codehere 0.2.2 → 0.3.0-rc.10

package/dist/infrastructure/governance/nist-ai-rmf.js

@@ -1,292 +0,0 @@
-/**
- * INTERNAL ONLY — infrastructure helper, not a user-facing feature.
- *
- * NIST AI Risk Management Framework (AI RMF) - Infrastructure-only, not yet exposed as user-facing feature.
- * Planned for 0.5.x (Teams & Governance). Not guaranteed to be stable.
- *
- * Do not rely on this directly.
- *
- * @internal
- */
-/**
- * NIST AI RMF Framework
- * Implements 4 core functions for enterprise AI governance
- */
-export class NISTAIRMF {
-    decisions = [];
-    /**
-     * GOVERN Function: Risk culture, accountability, lifecycle management
-     * Establishes organizational context for AI risk management
-     */
-    async govern(context) {
-        const decisionId = `govern-${Date.now()}`;
-        // Govern: Risk culture assessment
-        const riskCulture = this.assessRiskCulture(context);
-        // Govern: Accountability assignment
-        const accountability = this.assignAccountability(context);
-        // Govern: Lifecycle management planning
-        const lifecycle = this.planLifecycle(context);
-        const decision = {
-            decisionId,
-            timestamp: Date.now(),
-            function: 'govern',
-            decision: `Risk culture: ${riskCulture.level}, Accountability: ${accountability.role}, Lifecycle: ${lifecycle.phase}`,
-            rationale: `Governed ${context.contextType} operation with ${context.riskLevel} risk level`,
-            outcome: riskCulture.level === 'critical' ? 'requires_review' : 'allowed',
-        };
-        this.decisions.push(decision);
-        return decision;
-    }
-    /**
-     * MAP Function: Context framing, risk identification
-     * Identifies and characterizes risks in specific contexts
-     */
-    async map(context, existingRiskProfile) {
-        const decisionId = `map-${Date.now()}`;
-        // Map: Context framing
-        const contextFrame = this.frameContext(context);
-        // Map: Risk identification
-        const riskProfile = existingRiskProfile || {
-            security: {
-                vulnerabilities: 0,
-                licenseConflicts: 0,
-                providerBias: false,
-                uncertainty: 0.5,
-            },
-            compliance: {
-                gdprRelevant: context.regulatoryRelevant,
-                hipaaRelevant: context.targetDomain === 'healthcare',
-            },
-            operational: {
-                complexity: context.riskLevel === 'critical' ? 0.9 : 0.5,
-                dependencies: 0,
-            },
-        };
-        // Map: Risk characterization
-        const risks = this.characterizeRisks(riskProfile, context);
-        const decision = {
-            decisionId,
-            timestamp: Date.now(),
-            function: 'map',
-            decision: `Mapped ${risks.length} risks in ${context.contextType} context`,
-            rationale: risks.map(r => r.description).join('; '),
-            riskProfile,
-            outcome: risks.some(r => r.severity === 'critical') ? 'requires_review' : 'allowed',
-        };
-        this.decisions.push(decision);
-        return { decision, riskProfile };
-    }
-    /**
-     * MEASURE Function: SAST/SCA mandatory, security density tracking
-     * Quantifies and monitors AI risks and performance
-     */
-    async measure(riskProfile, metrics) {
-        const decisionId = `measure-${Date.now()}`;
-        // Measure: SAST/SCA metrics (mandatory)
-        const securityMetrics = {
-            vulnerabilities: metrics.sastFindings || 0,
-            licenseConflicts: metrics.licenseFindings || 0,
-            providerBias: (metrics.providerBiasFindings || 0) > 0,
-            uncertainty: metrics.uncertaintyScore || riskProfile.security.uncertainty,
-        };
-        // Measure: Security density tracking (language-specific thresholds)
-        const securityDensity = metrics.securityDensity || 0;
-        const densityThreshold = this.getSecurityDensityThreshold(riskProfile);
-        // Measure: Test coverage tracking
-        const testCoverage = metrics.testCoverage || riskProfile.operational.testCoverage || 0;
-        const updatedRiskProfile = {
-            ...riskProfile,
-            security: securityMetrics,
-            operational: {
-                ...riskProfile.operational,
-                testCoverage,
-            },
-        };
-        const decision = {
-            decisionId,
-            timestamp: Date.now(),
-            function: 'measure',
-            decision: `Measured: ${securityMetrics.vulnerabilities} vulnerabilities, ${securityMetrics.licenseConflicts} license conflicts, security density: ${securityDensity.toFixed(2)}, test coverage: ${testCoverage.toFixed(1)}%`,
-            rationale: `SAST/SCA metrics collected. Security density ${securityDensity > densityThreshold ? 'EXCEEDS' : 'within'} threshold (${densityThreshold}). Test coverage ${testCoverage < 80 ? 'BELOW' : 'meets'} target (80%)`,
-            riskProfile: updatedRiskProfile,
-            outcome: securityMetrics.vulnerabilities > 0 || securityMetrics.licenseConflicts > 0 || testCoverage < 50 ? 'requires_review' : 'allowed',
-        };
-        this.decisions.push(decision);
-        return decision;
-    }
-    /**
-     * MANAGE Function: Incident response, continuous updates
-     * Responds to and manages AI risks over time
-     */
-    async manage(incident, action) {
-        const decisionId = `manage-${Date.now()}`;
-        // Manage: Incident response
-        const response = this.respondToIncident(incident, action);
-        // Manage: Continuous update planning
-        const updates = this.planContinuousUpdates(incident);
-        const decision = {
-            decisionId,
-            timestamp: Date.now(),
-            function: 'manage',
-            decision: `${action.toUpperCase()}: ${incident.type} incident (${incident.severity})`,
-            rationale: `${response.description}. Continuous updates: ${updates.map(u => u.action).join(', ')}`,
-            outcome: action === 'accept' || action === 'transfer' ? 'allowed' : action === 'avoid' ? 'blocked' : 'requires_review',
-        };
-        this.decisions.push(decision);
-        return decision;
-    }
-    /**
-     * Get governance history for audit
-     */
-    getGovernanceHistory(filter) {
-        let filtered = [...this.decisions];
-        if (filter?.function) {
-            filtered = filtered.filter(d => d.function === filter.function);
-        }
-        if (filter?.outcome) {
-            filtered = filtered.filter(d => d.outcome === filter.outcome);
-        }
-        if (filter?.startTime) {
-            filtered = filtered.filter(d => d.timestamp >= filter.startTime);
-        }
-        if (filter?.endTime) {
-            filtered = filtered.filter(d => d.timestamp <= filter.endTime);
-        }
-        return filtered.sort((a, b) => b.timestamp - a.timestamp);
-    }
-    // Private helper methods
-    assessRiskCulture(context) {
-        const factors = [];
-        let level = 'low';
-        if (context.riskLevel === 'critical') {
-            level = 'critical';
-            factors.push('Critical risk level detected');
-        }
-        else if (context.regulatoryRelevant) {
-            level = 'high';
-            factors.push('Regulatory relevance (GDPR/HIPAA)');
-        }
-        else if (context.riskLevel === 'high') {
-            level = 'high';
-            factors.push('High risk level');
-        }
-        else {
-            level = context.riskLevel;
-        }
-        return { level, factors };
-    }
-    assignAccountability(context) {
-        // Accountability assignment based on risk level
-        if (context.riskLevel === 'critical') {
-            return { role: 'senior_engineer_review', responsible: 'Senior Engineer + Security Team' };
-        }
-        else if (context.riskLevel === 'high') {
-            return { role: 'engineer_review', responsible: 'Engineering Lead' };
-        }
-        else {
-            return { role: 'automated', responsible: 'AI System' };
-        }
-    }
-    planLifecycle(context) {
-        const stages = ['Development', 'Testing', 'Deployment', 'Monitoring', 'Retirement'];
-        return {
-            phase: 'Development',
-            stages,
-        };
-    }
-    frameContext(context) {
-        const constraints = [];
-        if (context.regulatoryRelevant) {
-            constraints.push('Regulatory compliance required');
-        }
-        if (context.riskLevel === 'critical') {
-            constraints.push('Critical risk - human review mandatory');
-        }
-        return {
-            domain: context.targetDomain,
-            constraints,
-        };
-    }
-    characterizeRisks(riskProfile, context) {
-        const risks = [];
-        if (riskProfile.security.vulnerabilities > 0) {
-            risks.push({
-                type: 'security',
-                severity: riskProfile.security.vulnerabilities > 5 ? 'critical' : 'high',
-                description: `${riskProfile.security.vulnerabilities} security vulnerabilities detected`,
-            });
-        }
-        if (riskProfile.security.licenseConflicts > 0) {
-            risks.push({
-                type: 'compliance',
-                severity: 'critical',
-                description: `${riskProfile.security.licenseConflicts} license conflicts detected (35% contamination risk)`,
-            });
-        }
-        if (riskProfile.security.providerBias) {
-            risks.push({
-                type: 'operational',
-                severity: 'medium',
-                description: 'Provider bias detected - vendor lock-in risk',
-            });
-        }
-        if (riskProfile.security.uncertainty > 0.7) {
-            risks.push({
-                type: 'reliability',
-                severity: 'high',
-                description: `High epistemic uncertainty (${(riskProfile.security.uncertainty * 100).toFixed(1)}%) - hallucination risk`,
-            });
-        }
-        if (riskProfile.compliance.gdprRelevant || riskProfile.compliance.hipaaRelevant) {
-            risks.push({
-                type: 'compliance',
-                severity: 'high',
-                description: 'Regulatory compliance requirements (GDPR/HIPAA)',
-            });
-        }
-        return risks;
-    }
-    getSecurityDensityThreshold(riskProfile) {
-        // Language-specific thresholds (LOC per CWE)
-        // Research: Security density tracking with language-specific thresholds
-        return 1000; // Default: 1 CWE per 1000 LOC
-    }
-    respondToIncident(incident, action) {
-        const steps = [];
-        if (action === 'mitigate') {
-            steps.push('Identify root cause');
-            steps.push('Implement fix');
-            steps.push('Verify resolution');
-            steps.push('Update risk profile');
-        }
-        else if (action === 'accept') {
-            steps.push('Document acceptance rationale');
-            steps.push('Monitor for escalation');
-        }
-        else if (action === 'avoid') {
-            steps.push('Block operation');
-            steps.push('Notify stakeholders');
-        }
-        else if (action === 'transfer') {
-            steps.push('Assign to responsible party');
-            steps.push('Track resolution');
-        }
-        return {
-            description: `${action.toUpperCase()} action for ${incident.severity} ${incident.type} incident`,
-            steps,
-        };
-    }
-    planContinuousUpdates(incident) {
-        const updates = [];
-        if (incident.severity === 'critical') {
-            updates.push({ action: 'Update risk models', priority: 'high' });
-            updates.push({ action: 'Enhance detection rules', priority: 'high' });
-        }
-        else {
-            updates.push({ action: 'Monitor similar incidents', priority: 'medium' });
-        }
-        updates.push({ action: 'Review governance policies', priority: 'low' });
-        return updates;
-    }
-}
-//# sourceMappingURL=nist-ai-rmf.js.map

package/dist/infrastructure/governance/policy-as-code.js

@@ -1,258 +0,0 @@
-/**
- * INTERNAL ONLY — infrastructure helper, not a user-facing feature.
- *
- * Policy-as-Code (PaC) Framework - Infrastructure-only, not yet exposed as user-facing feature.
- * Planned for 0.5.x (Teams & Governance). Not guaranteed to be stable.
- *
- * Do not rely on this directly.
- *
- * @internal
- */
-/**
- * Policy-as-Code Framework
- * Enforces policies automatically based on code-defined rules
- */
-export class PolicyAsCode {
-    policies = new Map();
-    defaultPolicies = [];
-    constructor() {
-        this.initializeDefaultPolicies();
-    }
-    /**
-     * Load policy from code definition
-     */
-    loadPolicy(rule) {
-        this.policies.set(rule.id, rule);
-        this.defaultPolicies.push(rule);
-    }
-    /**
-     * Evaluate policies against context
-     */
-    async evaluate(context) {
-        const results = [];
-        const blockingRules = [];
-        // Evaluate all enabled policies
-        for (const [ruleId, rule] of this.policies.entries()) {
-            if (!rule.enabled)
-                continue;
-            const result = await this.evaluateRule(rule, context);
-            results.push(result);
-            if (!result.passed && (result.action === 'block' || result.action === 'require_review')) {
-                blockingRules.push(result);
-            }
-        }
-        const passed = blockingRules.length === 0;
-        return {
-            passed,
-            results,
-            blockingRules,
-        };
-    }
-    /**
-     * Get all policies
-     */
-    getPolicies() {
-        return Array.from(this.policies.values());
-    }
-    /**
-     * Enable/disable policy
-     */
-    setPolicyEnabled(ruleId, enabled) {
-        const rule = this.policies.get(ruleId);
-        if (!rule)
-            return false;
-        rule.enabled = enabled;
-        rule.updatedAt = Date.now();
-        return true;
-    }
-    /**
-     * Update policy
-     */
-    updatePolicy(ruleId, updates) {
-        const rule = this.policies.get(ruleId);
-        if (!rule)
-            return false;
-        Object.assign(rule, updates);
-        rule.updatedAt = Date.now();
-        rule.version = this.incrementVersion(rule.version);
-        return true;
-    }
-    // Private methods
-    async evaluateRule(rule, context) {
-        // Evaluate all conditions (AND logic - all must pass)
-        let passed = true;
-        const evidence = {};
-        for (const condition of rule.conditions) {
-            const conditionResult = this.evaluateCondition(condition, context);
-            // Debug logging
-            if (process.env.CODEHERE_DEBUG === '1')
-                console.log(`[PolicyAsCode] Evaluating condition: ${condition.type} ${condition.operator} ${condition.value}, actual: ${conditionResult.actual}, condition met: ${conditionResult.passed}`);
-            // CRITICAL FIX: Policy conditions are "blocking conditions"
-            // If condition is met (passed = true), it means we SHOULD block → policy FAILS
-            // If condition is NOT met (passed = false), it means we should NOT block → policy PASSES
-            // So: conditionResult.passed = true → should block → policy fails
-            //     conditionResult.passed = false → should not block → policy passes
-            if (conditionResult.passed) {
-                passed = false; // Condition met → should block → policy fails
-            }
-            evidence[condition.field] = {
-                expected: condition.value,
-                actual: conditionResult.actual,
-                passed: conditionResult.passed,
-                note: conditionResult.passed ? 'Condition met - blocking' : 'Condition not met - allowing',
-            };
-        }
-        return {
-            ruleId: rule.id,
-            ruleName: rule.name,
-            passed,
-            severity: rule.severity,
-            action: rule.action,
-            message: passed
-                ? `Policy "${rule.name}" passed`
-                : `Policy "${rule.name}" failed: ${rule.description}`,
-            evidence,
-        };
-    }
-    evaluateCondition(condition, context) {
-        let actual;
-        // Get actual value from context based on condition type
-        switch (condition.type) {
-            case 'security':
-                // Only count critical and high severity findings for policy evaluation
-                // This reduces false positives from medium/low severity findings
-                const securityFindings = context.securityFindings || [];
-                actual = securityFindings.filter((f) => f.severity === 'critical' || f.severity === 'high').length;
-                break;
-            case 'license':
-                actual = context.licenseFindings?.length || 0;
-                break;
-            case 'provider_bias':
-                actual = (context.providerBiasFindings?.length || 0) > 0;
-                break;
-            case 'uncertainty':
-                actual = context.uncertainty?.epistemic?.value || 0;
-                break;
-            case 'test_coverage':
-                actual = context.testCoverage || 0;
-                break;
-            default:
-                actual = context.metadata?.[condition.field] || null;
-        }
-        // Evaluate condition based on operator
-        let passed = false;
-        switch (condition.operator) {
-            case 'equals':
-                passed = actual === condition.value;
-                break;
-            case 'greater_than':
-                passed = actual > condition.value;
-                break;
-            case 'less_than':
-                passed = actual < condition.value;
-                break;
-            case 'contains':
-                passed = String(actual).includes(String(condition.value));
-                break;
-            case 'not_contains':
-                passed = !String(actual).includes(String(condition.value));
-                break;
-            case 'exists':
-                passed = actual !== null && actual !== undefined;
-                break;
-        }
-        return { passed, actual };
-    }
-    initializeDefaultPolicies() {
-        // Default Policy 1: Block critical security vulnerabilities
-        // Policy semantics: Block if critical vulnerabilities > 0
-        // Condition: greater_than with value 0 means "if actual > 0, block"
-        // So: actual = 0 → 0 > 0 = false → condition NOT met → should NOT block → policy PASSES
-        //     actual > 0 → actual > 0 = true → condition met → should block → policy FAILS
-        this.loadPolicy({
-            id: 'security-critical-block',
-            name: 'Block Critical Security Vulnerabilities',
-            description: 'Block code with critical security vulnerabilities',
-            severity: 'critical',
-            action: 'block',
-            enabled: true,
-            conditions: [
-                {
-                    type: 'security',
-                    operator: 'greater_than',
-                    field: 'critical_vulnerabilities',
-                    value: 0,
-                },
-            ],
-            version: '1.0.0',
-            createdAt: Date.now(),
-            updatedAt: Date.now(),
-        });
-        // Default Policy 2: Block license conflicts
-        this.loadPolicy({
-            id: 'license-conflict-block',
-            name: 'Block License Conflicts',
-            description: 'Block code with license conflicts (GPL/MIT contamination)',
-            severity: 'critical',
-            action: 'block',
-            enabled: true,
-            conditions: [
-                {
-                    type: 'license',
-                    operator: 'greater_than',
-                    field: 'license_conflicts',
-                    value: 0,
-                },
-            ],
-            version: '1.0.0',
-            createdAt: Date.now(),
-            updatedAt: Date.now(),
-        });
-        // Default Policy 3: Warn on high uncertainty
-        this.loadPolicy({
-            id: 'uncertainty-high-warn',
-            name: 'Warn on High Uncertainty',
-            description: 'Warn when epistemic uncertainty exceeds threshold (hallucination risk)',
-            severity: 'high',
-            action: 'warn',
-            enabled: true,
-            conditions: [
-                {
-                    type: 'uncertainty',
-                    operator: 'greater_than',
-                    field: 'epistemic_uncertainty',
-                    value: 0.7,
-                },
-            ],
-            version: '1.0.0',
-            createdAt: Date.now(),
-            updatedAt: Date.now(),
-        });
-        // Default Policy 4: Require review for provider bias
-        this.loadPolicy({
-            id: 'provider-bias-review',
-            name: 'Review Provider Bias',
-            description: 'Require review when provider bias is detected (vendor lock-in risk)',
-            severity: 'medium',
-            action: 'require_review',
-            enabled: true,
-            conditions: [
-                {
-                    type: 'provider_bias',
-                    operator: 'equals',
-                    field: 'has_provider_bias',
-                    value: true,
-                },
-            ],
-            version: '1.0.0',
-            createdAt: Date.now(),
-            updatedAt: Date.now(),
-        });
-    }
-    incrementVersion(version) {
-        const parts = version.split('.');
-        const patch = parseInt(parts[2] || '0', 10) + 1;
-        return `${parts[0]}.${parts[1]}.${patch}`;
-    }
-}
-//# sourceMappingURL=policy-as-code.js.map