erosolar-cli 1.5.2 → 1.5.4

package/dist/bin/alpha-zero/metricsTracker.js

@@ -0,0 +1,207 @@
+/**
+ * Alpha Zero 2 - Metrics Tracker
+ *
+ * Performance metrics tracking for agent sessions.
+ *
+ * Principal Investigator: Bo Shang
+ * Framework: erosolar-cli
+ */
+/**
+ * Creates default performance metrics.
+ */
+export function createDefaultMetrics(sessionId) {
+    return {
+        sessionId,
+        totalMessages: 0,
+        totalToolCalls: 0,
+        totalTokensUsed: 0,
+        totalTimeMs: 0,
+        successfulToolCalls: 0,
+        failedToolCalls: 0,
+        codeBlocksGenerated: 0,
+        avgResponseTimeMs: 0,
+        avgCodeQuality: 0,
+        avgAlgorithmEfficiency: 0,
+        avgErrorHandling: 0,
+    };
+}
+/**
+ * Tracks performance metrics for an agent session.
+ */
+export class MetricsTracker {
+    constructor(sessionId) {
+        this.responseTimes = [];
+        this.codeQualityScores = [];
+        this.efficiencyScores = [];
+        this.errorHandlingScores = [];
+        this.traces = [];
+        this.metrics = createDefaultMetrics(sessionId);
+    }
+    /**
+     * Record a message exchange.
+     */
+    recordMessage(elapsedMs, usage) {
+        this.metrics.totalMessages += 1;
+        this.metrics.totalTimeMs += elapsedMs;
+        this.responseTimes.push(elapsedMs);
+        if (usage) {
+            const tokens = usage.totalTokens ?? (usage.inputTokens ?? 0) + (usage.outputTokens ?? 0);
+            this.metrics.totalTokensUsed += tokens;
+        }
+        this.updateAverages();
+    }
+    /**
+     * Record a tool call.
+     */
+    recordToolCall(success) {
+        this.metrics.totalToolCalls += 1;
+        if (success) {
+            this.metrics.successfulToolCalls += 1;
+        }
+        else {
+            this.metrics.failedToolCalls += 1;
+        }
+    }
+    /**
+     * Record code generation.
+     */
+    recordCodeGeneration(codeBlockCount) {
+        this.metrics.codeBlocksGenerated += codeBlockCount;
+    }
+    /**
+     * Record code quality evaluation.
+     */
+    recordCodeQuality(quality) {
+        this.codeQualityScores.push(quality.codeQualityScore);
+        this.efficiencyScores.push(quality.algorithmEfficiency);
+        this.errorHandlingScores.push(quality.errorHandlingScore);
+        this.updateAverages();
+    }
+    /**
+     * Add an execution trace.
+     */
+    addTrace(trace) {
+        this.traces.push(trace);
+        // Keep only the last 100 traces
+        if (this.traces.length > 100) {
+            this.traces.shift();
+        }
+    }
+    /**
+     * Update running averages.
+     */
+    updateAverages() {
+        if (this.responseTimes.length > 0) {
+            this.metrics.avgResponseTimeMs =
+                this.responseTimes.reduce((a, b) => a + b, 0) / this.responseTimes.length;
+        }
+        if (this.codeQualityScores.length > 0) {
+            this.metrics.avgCodeQuality =
+                this.codeQualityScores.reduce((a, b) => a + b, 0) / this.codeQualityScores.length;
+        }
+        if (this.efficiencyScores.length > 0) {
+            this.metrics.avgAlgorithmEfficiency =
+                this.efficiencyScores.reduce((a, b) => a + b, 0) / this.efficiencyScores.length;
+        }
+        if (this.errorHandlingScores.length > 0) {
+            this.metrics.avgErrorHandling =
+                this.errorHandlingScores.reduce((a, b) => a + b, 0) / this.errorHandlingScores.length;
+        }
+    }
+    /**
+     * Get current metrics.
+     */
+    getMetrics() {
+        return { ...this.metrics };
+    }
+    /**
+     * Get execution traces.
+     */
+    getTraces() {
+        return [...this.traces];
+    }
+    /**
+     * Get human-readable performance summary.
+     */
+    getPerformanceSummary() {
+        const m = this.metrics;
+        const lines = [
+            `Agent Performance Summary: ${m.sessionId}`,
+            '='.repeat(50),
+            `Messages: ${m.totalMessages}`,
+            `Total Time: ${(m.totalTimeMs / 1000).toFixed(2)}s`,
+            `Avg Response: ${m.avgResponseTimeMs.toFixed(0)}ms`,
+            `Code Blocks: ${m.codeBlocksGenerated}`,
+            `Tokens Used: ${m.totalTokensUsed.toLocaleString()}`,
+            '',
+            'Tool Usage:',
+            `  Total Calls: ${m.totalToolCalls}`,
+            `  Success Rate: ${m.totalToolCalls > 0 ? ((m.successfulToolCalls / m.totalToolCalls) * 100).toFixed(1) : 0}%`,
+            '',
+            'Code Quality Metrics:',
+            `  Quality Score: ${(m.avgCodeQuality * 100).toFixed(1)}/100`,
+            `  Algorithm Efficiency: ${(m.avgAlgorithmEfficiency * 100).toFixed(1)}/100`,
+            `  Error Handling: ${(m.avgErrorHandling * 100).toFixed(1)}/100`,
+        ];
+        return lines.join('\n');
+    }
+    /**
+     * Get improvement suggestions based on metrics.
+     */
+    getImprovementSuggestions() {
+        const suggestions = [];
+        const m = this.metrics;
+        if (m.avgResponseTimeMs > 5000) {
+            suggestions.push({
+                category: 'performance',
+                severity: 'high',
+                message: 'Response time is high - consider optimizing prompts or using a faster model',
+                suggestedAction: 'Review prompt complexity and consider caching common operations',
+            });
+        }
+        if (m.avgCodeQuality < 0.5 && m.codeBlocksGenerated > 0) {
+            suggestions.push({
+                category: 'quality',
+                severity: 'medium',
+                message: 'Code quality is below average - enhance system prompt with coding best practices',
+                suggestedAction: 'Add explicit code style guidelines to the system prompt',
+            });
+        }
+        if (m.avgAlgorithmEfficiency < 0.5 && m.codeBlocksGenerated > 0) {
+            suggestions.push({
+                category: 'efficiency',
+                severity: 'medium',
+                message: 'Algorithm efficiency is low - add guidance for efficient data structures',
+                suggestedAction: 'Include examples of optimal algorithm patterns in prompts',
+            });
+        }
+        if (m.avgErrorHandling < 0.3 && m.codeBlocksGenerated > 0) {
+            suggestions.push({
+                category: 'error-handling',
+                severity: 'high',
+                message: 'Error handling is weak - instruct agent to include try/catch blocks',
+                suggestedAction: 'Require explicit error handling in generated code',
+            });
+        }
+        if (m.totalToolCalls > 0 && m.failedToolCalls / m.totalToolCalls > 0.2) {
+            suggestions.push({
+                category: 'performance',
+                severity: 'medium',
+                message: `Tool failure rate is ${((m.failedToolCalls / m.totalToolCalls) * 100).toFixed(1)}%`,
+                suggestedAction: 'Review failed tool calls and improve error recovery',
+            });
+        }
+        return suggestions;
+    }
+    /**
+     * Reset all metrics.
+     */
+    reset() {
+        this.metrics = createDefaultMetrics(this.metrics.sessionId);
+        this.responseTimes = [];
+        this.codeQualityScores = [];
+        this.efficiencyScores = [];
+        this.errorHandlingScores = [];
+        this.traces = [];
+    }
+}

package/dist/bin/alpha-zero/security/core.js

@@ -0,0 +1,269 @@
+/**
+ * Core Security Research Framework
+ *
+ * Base authorization system and reconnaissance capabilities.
+ * All operations require explicit authorization.
+ *
+ * Principal Investigator: Bo Shang
+ * Framework: erosolar-cli
+ */
+import * as dns from 'dns/promises';
+import * as net from 'net';
+/**
+ * Scope of authorization for security testing
+ */
+export var AuthorizationScope;
+(function (AuthorizationScope) {
+    AuthorizationScope["OWNED_SYSTEMS"] = "owned_systems";
+    AuthorizationScope["BUG_BOUNTY"] = "bug_bounty";
+    AuthorizationScope["PENTEST_ENGAGEMENT"] = "pentest_engagement";
+    AuthorizationScope["CTF_COMPETITION"] = "ctf_competition";
+    AuthorizationScope["RED_TEAM"] = "red_team";
+    AuthorizationScope["EDUCATIONAL"] = "educational";
+})(AuthorizationScope || (AuthorizationScope = {}));
+const DEFAULT_CONFIG = {
+    dataDir: '.security_research',
+    verbose: false,
+};
+/**
+ * Security Research Engine
+ *
+ * All operations require explicit authorization records.
+ */
+export class SecurityResearchEngine {
+    constructor(config = {}) {
+        this.authorization = null;
+        this.findings = [];
+        this.reconResults = [];
+        this.config = { ...DEFAULT_CONFIG, ...config };
+    }
+    /**
+     * Set authorization for testing
+     */
+    setAuthorization(authorization) {
+        this.authorization = authorization;
+        if (this.config.verbose) {
+            console.log(`[Authorization] Set for ${authorization.targetDomain}`);
+        }
+    }
+    /**
+     * Check if authorization is valid
+     */
+    checkAuthorization(target) {
+        if (!this.authorization) {
+            throw new Error('No authorization record set.');
+        }
+        // Check expiration
+        if (this.authorization.expirationDate) {
+            const exp = new Date(this.authorization.expirationDate);
+            if (new Date() > exp) {
+                throw new Error('Authorization has expired.');
+            }
+        }
+        // Check scope
+        const inScope = this.authorization.targetDomain.includes(target) ||
+            target.endsWith(this.authorization.targetDomain);
+        const outOfScope = this.authorization.outOfScope.some(oos => target.includes(oos));
+        if (!inScope || outOfScope) {
+            throw new Error(`Target ${target} is not within authorized scope.`);
+        }
+    }
+    /**
+     * Perform passive reconnaissance
+     */
+    async passiveRecon(target) {
+        this.checkAuthorization(target);
+        if (this.config.verbose) {
+            console.log(`[Recon] Starting passive recon on ${target}`);
+        }
+        const result = {
+            target,
+            timestamp: Date.now(),
+            dnsRecords: {},
+            openPorts: [],
+            sslInfo: {},
+            httpHeaders: {},
+            technologies: [],
+            subdomains: [],
+            potentialVectors: [],
+        };
+        // DNS lookup
+        try {
+            result.dnsRecords['A'] = await dns.resolve4(target);
+        }
+        catch { /* ignore */ }
+        try {
+            result.dnsRecords['MX'] = (await dns.resolveMx(target)).map(r => r.exchange);
+        }
+        catch { /* ignore */ }
+        try {
+            result.dnsRecords['TXT'] = await dns.resolveTxt(target).then(r => r.flat());
+        }
+        catch { /* ignore */ }
+        // Common subdomain patterns
+        const prefixes = ['www', 'mail', 'api', 'dev', 'staging', 'admin'];
+        result.subdomains = prefixes.map(p => `${p}.${target}`);
+        this.reconResults.push(result);
+        return result;
+    }
+    /**
+     * Perform active reconnaissance (requires stronger authorization)
+     */
+    async activeRecon(target, ports = [80, 443, 8080, 8443]) {
+        this.checkAuthorization(target);
+        // Active recon requires stronger authorization
+        const allowed = [
+            AuthorizationScope.OWNED_SYSTEMS,
+            AuthorizationScope.PENTEST_ENGAGEMENT,
+            AuthorizationScope.RED_TEAM,
+            AuthorizationScope.CTF_COMPETITION,
+        ];
+        if (!allowed.includes(this.authorization.scope)) {
+            throw new Error('Active recon requires stronger authorization.');
+        }
+        const result = await this.passiveRecon(target);
+        // Port scan
+        result.openPorts = await this.scanPorts(target, ports);
+        // Identify vectors
+        result.potentialVectors = this.identifyVectors(result);
+        return result;
+    }
+    /**
+     * Scan ports
+     */
+    async scanPorts(host, ports) {
+        const checkPort = (port) => {
+            return new Promise(resolve => {
+                const socket = new net.Socket();
+                socket.setTimeout(2000);
+                socket.on('connect', () => {
+                    socket.destroy();
+                    resolve(true);
+                });
+                socket.on('error', () => {
+                    socket.destroy();
+                    resolve(false);
+                });
+                socket.on('timeout', () => {
+                    socket.destroy();
+                    resolve(false);
+                });
+                socket.connect(port, host);
+            });
+        };
+        const results = await Promise.all(ports.map(async (port) => {
+            const isOpen = await checkPort(port);
+            return isOpen ? port : null;
+        }));
+        return results.filter((p) => p !== null);
+    }
+    /**
+     * Identify potential attack vectors
+     */
+    identifyVectors(recon) {
+        const vectors = [];
+        // Missing security headers (would need HTTP request to determine)
+        // Placeholder for now
+        vectors.push('Check for missing security headers');
+        // Open ports analysis
+        if (recon.openPorts.includes(21)) {
+            vectors.push('FTP port open - check for anonymous access');
+        }
+        if (recon.openPorts.includes(22)) {
+            vectors.push('SSH port open - check for weak credentials');
+        }
+        return vectors;
+    }
+    /**
+     * Analyze for vulnerabilities
+     */
+    analyzeForVulnerabilities(recon) {
+        this.checkAuthorization(recon.target);
+        const findings = [];
+        // Example: missing HSTS (would need actual HTTP response)
+        findings.push({
+            title: 'Missing HSTS Header (Verify Required)',
+            severity: 'medium',
+            category: 'config',
+            description: 'Verify HSTS header is present.',
+            evidence: 'Requires HTTP response analysis',
+            remediation: 'Add Strict-Transport-Security header',
+            cweId: 'CWE-319',
+        });
+        this.findings.push(...findings);
+        return findings;
+    }
+    /**
+     * Generate report
+     */
+    generateReport(format = 'text') {
+        if (format === 'json') {
+            return JSON.stringify({
+                generated: new Date().toISOString(),
+                authorization: this.authorization,
+                findings: this.findings,
+                reconResults: this.reconResults,
+            }, null, 2);
+        }
+        const lines = [
+            '='.repeat(60),
+            'SECURITY RESEARCH REPORT',
+            '='.repeat(60),
+            `Generated: ${new Date().toISOString()}`,
+        ];
+        if (this.authorization) {
+            lines.push(`Target: ${this.authorization.targetDomain}`);
+            lines.push(`Scope: ${this.authorization.scope}`);
+        }
+        if (this.findings.length > 0) {
+            lines.push('', `Findings: ${this.findings.length}`);
+            for (const f of this.findings) {
+                lines.push(`  [${f.severity.toUpperCase()}] ${f.title}`);
+            }
+        }
+        return lines.join('\n');
+    }
+}
+/**
+ * Create bug bounty authorization
+ */
+export function createBugBountyAuthorization(targetDomain, programName, scopeLimitations = [], outOfScope = []) {
+    return {
+        scope: AuthorizationScope.BUG_BOUNTY,
+        targetDomain,
+        authorizedBy: `Bug Bounty: ${programName}`,
+        authorizationDate: new Date().toISOString(),
+        scopeLimitations,
+        outOfScope,
+        notes: 'Testing authorized under bug bounty program terms',
+    };
+}
+/**
+ * Create pentest authorization
+ */
+export function createPentestAuthorization(targetDomain, clientName, engagementId, expirationDate) {
+    return {
+        scope: AuthorizationScope.PENTEST_ENGAGEMENT,
+        targetDomain,
+        authorizedBy: `Client: ${clientName} (${engagementId})`,
+        authorizationDate: new Date().toISOString(),
+        expirationDate,
+        scopeLimitations: [],
+        outOfScope: [],
+        notes: 'Testing authorized under penetration testing agreement',
+    };
+}
+/**
+ * Create CTF authorization
+ */
+export function createCtfAuthorization(targetDomain, ctfName) {
+    return {
+        scope: AuthorizationScope.CTF_COMPETITION,
+        targetDomain,
+        authorizedBy: `CTF: ${ctfName}`,
+        authorizationDate: new Date().toISOString(),
+        scopeLimitations: [],
+        outOfScope: [],
+        notes: 'CTF competition testing',
+    };
+}