cyberaudit-skill 3.1.5 → 3.2.0

package/dist/cli.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cli.test.js

@@ -0,0 +1,100 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { existsSync, rmSync, readFileSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { mkdtempSync } from 'fs';
+describe('CLI Installer Safety', () => {
+    let tmp;
+    beforeEach(() => {
+        tmp = mkdtempSync(join(tmpdir(), 'cyberaudit-test-'));
+    });
+    afterEach(() => {
+        rmSync(tmp, { recursive: true, force: true });
+    });
+    it('isSafePath should block paths outside HOME containing cyberaudit', async () => {
+        const cliPath = join(process.cwd(), 'src', 'cli.ts');
+        const content = readFileSync(cliPath, 'utf-8');
+        // New version uses isSafeInsideHome, isSafeSkillPath, isSafeCommandPath
+        expect(content).toMatch(/isSafe.*Path/);
+        expect(content).toContain('homedir');
+        expect(content).toContain('cyberaudit');
+        expect(content).toContain('isSafeInsideHome');
+    });
+    it('installDir should exist as function', () => {
+        const content = readFileSync(join(process.cwd(), 'src', 'cli.ts'), 'utf-8');
+        expect(content).toContain('function installDir');
+    });
+    it('installForCursor handles corrupted mcp.json with backup', () => {
+        const cliContent = readFileSync(join(process.cwd(), 'src/cli.ts'), 'utf-8');
+        expect(cliContent).toContain('mcp.json is corrupted');
+        expect(cliContent).toContain('.bak');
+        expect(cliContent).toContain('copyFileSync');
+    });
+    it('version comes from package.json not hardcoded', () => {
+        const cliContent = readFileSync(join(process.cwd(), 'src/cli.ts'), 'utf-8');
+        expect(cliContent).toContain('PKG.version');
+        expect(cliContent).not.toMatch(/version:\s*\"3\.0\.0\"/);
+    });
+});
+describe('Command files completeness', () => {
+    it('should have at least 50 command files', () => {
+        const fs = require('fs');
+        const files = fs.readdirSync(join(process.cwd(), 'skills', 'cyberaudit', 'commands'));
+        expect(files.length).toBeGreaterThanOrEqual(50);
+    });
+    it('should have audit-cloud file', () => {
+        const fs = require('fs');
+        const files = fs.readdirSync(join(process.cwd(), 'skills', 'cyberaudit', 'commands'));
+        expect(files).toContain('audit-cloud.md');
+        expect(files).toContain('audit-cloud-s3.md');
+        expect(files).toContain('audit-cloud-iam.md');
+    });
+});
+describe('Cloud module completeness', () => {
+    it('cloud checklist exists', () => {
+        expect(existsSync(join(process.cwd(), 'skills', 'cyberaudit', 'cloud', 'CLOUD-CHECKLIST.md'))).toBe(true);
+    });
+    it('cloud philosophy exists', () => {
+        expect(existsSync(join(process.cwd(), 'skills', 'cyberaudit', 'cloud', 'CLOUD-PHILOSOPHY.md'))).toBe(true);
+    });
+    it('cloud remediation exists', () => {
+        expect(existsSync(join(process.cwd(), 'skills', 'cyberaudit', 'cloud', 'CLOUD-REMEDIATION-LIBRARY.md'))).toBe(true);
+    });
+    it('cloud report template exists', () => {
+        expect(existsSync(join(process.cwd(), 'skills', 'cyberaudit', 'reports', 'REPORT-TEMPLATE-CLOUD.md'))).toBe(true);
+    });
+});
+describe('Multi-agent support (like ui-ux-pro)', () => {
+    it('should support at least 15 agents', () => {
+        const content = readFileSync(join(process.cwd(), 'src', 'cli.ts'), 'utf-8');
+        // Count Agent union type entries
+        const match = content.match(/type Agent =([\s\S]*?);/);
+        expect(match).toBeTruthy();
+        const agents = match[1].split('|').map(s => s.trim()).filter(Boolean);
+        expect(agents.length).toBeGreaterThanOrEqual(15);
+    });
+    it('should have MAIN_COMMANDS 8 for \"/\" menu', () => {
+        const content = readFileSync(join(process.cwd(), 'src', 'cli.ts'), 'utf-8');
+        expect(content).toContain('MAIN_COMMANDS');
+        // Should contain 8 entries
+        const mainMatch = content.match(/const MAIN_COMMANDS = \[([\s\S]*?)\];/);
+        expect(mainMatch).toBeTruthy();
+        const count = (mainMatch[1].match(/\.md/g) || []).length;
+        expect(count).toBe(8);
+    });
+    it('should define AGENT_CONFIG for many agents', () => {
+        const content = readFileSync(join(process.cwd(), 'src', 'cli.ts'), 'utf-8');
+        expect(content).toContain('AGENT_CONFIG');
+        expect(content).toContain('claude-code');
+        expect(content).toContain('cursor');
+        expect(content).toContain('windsurf');
+        expect(content).toContain('copilot');
+        expect(content).toContain('codex');
+        expect(content).toContain('continue');
+    });
+    it('should install commands for \"/\" menu', () => {
+        const content = readFileSync(join(process.cwd(), 'src', 'cli.ts'), 'utf-8');
+        expect(content).toContain('installCommands');
+        expect(content).toContain('"/" will show');
+    });
+});

package/dist/mcp-server.d.ts

@@ -1,2 +1,136 @@
 #!/usr/bin/env node
-export {};
+export declare const MCP_TOOLS: ({
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            target: {
+                type: string;
+                description: string;
+            };
+            depth: {
+                type: string;
+                enum: string[];
+                default: string;
+            };
+            platform?: undefined;
+        };
+        required: string[];
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            target: {
+                type: string;
+                description: string;
+            };
+            platform: {
+                type: string;
+                enum: string[];
+                default: string;
+            };
+            depth?: undefined;
+        };
+        required: string[];
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            target: {
+                type: string;
+                description: string;
+            };
+            depth?: undefined;
+            platform?: undefined;
+        };
+        required: string[];
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            target?: undefined;
+            depth?: undefined;
+            platform?: undefined;
+        };
+        required?: undefined;
+    };
+})[];
+export declare const capabilities: {
+    tools: ({
+        name: string;
+        description: string;
+        inputSchema: {
+            type: string;
+            properties: {
+                target: {
+                    type: string;
+                    description: string;
+                };
+                depth: {
+                    type: string;
+                    enum: string[];
+                    default: string;
+                };
+                platform?: undefined;
+            };
+            required: string[];
+        };
+    } | {
+        name: string;
+        description: string;
+        inputSchema: {
+            type: string;
+            properties: {
+                target: {
+                    type: string;
+                    description: string;
+                };
+                platform: {
+                    type: string;
+                    enum: string[];
+                    default: string;
+                };
+                depth?: undefined;
+            };
+            required: string[];
+        };
+    } | {
+        name: string;
+        description: string;
+        inputSchema: {
+            type: string;
+            properties: {
+                target: {
+                    type: string;
+                    description: string;
+                };
+                depth?: undefined;
+                platform?: undefined;
+            };
+            required: string[];
+        };
+    } | {
+        name: string;
+        description: string;
+        inputSchema: {
+            type: string;
+            properties: {
+                target?: undefined;
+                depth?: undefined;
+                platform?: undefined;
+            };
+            required?: undefined;
+        };
+    })[];
+};
+export declare function startMcpServer(): void;

package/dist/mcp-server.js

@@ -1,126 +1,215 @@
 #!/usr/bin/env node
 import { createInterface } from "readline";
-import { join, dirname } from "path";
+import { readFileSync, existsSync, statSync } from "fs";
+import { join, dirname, resolve } from "path";
 import { fileURLToPath } from "url";
+import { scanSecrets, formatFindingsText } from "./scanners/secrets.js";
+import { scanWeb, formatWebFindingsText } from "./scanners/web.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
-const SKILL_DIR = join(__dirname, "..", "skills", "cyberaudit");
-const capabilities = {
-    tools: [
-        {
-            name: "cyberaudit-web",
-            description: "Run a web application security audit (OWASP Top 10)",
-            inputSchema: {
-                type: "object",
-                properties: {
-                    target: { type: "string", description: "URL, domain, or project path to audit" },
-                    depth: { type: "string", enum: ["quick", "standard", "deep"], default: "standard" },
-                },
-                required: ["target"],
+const PKG_ROOT = join(__dirname, "..");
+const SKILL_DIR = join(PKG_ROOT, "skills", "cyberaudit");
+function getVersion() {
+    try {
+        const pkgPath = join(PKG_ROOT, "package.json");
+        if (existsSync(pkgPath)) {
+            const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+            return pkg.version || "3.1.5";
+        }
+    }
+    catch { }
+    return "3.1.5";
+}
+const VERSION = getVersion();
+export const MCP_TOOLS = [
+    {
+        name: "cyberaudit-web",
+        description: "Run a web application security audit (OWASP Top 10)",
+        inputSchema: {
+            type: "object",
+            properties: {
+                target: { type: "string", description: "URL, domain, or project path to audit" },
+                depth: { type: "string", enum: ["quick", "standard", "deep"], default: "standard" },
             },
+            required: ["target"],
         },
-        {
-            name: "cyberaudit-mobile",
-            description: "Run a mobile application security audit (OWASP MASVS)",
-            inputSchema: {
-                type: "object",
-                properties: {
-                    target: { type: "string", description: "App identifier, APK/IPA path, or project path" },
-                    platform: { type: "string", enum: ["android", "ios", "both"], default: "both" },
-                },
-                required: ["target"],
+    },
+    {
+        name: "cyberaudit-mobile",
+        description: "Run a mobile application security audit (OWASP MASVS)",
+        inputSchema: {
+            type: "object",
+            properties: {
+                target: { type: "string", description: "App identifier, APK/IPA path, or project path" },
+                platform: { type: "string", enum: ["android", "ios", "both"], default: "both" },
             },
+            required: ["target"],
         },
-        {
-            name: "cyberaudit-api",
-            description: "Run an API security audit",
-            inputSchema: {
-                type: "object",
-                properties: {
-                    target: { type: "string", description: "API base URL, OpenAPI spec path, or project directory" },
-                },
-                required: ["target"],
+    },
+    {
+        name: "cyberaudit-api",
+        description: "Run an API security audit (OWASP API Top 10)",
+        inputSchema: {
+            type: "object",
+            properties: {
+                target: { type: "string", description: "API base URL, OpenAPI spec path, or project directory" },
             },
+            required: ["target"],
         },
-        {
-            name: "cyberaudit-cloud",
-            description: "Run a cloud configuration security audit",
-            inputSchema: {
-                type: "object",
-                properties: {
-                    target: { type: "string", description: "Cloud provider or config file path" },
-                },
-                required: ["target"],
+    },
+    {
+        name: "cyberaudit-cloud",
+        description: "Run a cloud configuration security audit (AWS/GCP/Azure S3, IAM, SG, storage)",
+        inputSchema: {
+            type: "object",
+            properties: {
+                target: { type: "string", description: "Cloud provider, IaC path (terraform/cloudformation), or config file path" },
             },
+            required: ["target"],
         },
-        {
-            name: "cyberaudit-quick",
-            description: "Run a quick vulnerability scan (5-minute assessment)",
-            inputSchema: {
-                type: "object",
-                properties: {
-                    target: { type: "string", description: "URL, domain, or project path" },
-                },
-                required: ["target"],
+    },
+    {
+        name: "cyberaudit-quick",
+        description: "Run a quick vulnerability scan (5-minute assessment, secrets + criticals) — deterministic scanner included",
+        inputSchema: {
+            type: "object",
+            properties: {
+                target: { type: "string", description: "URL, domain, or project path" },
             },
+            required: ["target"],
         },
-    ],
+    },
+    {
+        name: "cyberaudit-list",
+        description: "List all available audit types and check installation",
+        inputSchema: { type: "object", properties: {} },
+    },
+];
+export const capabilities = {
+    tools: MCP_TOOLS,
 };
 function write(id, result) {
     process.stdout.write(JSON.stringify({ jsonrpc: "2.0", id, ...result }) + "\n");
 }
 function handleToolCall(id, name, args) {
     const auditType = name.replace("cyberaudit-", "");
-    write(id, {
-        content: [
-            {
-                type: "text",
-                text: `▶ CyberAudit: ${auditType.toUpperCase()} audit requested
+    if (name === "cyberaudit-list") {
+        write(id, {
+            result: {
+                content: [
+                    {
+                        type: "text",
+                        text: `═══ CyberAudit ${VERSION} — Available Audits ═══
 
-Target: ${args.target}
-${args.depth ? `Depth: ${args.depth}` : ""}
-${args.platform ? `Platform: ${args.platform}` : ""}
+• cyberaudit-web: OWASP Top 10 web app audit
+• cyberaudit-mobile: OWASP MASVS mobile audit
+• cyberaudit-api: OWASP API Top 10 audit
+• cyberaudit-cloud: Cloud config audit (S3, IAM, SG, storage)
+• cyberaudit-quick: Quick 5-minute scan (secrets + criticals) — DETERMINISTIC SCANNER
+• cyberaudit-full: Full stack (web + api + cloud) via /audit
 
+Skill location: ${SKILL_DIR}
+Docs: https://github.com/ArisRoman/cyberaudit-skill
+Scanner: deterministic secrets detection 15 patterns`,
+                    },
+                ],
+            },
+        });
+        return;
+    }
+    if (name === "cyberaudit-quick" && args.target) {
+        try {
+            const targetPath = resolve(args.target);
+            if (existsSync(targetPath)) {
+                const stat = statSync(targetPath);
+                if (stat.isDirectory() || stat.isFile()) {
+                    const secretFindings = scanSecrets(targetPath);
+                    const webFindings = scanWeb(targetPath);
+                    const secretReport = formatFindingsText(secretFindings, args.target);
+                    const webReport = formatWebFindingsText(webFindings, args.target);
+                    write(id, {
+                        result: {
+                            content: [
+                                {
+                                    type: "text",
+                                    text: `▶ CyberAudit ${VERSION}: QUICK deterministic scan completed\n\n${secretReport}\n${webReport}\n---\nTotal: ${secretFindings.length + webFindings.length} findings (secrets:${secretFindings.length} web:${webFindings.length})\nFor full context-aware audit, load skill and run:\n/${name} "${args.target}"\n\nSkill location: ${SKILL_DIR}\nChecklist: ${SKILL_DIR}/cloud/CLOUD-CHECKLIST.md\nCLI: npx cyberaudit-skill scan "${args.target}" --json`,
+                                },
+                            ],
+                        },
+                    });
+                    return;
+                }
+            }
+        }
+        catch (e) {
+            console.error(`[CyberAudit] Quick scan failed for ${args.target}: ${e.message}`);
+        }
+    }
+    write(id, {
+        result: {
+            content: [
+                {
+                    type: "text",
+                    text: `▶ CyberAudit ${VERSION}: ${auditType.toUpperCase()} audit requested
+
+Target: ${args.target || "not provided"}
+${args.depth ? `Depth: ${args.depth}\n` : ""}${args.platform ? `Platform: ${args.platform}\n` : ""}
 To execute the full audit, load the CyberAudit Skill and run:
 
-/${name} "${args.target}"
+/${name} "${args.target || "."}"
 
 The skill will guide you through all checks, scoring, and report generation.
 
-Skill location: ${SKILL_DIR}`,
-            },
-        ],
+Skill location: ${SKILL_DIR}
+Cloud checklist: ${SKILL_DIR}/cloud/CLOUD-CHECKLIST.md
+Secrets scanner: npx cyberaudit-skill scan "${args.target || "."}"`,
+                },
+            ],
+        },
     });
 }
-const rl = createInterface({ input: process.stdin });
-rl.on("line", (line) => {
-    try {
-        const msg = JSON.parse(line.trim());
-        const id = msg.id;
-        switch (msg.method) {
-            case "initialize":
-                write(id, {
-                    protocolVersion: "2024-11-05",
-                    capabilities,
-                    serverInfo: { name: "cyberaudit-skill", version: "3.0.0" },
-                });
-                break;
-            case "tools/list":
-                write(id, capabilities);
-                break;
-            case "tools/call":
-                handleToolCall(id, msg.params.name, msg.params.arguments || {});
-                break;
-            case "notifications/initialized":
-                // no response expected
-                break;
-            default:
-                write(id, { error: { code: -32601, message: `Method not found: ${msg.method}` } });
+export function startMcpServer() {
+    const rl = createInterface({ input: process.stdin });
+    rl.on("line", (line) => {
+        try {
+            const trimmed = line.trim();
+            if (!trimmed)
+                return;
+            const msg = JSON.parse(trimmed);
+            const id = msg.id;
+            switch (msg.method) {
+                case "initialize":
+                    write(id, {
+                        result: {
+                            protocolVersion: "2024-11-05",
+                            capabilities,
+                            serverInfo: { name: "cyberaudit-skill", version: VERSION },
+                        },
+                    });
+                    break;
+                case "tools/list":
+                    write(id, {
+                        result: capabilities,
+                    });
+                    break;
+                case "tools/call":
+                    handleToolCall(id, msg.params?.name, msg.params?.arguments || {});
+                    break;
+                case "notifications/initialized":
+                    break;
+                default:
+                    if (id !== undefined) {
+                        write(id, { error: { code: -32601, message: `Method not found: ${msg.method}` } });
+                    }
+            }
         }
-    }
-    catch (e) {
-        // ignore malformed input
-    }
-});
-process.on("SIGINT", () => process.exit(0));
-process.on("SIGTERM", () => process.exit(0));
-console.error(`[CyberAudit] MCP server ready | Skill: ${SKILL_DIR}`);
+        catch {
+            // ignore malformed
+        }
+    });
+    process.on("SIGINT", () => process.exit(0));
+    process.on("SIGTERM", () => process.exit(0));
+    console.error(`[CyberAudit] MCP server ready v${VERSION} | Skill: ${SKILL_DIR}`);
+}
+if (import.meta.url === `file://${process.argv[1]}` || process.argv[1]?.endsWith("mcp-server.js") || process.argv[1]?.endsWith("mcp-server.ts")) {
+    startMcpServer();
+}

package/dist/mcp-server.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/mcp-server.test.js

@@ -0,0 +1,77 @@
+import { describe, it, expect } from 'vitest';
+import { spawn } from 'child_process';
+import { join } from 'path';
+function runMcp(inputLines) {
+    return new Promise((resolve, reject) => {
+        const proc = spawn('node', [join(process.cwd(), 'dist', 'mcp-server.js')], {
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        let stdout = '';
+        let stderr = '';
+        proc.stdout.on('data', (d) => (stdout += d.toString()));
+        proc.stderr.on('data', (d) => (stderr += d.toString()));
+        proc.on('error', reject);
+        // Write lines
+        for (const line of inputLines) {
+            proc.stdin.write(line + '\n');
+        }
+        setTimeout(() => {
+            proc.kill();
+            resolve({ stdout, stderr });
+        }, 800);
+    });
+}
+describe('MCP Server', () => {
+    it('should respond to initialize', async () => {
+        const { stdout, stderr } = await runMcp([
+            JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} }),
+        ]);
+        expect(stdout).toContain('protocolVersion');
+        expect(stdout).toContain('cyberaudit-skill');
+        expect(stderr).toContain('MCP server ready');
+        const lines = stdout.trim().split('\n').filter(Boolean);
+        const first = JSON.parse(lines[0]);
+        expect(first.result.serverInfo.version).toMatch(/\d+\.\d+\.\d+/);
+        // Should read version from package.json (3.1.5)
+        expect(first.result.serverInfo.version).toBe('3.1.5');
+    });
+    it('should list 6 tools including cloud', async () => {
+        const { stdout } = await runMcp([
+            JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} }),
+            JSON.stringify({ jsonrpc: '2.0', id: 2, method: 'tools/list', params: {} }),
+        ]);
+        const lines = stdout.trim().split('\n').filter(Boolean).map(l => JSON.parse(l));
+        const listResp = lines.find(r => r.id === 2);
+        expect(listResp).toBeDefined();
+        const toolNames = listResp.result.tools.map((t) => t.name);
+        expect(toolNames).toContain('cyberaudit-web');
+        expect(toolNames).toContain('cyberaudit-cloud');
+        expect(toolNames).toContain('cyberaudit-quick');
+        expect(toolNames.length).toBeGreaterThanOrEqual(6);
+    });
+    it('should handle cloud tool call', async () => {
+        const { stdout } = await runMcp([
+            JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} }),
+            JSON.stringify({
+                jsonrpc: '2.0',
+                id: 2,
+                method: 'tools/call',
+                params: { name: 'cyberaudit-cloud', arguments: { target: 'terraform/' } },
+            }),
+        ]);
+        const lines = stdout.trim().split('\n').filter(Boolean).map(l => JSON.parse(l));
+        const callResp = lines.find(r => r.id === 2);
+        expect(callResp).toBeDefined();
+        const text = callResp.result.content[0].text;
+        expect(text).toContain('CLOUD');
+        expect(text).toContain('terraform/');
+        expect(text).toContain('CLOUD-CHECKLIST.md');
+    });
+    it('should use single source of truth (no duplicate implementation in cli)', async () => {
+        // cli.ts should import from mcp-server.js
+        const fs = await import('fs');
+        const cliContent = fs.readFileSync(join(process.cwd(), 'src', 'cli.ts'), 'utf-8');
+        expect(cliContent).toContain('from "./mcp-server.js"');
+        expect(cliContent).not.toContain('msg.para'); // old buggy truncation
+    });
+});

package/dist/report/generator.d.ts

@@ -0,0 +1,2 @@
+import { ReportInput, ReportOutput } from './types.js';
+export declare function generateReport(input: ReportInput): ReportOutput;