create-genia-os 2.4.0 → 3.0.0

package/template/.aiox-core/development/scripts/security-checker.js

@@ -0,0 +1,359 @@
+/**
+ * Security Checker for AIOX Developer Meta-Agent
+ * Validates generated code and configurations for security vulnerabilities
+ */
+
+const path = require('path');
+const yaml = require('js-yaml');
+
+class SecurityChecker {
+  constructor() {
+    // Patterns that indicate potential security issues
+    this.dangerousPatterns = [
+      /eval\s*\(/gi,
+      /Function\s*\(/gi,
+      /new\s+Function/gi,
+      /setTimeout\s*\([^,]+,/gi,
+      /setInterval\s*\([^,]+,/gi,
+      /require\s*\([^'"]/gi, // Dynamic require
+      /import\s*\(/gi, // Dynamic import
+      /child_process/gi,
+      /exec\s*\(/gi,
+      /spawn\s*\(/gi,
+      /\.\.\/\.\.\//g, // Path traversal
+      /process\.env/gi,
+      /__dirname/gi,
+      /__filename/gi,
+    ];
+
+    // SQL injection patterns
+    this.sqlInjectionPatterns = [
+      /;\s*DROP\s+TABLE/gi,
+      /;\s*DELETE\s+FROM/gi,
+      /UNION\s+SELECT/gi,
+      /OR\s+1\s*=\s*1/gi,
+      /'\s+OR\s+'/gi,
+    ];
+
+    // Command injection patterns
+    this.commandInjectionPatterns = [
+      /[;&|`$()]/g,
+      /\$\{.*\}/g,
+      />|</g,
+    ];
+
+    // Safe patterns that should be allowed
+    this.safePatterns = {
+      'eval': [
+        /\/\*.*eval.*\*\//gs, // eval in comments
+        /\/\/.*eval/g, // eval in single-line comments
+        /".*eval.*"/g, // eval in strings
+        /'.*eval.*'/g,
+      ]
+    };
+  }
+
+  /**
+   * Validate generated code for security vulnerabilities
+   * @param {string} code - The code to validate
+   * @param {string} [language='javascript'] - The programming language
+   * @returns {Object} Validation results with valid flag, errors, warnings, and suggestions
+   */
+  validateCode(code, language = 'javascript') {
+    const results = {
+      valid: true,
+      errors: [],
+      warnings: [],
+      suggestions: []
+    };
+
+    // Validate input
+    if (!code || typeof code !== 'string') {
+      results.valid = false;
+      results.errors.push({
+        type: 'invalid_input',
+        message: 'Code must be a non-empty string'
+      });
+      return results;
+    }
+
+    // Check for dangerous patterns
+    for (const pattern of this.dangerousPatterns) {
+      const matches = code.match(pattern);
+      if (matches) {
+        // Check if it's in a safe context
+        let isSafe = false;
+        const patternName = pattern.source.split('\\')[0];
+        
+        if (this.safePatterns[patternName]) {
+          for (const safePattern of this.safePatterns[patternName]) {
+            if (code.match(safePattern)) {
+              isSafe = true;
+              break;
+            }
+          }
+        }
+
+        if (!isSafe) {
+          results.valid = false;
+          results.errors.push({
+            type: 'dangerous_pattern',
+            pattern: pattern.source,
+            matches: matches,
+            message: `Dangerous pattern detected: ${matches[0]}`,
+            line: this._getLineNumber(code, matches.index)
+          });
+        }
+      }
+    }
+
+    // Check for SQL injection (if applicable)
+    if (code.includes('SELECT') || code.includes('INSERT') || code.includes('UPDATE')) {
+      for (const pattern of this.sqlInjectionPatterns) {
+        if (pattern.test(code)) {
+          results.valid = false;
+          results.errors.push({
+            type: 'sql_injection',
+            pattern: pattern.source,
+            message: 'Potential SQL injection vulnerability detected'
+          });
+        }
+      }
+    }
+
+    // Validate input sanitization
+    if (code.includes('req.body') || code.includes('req.query') || code.includes('req.params')) {
+      if (!code.includes('sanitize') && !code.includes('validate') && !code.includes('escape')) {
+        results.warnings.push({
+          type: 'input_validation',
+          message: 'User input detected without explicit sanitization'
+        });
+      }
+    }
+
+    return results;
+  }
+
+  /**
+   * Validate YAML configuration for security issues
+   */
+  validateYAML(yamlContent) {
+    const results = {
+      valid: true,
+      errors: [],
+      warnings: []
+    };
+
+    try {
+      const parsed = yaml.load(yamlContent);
+      
+      // Check for dangerous YAML features
+      if (yamlContent.includes('!!') && !yamlContent.includes('!!str')) {
+        results.warnings.push({
+          type: 'yaml_tags',
+          message: 'YAML tags detected - ensure they are safe'
+        });
+      }
+
+      // Validate structure
+      this.validateYAMLStructure(parsed, results);
+      
+    } catch (error) {
+      results.valid = false;
+      results.errors.push({
+        type: 'yaml_parse',
+        message: `YAML parsing error: ${error.message}`
+      });
+    }
+
+    return results;
+  }
+
+  /**
+   * Validate YAML structure recursively
+   */
+  validateYAMLStructure(obj, results, path = '') {
+    if (typeof obj === 'object' && obj !== null) {
+      for (const [key, value] of Object.entries(obj)) {
+        const currentPath = path ? `${path}.${key}` : key;
+        
+        // Check for command injection in string values
+        if (typeof value === 'string') {
+          for (const pattern of this.commandInjectionPatterns) {
+            if (pattern.test(_value) && !this.isSafeCommandContext(key, value)) {
+              results.warnings.push({
+                type: 'command_injection',
+                path: currentPath,
+                message: `Potential command injection in ${currentPath}`
+              });
+            }
+          }
+        }
+        
+        // Recurse for nested objects
+        if (typeof value === 'object') {
+          this.validateYAMLStructure(_value, results, currentPath);
+        }
+      }
+    }
+  }
+
+  /**
+   * Check if command-like string is in safe context
+   */
+  isSafeCommandContext(key, value) {
+    const safeKeys = ['description', 'comment', 'note', 'help', 'usage'];
+    return safeKeys.some(safe => key.toLowerCase().includes(safe));
+  }
+
+  /**
+   * Validate file paths for security issues
+   */
+  validatePath(filePath) {
+    const results = {
+      valid: true,
+      errors: []
+    };
+
+    // Normalize the path
+    const normalized = path.normalize(filePath);
+
+    // Check for path traversal
+    if (normalized.includes('..')) {
+      results.valid = false;
+      results.errors.push({
+        type: 'path_traversal',
+        message: 'Path traversal detected'
+      });
+    }
+
+    // Check for absolute paths (unless allowed)
+    if (path.isAbsolute(normalized)) {
+      results.errors.push({
+        type: 'absolute_path',
+        message: 'Absolute path detected - use relative paths'
+      });
+    }
+
+    // Check for sensitive directories
+    const sensitivePatterns = [
+      /node_modules/i,
+      /\.git/i,
+      /\.env/i,
+      /private/i,
+      /secret/i,
+      /config/i,
+    ];
+
+    for (const pattern of sensitivePatterns) {
+      if (pattern.test(normalized)) {
+        results.warnings = results.warnings || [];
+        results.warnings.push({
+          type: 'sensitive_path',
+          message: `Path contains potentially sensitive directory: ${pattern.source}`
+        });
+      }
+    }
+
+    return results;
+  }
+
+  /**
+   * Validate user input for common security issues
+   */
+  sanitizeInput(input, type = 'general') {
+    if (typeof input !== 'string') {
+      return input;
+    }
+
+    let sanitized = input;
+
+    // Remove null bytes
+    sanitized = sanitized.replace(/\0/g, '');
+
+    // Type-specific sanitization
+    switch (type) {
+      case 'filename':
+        // Allow only alphanumeric, dash, underscore, and dot
+        sanitized = sanitized.replace(/[^a-zA-Z0-9\-_\.]/g, '');
+        break;
+      
+      case 'identifier':
+        // Allow only alphanumeric, dash, and underscore
+        sanitized = sanitized.replace(/[^a-zA-Z0-9\-_]/g, '');
+        break;
+      
+      case 'yaml':
+        // Escape special YAML characters
+        sanitized = sanitized
+          .replace(/:/g, '\\:')
+          .replace(/\|/g, '\\|')
+          .replace(/>/g, '\\>')
+          .replace(/</g, '\\<');
+        break;
+      
+      case 'general':
+      default:
+        // Basic HTML/script escaping
+        sanitized = sanitized
+          .replace(/&/g, '&amp;')
+          .replace(/</g, '&lt;')
+          .replace(/>/g, '&gt;')
+          .replace(/"/g, '&quot;')
+          .replace(/'/g, '&#x27;')
+          .replace(/\//g, '&#x2F;');
+    }
+
+    return sanitized;
+  }
+
+  /**
+   * Generate security report
+   * @param {Array} validations - Array of validation results
+   * @returns {Object} Comprehensive security report
+   */
+  generateReport(validations) {
+    const report = {
+      timestamp: new Date().toISOString(),
+      summary: {
+        totalChecks: 0,
+        passed: 0,
+        failed: 0,
+        warnings: 0
+      },
+      details: validations
+    };
+
+    // Calculate summary
+    for (const validation of validations) {
+      report.summary.totalChecks++;
+      if (validation.valid) {
+        report.summary.passed++;
+      } else {
+        report.summary.failed++;
+      }
+      report.summary.warnings += (validation.warnings || []).length;
+    }
+
+    report.summary.securityScore = Math.round(
+      (report.summary.passed / report.summary.totalChecks) * 100
+    );
+
+    return report;
+  }
+
+  /**
+   * Get line number from string index
+   * @private
+   * @param {string} text - The text to search
+   * @param {number} index - Character index
+   * @returns {number} Line number (1-based)
+   */
+  _getLineNumber(text, index) {
+    if (!text || index === undefined) return null;
+    const lines = text.substring(0, index).split('\n');
+    return lines.length;
+  }
+}
+
+module.exports = SecurityChecker;

package/template/.aiox-core/development/scripts/skill-validator.js

@@ -0,0 +1,341 @@
+/**
+ * AIOX Skill Validator
+ * Story GEMINI-INT.5 - Skills Cross-CLI Compatibility
+ *
+ * Validates that AIOX agent skills work correctly in both
+ * Claude Code and Gemini CLI environments.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const yaml = require('js-yaml');
+
+/**
+ * Skill Validator - Ensures cross-CLI compatibility
+ */
+class SkillValidator {
+  constructor(config = {}) {
+    this.agentsDir = config.agentsDir || path.join(process.cwd(), '.aiox-core', 'development', 'agents');
+    this.tasksDir = config.tasksDir || path.join(process.cwd(), '.aiox-core', 'development', 'tasks');
+    this.errors = [];
+    this.warnings = [];
+  }
+
+  /**
+   * Validate all agent skills
+   * @returns {Object} Validation result
+   */
+  async validateAll() {
+    this.errors = [];
+    this.warnings = [];
+
+    const results = {
+      agents: [],
+      tasks: [],
+      compatible: true,
+      errors: [],
+      warnings: [],
+    };
+
+    // Validate agents
+    const agentFiles = this.getMarkdownFiles(this.agentsDir);
+    for (const file of agentFiles) {
+      const result = await this.validateAgentSkill(file);
+      results.agents.push(result);
+      if (!result.valid) results.compatible = false;
+    }
+
+    // Validate tasks
+    const taskFiles = this.getMarkdownFiles(this.tasksDir);
+    for (const file of taskFiles) {
+      const result = await this.validateTask(file);
+      results.tasks.push(result);
+      if (!result.valid) results.compatible = false;
+    }
+
+    results.errors = this.errors;
+    results.warnings = this.warnings;
+
+    return results;
+  }
+
+  /**
+   * Validate a single agent skill file
+   * @param {string} filePath - Path to agent file
+   * @returns {Object} Validation result
+   */
+  async validateAgentSkill(filePath) {
+    const result = {
+      file: path.basename(filePath),
+      path: filePath,
+      valid: true,
+      claudeCompatible: true,
+      geminiCompatible: true,
+      errors: [],
+      warnings: [],
+    };
+
+    try {
+      const content = fs.readFileSync(filePath, 'utf8');
+
+      // Extract YAML frontmatter
+      const yamlMatch = content.match(/```yaml\n([\s\S]*?)```/);
+      if (!yamlMatch) {
+        result.errors.push('No YAML block found');
+        result.valid = false;
+        this.errors.push(`${result.file}: No YAML block found`);
+        return result;
+      }
+
+      const agentDef = yaml.load(yamlMatch[1]);
+
+      // Required fields for both CLIs
+      const requiredFields = ['agent.name', 'agent.id', 'agent.title'];
+      for (const field of requiredFields) {
+        if (!this.getNestedValue(agentDef, field)) {
+          result.errors.push(`Missing required field: ${field}`);
+          result.valid = false;
+        }
+      }
+
+      // Check commands format (both CLIs support * prefix)
+      if (agentDef.commands) {
+        if (!Array.isArray(agentDef.commands)) {
+          result.errors.push('Commands must be an array');
+          result.valid = false;
+        }
+      }
+
+      // Check dependencies format
+      if (agentDef.dependencies) {
+        this.validateDependencies(agentDef.dependencies, result);
+      }
+
+      // Check persona (optional but recommended)
+      if (!agentDef.persona) {
+        result.warnings.push('No persona defined - recommended for consistent behavior');
+        this.warnings.push(`${result.file}: No persona defined`);
+      }
+
+      // Claude-specific checks
+      this.validateClaudeCompatibility(agentDef, result);
+
+      // Gemini-specific checks
+      this.validateGeminiCompatibility(agentDef, result);
+
+      if (result.errors.length > 0) {
+        result.valid = false;
+        this.errors.push(...result.errors.map((e) => `${result.file}: ${e}`));
+      }
+    } catch (error) {
+      result.errors.push(`Parse error: ${error.message}`);
+      result.valid = false;
+      this.errors.push(`${result.file}: ${error.message}`);
+    }
+
+    return result;
+  }
+
+  /**
+   * Validate Claude Code compatibility
+   * @param {Object} agentDef - Agent definition
+   * @param {Object} result - Result object to update
+   */
+  validateClaudeCompatibility(agentDef, result) {
+    // Claude Code uses .claude/commands/ structure
+    // Check for any Claude-specific features that might not work in Gemini
+
+    // Claude supports slash commands via Skill tool
+    if (agentDef.commands) {
+      for (const cmd of agentDef.commands) {
+        // Commands should not have leading slash (added by system)
+        if (typeof cmd === 'string' && cmd.startsWith('/')) {
+          result.warnings.push(`Command "${cmd}" should not start with /`);
+        }
+      }
+    }
+  }
+
+  /**
+   * Validate Gemini CLI compatibility
+   * @param {Object} agentDef - Agent definition
+   * @param {Object} result - Result object to update
+   */
+  validateGeminiCompatibility(agentDef, result) {
+    // Gemini CLI uses .gemini/rules/AIOX/agents/ structure
+    // Check for any Gemini-specific requirements
+
+    // Gemini requires activation-instructions
+    if (!agentDef['activation-instructions']) {
+      result.warnings.push('No activation-instructions - may affect Gemini CLI behavior');
+    }
+
+    // Check for hooks integration hints
+    if (agentDef.hooks) {
+      result.geminiCompatible = true; // Gemini has native hooks support
+    }
+  }
+
+  /**
+   * Validate dependencies structure
+   * @param {Object} deps - Dependencies object
+   * @param {Object} result - Result object to update
+   */
+  validateDependencies(deps, result) {
+    const validTypes = ['tasks', 'templates', 'checklists', 'data', 'scripts', 'tools'];
+
+    for (const [type, items] of Object.entries(deps)) {
+      if (!validTypes.includes(type) && type !== 'git_restrictions' && type !== 'coderabbit_integration') {
+        result.warnings.push(`Unknown dependency type: ${type}`);
+      }
+
+      if (Array.isArray(items)) {
+        for (const item of items) {
+          if (typeof item !== 'string') {
+            result.errors.push(`Invalid dependency item in ${type}`);
+          }
+        }
+      }
+    }
+  }
+
+  /**
+   * Validate a task file
+   * @param {string} filePath - Path to task file
+   * @returns {Object} Validation result
+   */
+  async validateTask(filePath) {
+    const result = {
+      file: path.basename(filePath),
+      path: filePath,
+      valid: true,
+      errors: [],
+      warnings: [],
+    };
+
+    try {
+      const content = fs.readFileSync(filePath, 'utf8');
+
+      // Check for basic structure
+      if (!content.includes('# ') && !content.includes('## ')) {
+        result.warnings.push('No markdown headers found');
+      }
+
+      // Check for task definition section
+      if (!content.includes('## Instructions') && !content.includes('## Purpose')) {
+        result.warnings.push('No Instructions or Purpose section found');
+      }
+
+      // Check for YAML frontmatter (optional)
+      if (content.startsWith('---')) {
+        const frontmatterMatch = content.match(/^---\n([\s\S]*?)\n---/);
+        if (frontmatterMatch) {
+          try {
+            yaml.load(frontmatterMatch[1]);
+          } catch (e) {
+            result.errors.push(`Invalid YAML frontmatter: ${e.message}`);
+            result.valid = false;
+          }
+        }
+      }
+    } catch (error) {
+      result.errors.push(`Read error: ${error.message}`);
+      result.valid = false;
+    }
+
+    return result;
+  }
+
+  /**
+   * Get nested value from object using dot notation
+   * @param {Object} obj - Object to traverse
+   * @param {string} path - Dot-separated path
+   * @returns {*} Value or undefined
+   */
+  getNestedValue(obj, path) {
+    return path.split('.').reduce((curr, key) => curr?.[key], obj);
+  }
+
+  /**
+   * Get all markdown files in directory
+   * @param {string} dir - Directory path
+   * @returns {Array<string>} File paths
+   */
+  getMarkdownFiles(dir) {
+    if (!fs.existsSync(dir)) {
+      return [];
+    }
+
+    return fs
+      .readdirSync(dir)
+      .filter((f) => f.endsWith('.md'))
+      .map((f) => path.join(dir, f));
+  }
+
+  /**
+   * Generate compatibility report
+   * @param {Object} results - Validation results
+   * @returns {string} Formatted report
+   */
+  generateReport(results) {
+    let report = '# AIOX Skills Cross-CLI Compatibility Report\n\n';
+
+    report += `**Overall Status:** ${results.compatible ? '✅ Compatible' : '❌ Issues Found'}\n\n`;
+
+    // Summary
+    report += '## Summary\n\n';
+    report += `- Agents validated: ${results.agents.length}\n`;
+    report += `- Tasks validated: ${results.tasks.length}\n`;
+    report += `- Errors: ${results.errors.length}\n`;
+    report += `- Warnings: ${results.warnings.length}\n\n`;
+
+    // Agents
+    if (results.agents.length > 0) {
+      report += '## Agents\n\n';
+      for (const agent of results.agents) {
+        const icon = agent.valid ? '✅' : '❌';
+        report += `### ${icon} ${agent.file}\n`;
+        report += `- Claude Compatible: ${agent.claudeCompatible ? 'Yes' : 'No'}\n`;
+        report += `- Gemini Compatible: ${agent.geminiCompatible ? 'Yes' : 'No'}\n`;
+        if (agent.errors.length > 0) {
+          report += `- Errors: ${agent.errors.join(', ')}\n`;
+        }
+        if (agent.warnings.length > 0) {
+          report += `- Warnings: ${agent.warnings.join(', ')}\n`;
+        }
+        report += '\n';
+      }
+    }
+
+    // Errors
+    if (results.errors.length > 0) {
+      report += '## Errors\n\n';
+      for (const error of results.errors) {
+        report += `- ❌ ${error}\n`;
+      }
+      report += '\n';
+    }
+
+    // Warnings
+    if (results.warnings.length > 0) {
+      report += '## Warnings\n\n';
+      for (const warning of results.warnings) {
+        report += `- ⚠️ ${warning}\n`;
+      }
+    }
+
+    return report;
+  }
+}
+
+module.exports = { SkillValidator };
+
+// CLI execution
+if (require.main === module) {
+  const validator = new SkillValidator();
+
+  validator.validateAll().then((results) => {
+    console.log(validator.generateReport(results));
+    process.exit(results.compatible ? 0 : 1);
+  });
+}