrB,EAAE,OAAO,EAAE,2DAA2D,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE;IACjH,6CAA6C;IAC7C,EAAE,OAAO,EAAE,qDAAqD,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,iBAAiB,EAAE;CAC/G,CAAC;AAEF,wDAAwD;AACxD,MAAM,mBAAmB,GAAgC;IACvD,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7F,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IACrF,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9E,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;CAChE,CAAC;AAYF,SAAS,eAAe,CAAC,OAAe,EAAE,QAAgB;IACxD,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,SAAS,IAAI,CAAC,GAAW,EAAE,KAAa;QACtC,IAAI,KAAK,GAAG,EAAE,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ;YAAE,OAAO;QACrD,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QAEnB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ;gBAAE,MAAM;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAE5C,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtD,IAAI,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC5B,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACvC,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBAClF,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACjB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,2BAA2B,CAAC,WAAqB,EAAE,WAAmB;IAC7E,MAAM,OAAO,GAAyB,EAAE,CAAC;IAEzC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;YAEtC,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACrE,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;oBAC1B,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;wBACvB,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;wBACxB,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;gBACtC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;gBACtC,WAAW;aACZ,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAaD,SAAS,yBAAyB,CAAC,GAAe;IAChD,MAAM,GAAG,GAAsB,EAAE,CAAC;IAElC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC;QAExC,uCAAuC;QACvC,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;YACpB,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;gBAC3B,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC/D,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC/E,CAAC;qBAAM,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACxD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,QAAQ,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBAClF,CAAC;qBAAM,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACjD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,QAAQ,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;gBACnD,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9F,CAAC;qBAAM,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjG,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,sBAAsB,CAAC,WAAmB,EAAE,QAAgB;IACnE,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAExD,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAErD,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,uBAAuB,EAAE,CAAC;gBAC/D,cAAc;gBACd,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;gBACtB,IAAI,KAA6B,CAAC;gBAClC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBAChD,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;oBAClE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,QAAgB;IAC3D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAE1E,SAAS,IAAI,CAAC,GAAW,EAAE,KAAa;QACtC,IAAI,KAAK,GAAG,EAAE,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ;YAAE,OAAO;QACrD,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QAEnB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ;gBAAE,MAAM;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAE5C,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtD,IAAI,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC5B,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBAC3D,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACjB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,SAAS,gBAAgB,CACvB,QAA8B,EAC9B,MAAyB,EACzB,WAAmB;IAEnB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,oDAAoD;IACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE3C,uCAAuC;IACvC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAC/B,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvE,2BAA2B;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEd,mCAAmC;QACnC,IAAI,QAAuB,CAAC;QAC5B,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC;YACZ,KAAK,WAAW;gBACd,QAAQ,GAAG,UAAU,CAAC;gBACtB,MAAM;YACR,KAAK,SAAS;gBACZ,QAAQ,GAAG,MAAM,CAAC;gBAClB,MAAM;YACR,KAAK,YAAY;gBACf,QAAQ,GAAG,QAAQ,CAAC;gBACpB,MAAM;YACR;gBACE,QAAQ,GAAG,KAAK,CAAC;QACrB,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,cAAc,EAAE,CAAC,IAAI,EAAE;YAC/B,QAAQ;YACR,OAAO,EAAE,cAAc,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,iCAAiC;YAC7G,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;YAC1C,IAAI,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;SAC/E,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAmB,EACnB,UAAgC,EAAE;IAElC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC;IAEzC,sCAAsC;IACtC,MAAM,WAAW,GAAG,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAEvE,wEAAwE;IACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,IAAI,MAAyB,CAAC;IAC9B,IAAI,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,sBAAsB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;IAED,qCAAqC;IACrC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAEjE,kBAAkB;IAClB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,SAAS,IAAI,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC;IAE1D,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK;QACL,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC"}
|
|
1
|
+
{"version":3,"file":"tool-poisoning.js","sourceRoot":"","sources":["../../../src/trust/passes/tool-poisoning.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAIL,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAkBrB,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa;IAC/D,QAAQ,EAAE,QAAQ,EAAE,UAAU;CAC/B,CAAC,CAAC;AAEH,sDAAsD;AACtD,MAAM,eAAe,GAAG;IACtB,cAAc,EAAE,cAAc,EAAE,aAAa;IAC7C,cAAc,EAAE,cAAc;IAC9B,UAAU,EAAE,WAAW;IACvB,aAAa,EAAE,eAAe;CAC/B,CAAC;AAEF,uCAAuC;AACvC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;AAEpD,2DAA2D;AAC3D,MAAM,uBAAuB,GAAG;IAC9B,qBAAqB;IACrB,EAAE,OAAO,EAAE,+EAA+E,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE;IACpI,EAAE,OAAO,EAAE,mEAAmE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,EAAE;IAC1H,EAAE,OAAO,EAAE,kCAAkC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE;IACnG,qBAAqB;IACrB,EAAE,OAAO,EAAE,2DAA2D,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE;IACjH,6CAA6C;IAC7C,EAAE,OAAO,EAAE,qDAAqD,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,iBAAiB,EAAE;CAC/G,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,yBAAyB,GAK1B;IACH;QACE,OAAO,EAAE,kFAAkF;QAC3F,MAAM,EAAE,sBAAsB;QAC9B,KAAK,EAAE,wBAAwB;QAC/B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,OAAO,EAAE,iHAAiH;QAC1H,MAAM,EAAE,uCAAuC;QAC/C,KAAK,EAAE,gCAAgC;QACvC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,OAAO,EAAE,8GAA8G;QACvH,MAAM,EAAE,8BAA8B;QACtC,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,OAAO,EAAE,6DAA6D;QACtE,MAAM,EAAE,0BAA0B;QAClC,KAAK,EAAE,8BAA8B;QACrC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,OAAO,EAAE,uKAAuK;QAChL,MAAM,EAAE,iCAAiC;QACzC,KAAK,EAAE,+BAA+B;QACtC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,OAAO,EAAE,qIAAqI;QAC9I,MAAM,EAAE,+BAA+B;QACvC,KAAK,EAAE,wBAAwB;QAC/B,QAAQ,EAAE,UAAU;KACrB;CACF,CAAC;AAEF,wDAAwD;AACxD,MAAM,mBAAmB,GAAgC;IACvD,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7F,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IACrF,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9E,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;CAChE,CAAC;AAYF,SAAS,eAAe,CAAC,OAAe,EAAE,QAAgB;IACxD,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,SAAS,IAAI,CAAC,GAAW,EAAE,KAAa;QACtC,IAAI,KAAK,GAAG,EAAE,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ;YAAE,OAAO;QACrD,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QAEnB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ;gBAAE,MAAM;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAE5C,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtD,IAAI,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC5B,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACvC,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBAClF,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACjB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,2BAA2B,CAAC,WAAqB,EAAE,WAAmB;IAC7E,MAAM,OAAO,GAAyB,EAAE,CAAC;IAEzC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;YAEtC,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACrE,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;oBAC1B,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;wBACvB,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;wBACxB,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;gBACtC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;gBACtC,WAAW;aACZ,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAaD,SAAS,yBAAyB,CAAC,GAAe;IAChD,MAAM,GAAG,GAAsB,EAAE,CAAC;IAElC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC;QAExC,uCAAuC;QACvC,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;YACpB,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;gBAC3B,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC/D,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC/E,CAAC;qBAAM,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACxD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,QAAQ,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBAClF,CAAC;qBAAM,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACjD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,QAAQ,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;gBACnD,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9F,CAAC;qBAAM,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjG,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,sBAAsB,CAAC,WAAmB,EAAE,QAAgB;IACnE,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAExD,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAErD,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,uBAAuB,EAAE,CAAC;gBAC/D,cAAc;gBACd,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;gBACtB,IAAI,KAA6B,CAAC;gBAClC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBAChD,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;oBAClE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,QAAgB;IAC3D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAE1E,SAAS,IAAI,CAAC,GAAW,EAAE,KAAa;QACtC,IAAI,KAAK,GAAG,EAAE,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ;YAAE,OAAO;QACrD,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QAEnB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ;gBAAE,MAAM;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAE5C,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtD,IAAI,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC5B,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBAC3D,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACjB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,SAAS,gBAAgB,CACvB,QAA8B,EAC9B,MAAyB,EACzB,WAAmB;IAEnB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,oDAAoD;IACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE3C,uCAAuC;IACvC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAC/B,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvE,2BAA2B;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEd,mCAAmC;QACnC,IAAI,QAAuB,CAAC;QAC5B,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC;YACZ,KAAK,WAAW;gBACd,QAAQ,GAAG,UAAU,CAAC;gBACtB,MAAM;YACR,KAAK,SAAS;gBACZ,QAAQ,GAAG,MAAM,CAAC;gBAClB,MAAM;YACR,KAAK,YAAY;gBACf,QAAQ,GAAG,QAAQ,CAAC;gBACpB,MAAM;YACR;gBACE,QAAQ,GAAG,KAAK,CAAC;QACrB,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,cAAc,EAAE,CAAC,IAAI,EAAE;YAC/B,QAAQ;YACR,OAAO,EAAE,cAAc,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,iCAAiC;YAC7G,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;YAC1C,IAAI,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;SAC/E,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,WAAqB,EAAE,WAAmB;IACxE,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAE7C,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,yBAAyB,EAAE,CAAC;YAC7E,wEAAwE;YACxE,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,CAAC;gBAAE,SAAS;YAEjB,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACvD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,IAAI,EAAE,CAAC;YAClC,CAAC;YAED,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,MAAM;gBACN,QAAQ;gBACR,OAAO,EAAE,sCAAsC,KAAK,oBAAoB,GAAG,IAAI,IAAI,+FAA+F;gBAClL,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE;gBAC7B,IAAI,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE;aACvD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAmB,EACnB,UAAgC,EAAE;IAElC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC;IAEzC,sCAAsC;IACtC,MAAM,WAAW,GAAG,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAEvE,wEAAwE;IACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,IAAI,MAAyB,CAAC;IAC9B,IAAI,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,sBAAsB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;IAED,qCAAqC;IACrC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAEjE,qEAAqE;IACrE,iEAAiE;IACjE,4CAA4C;IAC5C,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IAEnE,kBAAkB;IAClB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,SAAS,IAAI,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC;IAE1D,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK;QACL,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC"}
|
package/dist/trust/scoring.d.ts
CHANGED
|
@@ -11,6 +11,17 @@ export interface TrustScoringConfig {
|
|
|
11
11
|
weights: Record<TrustCategory, number>;
|
|
12
12
|
}
|
|
13
13
|
export declare const DEFAULT_SCORING_CONFIG: TrustScoringConfig;
|
|
14
|
+
/**
|
|
15
|
+
* cognium-ai#119 — intra-category pass weights. Within a category, passes
|
|
16
|
+
* average as a WEIGHTED mean (default weight 1). Actual vulnerability
|
|
17
|
+
* findings must not be one-vote-among-N maintainability passes: the LLM
|
|
18
|
+
* security scan carries a heavier weight so an LLM-discovered SQLi/RCE
|
|
19
|
+
* moves the aggregate meaningfully instead of washing out and rounding
|
|
20
|
+
* away. Tune here — higher = the security signal dominates code_security
|
|
21
|
+
* more. Unlisted passes default to 1 (byte-identical to the old simple
|
|
22
|
+
* average when no weighted pass is present).
|
|
23
|
+
*/
|
|
24
|
+
export declare const PASS_INTRA_CATEGORY_WEIGHT: Record<string, number>;
|
|
14
25
|
export declare const PASS_CATEGORY_MAP: Record<string, TrustCategory>;
|
|
15
26
|
/** Keys of the 12 score-component fields on TrustScoreResult. */
|
|
16
27
|
type ScoreComponent = 'vulnerability_score' | 'supply_chain_score' | 'exfiltration_score' | 'instruction_score' | 'permission_score' | 'secrets_score' | 'hygiene_score' | 'license_score' | 'compliance_score' | 'crypto_score' | 'poisoning_score' | 'provenance_score' | 'performance_score';
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAEtB,MAAM,YAAY,CAAC;AAMpB,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,eAAe,GACf,WAAW,GACX,YAAY,GACZ,WAAW,CAAC;AAMhB,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,eAAO,MAAM,sBAAsB,EAAE,kBAQpC,CAAC;
|
|
1
|
+
{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAEtB,MAAM,YAAY,CAAC;AAMpB,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,eAAe,GACf,WAAW,GACX,YAAY,GACZ,WAAW,CAAC;AAMhB,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,eAAO,MAAM,sBAAsB,EAAE,kBAQpC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAE7D,CAAC;AAUF,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CA0D3D,CAAC;AAMF,iEAAiE;AACjE,KAAK,cAAc,GACf,qBAAqB,GACrB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,kBAAkB,GAClB,eAAe,GACf,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,CAAC;AAExB,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAmC7D,CAAC;AAMF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAUtE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,eAAe,EAAE,EAC9B,MAAM,GAAE,kBAA2C,GAClD,gBAAgB,CA+GlB"}
|
package/dist/trust/scoring.js
CHANGED
|
@@ -15,6 +15,22 @@ export const DEFAULT_SCORING_CONFIG = {
|
|
|
15
15
|
artifacts: 0.0,
|
|
16
16
|
},
|
|
17
17
|
};
|
|
18
|
+
/**
|
|
19
|
+
* cognium-ai#119 — intra-category pass weights. Within a category, passes
|
|
20
|
+
* average as a WEIGHTED mean (default weight 1). Actual vulnerability
|
|
21
|
+
* findings must not be one-vote-among-N maintainability passes: the LLM
|
|
22
|
+
* security scan carries a heavier weight so an LLM-discovered SQLi/RCE
|
|
23
|
+
* moves the aggregate meaningfully instead of washing out and rounding
|
|
24
|
+
* away. Tune here — higher = the security signal dominates code_security
|
|
25
|
+
* more. Unlisted passes default to 1 (byte-identical to the old simple
|
|
26
|
+
* average when no weighted pass is present).
|
|
27
|
+
*/
|
|
28
|
+
export const PASS_INTRA_CATEGORY_WEIGHT = {
|
|
29
|
+
'llm-security-scan': 10,
|
|
30
|
+
};
|
|
31
|
+
function passWeight(pass) {
|
|
32
|
+
return PASS_INTRA_CATEGORY_WEIGHT[pass] ?? 1;
|
|
33
|
+
}
|
|
18
34
|
// ---------------------------------------------------------------------------
|
|
19
35
|
// Pass → Category mapping (all 16 passes)
|
|
20
36
|
// ---------------------------------------------------------------------------
|
|
@@ -28,6 +44,12 @@ export const PASS_CATEGORY_MAP = {
|
|
|
28
44
|
'data-exfiltration': 'code_security',
|
|
29
45
|
'input-validation': 'code_security',
|
|
30
46
|
'code-complexity': 'code_security',
|
|
47
|
+
// cognium-ai#119 — the synthetic LLM security pass (injected by
|
|
48
|
+
// `cognium-ai trust` when --llm is set) was in PASS_COMPONENT_MAP
|
|
49
|
+
// (display-only vulnerability_score) but NOT here, so computeTrustScore
|
|
50
|
+
// skipped it entirely and the aggregate ignored LLM-discovered vulns.
|
|
51
|
+
// Mapped to code_security + weighted (see PASS_INTRA_CATEGORY_WEIGHT).
|
|
52
|
+
'llm-security-scan': 'code_security',
|
|
31
53
|
// ai_safety
|
|
32
54
|
'prompt-injection': 'ai_safety',
|
|
33
55
|
'excessive-permissions': 'ai_safety',
|
|
@@ -128,6 +150,9 @@ export function validateScoringConfig(config) {
|
|
|
128
150
|
export function computeTrustScore(passResults, config = DEFAULT_SCORING_CONFIG) {
|
|
129
151
|
validateScoringConfig(config);
|
|
130
152
|
// -- Step 1 & 2: Category averages ----------------------------------------
|
|
153
|
+
// cognium-ai#119 — weighted accumulation per category (weight from
|
|
154
|
+
// PASS_INTRA_CATEGORY_WEIGHT, default 1). With all weights 1 this is
|
|
155
|
+
// byte-identical to the previous simple average.
|
|
131
156
|
const categoryScores = new Map();
|
|
132
157
|
for (const pr of passResults) {
|
|
133
158
|
const category = PASS_CATEGORY_MAP[pr.pass];
|
|
@@ -135,18 +160,19 @@ export function computeTrustScore(passResults, config = DEFAULT_SCORING_CONFIG)
|
|
|
135
160
|
// Unknown pass — skip silently so future passes don't break scoring
|
|
136
161
|
continue;
|
|
137
162
|
}
|
|
163
|
+
const w = passWeight(pr.pass);
|
|
138
164
|
const bucket = categoryScores.get(category);
|
|
139
165
|
if (bucket) {
|
|
140
|
-
bucket.
|
|
166
|
+
bucket.weightedSum += pr.score * w;
|
|
167
|
+
bucket.weightSum += w;
|
|
141
168
|
}
|
|
142
169
|
else {
|
|
143
|
-
categoryScores.set(category,
|
|
170
|
+
categoryScores.set(category, { weightedSum: pr.score * w, weightSum: w });
|
|
144
171
|
}
|
|
145
172
|
}
|
|
146
173
|
const categoryAverages = new Map();
|
|
147
|
-
for (const [cat,
|
|
148
|
-
|
|
149
|
-
categoryAverages.set(cat, avg);
|
|
174
|
+
for (const [cat, { weightedSum, weightSum }] of categoryScores) {
|
|
175
|
+
categoryAverages.set(cat, weightSum > 0 ? weightedSum / weightSum : 100);
|
|
150
176
|
}
|
|
151
177
|
// -- Step 3: Weighted composite score -------------------------------------
|
|
152
178
|
let compositeScore = 0;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scoring.js","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAGL,eAAe,GAChB,MAAM,YAAY,CAAC;AAqBpB,MAAM,CAAC,MAAM,sBAAsB,GAAuB;IACxD,OAAO,EAAE;QACP,YAAY,EAAE,GAAG;QACjB,aAAa,EAAE,GAAG;QAClB,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,GAAG;KACf;CACF,CAAC;AAEF,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAkC;IAC9D,eAAe;IACf,mBAAmB,EAAE,cAAc;IACnC,qBAAqB,EAAE,cAAc;IACrC,sBAAsB,EAAE,cAAc;IACtC,kBAAkB,EAAE,cAAc;IAElC,gBAAgB;IAChB,mBAAmB,EAAE,eAAe;IACpC,kBAAkB,EAAE,eAAe;IACnC,iBAAiB,EAAE,eAAe;
|
|
1
|
+
{"version":3,"file":"scoring.js","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAGL,eAAe,GAChB,MAAM,YAAY,CAAC;AAqBpB,MAAM,CAAC,MAAM,sBAAsB,GAAuB;IACxD,OAAO,EAAE;QACP,YAAY,EAAE,GAAG;QACjB,aAAa,EAAE,GAAG;QAClB,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,GAAG;KACf;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA2B;IAChE,mBAAmB,EAAE,EAAE;CACxB,CAAC;AAEF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAkC;IAC9D,eAAe;IACf,mBAAmB,EAAE,cAAc;IACnC,qBAAqB,EAAE,cAAc;IACrC,sBAAsB,EAAE,cAAc;IACtC,kBAAkB,EAAE,cAAc;IAElC,gBAAgB;IAChB,mBAAmB,EAAE,eAAe;IACpC,kBAAkB,EAAE,eAAe;IACnC,iBAAiB,EAAE,eAAe;IAClC,gEAAgE;IAChE,kEAAkE;IAClE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,mBAAmB,EAAE,eAAe;IAEpC,YAAY;IACZ,kBAAkB,EAAE,WAAW;IAC/B,uBAAuB,EAAE,WAAW;IACpC,iBAAiB,EAAE,WAAW;IAC9B,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;IAC7B,0BAA0B,EAAE,WAAW;IAEvC,aAAa;IACb,oBAAoB,EAAE,YAAY;IAClC,mBAAmB,EAAE,YAAY;IAEjC,yCAAyC;IACzC,oBAAoB,EAAE,eAAe;IACrC,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,eAAe;IACrC,6BAA6B,EAAE,eAAe;IAC9C,eAAe,EAAE,eAAe;IAEhC,qCAAqC;IACrC,sBAAsB,EAAE,eAAe;IACvC,sBAAsB,EAAE,eAAe;IACvC,gBAAgB,EAAE,eAAe;IACjC,oBAAoB,EAAE,eAAe;IAErC,kEAAkE;IAClE,mBAAmB,EAAE,eAAe;IACpC,cAAc,EAAE,eAAe;IAE/B,gEAAgE;IAChE,WAAW,EAAE,eAAe;IAC5B,mBAAmB,EAAE,eAAe;IAEpC,qDAAqD;IACrD,iBAAiB,EAAE,eAAe;IAElC,YAAY;IACZ,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;IAC7B,aAAa,EAAE,WAAW;CAC3B,CAAC;AAsBF,MAAM,CAAC,MAAM,kBAAkB,GAAmC;IAChE,kBAAkB,EAAE,qBAAqB;IACzC,qBAAqB,EAAE,oBAAoB;IAC3C,sBAAsB,EAAE,oBAAoB;IAC5C,kBAAkB,EAAE,oBAAoB;IACxC,mBAAmB,EAAE,oBAAoB;IACzC,kBAAkB,EAAE,mBAAmB;IACvC,uBAAuB,EAAE,kBAAkB;IAC3C,iBAAiB,EAAE,kBAAkB;IACrC,mBAAmB,EAAE,eAAe;IACpC,iBAAiB,EAAE,eAAe;IAClC,oBAAoB,EAAE,eAAe;IACrC,mBAAmB,EAAE,kBAAkB;IACvC,iBAAiB,EAAE,kBAAkB;IACrC,gBAAgB,EAAE,iBAAiB;IACnC,0BAA0B,EAAE,kBAAkB;IAC9C,oBAAoB,EAAE,eAAe;IACrC,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,eAAe;IACrC,6BAA6B,EAAE,eAAe;IAC9C,eAAe,EAAE,eAAe;IAChC,sBAAsB,EAAE,mBAAmB;IAC3C,sBAAsB,EAAE,mBAAmB;IAC3C,gBAAgB,EAAE,mBAAmB;IACrC,oBAAoB,EAAE,mBAAmB;IACzC,mBAAmB,EAAE,qBAAqB;IAC1C,0EAA0E;IAC1E,gEAAgE;IAChE,4DAA4D;IAC5D,mBAAmB,EAAE,qBAAqB;IAC1C,cAAc,EAAE,eAAe;IAC/B,WAAW,EAAE,eAAe;IAC5B,mBAAmB,EAAE,eAAe;IACpC,iBAAiB,EAAE,eAAe;IAClC,iDAAiD;CAClD,CAAC;AAEF,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;SACtB,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAElC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,kDAAkD,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAA8B,EAC9B,SAA6B,sBAAsB;IAEnD,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAE9B,4EAA4E;IAE5E,mEAAmE;IACnE,qEAAqE;IACrE,iDAAiD;IACjD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA6D,CAAC;IAE5F,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,oEAAoE;YACpE,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;YACnC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/D,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3E,CAAC;IAED,4EAA4E;IAE5E,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,MAAM,UAAU,GAAoB;QAClC,cAAc;QACd,eAAe;QACf,WAAW;QACX,YAAY;QACZ,WAAW;KACZ,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,CAAC;YAAE,SAAS;QAC3B,8DAA8D;QAC9D,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;QAC7C,cAAc,IAAI,GAAG,GAAG,MAAM,CAAC;IACjC,CAAC;IAED,iBAAiB;IACjB,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEpF,4EAA4E;IAE5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE7D,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAmB,EAAU,EAAE;QACnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,gBAAgB;QAChE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3D,CAAC,CAAC;IAEF,4EAA4E;IAE5E,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAC1C,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CACnD,CAAC;IAEF,MAAM,IAAI,GAAG,eAAe,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAE1D,4EAA4E;IAE5E,OAAO;QACL,KAAK,EAAE,cAAc;QACrB,IAAI;QAEJ,sBAAsB;QACtB,mBAAmB,EAAE,YAAY,CAAC,qBAAqB,CAAC;QACxD,kBAAkB,EAAE,YAAY,CAAC,oBAAoB,CAAC;QACtD,kBAAkB,EAAE,YAAY,CAAC,oBAAoB,CAAC;QACtD,iBAAiB,EAAE,YAAY,CAAC,mBAAmB,CAAC;QACpD,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,YAAY,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,oBAAoB;QAChE,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,eAAe,EAAE,YAAY,CAAC,iBAAiB,CAAC;QAChD,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,iBAAiB,EAAE,YAAY,CAAC,mBAAmB,CAAC;QAEpD,6CAA6C;QAC7C,mBAAmB,EAAE,GAAG;QACxB,YAAY,EAAE,GAAG;QACjB,gBAAgB,EAAE,GAAG;QAErB,WAAW;QACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "circle-ir-ai",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.39.0",
|
|
4
4
|
"description": "LLM-enhanced SAST analysis built on circle-ir",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.js",
|
|
@@ -97,7 +97,7 @@
|
|
|
97
97
|
"@ax-llm/ax": "^20.0.0",
|
|
98
98
|
"@cognium/project-profile-detect": "^1.1.0",
|
|
99
99
|
"@mastra/core": "^1.18.0",
|
|
100
|
-
"circle-ir": "3.
|
|
100
|
+
"circle-ir": "3.164.0",
|
|
101
101
|
"minimatch": "^10.2.5",
|
|
102
102
|
"p-queue": "^9.1.0"
|
|
103
103
|
},
|