guardlink 1.0.0

package/dist/analyzer/sarif.js

@@ -0,0 +1,149 @@
+/**
+ * GuardLink SARIF — Convert threat model findings to SARIF 2.1.0.
+ *
+ * SARIF (Static Analysis Results Interchange Format) is consumed by:
+ *   - GitHub Advanced Security (code scanning alerts)
+ *   - VS Code SARIF Viewer extension
+ *   - Azure DevOps
+ *   - SonarQube, Snyk, etc.
+ *
+ * We emit results for:
+ *   1. Unmitigated exposures (the primary security findings)
+ *   2. Parse errors (annotation syntax problems)
+ *   3. Dangling references (broken #id refs)
+ *
+ * @exposes #sarif to #info-disclosure [low] cwe:CWE-200 -- "SARIF output contains detailed threat model findings"
+ * @accepts #info-disclosure on #sarif -- "SARIF export for security tools is the intended feature"
+ * @exposes #sarif to #arbitrary-write [high] cwe:CWE-73 -- "SARIF written to user-specified output path"
+ * @mitigates #sarif against #arbitrary-write using #path-validation -- "CLI resolves output path before write"
+ * @flows #parser -> #sarif via ThreatModel -- "SARIF generator receives parsed threat model"
+ * @flows #sarif -> External_Security_Tools via SARIF_JSON -- "Output consumed by GitHub, VS Code, etc."
+ */
+// ─── Rule definitions ────────────────────────────────────────────────
+const RULES = [
+    {
+        id: 'guardlink/unmitigated-exposure',
+        name: 'UnmitigatedExposure',
+        shortDescription: { text: 'Asset exposed to threat with no mitigation or acceptance' },
+        fullDescription: { text: 'An @exposes annotation exists but no matching @mitigates or @accepts covers this (asset, threat) pair. This represents an acknowledged but unaddressed security risk.' },
+        helpUri: 'https://guardlink.bugb.io/docs/exposures',
+        defaultConfiguration: { level: 'warning' },
+    },
+    {
+        id: 'guardlink/unmitigated-critical',
+        name: 'UnmitigatedCriticalExposure',
+        shortDescription: { text: 'Critical/high severity exposure with no mitigation' },
+        fullDescription: { text: 'A critical or high severity exposure exists without mitigation. This should be addressed before deployment.' },
+        helpUri: 'https://guardlink.bugb.io/docs/exposures',
+        defaultConfiguration: { level: 'error' },
+    },
+    {
+        id: 'guardlink/parse-error',
+        name: 'AnnotationParseError',
+        shortDescription: { text: 'Malformed GuardLink annotation' },
+        fullDescription: { text: 'A GuardLink annotation could not be parsed. Check syntax against the specification.' },
+        helpUri: 'https://guardlink.bugb.io/docs/syntax',
+        defaultConfiguration: { level: 'error' },
+    },
+    {
+        id: 'guardlink/dangling-ref',
+        name: 'DanglingReference',
+        shortDescription: { text: 'Reference to undefined threat, control, or asset ID' },
+        fullDescription: { text: 'An annotation references a #id that is not defined anywhere in the project.' },
+        helpUri: 'https://guardlink.bugb.io/docs/definitions',
+        defaultConfiguration: { level: 'warning' },
+    },
+];
+export function generateSarif(model, diagnostics = [], danglingRefs = [], options = {}) {
+    const { includeDiagnostics = true, includeDanglingRefs = true } = options;
+    const results = [];
+    // ── Unmitigated exposures ──
+    const mitigated = new Set();
+    const accepted = new Set();
+    for (const m of model.mitigations)
+        mitigated.add(`${m.asset}::${m.threat}`);
+    for (const a of model.acceptances)
+        accepted.add(`${a.asset}::${a.threat}`);
+    for (const e of model.exposures) {
+        const key = `${e.asset}::${e.threat}`;
+        if (mitigated.has(key) || accepted.has(key))
+            continue;
+        // Severity filter
+        if (options.minSeverity && !meetsMinSeverity(e.severity, options.minSeverity))
+            continue;
+        const isCritical = e.severity === 'critical' || e.severity === 'high';
+        const ruleId = isCritical ? 'guardlink/unmitigated-critical' : 'guardlink/unmitigated-exposure';
+        const level = isCritical ? 'error' : 'warning';
+        const threat = e.threat.startsWith('#') ? e.threat.slice(1) : e.threat;
+        const desc = e.description ? `: ${e.description}` : '';
+        results.push({
+            ruleId,
+            level,
+            message: { text: `${e.asset} is exposed to ${threat}${desc}` },
+            locations: [locationFrom(e.location.file, e.location.line)],
+            properties: {
+                severity: e.severity || 'unset',
+                asset: e.asset,
+                threat: e.threat,
+                ...(e.external_refs.length > 0 ? { externalRefs: e.external_refs } : {}),
+            },
+        });
+    }
+    // ── Parse errors ──
+    if (includeDiagnostics) {
+        for (const d of diagnostics) {
+            if (d.level !== 'error')
+                continue;
+            results.push({
+                ruleId: 'guardlink/parse-error',
+                level: 'error',
+                message: { text: d.message },
+                locations: [locationFrom(d.file, d.line)],
+            });
+        }
+    }
+    // ── Dangling refs ──
+    if (includeDanglingRefs) {
+        for (const d of danglingRefs) {
+            results.push({
+                ruleId: 'guardlink/dangling-ref',
+                level: 'warning',
+                message: { text: d.message },
+                locations: [locationFrom(d.file, d.line)],
+            });
+        }
+    }
+    return {
+        $schema: 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json',
+        version: '2.1.0',
+        runs: [{
+                tool: {
+                    driver: {
+                        name: 'GuardLink',
+                        version: '1.0.0',
+                        informationUri: 'https://guardlink.bugb.io',
+                        rules: RULES,
+                    },
+                },
+                results,
+            }],
+    };
+}
+// ─── Helpers ─────────────────────────────────────────────────────────
+function locationFrom(file, line) {
+    // SARIF uses forward-slash URIs
+    const uri = file.replace(/\\/g, '/');
+    return {
+        physicalLocation: {
+            artifactLocation: { uri },
+            region: { startLine: line },
+        },
+    };
+}
+const SEV_ORDER = { critical: 0, high: 1, medium: 2, low: 3 };
+function meetsMinSeverity(actual, min) {
+    if (!actual || !min)
+        return true;
+    return (SEV_ORDER[actual] ?? 4) <= (SEV_ORDER[min] ?? 4);
+}
+//# sourceMappingURL=sarif.js.map

package/dist/analyzer/sarif.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../src/analyzer/sarif.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAsDH,wEAAwE;AAExE,MAAM,KAAK,GAAgB;IACzB;QACE,EAAE,EAAE,gCAAgC;QACpC,IAAI,EAAE,qBAAqB;QAC3B,gBAAgB,EAAE,EAAE,IAAI,EAAE,0DAA0D,EAAE;QACtF,eAAe,EAAE,EAAE,IAAI,EAAE,uKAAuK,EAAE;QAClM,OAAO,EAAE,0CAA0C;QACnD,oBAAoB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;KAC3C;IACD;QACE,EAAE,EAAE,gCAAgC;QACpC,IAAI,EAAE,6BAA6B;QACnC,gBAAgB,EAAE,EAAE,IAAI,EAAE,oDAAoD,EAAE;QAChF,eAAe,EAAE,EAAE,IAAI,EAAE,6GAA6G,EAAE;QACxI,OAAO,EAAE,0CAA0C;QACnD,oBAAoB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;KACzC;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,sBAAsB;QAC5B,gBAAgB,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE;QAC5D,eAAe,EAAE,EAAE,IAAI,EAAE,qFAAqF,EAAE;QAChH,OAAO,EAAE,uCAAuC;QAChD,oBAAoB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;KACzC;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,mBAAmB;QACzB,gBAAgB,EAAE,EAAE,IAAI,EAAE,qDAAqD,EAAE;QACjF,eAAe,EAAE,EAAE,IAAI,EAAE,6EAA6E,EAAE;QACxG,OAAO,EAAE,4CAA4C;QACrD,oBAAoB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;KAC3C;CACF,CAAC;AAaF,MAAM,UAAU,aAAa,CAC3B,KAAkB,EAClB,cAAiC,EAAE,EACnC,eAAkC,EAAE,EACpC,UAAwB,EAAE;IAE1B,MAAM,EAAE,kBAAkB,GAAG,IAAI,EAAE,mBAAmB,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAE1E,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,8BAA8B;IAC9B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW;QAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAE3E,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QACtC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAEtD,kBAAkB;QAClB,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC;YAAE,SAAS;QAExF,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC;QACtE,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,gCAAgC,CAAC;QAChG,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,OAAgB,CAAC,CAAC,CAAC,SAAkB,CAAC;QAEjE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACvE,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAEvD,OAAO,CAAC,IAAI,CAAC;YACX,MAAM;YACN,KAAK;YACL,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,kBAAkB,MAAM,GAAG,IAAI,EAAE,EAAE;YAC9D,SAAS,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC3D,UAAU,EAAE;gBACV,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,OAAO;gBAC/B,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzE;SACF,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB;IACrB,IAAI,kBAAkB,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO;gBAAE,SAAS;YAClC,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,uBAAuB;gBAC/B,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;gBAC5B,SAAS,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,IAAI,mBAAmB,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,wBAAwB;gBAChC,KAAK,EAAE,SAAS;gBAChB,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;gBAC5B,SAAS,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,sGAAsG;QAC/G,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,CAAC;gBACL,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,WAAW;wBACjB,OAAO,EAAE,OAAO;wBAChB,cAAc,EAAE,2BAA2B;wBAC3C,KAAK,EAAE,KAAK;qBACb;iBACF;gBACD,OAAO;aACR,CAAC;KACH,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,gCAAgC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrC,OAAO;QACL,gBAAgB,EAAE;YAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE;YACzB,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;SAC5B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAEtF,SAAS,gBAAgB,CAAC,MAAiB,EAAE,GAAc;IACzD,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+/**
+ * GuardLink CLI — Reference Implementation
+ *
+ * Usage:
+ *   guardlink init [dir]        Initialize GuardLink in a project
+ *   guardlink parse [dir]       Parse annotations, output ThreatModel JSON
+ *   guardlink status [dir]      Show annotation coverage summary
+ *   guardlink validate [dir]    Check for syntax errors and dangling refs
+ *   guardlink analyze [framework] AI-powered threat analysis (STRIDE, DREAD, etc.)
+ *   guardlink annotate <prompt>  Launch coding agent for annotation
+ *   guardlink config <action>    Manage LLM provider configuration
+ *
+ * @exposes #cli to #path-traversal [high] cwe:CWE-22 -- "Accepts directory paths from command line arguments"
+ * @exposes #cli to #arbitrary-write [high] cwe:CWE-73 -- "Writes reports and SARIF to user-specified output paths"
+ * @accepts #arbitrary-write on #cli -- "Intentional feature: users specify output paths for reports"
+ * @mitigates #cli against #path-traversal using #path-validation -- "resolve() normalizes paths before passing to submodules"
+ * @boundary between #cli and #parser (#cli-parser-boundary) -- "CLI is the primary user input trust boundary"
+ * @flows User -> #cli via argv -- "User provides directory paths and options via command line"
+ * @flows #cli -> #parser via parseProject -- "CLI dispatches parsed commands to parser"
+ * @flows #cli -> #report via generateReport -- "CLI writes report output"
+ * @flows #cli -> #init via initProject -- "CLI initializes project structure"
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG"}