fullshield 0.1.3 → 0.3.0

package/dist/compliance.js

@@ -73,6 +73,7 @@ var RULE_MAP = [
   ROW("SUPPLY-BEHAVIOR-001", "A06:2021 Vulnerable Components", "CWE-829", "V14.2.1", "PCI DSS 6.3.3"),
   ROW("SUPPLY-COOLDOWN-001", "A06:2021 Vulnerable Components", "CWE-1104", "V14.2.1", "PCI DSS 6.3.3"),
   ROW("SUPPLY-LOCKURL-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
+  ROW("SUPPLY-LOCKINTEGRITY-001", "A08:2021 Integrity Failures", "CWE-353", "V14.2.3", "PCI DSS 6.3.3"),
   ROW("SUPPLY-CONFUSION-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
   ROW("SUPPLY-PROVENANCE-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
   ROW("SUPPLY-WORM-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 6.3.3 / 12.10"),
@@ -81,6 +82,9 @@ var RULE_MAP = [
   ROW("IAC-GHA-PRTARGET-001", "A01:2021 Broken Access Control", "CWE-269", "V4.1.1", "PCI DSS 7.2"),
   ROW("IAC-GHA-PERMS-001", "A01:2021 Broken Access Control", "CWE-250", "V4.1.1", "PCI DSS 7.2"),
   ROW("IAC-GHA-SECRETLOG-001", "A09:2021 Security Logging Failures", "CWE-532", "V7.1.1", "PCI DSS 3.2 / 10.2"),
+  ROW("IAC-GHA-INJECT-001", "A03:2021 Injection", "CWE-94", "V5.2.4", "PCI DSS 6.2.4"),
+  ROW("IAC-GHA-PRCHECKOUT-001", "A01:2021 Broken Access Control", "CWE-829", "V4.1.1", "PCI DSS 6.2.4"),
+  ROW("DEPS-LICENSE-001", "A06:2021 Vulnerable Components", "CWE-1104", "V14.2.1", "PCI DSS 6.3.3"),
   ROW("IAC-TF-S3PUBLIC-001", "A01:2021 Broken Access Control", "CWE-284", "V12.1.1", "PCI DSS 1.3 / 3.2"),
   ROW("IAC-TF-SGOPEN-001", "A05:2021 Security Misconfiguration", "CWE-284", "V1.4.1", "PCI DSS 1.2 / 1.3"),
   ROW("IAC-TF-UNENCRYPTED-001", "A02:2021 Cryptographic Failures", "CWE-311", "V6.2.1", "PCI DSS 3.4 / 4.2"),
@@ -107,6 +111,7 @@ var RULE_MAP = [
   ROW("SAST-TIMING-001", "A07:2021 Identification Failures", "CWE-208", "V2.10.3", "PCI DSS 8.3"),
   ROW("SAST-HASH-001", "A02:2021 Cryptographic Failures", "CWE-916", "V6.2.2", "PCI DSS 8.3.1"),
   ROW("SAST-GQL-001", "A04:2021 Insecure Design", "CWE-770/200", "V13.1.1", "PCI DSS 6.2.4"),
+  ROW("SAST-SKIP-001", "A05:2021 Security Misconfiguration", "CWE-693", "V1.1.1", "PCI DSS 6.2.4"),
   ROW("CONFIG-TRUSTPROXY-001", "A07:2021 Identification Failures", "CWE-290", "V2.2.1", "PCI DSS 8.3.4"),
   ROW("SECRET-BUNDLE-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 3.2 / 8.3"),
   ROW("DLP-SECRET-001", "A02:2021 Cryptographic Failures", "CWE-200", "V8.3.4", "PCI DSS 3.2 / 8.3"),

package/dist/dashboard.js

@@ -5,8 +5,22 @@ import { join } from 'path';
 
 // src/dashboard/index.ts
 var require2 = createRequire(import.meta.url);
+function nodeSqliteAvailable() {
+  try {
+    require2("node:sqlite");
+    return true;
+  } catch {
+    return false;
+  }
+}
+function nodeSqliteUnavailableMessage(feature) {
+  return `${feature} requires Node 22.13+ (node:sqlite is not available on Node ${process.versions.node})`;
+}
+
+// src/dashboard/index.ts
+var require3 = createRequire(import.meta.url);
 function sqliteDb(file) {
-  const { DatabaseSync } = require2("node:sqlite");
+  const { DatabaseSync } = require3("node:sqlite");
   let db;
   try {
     db = new DatabaseSync(file);
@@ -57,6 +71,9 @@ function sqliteDb(file) {
   };
 }
 function openHistory(dir) {
+  if (!nodeSqliteAvailable()) {
+    throw new Error(nodeSqliteUnavailableMessage("history"));
+  }
   const root = join(dir, ".fullshield");
   mkdirSync(root, { recursive: true });
   return sqliteDb(join(root, "history.db"));

package/dist/iac.js

@@ -22,6 +22,32 @@ function finding(ruleId, title, message, file, severity = "high") {
     remediation: "Pin actions by SHA, drop pull_request_target, tighten permissions, close 0.0.0.0/0, encrypt storage, drop privileged."
   };
 }
+function runBodies(text) {
+  const bodies = [];
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i += 1) {
+    const match = /^(\s*)(?:-\s+)?run:\s*(.*)$/.exec(lines[i] ?? "");
+    if (match === null) continue;
+    const indent = match[1]?.length ?? 0;
+    let body = match[2] ?? "";
+    if (body === "|" || body === ">") {
+      const block = [];
+      for (let j = i + 1; j < lines.length; j += 1) {
+        const line = lines[j] ?? "";
+        if (line.trim() === "") {
+          block.push(line);
+          continue;
+        }
+        const lead = line.match(/^\s*/)?.[0].length ?? 0;
+        if (lead <= indent) break;
+        block.push(line);
+      }
+      body = block.join("\n");
+    }
+    bodies.push(body);
+  }
+  return bodies;
+}
 function walk(dir, out = []) {
   if (!existsSync(dir)) return out;
   for (const entry of readdirSync(dir, { withFileTypes: true })) {
@@ -49,6 +75,28 @@ function scanIac(dir, opts = {}) {
       if (/pull_request_target/.test(text)) {
         findings.push(finding("IAC-GHA-PRTARGET-001", "pull_request_target workflow", "untrusted PR can run with base secrets", rel, "critical"));
       }
+      if (/pull_request_target/.test(text) && /actions\/checkout/.test(text) && /github\.event\.pull_request/.test(text)) {
+        findings.push(
+          finding(
+            "IAC-GHA-PRCHECKOUT-001",
+            "pull_request_target checks out pull-request code",
+            "untrusted head can run with the base repository token",
+            rel,
+            "critical"
+          )
+        );
+      }
+      if (runBodies(text).some((body) => /\$\{\{\s*github\.event\./.test(body))) {
+        findings.push(
+          finding(
+            "IAC-GHA-INJECT-001",
+            "Workflow run step interpolates github.event",
+            "untrusted event text is passed to the shell",
+            rel,
+            "critical"
+          )
+        );
+      }
       if (/permissions:\s*\n\s+contents:\s*write/.test(text) || /permissions:\s+write-all/.test(text)) {
         findings.push(finding("IAC-GHA-PERMS-001", "Overly broad GitHub Actions permissions", "write-all or contents: write", rel));
       }

package/dist/index.d.ts

@@ -42,9 +42,11 @@ interface Finding {
         note: string;
     }>;
     /** Dependency reachability (Phase 13 / harden-3). */
-    reachability?: 'reachable' | 'imported-not-called' | 'reachable-via-dependency' | 'not-imported' | 'reachability-unknown';
+    reachability?: 'reachable' | 'imported-not-called' | 'reachable-via-dependency' | 'not-imported' | 'reachability-unknown' | 'symbol-reachable' | 'symbol-not-called';
     /** Lockfile path from an imported direct dependency, e.g. express > body-parser > qs. */
     dependencyPath?: string[];
+    /** Every retained dependency path for this package+advisory (shortest first). */
+    dependencyPaths?: string[][];
     /** Deterministic (default) vs AI-added. AI findings never fail CI. */
     source?: 'deterministic' | 'ai';
     aiVerdict?: 'true-positive' | 'likely-false-positive' | 'needs-review';
@@ -93,14 +95,23 @@ interface AiConfig {
     /** Highest-severity findings sent to the model first. */
     maxFindings: number;
 }
+interface SastConfig {
+    /** Files larger than this are not parsed. Reported as SAST-SKIP-001. */
+    maxFileBytes: number;
+}
 interface ResolvedConfig {
     modules: ModuleName[];
     failOn: Severity;
     ignore: string[];
+    /** When false, generated/vendored/minified excludes are not applied. */
+    defaultExcludes: boolean;
+    /** Replaces the built-in exclude list when set. */
+    excludes?: string[];
     baseline: string;
     notify: NotifyConfig;
     deps: DepsConfig;
     ai: AiConfig;
+    sast: SastConfig;
 }
 declare const DEFAULT_CONFIG: ResolvedConfig;
 declare class ConfigError extends Error {
@@ -221,6 +232,8 @@ interface ScanMetadata {
     modulesRequested: ModuleName[];
     /** Requested modules that are actually implemented and ran. */
     modulesRun: ModuleName[];
+    /** Set when `scan --history` stops at the commit cap. Exact text: `scanned N of M commits`. */
+    history?: string;
 }
 interface PolicyScanResult {
     enabled: true;
@@ -236,6 +249,8 @@ interface ScanResult {
     config: ResolvedConfig;
     /** Present only when experimental policy was loaded from `fullshield.policy.json`. */
     policy?: PolicyScanResult;
+    /** Set when a baseline suppression is missing fields or has expired. */
+    suppressionErrors?: string[];
 }
 /**
  * Scanner modules register here as their phases are built.
@@ -256,6 +271,13 @@ interface WalkOptions {
     cwd: string;
     /** Extra gitignore-style patterns (from config) on top of .gitignore. */
     ignore?: string[];
+    /**
+     * When false, `excludes` / `DEFAULT_EXCLUDES` are not applied.
+     * `.git/` and `.fullshield/` are still ignored.
+     */
+    defaultExcludes?: boolean;
+    /** Replaces `DEFAULT_EXCLUDES` when set. Ignored when `defaultExcludes` is false. */
+    excludes?: string[];
 }
 /**
  * Recursively list files under `cwd`, respecting the project's .gitignore and
@@ -388,6 +410,14 @@ declare function runAiFix(options: {
     client: AiClient;
 }): Promise<AiFixResult>;
 
+interface Suppression {
+    ruleId: string;
+    file?: string;
+    owner: string;
+    reason: string;
+    /** ISO date (`YYYY-MM-DD`) or datetime. */
+    expires: string;
+}
 interface BaselineFile {
     version: 1;
     findings: Array<{
@@ -396,6 +426,7 @@ interface BaselineFile {
         file?: string;
         line?: number;
     }>;
+    suppressions?: Suppression[];
 }
 declare function readBaseline(path: string): Promise<BaselineFile | undefined>;
 declare function writeBaseline(path: string, findings: readonly Finding[]): Promise<void>;
@@ -413,25 +444,57 @@ declare function parseIgnore(line: string): {
 declare function applyInlineSuppressions(findings: readonly Finding[], sources: Readonly<Record<string, string>>): Finding[];
 
 /** Human-readable report: findings grouped by severity, highest first. */
-declare function renderConsoleReport(result: ScanResult): string;
+declare function renderConsoleReport(input: ScanResult): string;
 
 /** Standalone HTML report. Finding text is escaped; secrets are already masked. */
-declare function renderHtmlReport(result: ScanResult): string;
+declare function renderHtmlReport(input: ScanResult): string;
 
 /** Machine-readable report: full findings plus summary and scan metadata. */
 declare function renderJsonReport(result: ScanResult): string;
 
 /** Shareable Markdown report grouped by severity (highest first). */
-declare function renderMarkdownReport(result: ScanResult): string;
+declare function renderMarkdownReport(input: ScanResult): string;
 
 /** SARIF 2.1.0 report for GitHub Code Scanning and other consumers. */
-declare function renderSarifReport(result: ScanResult): string;
+declare function renderSarifReport(input: ScanResult): string;
 /**
  * Structural SARIF 2.1.0 schema check for the documents we emit.
  * Returns an empty array when valid; otherwise human-readable errors.
  */
 declare function validateSarif21(doc: unknown): string[];
 
+/**
+ * GitHub Actions workflow commands.
+ * Critical and high are `error`, medium is `warning`, low and info are `notice`.
+ */
+declare function renderGithubAnnotations(input: ScanResult): string;
+/**
+ * JUnit XML. Medium and above are failures. Low and info are skipped.
+ * An empty scan is one passing testcase.
+ */
+declare function renderJunitReport(input: ScanResult): string;
+/** GitLab Code Quality report. Severities map to info, minor, major, critical, blocker. */
+declare function renderGitlabCodeQuality(input: ScanResult): string;
+
+/** Compare two scan JSON files. Off unless this is `1`. */
+declare const DIFF_FLAG = "FULLSHIELD_EXPERIMENTAL_DIFF";
+
+type DiffFinding = Finding;
+interface ScanDiff {
+    unchanged: DiffFinding[];
+    added: DiffFinding[];
+    removed: DiffFinding[];
+    moved: Array<{
+        before: DiffFinding;
+        after: DiffFinding;
+    }>;
+}
+/** Compare two finding lists. Does not invent findings. */
+declare function diffScans(before: readonly DiffFinding[], after: readonly DiffFinding[]): ScanDiff;
+declare function parseScanDocument(text: string): DiffFinding[];
+/** Human summary. Lists at most 20 added findings. */
+declare function renderDiffText(diff: ScanDiff): string;
+
 declare function buildSbom(cwd: string): Promise<Record<string, unknown>>;
 
 interface SbomComponent {
@@ -481,4 +544,4 @@ declare function provenanceCoverage(packages: readonly {
     version: string;
 }[], known: ReadonlyMap<string, boolean>): ProvenanceScore;
 
-export { type AiConfig, type AppliedPolicy, type BaselineFile, CONFIG_FILE_NAME, type Confidence, ConfigError, DEFAULT_CONFIG, type DepsConfig, type Finding, type FindingSummary, type FixOptions, type FixPatch, type FixProposal, type FixResult, type FullShieldPolicy, type GuardTool, type GuardToolCall, IMPLEMENTED_MODULES, MODULE_NAMES, type McpScanOptions, type ModuleContext, type ModuleName, type NotifyConfig, POLICY_FILE_NAME, POLICY_FLAG, POLICY_PEER_ERROR, PolicyError, type PolicyException, type PolicyScanResult, type ResolvedConfig, SEVERITIES, type SbomComponent, type SbomInput, type ScanMetadata, type ScanModule, type ScanOptions, type ScanResult, type Severity, type WalkOptions, analyzeWorkflowTampering, analyzeWormIndicators, applyBaseline, applyInlineSuppressions, applyPolicy, buildCycloneDxVex, buildOpenVex, buildSbom, buildVex, builtinModules, createAiClient, experimentalVex, failsCi, guardTools, isInternalAi, isLiveAi, isModuleName, isPolicyEnabled, isSeverity, loadConfig, loadPolicy, makeFindingId, mcpCfgEnabled, mcpHomeConfigPaths, meetsThreshold, packageVersion, parseIgnore, parsePolicy, provenanceCoverage, readBaseline, renderConsoleReport, renderCycloneDx, renderHtmlReport, renderJsonReport, renderMarkdownReport, renderPrSummary, renderSarifReport, ruleDocsUrl, runAiFix, runFix, runScan, scan, scanMcpConfig, scanTextForSecrets, severityRank, sortFindings, summarize, validateCycloneDx15, validateCycloneDxVex, validateOpenVex, validateSarif21, walkFiles, writeBaseline };
+export { type AiConfig, type AppliedPolicy, type BaselineFile, CONFIG_FILE_NAME, type Confidence, ConfigError, DEFAULT_CONFIG, DIFF_FLAG, type DepsConfig, type Finding, type FindingSummary, type FixOptions, type FixPatch, type FixProposal, type FixResult, type FullShieldPolicy, type GuardTool, type GuardToolCall, IMPLEMENTED_MODULES, MODULE_NAMES, type McpScanOptions, type ModuleContext, type ModuleName, type NotifyConfig, POLICY_FILE_NAME, POLICY_FLAG, POLICY_PEER_ERROR, PolicyError, type PolicyException, type PolicyScanResult, type ResolvedConfig, SEVERITIES, type SbomComponent, type SbomInput, type ScanDiff, type ScanMetadata, type ScanModule, type ScanOptions, type ScanResult, type Severity, type WalkOptions, analyzeWorkflowTampering, analyzeWormIndicators, applyBaseline, applyInlineSuppressions, applyPolicy, buildCycloneDxVex, buildOpenVex, buildSbom, buildVex, builtinModules, createAiClient, diffScans, experimentalVex, failsCi, guardTools, isInternalAi, isLiveAi, isModuleName, isPolicyEnabled, isSeverity, loadConfig, loadPolicy, makeFindingId, mcpCfgEnabled, mcpHomeConfigPaths, meetsThreshold, packageVersion, parseIgnore, parsePolicy, parseScanDocument, provenanceCoverage, readBaseline, renderConsoleReport, renderCycloneDx, renderDiffText, renderGithubAnnotations, renderGitlabCodeQuality, renderHtmlReport, renderJsonReport, renderJunitReport, renderMarkdownReport, renderPrSummary, renderSarifReport, ruleDocsUrl, runAiFix, runFix, runScan, scan, scanMcpConfig, scanTextForSecrets, severityRank, sortFindings, summarize, validateCycloneDx15, validateCycloneDxVex, validateOpenVex, validateSarif21, walkFiles, writeBaseline };