faultmesh 1.0.0 → 1.1.0

package/dist/healer/transformers/ExpressTransformers.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Express / Node.js Remediation Transformers
+ * Surgically injects defensive middleware and parameters into Express applications.
+ */
+export interface TransformerResult {
+    modified: boolean;
+    content: string;
+    description: string;
+}
+export declare class ExpressTransformers {
+    /**
+     * 1. Defensive Security Headers (Helmet)
+     */
+    static applyDefensiveHeaders(content: string): TransformerResult;
+    /**
+     * 2. Oversized Payload & Buffer OOM Defense (express.json limit)
+     */
+    static applyPayloadLimit(content: string): TransformerResult;
+    /**
+     * 3. CORS & Origin Validation
+     */
+    static applyCorsLockdown(content: string): TransformerResult;
+    /**
+     * 4. Error Sanitization & Stack Trace Exposure
+     */
+    static applyErrorSanitization(content: string): TransformerResult;
+    /**
+     * 5. Slowloris & Request Socket Timeout
+     */
+    static applySocketTimeouts(content: string): TransformerResult;
+    /**
+     * 6. Strict Host Header Whitelist Validation
+     */
+    static applyHostHeaderValidation(content: string): TransformerResult;
+    /**
+     * 7. Path Traversal & Unsanitized Directory Escape Guard
+     */
+    static applyPathTraversalGuard(content: string): TransformerResult;
+    /**
+     * 8. Duplicate Request Idempotency & Concurrency Race Protection
+     */
+    static applyIdempotencyProtection(content: string): TransformerResult;
+}

package/dist/healer/transformers/ExpressTransformers.js

@@ -0,0 +1,228 @@
+/**
+ * Express / Node.js Remediation Transformers
+ * Surgically injects defensive middleware and parameters into Express applications.
+ */
+export class ExpressTransformers {
+    /**
+     * 1. Defensive Security Headers (Helmet)
+     */
+    static applyDefensiveHeaders(content) {
+        // Check if already using helmet or security headers
+        if (content.includes('helmet') || (content.includes('X-Content-Type-Options') && content.includes('X-Frame-Options'))) {
+            return { modified: false, content, description: 'Defensive headers already configured' };
+        }
+        let modifiedContent = content;
+        const isESM = content.includes('import ') && content.includes('from ');
+        // 1. Add import/require
+        if (isESM) {
+            modifiedContent = `import helmet from 'helmet';\n${modifiedContent}`;
+        }
+        else {
+            modifiedContent = `const helmet = require('helmet');\n${modifiedContent}`;
+        }
+        // 2. Insert app.use(helmet()) right after app initialization
+        const appMatch = modifiedContent.match(/(const|let|var)\s+([a-zA-Z0-9_$]+)\s*=\s*(express\s*\(\)|createApp\s*\(\))/);
+        if (appMatch) {
+            const appVar = appMatch[2];
+            const targetStr = appMatch[0];
+            const cleanTarget = targetStr.replace(/;+$/, '');
+            const injection = `${cleanTarget};\n${appVar}.use(helmet());`;
+            modifiedContent = modifiedContent.replace(targetStr, injection);
+            return {
+                modified: true,
+                content: modifiedContent,
+                description: `Injected helmet security headers into Express app (${appVar}.use(helmet()))`,
+            };
+        }
+        return { modified: false, content, description: 'Could not find Express app instance to inject helmet' };
+    }
+    /**
+     * 2. Oversized Payload & Buffer OOM Defense (express.json limit)
+     */
+    static applyPayloadLimit(content) {
+        // Check if express.json or bodyParser already has a 1mb limit
+        if (content.includes("express.json({ limit: '1mb' })") || content.includes('express.json({ limit: "1mb" })') || content.includes("express.json({limit: '1mb'})")) {
+            return { modified: false, content, description: 'JSON payload limit (1mb) already configured' };
+        }
+        let modifiedContent = content;
+        let modified = false;
+        // Replace express.json(...) with express.json({ limit: '1mb' })
+        if (/express\.json\(\s*(\{[^}]*\})?\s*\)/.test(modifiedContent)) {
+            modifiedContent = modifiedContent.replace(/express\.json\(\s*(\{[^}]*\})?\s*\)/g, "express.json({ limit: '1mb' })");
+            modified = true;
+        }
+        // Replace express.urlencoded(...) with limit
+        if (modifiedContent.includes('express.urlencoded(') && !modifiedContent.includes("express.urlencoded({ limit:")) {
+            modifiedContent = modifiedContent.replace(/express\.urlencoded\(\{([^}]+)\}\)/g, "express.urlencoded({ $1, limit: '1mb' })");
+            modified = true;
+        }
+        // Fallback: If app.use is found but express.json is not called at all
+        if (!modified) {
+            const appMatch = modifiedContent.match(/([a-zA-Z0-9_$]+)\.use\(/);
+            if (appMatch) {
+                const appVar = appMatch[1];
+                modifiedContent = modifiedContent.replace(`${appVar}.use(`, `${appVar}.use(express.json({ limit: '1mb' }));\n${appVar}.use(`);
+                modified = true;
+            }
+        }
+        return {
+            modified,
+            content: modifiedContent,
+            description: modified ? "Enforced 1MB request payload limit (express.json({ limit: '1mb' }))" : 'Payload limit not applicable',
+        };
+    }
+    /**
+     * 3. CORS & Origin Validation
+     */
+    static applyCorsLockdown(content) {
+        // If wildcard CORS without validation is found
+        const openCorsPattern = /cors\(\s*\)/g;
+        const wildcardOriginPattern = /origin:\s*['"]\*['"]/g;
+        let modifiedContent = content;
+        let modified = false;
+        const safeCorsConfig = `{
+  origin: (origin, callback) => {
+    const allowed = (process.env.ALLOWED_ORIGINS || 'http://localhost:3000').split(',');
+    if (!origin || allowed.includes(origin)) return callback(null, true);
+    callback(new Error('CORS origin blocked by policy'));
+  },
+  credentials: true
+}`;
+        if (openCorsPattern.test(modifiedContent)) {
+            modifiedContent = modifiedContent.replace(openCorsPattern, `cors(${safeCorsConfig})`);
+            modified = true;
+        }
+        else if (wildcardOriginPattern.test(modifiedContent)) {
+            modifiedContent = modifiedContent.replace(wildcardOriginPattern, `origin: (origin, cb) => cb(null, origin || true)`);
+            modified = true;
+        }
+        return {
+            modified,
+            content: modifiedContent,
+            description: modified ? 'Locked down open CORS wildcard with strict origin validation' : 'CORS configuration already restricted',
+        };
+    }
+    /**
+     * 4. Error Sanitization & Stack Trace Exposure
+     */
+    static applyErrorSanitization(content) {
+        if (/\.use\s*\(\s*(\(\s*err|\s*function\s*\(\s*err)/.test(content)) {
+            return { modified: false, content, description: 'Error handling middleware already present' };
+        }
+        let modifiedContent = content;
+        const listenRegex = /(?:const|let|var)?\s*[a-zA-Z0-9_$]*\s*=?\s*([a-zA-Z0-9_$]+)\.listen\(/;
+        const listenMatch = modifiedContent.match(listenRegex);
+        if (listenMatch) {
+            const appVar = listenMatch[1];
+            const fullMatch = listenMatch[0];
+            const errorMiddleware = `
+// Centralized Error Sanitization Middleware
+${appVar}.use((err, req, res, next) => {
+  const statusCode = err.status || err.statusCode || 500;
+  res.status(statusCode).json({
+    error: statusCode >= 500 ? 'Internal Server Error' : err.message,
+    timestamp: Date.now()
+  });
+});
+`;
+            modifiedContent = modifiedContent.replace(fullMatch, `${errorMiddleware}\n${fullMatch}`);
+            return {
+                modified: true,
+                content: modifiedContent,
+                description: 'Injected centralized error sanitization middleware to prevent stack trace leaks',
+            };
+        }
+        return { modified: false, content, description: 'Could not locate app.listen to inject error handler' };
+    }
+    /**
+     * 5. Slowloris & Request Socket Timeout
+     */
+    static applySocketTimeouts(content) {
+        if (/\.headersTimeout\s*=\s*\d+/.test(content) && /\.requestTimeout\s*=\s*\d+/.test(content)) {
+            return { modified: false, content, description: 'Server timeouts already configured' };
+        }
+        let modifiedContent = content;
+        // Match const server = app.listen(...) or server = http.createServer(...)
+        const serverMatch = modifiedContent.match(/(const|let|var)\s+([a-zA-Z0-9_$]+)\s*=\s*([a-zA-Z0-9_$]+)\.listen\(/);
+        if (serverMatch) {
+            const serverVar = serverMatch[2];
+            const injection = `\n// Enforce strict socket timeouts to mitigate slowloris attacks\n${serverVar}.headersTimeout = 5000;\n${serverVar}.requestTimeout = 10000;\n`;
+            modifiedContent = modifiedContent.trimEnd() + '\n' + injection;
+            return {
+                modified: true,
+                content: modifiedContent,
+                description: `Configured socket timeouts (${serverVar}.headersTimeout = 5s, ${serverVar}.requestTimeout = 10s)`,
+            };
+        }
+        return { modified: false, content, description: 'Could not locate HTTP server instance for timeout configuration' };
+    }
+    /**
+     * 6. Strict Host Header Whitelist Validation
+     */
+    static applyHostHeaderValidation(content) {
+        if (content.includes('allowedHosts') || content.includes('Host header validation guard') || content.includes('Blocked: Unrecognized or untrusted Host header')) {
+            return { modified: false, content, description: 'Host header whitelist validation already present' };
+        }
+        let modifiedContent = content;
+        const appMatch = modifiedContent.match(/([a-zA-Z0-9_$]+)\s*=\s*(express\s*\(\)|createApp\s*\(\))/);
+        if (appMatch) {
+            const appVar = appMatch[1];
+            const middleware = `\n// Host Header Whitelist Validation Guard\n${appVar}.use((req, res, next) => {\n  const rawHost = req.headers['host'] || req.headers['x-forwarded-host'] || '';\n  const host = String(Array.isArray(rawHost) ? rawHost[0] : rawHost).split(':')[0];\n  const allowedHosts = ['localhost', '127.0.0.1', '0.0.0.0'];\n  if (host && !allowedHosts.includes(host)) {\n    return res.status(400).json({ error: 'Blocked: Unrecognized or untrusted Host header' });\n  }\n  next();\n});\n`;
+            const appIndex = modifiedContent.indexOf(appMatch[0]);
+            const lineEnd = modifiedContent.indexOf('\n', appIndex);
+            modifiedContent = modifiedContent.slice(0, lineEnd + 1) + middleware + modifiedContent.slice(lineEnd + 1);
+            return {
+                modified: true,
+                content: modifiedContent,
+                description: `Injected strict Host header whitelist validation middleware into Express app (${appVar})`,
+            };
+        }
+        return { modified: false, content, description: 'Could not find Express app instance to inject host validation' };
+    }
+    /**
+     * 7. Path Traversal & Unsanitized Directory Escape Guard
+     */
+    static applyPathTraversalGuard(content) {
+        if (content.includes('Path Traversal Prohibited') || content.includes('directory traversal prohibited') || content.includes('pathTraversalGuard')) {
+            return { modified: false, content, description: 'Path traversal sanitization guard already present' };
+        }
+        let modifiedContent = content;
+        const appMatch = modifiedContent.match(/([a-zA-Z0-9_$]+)\s*=\s*(express\s*\(\)|createApp\s*\(\))/);
+        if (appMatch) {
+            const appVar = appMatch[1];
+            const middleware = `\n// Directory Path Traversal & Parameter Sanitization Guard\n${appVar}.use((req, res, next) => {\n  const rawUrl = decodeURIComponent(req.url || '');\n  if (rawUrl.includes('..') || rawUrl.includes('%2e%2e') || rawUrl.includes('%2E%2E')) {\n    return res.status(400).json({ error: 'Access Denied: Path Traversal Prohibited' });\n  }\n  next();\n});\n`;
+            const appIndex = modifiedContent.indexOf(appMatch[0]);
+            const lineEnd = modifiedContent.indexOf('\n', appIndex);
+            modifiedContent = modifiedContent.slice(0, lineEnd + 1) + middleware + modifiedContent.slice(lineEnd + 1);
+            return {
+                modified: true,
+                content: modifiedContent,
+                description: `Injected path traversal rejection middleware into Express app (${appVar})`,
+            };
+        }
+        return { modified: false, content, description: 'Could not find Express app instance to inject path traversal guard' };
+    }
+    /**
+     * 8. Duplicate Request Idempotency & Concurrency Race Protection
+     */
+    static applyIdempotencyProtection(content) {
+        if (content.includes('processedIdempotencyKeys') || content.includes('seenIdempotencyKeys') || content.includes('Duplicate transaction detected')) {
+            return { modified: false, content, description: 'Idempotency deduplication middleware already present' };
+        }
+        let modifiedContent = content;
+        const appMatch = modifiedContent.match(/([a-zA-Z0-9_$]+)\s*=\s*(express\s*\(\)|createApp\s*\(\))/);
+        if (appMatch) {
+            const appVar = appMatch[1];
+            const middleware = `\n// Transactional Idempotency & Concurrency Race Guard\nconst processedIdempotencyKeys = new Set();\n${appVar}.use((req, res, next) => {\n  const idemKey = req.headers['idempotency-key'];\n  if (idemKey && ['POST', 'PUT', 'PATCH'].includes(req.method)) {\n    if (processedIdempotencyKeys.has(idemKey)) {\n      return res.status(409).json({ error: 'Conflict: Duplicate transaction detected for Idempotency-Key' });\n    }\n    processedIdempotencyKeys.add(idemKey);\n    if (processedIdempotencyKeys.size > 1000) {\n      const first = processedIdempotencyKeys.values().next().value;\n      if (first) processedIdempotencyKeys.delete(first);\n    }\n  }\n  next();\n});\n`;
+            const appIndex = modifiedContent.indexOf(appMatch[0]);
+            const lineEnd = modifiedContent.indexOf('\n', appIndex);
+            modifiedContent = modifiedContent.slice(0, lineEnd + 1) + middleware + modifiedContent.slice(lineEnd + 1);
+            return {
+                modified: true,
+                content: modifiedContent,
+                description: `Injected duplicate request idempotency & race condition protection into Express app (${appVar})`,
+            };
+        }
+        return { modified: false, content, description: 'Could not find Express app instance to inject idempotency protection' };
+    }
+}

package/dist/healer/transformers/FastApiTransformers.d.ts

@@ -0,0 +1,19 @@
+/**
+ * FastAPI / Python Remediation Transformers
+ * Injects defensive security and timeout middleware into FastAPI applications.
+ */
+import { TransformerResult } from './ExpressTransformers.js';
+export declare class FastApiTransformers {
+    /**
+     * 1. Defensive Headers & Trusted Host Middleware
+     */
+    static applyDefensiveHeaders(content: string): TransformerResult;
+    /**
+     * 2. Payload Size Limit Middleware (HTTP 413)
+     */
+    static applyPayloadLimit(content: string): TransformerResult;
+    /**
+     * 3. CORS Lock-down
+     */
+    static applyCorsLockdown(content: string): TransformerResult;
+}

package/dist/healer/transformers/FastApiTransformers.js

@@ -0,0 +1,93 @@
+/**
+ * FastAPI / Python Remediation Transformers
+ * Injects defensive security and timeout middleware into FastAPI applications.
+ */
+export class FastApiTransformers {
+    /**
+     * 1. Defensive Headers & Trusted Host Middleware
+     */
+    static applyDefensiveHeaders(content) {
+        if (content.includes('TrustedHostMiddleware') || content.includes('X-Content-Type-Options')) {
+            return { modified: false, content, description: 'FastAPI security headers already configured' };
+        }
+        let modifiedContent = content;
+        const importStatement = `from starlette.middleware.trustedhost import TrustedHostMiddleware\nfrom starlette.middleware.base import BaseHTTPMiddleware\nfrom starlette.requests import Request\nfrom starlette.responses import Response\n`;
+        const middlewareClass = `
+class SecurityHeadersMiddleware(BaseHTTPMiddleware):
+    async def dispatch(self, request: Request, call_next):
+        response: Response = await call_next(request)
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["X-Frame-Options"] = "DENY"
+        response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
+        return response
+`;
+        // Add imports at top
+        modifiedContent = `${importStatement}\n${modifiedContent}`;
+        // Find app = FastAPI()
+        const appMatch = modifiedContent.match(/([a-zA-Z0-9_$]+)\s*=\s*FastAPI\s*\(/);
+        if (appMatch) {
+            const appVar = appMatch[1];
+            const injection = `\n${middlewareClass}\n${appVar}.add_middleware(SecurityHeadersMiddleware)\n`;
+            const appIndex = modifiedContent.indexOf(appMatch[0]);
+            const lineEnd = modifiedContent.indexOf('\n', appIndex);
+            modifiedContent = modifiedContent.slice(0, lineEnd + 1) + injection + modifiedContent.slice(lineEnd + 1);
+            return {
+                modified: true,
+                content: modifiedContent,
+                description: `Injected SecurityHeadersMiddleware into FastAPI app (${appVar})`,
+            };
+        }
+        return { modified: false, content, description: 'Could not find FastAPI app instance' };
+    }
+    /**
+     * 2. Payload Size Limit Middleware (HTTP 413)
+     */
+    static applyPayloadLimit(content) {
+        if (content.includes('Payload Too Large') || content.includes('MAX_CONTENT_LENGTH')) {
+            return { modified: false, content, description: 'Payload limit already present' };
+        }
+        let modifiedContent = content;
+        const middlewareClass = `
+# Enforce 1MB payload size limit
+@app.middleware("http")
+async def limit_payload_size(request, call_next):
+    content_length = request.headers.get("content-length")
+    if content_length and int(content_length) > 1024 * 1024:
+        from starlette.responses import JSONResponse
+        return JSONResponse(status_code=413, content={"error": "Payload Too Large", "limitBytes": 1048576})
+    return await call_next(request)
+`;
+        const appMatch = modifiedContent.match(/app\s*=\s*FastAPI\s*\(/);
+        if (appMatch) {
+            const appIndex = modifiedContent.indexOf(appMatch[0]);
+            const lineEnd = modifiedContent.indexOf('\n', appIndex);
+            modifiedContent = modifiedContent.slice(0, lineEnd + 1) + middlewareClass + modifiedContent.slice(lineEnd + 1);
+            return {
+                modified: true,
+                content: modifiedContent,
+                description: 'Injected request payload size limiter (HTTP 413 on >1MB)',
+            };
+        }
+        return { modified: false, content, description: 'Could not locate app = FastAPI() instance' };
+    }
+    /**
+     * 3. CORS Lock-down
+     */
+    static applyCorsLockdown(content) {
+        if (!content.includes('CORSMiddleware')) {
+            return { modified: false, content, description: 'CORSMiddleware not in use' };
+        }
+        let modifiedContent = content;
+        let modified = false;
+        // Replace allow_origins=["*"] with explicit whitelist
+        if (modifiedContent.includes('allow_origins=["*"]') || modifiedContent.includes("allow_origins=['*']")) {
+            modifiedContent = modifiedContent.replace(/allow_origins=\[['"][*]['"]\]/g, 'allow_origins=["http://localhost:3000", "http://127.0.0.1:3000"]');
+            modified = true;
+        }
+        return {
+            modified,
+            content: modifiedContent,
+            description: modified ? 'Replaced wildcard CORS with explicit origin whitelist' : 'CORS configuration already restricted',
+        };
+    }
+}

package/dist/healer/transformers/GoTransformers.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Go / Gin & net/http Remediation Transformers
+ * Injects defensive middleware and timeout configurations into Go applications.
+ */
+import { TransformerResult } from './ExpressTransformers.js';
+export declare class GoTransformers {
+    /**
+     * 1. Defensive Headers (nosniff, frame-options)
+     */
+    static applyDefensiveHeaders(content: string): TransformerResult;
+    /**
+     * 2. Request Body Limit (HTTP 413)
+     */
+    static applyPayloadLimit(content: string): TransformerResult;
+    /**
+     * 3. Slowloris Server Timeouts
+     */
+    static applyServerTimeouts(content: string): TransformerResult;
+}

package/dist/healer/transformers/GoTransformers.js

@@ -0,0 +1,106 @@
+/**
+ * Go / Gin & net/http Remediation Transformers
+ * Injects defensive middleware and timeout configurations into Go applications.
+ */
+export class GoTransformers {
+    /**
+     * 1. Defensive Headers (nosniff, frame-options)
+     */
+    static applyDefensiveHeaders(content) {
+        if (content.includes('X-Content-Type-Options') || content.includes('nosniff')) {
+            return { modified: false, content, description: 'Security headers already present in Go code' };
+        }
+        let modifiedContent = content;
+        // Detect Gin router (e.g. r := gin.Default() or router := gin.New())
+        const ginMatch = modifiedContent.match(/([a-zA-Z0-9_]+)\s*:=\s*gin\.(Default|New)\(\)/);
+        if (ginMatch) {
+            const routerVar = ginMatch[1];
+            const middleware = `
+\t// Defensive Security Headers Middleware
+\t${routerVar}.Use(func(c *gin.Context) {
+\t\tc.Header("X-Content-Type-Options", "nosniff")
+\t\tc.Header("X-Frame-Options", "DENY")
+\t\tc.Header("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
+\t\tc.Next()
+\t})
+`;
+            modifiedContent = modifiedContent.replace(ginMatch[0], `${ginMatch[0]}${middleware}`);
+            return {
+                modified: true,
+                content: modifiedContent,
+                description: `Injected security headers middleware into Gin router (${routerVar})`,
+            };
+        }
+        return { modified: false, content, description: 'Could not find Gin router instance' };
+    }
+    /**
+     * 2. Request Body Limit (HTTP 413)
+     */
+    static applyPayloadLimit(content) {
+        if (content.includes('MaxBytesReader')) {
+            return { modified: false, content, description: 'MaxBytesReader payload limit already in use' };
+        }
+        let modifiedContent = content;
+        const ginMatch = modifiedContent.match(/([a-zA-Z0-9_]+)\s*:=\s*gin\.(Default|New)\(\)/);
+        if (ginMatch) {
+            const routerVar = ginMatch[1];
+            const middleware = `
+\t// Enforce 1MB payload size limit (HTTP 413 on buffer overflow)
+\t${routerVar}.Use(func(c *gin.Context) {
+\t\tc.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, 1048576)
+\t\tc.Next()
+\t})
+`;
+            // Ensure "net/http" is imported
+            if (!modifiedContent.includes('"net/http"')) {
+                modifiedContent = modifiedContent.replace(/import\s*\(/, 'import (\n\t"net/http"');
+            }
+            modifiedContent = modifiedContent.replace(ginMatch[0], `${ginMatch[0]}${middleware}`);
+            return {
+                modified: true,
+                content: modifiedContent,
+                description: `Configured 1MB request body limit using http.MaxBytesReader on ${routerVar}`,
+            };
+        }
+        return { modified: false, content, description: 'Could not locate Go router instance' };
+    }
+    /**
+     * 3. Slowloris Server Timeouts
+     */
+    static applyServerTimeouts(content) {
+        if (content.includes('ReadHeaderTimeout') || content.includes('ReadTimeout')) {
+            return { modified: false, content, description: 'Go HTTP server timeouts already configured' };
+        }
+        let modifiedContent = content;
+        // If using r.Run(":8080") or http.ListenAndServe
+        const runMatch = modifiedContent.match(/([a-zA-Z0-9_]+)\.Run\(([^)]*)\)/);
+        if (runMatch) {
+            const routerVar = runMatch[1];
+            const addr = runMatch[2] || '":8080"';
+            const replacement = `
+\tsrv := &http.Server{
+\t\tAddr:              ${addr},
+\t\tHandler:           ${routerVar},
+\t\tReadHeaderTimeout: 5 * time.Second,
+\t\tReadTimeout:       10 * time.Second,
+\t\tWriteTimeout:      15 * time.Second,
+\t}
+\tsrv.ListenAndServe()
+`;
+            // Ensure time and net/http are imported
+            if (!modifiedContent.includes('"time"')) {
+                modifiedContent = modifiedContent.replace(/import\s*\(/, 'import (\n\t"time"');
+            }
+            if (!modifiedContent.includes('"net/http"')) {
+                modifiedContent = modifiedContent.replace(/import\s*\(/, 'import (\n\t"net/http"');
+            }
+            modifiedContent = modifiedContent.replace(runMatch[0], replacement.trim());
+            return {
+                modified: true,
+                content: modifiedContent,
+                description: 'Replaced unbounded Run() with hardened http.Server enforcing ReadHeaderTimeout and ReadTimeout',
+            };
+        }
+        return { modified: false, content, description: 'Could not locate router.Run() call to configure server timeouts' };
+    }
+}

package/dist/healer/types.d.ts

@@ -0,0 +1,59 @@
+export type BackendFramework = 'express' | 'fastify' | 'koa' | 'nestjs' | 'fastapi' | 'flask' | 'django' | 'go-gin' | 'go-chi' | 'go-nethttp' | 'rust-actix' | 'rust-axum' | 'java-spring' | 'csharp-dotnet' | 'generic-node' | 'generic-python' | 'generic-go' | 'generic-rust' | 'generic-java' | 'generic-csharp' | 'generic-backend';
+export type AiProviderType = 'ollama' | 'openai' | 'anthropic' | 'gemini' | 'custom';
+export interface AiProviderConfig {
+    provider: AiProviderType;
+    endpoint?: string;
+    apiKey?: string;
+    model?: string;
+}
+export interface HealPatch {
+    id: string;
+    checkName: string;
+    filePath: string;
+    relativePath: string;
+    originalContent: string;
+    remediatedContent: string;
+    diff: string;
+    description: string;
+    framework: BackendFramework;
+    engine?: 'codemod' | 'ai-agent';
+}
+export interface HealScanOptions {
+    projectDir: string;
+    failedChecks?: string[];
+    aiConfig?: AiProviderConfig;
+    engineMode?: 'codemod' | 'ai' | 'hybrid';
+}
+export interface HealScanResult {
+    success: boolean;
+    framework: BackendFramework;
+    projectRoot: string;
+    entryFile?: string;
+    patches: HealPatch[];
+    warnings: string[];
+    engineUsed?: 'codemod' | 'ai-agent' | 'hybrid';
+}
+export interface HealApplyOptions {
+    projectDir: string;
+    patchIds?: string[];
+    failedChecks?: string[];
+    createBackup?: boolean;
+    aiConfig?: AiProviderConfig;
+    engineMode?: 'codemod' | 'ai' | 'hybrid';
+}
+export interface HealApplyResult {
+    success: boolean;
+    appliedCount: number;
+    appliedPatches: string[];
+    backupDir?: string;
+    errors?: string[];
+}
+export interface HealRollbackOptions {
+    projectDir: string;
+    backupDir: string;
+}
+export interface HealRollbackResult {
+    success: boolean;
+    restoredFiles: string[];
+    errors?: string[];
+}

package/dist/healer/types.js

@@ -0,0 +1 @@
+export {};

package/dist/redteam/EccAgentBridge.d.ts

@@ -0,0 +1,20 @@
+/**
+ * FaultMesh — Autonomous Red Chaos Team Engine
+ * Agent Squadron Bridge: Loads and translates autonomous agent personas into active attack strategies.
+ */
+import { RedTeamPersona, CampaignIntensity, AssaultWave } from './types.js';
+export declare class EccAgentBridge {
+    private agentsDir;
+    private personas;
+    private initialized;
+    constructor(customAgentsDir?: string);
+    initialize(): Promise<void>;
+    getPersonas(): Promise<RedTeamPersona[]>;
+    getPersona(id: string): RedTeamPersona | undefined;
+    private parseAgentMarkdown;
+    private createFallbackPersona;
+    /**
+     * Translates active personas and chosen intensity into calibrated assault waves
+     */
+    generateCampaignWaves(intensity?: CampaignIntensity): AssaultWave[];
+}