hackmyagent-core 0.1.0

package/dist/hardening/scanner.test.js

@@ -0,0 +1,1103 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const scanner_1 = require("./scanner");
+const fs = __importStar(require("fs/promises"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+(0, vitest_1.describe)('HardeningScanner', () => {
+    let scanner;
+    let tempDir;
+    (0, vitest_1.beforeEach)(async () => {
+        scanner = new scanner_1.HardeningScanner();
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-test-'));
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    (0, vitest_1.describe)('scan', () => {
+        (0, vitest_1.it)('returns a scan result with findings', async () => {
+            const result = await scanner.scan({ targetDir: tempDir });
+            (0, vitest_1.expect)(result).toMatchObject({
+                timestamp: vitest_1.expect.any(Date),
+                platform: vitest_1.expect.any(String),
+                findings: vitest_1.expect.any(Array),
+                score: vitest_1.expect.any(Number),
+                maxScore: vitest_1.expect.any(Number),
+            });
+        });
+        (0, vitest_1.it)('calculates security score based on findings', async () => {
+            const result = await scanner.scan({ targetDir: tempDir });
+            (0, vitest_1.expect)(result.score).toBeGreaterThanOrEqual(0);
+            (0, vitest_1.expect)(result.score).toBeLessThanOrEqual(result.maxScore);
+        });
+        (0, vitest_1.it)('groups findings by category', async () => {
+            const result = await scanner.scan({ targetDir: tempDir });
+            const findings = result.findings;
+            // Each finding should have a category
+            for (const finding of findings) {
+                (0, vitest_1.expect)(finding.category).toBeDefined();
+                (0, vitest_1.expect)(typeof finding.category).toBe('string');
+            }
+        });
+    });
+    (0, vitest_1.describe)('credential exposure checks', () => {
+        (0, vitest_1.it)('detects API keys in config files', async () => {
+            // Create a config file with exposed API key
+            const configPath = path.join(tempDir, 'config.json');
+            await fs.writeFile(configPath, JSON.stringify({
+                apiKey: 'sk-ant-api03-xxxxxxxxxxxxxxxxxxxxx',
+                name: 'test',
+            }));
+            const result = await scanner.scan({ targetDir: tempDir });
+            const credFindings = result.findings.filter((f) => f.category === 'credentials');
+            (0, vitest_1.expect)(credFindings.some((f) => !f.passed)).toBe(true);
+        });
+        (0, vitest_1.it)('detects OpenAI API keys', async () => {
+            const configPath = path.join(tempDir, '.env');
+            await fs.writeFile(configPath, 'OPENAI_API_KEY=sk-proj-xxxxxxxxxxxxxxxxxxxxxxxx\n');
+            const result = await scanner.scan({ targetDir: tempDir });
+            const finding = result.findings.find((f) => f.checkId === 'CRED-001' && !f.passed);
+            (0, vitest_1.expect)(finding).toBeDefined();
+            (0, vitest_1.expect)(finding?.details?.keys).toContain('OPENAI_API_KEY');
+        });
+        (0, vitest_1.it)('detects AWS credentials', async () => {
+            const configPath = path.join(tempDir, 'config.yaml');
+            await fs.writeFile(configPath, 'aws_access_key_id: AKIAIOSFODNN7EXAMPLE\naws_secret_access_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\n');
+            const result = await scanner.scan({ targetDir: tempDir });
+            const finding = result.findings.find((f) => f.checkId === 'CRED-001' && !f.passed);
+            (0, vitest_1.expect)(finding).toBeDefined();
+        });
+        (0, vitest_1.it)('passes when no credentials exposed', async () => {
+            const configPath = path.join(tempDir, 'config.json');
+            await fs.writeFile(configPath, JSON.stringify({
+                name: 'safe-config',
+                apiKey: '${ANTHROPIC_API_KEY}', // env var reference, not actual key
+            }));
+            const result = await scanner.scan({ targetDir: tempDir });
+            const credFindings = result.findings.filter((f) => f.category === 'credentials' && !f.passed);
+            (0, vitest_1.expect)(credFindings).toHaveLength(0);
+        });
+    });
+    (0, vitest_1.describe)('file permission checks', () => {
+        (0, vitest_1.it)('detects world-readable sensitive files', async () => {
+            const secretPath = path.join(tempDir, 'secrets.json');
+            await fs.writeFile(secretPath, '{"secret": "value"}');
+            await fs.chmod(secretPath, 0o644); // world-readable
+            const result = await scanner.scan({ targetDir: tempDir });
+            const permFindings = result.findings.filter((f) => f.category === 'permissions' && !f.passed);
+            // Should detect overly permissive files
+            (0, vitest_1.expect)(permFindings.length).toBeGreaterThanOrEqual(0);
+        });
+    });
+    (0, vitest_1.describe)('claude code specific checks', () => {
+        (0, vitest_1.it)('detects CLAUDE.md with sensitive content', async () => {
+            const claudeMdPath = path.join(tempDir, 'CLAUDE.md');
+            await fs.writeFile(claudeMdPath, '# Instructions\n\nAPI Key: sk-ant-api03-testsecretkey1234567890abc\n\nDo not share this.');
+            const result = await scanner.scan({ targetDir: tempDir });
+            const finding = result.findings.find((f) => f.checkId === 'CLAUDE-001' && !f.passed);
+            (0, vitest_1.expect)(finding).toBeDefined();
+            (0, vitest_1.expect)(finding?.message).toContain('CLAUDE.md');
+        });
+        (0, vitest_1.it)('passes for safe CLAUDE.md', async () => {
+            const claudeMdPath = path.join(tempDir, 'CLAUDE.md');
+            await fs.writeFile(claudeMdPath, '# Instructions\n\nUse environment variables for API keys.\n');
+            const result = await scanner.scan({ targetDir: tempDir });
+            const finding = result.findings.find((f) => f.checkId === 'CLAUDE-001');
+            (0, vitest_1.expect)(finding?.passed).toBe(true);
+        });
+    });
+    (0, vitest_1.describe)('MCP configuration checks', () => {
+        (0, vitest_1.it)('detects insecure MCP server configurations', async () => {
+            const mcpConfigPath = path.join(tempDir, 'mcp.json');
+            await fs.writeFile(mcpConfigPath, JSON.stringify({
+                servers: {
+                    filesystem: {
+                        command: 'mcp-server-filesystem',
+                        args: ['/'], // Root access - dangerous
+                    },
+                },
+            }));
+            const result = await scanner.scan({ targetDir: tempDir });
+            const finding = result.findings.find((f) => f.checkId === 'MCP-001' && !f.passed);
+            (0, vitest_1.expect)(finding).toBeDefined();
+        });
+        (0, vitest_1.it)('detects shell MCP server without restrictions', async () => {
+            const mcpConfigPath = path.join(tempDir, 'mcp.json');
+            await fs.writeFile(mcpConfigPath, JSON.stringify({
+                servers: {
+                    shell: {
+                        command: 'mcp-server-shell',
+                        // No command restrictions
+                    },
+                },
+            }));
+            const result = await scanner.scan({ targetDir: tempDir });
+            const finding = result.findings.find((f) => f.checkId === 'MCP-002' && !f.passed);
+            (0, vitest_1.expect)(finding).toBeDefined();
+        });
+    });
+    (0, vitest_1.describe)('auto-fix capabilities', () => {
+        (0, vitest_1.it)('can fix file permission issues', async () => {
+            const secretPath = path.join(tempDir, 'secrets.json');
+            await fs.writeFile(secretPath, '{"secret": "value"}');
+            await fs.chmod(secretPath, 0o644);
+            const result = await scanner.scan({
+                targetDir: tempDir,
+                autoFix: true,
+            });
+            // Check if fix was attempted for permission issues
+            const permFinding = result.findings.find((f) => f.category === 'permissions' && f.fixable);
+            if (permFinding && permFinding.fixed) {
+                const stats = await fs.stat(secretPath);
+                const mode = stats.mode & 0o777;
+                (0, vitest_1.expect)(mode).toBe(0o600);
+            }
+        });
+        (0, vitest_1.it)('reports which fixes were applied', async () => {
+            const result = await scanner.scan({
+                targetDir: tempDir,
+                autoFix: true,
+            });
+            for (const finding of result.findings) {
+                if (finding.fixable && !finding.passed) {
+                    (0, vitest_1.expect)(finding.fixed).toBeDefined();
+                    if (finding.fixed) {
+                        (0, vitest_1.expect)(finding.fixMessage).toBeDefined();
+                    }
+                }
+            }
+        });
+        (0, vitest_1.it)('does not auto-fix when disabled', async () => {
+            const secretPath = path.join(tempDir, 'secrets.json');
+            await fs.writeFile(secretPath, '{"secret": "value"}');
+            await fs.chmod(secretPath, 0o644);
+            const result = await scanner.scan({
+                targetDir: tempDir,
+                autoFix: false,
+            });
+            const fixedFindings = result.findings.filter((f) => f.fixed);
+            (0, vitest_1.expect)(fixedFindings).toHaveLength(0);
+        });
+    });
+    (0, vitest_1.describe)('score calculation', () => {
+        (0, vitest_1.it)('gives higher score when more checks pass', async () => {
+            // Safe directory
+            const safeDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-safe-'));
+            await fs.writeFile(path.join(safeDir, 'config.json'), JSON.stringify({ name: 'safe' }));
+            // Unsafe directory
+            const unsafeDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-unsafe-'));
+            await fs.writeFile(path.join(unsafeDir, 'config.json'), JSON.stringify({ apiKey: 'sk-ant-api03-secretkey1234567890def' }));
+            const safeResult = await scanner.scan({ targetDir: safeDir });
+            const unsafeResult = await scanner.scan({ targetDir: unsafeDir });
+            (0, vitest_1.expect)(safeResult.score).toBeGreaterThanOrEqual(unsafeResult.score);
+            await fs.rm(safeDir, { recursive: true, force: true });
+            await fs.rm(unsafeDir, { recursive: true, force: true });
+        });
+        (0, vitest_1.it)('weights critical issues higher than low', async () => {
+            // The score should penalize critical issues more than low issues
+            const result = await scanner.scan({ targetDir: tempDir });
+            // Verify score calculation logic exists
+            (0, vitest_1.expect)(result.maxScore).toBeGreaterThan(0);
+        });
+    });
+});
+(0, vitest_1.describe)('Git security checks', () => {
+    let scanner;
+    let tempDir;
+    (0, vitest_1.beforeEach)(async () => {
+        scanner = new scanner_1.HardeningScanner();
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-test-'));
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    (0, vitest_1.it)('detects missing .gitignore', async () => {
+        // No .gitignore file
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'GIT-001');
+        (0, vitest_1.expect)(finding).toBeDefined();
+        (0, vitest_1.expect)(finding?.passed).toBe(false);
+    });
+    (0, vitest_1.it)('detects .gitignore missing sensitive patterns', async () => {
+        // Create .gitignore without .env pattern
+        await fs.writeFile(path.join(tempDir, '.gitignore'), 'node_modules/\n');
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'GIT-002');
+        (0, vitest_1.expect)(finding).toBeDefined();
+        (0, vitest_1.expect)(finding?.passed).toBe(false);
+        (0, vitest_1.expect)(finding?.message).toContain('.env');
+    });
+    (0, vitest_1.it)('passes when .gitignore has all sensitive patterns', async () => {
+        await fs.writeFile(path.join(tempDir, '.gitignore'), '.env\n.env.*\nsecrets.json\n*.pem\n*.key\n');
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'GIT-002');
+        (0, vitest_1.expect)(finding?.passed).toBe(true);
+    });
+    (0, vitest_1.it)('detects .env file when .gitignore missing .env pattern', async () => {
+        await fs.writeFile(path.join(tempDir, '.gitignore'), 'node_modules/\n');
+        await fs.writeFile(path.join(tempDir, '.env'), 'SECRET=value\n');
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'GIT-003');
+        (0, vitest_1.expect)(finding).toBeDefined();
+        (0, vitest_1.expect)(finding?.passed).toBe(false);
+        (0, vitest_1.expect)(finding?.severity).toBe('critical');
+    });
+});
+(0, vitest_1.describe)('Network security checks', () => {
+    let scanner;
+    let tempDir;
+    (0, vitest_1.beforeEach)(async () => {
+        scanner = new scanner_1.HardeningScanner();
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-test-'));
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    (0, vitest_1.it)('detects MCP server bound to 0.0.0.0', async () => {
+        await fs.writeFile(path.join(tempDir, 'mcp.json'), JSON.stringify({
+            servers: {
+                myserver: {
+                    command: 'mcp-server',
+                    args: ['--host', '0.0.0.0'],
+                },
+            },
+        }));
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'NET-001');
+        (0, vitest_1.expect)(finding).toBeDefined();
+        (0, vitest_1.expect)(finding?.passed).toBe(false);
+        (0, vitest_1.expect)(finding?.severity).toBe('critical');
+    });
+    (0, vitest_1.it)('detects remote MCP server without TLS', async () => {
+        await fs.writeFile(path.join(tempDir, 'mcp.json'), JSON.stringify({
+            servers: {
+                remote: {
+                    url: 'http://api.example.com/mcp',
+                },
+            },
+        }));
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'NET-002');
+        (0, vitest_1.expect)(finding).toBeDefined();
+        (0, vitest_1.expect)(finding?.passed).toBe(false);
+        (0, vitest_1.expect)(finding?.severity).toBe('high');
+    });
+    (0, vitest_1.it)('passes for remote MCP server with HTTPS', async () => {
+        await fs.writeFile(path.join(tempDir, 'mcp.json'), JSON.stringify({
+            servers: {
+                remote: {
+                    url: 'https://api.example.com/mcp',
+                },
+            },
+        }));
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'NET-002');
+        (0, vitest_1.expect)(finding?.passed).toBe(true);
+    });
+});
+(0, vitest_1.describe)('Additional MCP checks', () => {
+    let scanner;
+    let tempDir;
+    (0, vitest_1.beforeEach)(async () => {
+        scanner = new scanner_1.HardeningScanner();
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-test-'));
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    (0, vitest_1.it)('detects secrets passed as environment variables to MCP', async () => {
+        await fs.writeFile(path.join(tempDir, 'mcp.json'), JSON.stringify({
+            servers: {
+                myserver: {
+                    command: 'mcp-server',
+                    env: {
+                        API_KEY: 'sk-ant-api03-hardcodedsecretkey1234567890',
+                    },
+                },
+            },
+        }));
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'MCP-003');
+        (0, vitest_1.expect)(finding).toBeDefined();
+        (0, vitest_1.expect)(finding?.passed).toBe(false);
+        (0, vitest_1.expect)(finding?.severity).toBe('critical');
+    });
+    (0, vitest_1.it)('passes when env vars use references', async () => {
+        await fs.writeFile(path.join(tempDir, 'mcp.json'), JSON.stringify({
+            servers: {
+                myserver: {
+                    command: 'mcp-server',
+                    env: {
+                        API_KEY: '${ANTHROPIC_API_KEY}',
+                    },
+                },
+            },
+        }));
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'MCP-003');
+        (0, vitest_1.expect)(finding?.passed).toBe(true);
+    });
+    (0, vitest_1.it)('detects database MCP server with default credentials', async () => {
+        await fs.writeFile(path.join(tempDir, 'mcp.json'), JSON.stringify({
+            servers: {
+                postgres: {
+                    command: 'mcp-server-postgres',
+                    args: ['--password', 'postgres'],
+                },
+            },
+        }));
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'MCP-004');
+        (0, vitest_1.expect)(finding).toBeDefined();
+        (0, vitest_1.expect)(finding?.passed).toBe(false);
+    });
+    (0, vitest_1.it)('detects MCP server allowing all tools', async () => {
+        await fs.writeFile(path.join(tempDir, 'mcp.json'), JSON.stringify({
+            servers: {
+                myserver: {
+                    command: 'mcp-server',
+                    allowedTools: ['*'],
+                },
+            },
+        }));
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'MCP-005');
+        (0, vitest_1.expect)(finding).toBeDefined();
+        (0, vitest_1.expect)(finding?.passed).toBe(false);
+        (0, vitest_1.expect)(finding?.severity).toBe('high');
+    });
+});
+(0, vitest_1.describe)('Claude Code additional checks', () => {
+    let scanner;
+    let tempDir;
+    (0, vitest_1.beforeEach)(async () => {
+        scanner = new scanner_1.HardeningScanner();
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-test-'));
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    (0, vitest_1.it)('detects overly permissive allowed commands', async () => {
+        await fs.mkdir(path.join(tempDir, '.claude'), { recursive: true });
+        await fs.writeFile(path.join(tempDir, '.claude', 'settings.json'), JSON.stringify({
+            permissions: {
+                allow: ['Bash(*)', 'Read(*)', 'Write(*)'],
+            },
+        }));
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'CLAUDE-002');
+        (0, vitest_1.expect)(finding).toBeDefined();
+        (0, vitest_1.expect)(finding?.passed).toBe(false);
+        (0, vitest_1.expect)(finding?.severity).toBe('high');
+    });
+    (0, vitest_1.it)('detects dangerous Bash patterns', async () => {
+        await fs.mkdir(path.join(tempDir, '.claude'), { recursive: true });
+        await fs.writeFile(path.join(tempDir, '.claude', 'settings.json'), JSON.stringify({
+            permissions: {
+                allow: ['Bash(rm -rf *)'],
+            },
+        }));
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'CLAUDE-003');
+        (0, vitest_1.expect)(finding).toBeDefined();
+        (0, vitest_1.expect)(finding?.passed).toBe(false);
+        (0, vitest_1.expect)(finding?.severity).toBe('critical');
+    });
+    (0, vitest_1.it)('passes for scoped permissions', async () => {
+        await fs.mkdir(path.join(tempDir, '.claude'), { recursive: true });
+        await fs.writeFile(path.join(tempDir, '.claude', 'settings.json'), JSON.stringify({
+            permissions: {
+                allow: ['Read(./src/**)', 'Write(./src/**)'],
+                deny: ['Bash(rm *)'],
+            },
+        }));
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'CLAUDE-002');
+        (0, vitest_1.expect)(finding?.passed).toBe(true);
+    });
+});
+(0, vitest_1.describe)('Cursor configuration checks', () => {
+    let scanner;
+    let tempDir;
+    (0, vitest_1.beforeEach)(async () => {
+        scanner = new scanner_1.HardeningScanner();
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-test-'));
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    (0, vitest_1.it)('detects credentials in Cursor rules', async () => {
+        await fs.mkdir(path.join(tempDir, '.cursor'), { recursive: true });
+        await fs.writeFile(path.join(tempDir, '.cursor', 'rules'), 'Use API key sk-ant-api03-secretkey1234567890xyz for all requests\n');
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'CURSOR-001');
+        (0, vitest_1.expect)(finding).toBeDefined();
+        (0, vitest_1.expect)(finding?.passed).toBe(false);
+        (0, vitest_1.expect)(finding?.severity).toBe('critical');
+    });
+    (0, vitest_1.it)('detects credentials in .cursorrules', async () => {
+        await fs.writeFile(path.join(tempDir, '.cursorrules'), 'API_KEY=sk-proj-xxxxxxxxxxxxxxxxxxxxxxxxxxxx\n');
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'CURSOR-001');
+        (0, vitest_1.expect)(finding).toBeDefined();
+        (0, vitest_1.expect)(finding?.passed).toBe(false);
+    });
+});
+(0, vitest_1.describe)('VSCode configuration checks', () => {
+    let scanner;
+    let tempDir;
+    (0, vitest_1.beforeEach)(async () => {
+        scanner = new scanner_1.HardeningScanner();
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-test-'));
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    (0, vitest_1.it)('detects credentials in VSCode MCP config', async () => {
+        await fs.mkdir(path.join(tempDir, '.vscode'), { recursive: true });
+        await fs.writeFile(path.join(tempDir, '.vscode', 'mcp.json'), JSON.stringify({
+            servers: {
+                myserver: {
+                    apiKey: 'sk-ant-api03-exposedsecretkey1234567890',
+                },
+            },
+        }));
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'VSCODE-001');
+        (0, vitest_1.expect)(finding).toBeDefined();
+        (0, vitest_1.expect)(finding?.passed).toBe(false);
+        (0, vitest_1.expect)(finding?.severity).toBe('critical');
+    });
+    (0, vitest_1.it)('detects overly permissive VSCode MCP config', async () => {
+        await fs.mkdir(path.join(tempDir, '.vscode'), { recursive: true });
+        await fs.writeFile(path.join(tempDir, '.vscode', 'mcp.json'), JSON.stringify({
+            servers: {
+                filesystem: {
+                    command: 'mcp-server-filesystem',
+                    args: ['/'],
+                },
+            },
+        }));
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'VSCODE-002');
+        (0, vitest_1.expect)(finding).toBeDefined();
+        (0, vitest_1.expect)(finding?.passed).toBe(false);
+    });
+});
+(0, vitest_1.describe)('Additional credential checks', () => {
+    let scanner;
+    let tempDir;
+    (0, vitest_1.beforeEach)(async () => {
+        scanner = new scanner_1.HardeningScanner();
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-test-'));
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    (0, vitest_1.it)('detects private keys in directory', async () => {
+        await fs.writeFile(path.join(tempDir, 'server.key'), '-----BEGIN RSA PRIVATE KEY-----\nMIIBOgIBAAJBALRi\n-----END RSA PRIVATE KEY-----\n');
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'CRED-002');
+        (0, vitest_1.expect)(finding).toBeDefined();
+        (0, vitest_1.expect)(finding?.passed).toBe(false);
+        (0, vitest_1.expect)(finding?.severity).toBe('critical');
+    });
+    (0, vitest_1.it)('detects .pem files', async () => {
+        await fs.writeFile(path.join(tempDir, 'cert.pem'), '-----BEGIN CERTIFICATE-----\nMIIBOgIBAAJBALRi\n-----END CERTIFICATE-----\n');
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'CRED-002');
+        (0, vitest_1.expect)(finding).toBeDefined();
+    });
+    (0, vitest_1.it)('detects hardcoded secrets in package.json', async () => {
+        await fs.writeFile(path.join(tempDir, 'package.json'), JSON.stringify({
+            name: 'test',
+            scripts: {
+                deploy: 'API_KEY=sk-ant-api03-secretkey12345678901234abc npm run build',
+            },
+        }));
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'CRED-003');
+        (0, vitest_1.expect)(finding).toBeDefined();
+        (0, vitest_1.expect)(finding?.passed).toBe(false);
+    });
+    (0, vitest_1.it)('detects JWT secrets in config', async () => {
+        await fs.writeFile(path.join(tempDir, 'config.json'), JSON.stringify({
+            jwt: {
+                secret: 'super-secret-jwt-key-that-should-not-be-here',
+            },
+        }));
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'CRED-004');
+        (0, vitest_1.expect)(finding).toBeDefined();
+        (0, vitest_1.expect)(finding?.passed).toBe(false);
+    });
+});
+(0, vitest_1.describe)('Permission boundary checks', () => {
+    let scanner;
+    let tempDir;
+    (0, vitest_1.beforeEach)(async () => {
+        scanner = new scanner_1.HardeningScanner();
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-test-'));
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    (0, vitest_1.it)('detects executable config files', async () => {
+        const configPath = path.join(tempDir, 'config.json');
+        await fs.writeFile(configPath, '{}');
+        await fs.chmod(configPath, 0o755);
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'PERM-002');
+        (0, vitest_1.expect)(finding).toBeDefined();
+        (0, vitest_1.expect)(finding?.passed).toBe(false);
+    });
+    (0, vitest_1.it)('detects group-writable sensitive files', async () => {
+        const envPath = path.join(tempDir, '.env');
+        await fs.writeFile(envPath, 'SECRET=value');
+        await fs.chmod(envPath, 0o664);
+        const result = await scanner.scan({ targetDir: tempDir });
+        const finding = result.findings.find((f) => f.checkId === 'PERM-003');
+        (0, vitest_1.expect)(finding).toBeDefined();
+        (0, vitest_1.expect)(finding?.passed).toBe(false);
+    });
+});
+(0, vitest_1.describe)('Auto-fix: Git security', () => {
+    let scanner;
+    let tempDir;
+    (0, vitest_1.beforeEach)(async () => {
+        scanner = new scanner_1.HardeningScanner();
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-test-'));
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    (0, vitest_1.it)('creates .gitignore when missing', async () => {
+        await scanner.scan({ targetDir: tempDir, autoFix: true });
+        const gitignoreExists = await fs.access(path.join(tempDir, '.gitignore')).then(() => true).catch(() => false);
+        (0, vitest_1.expect)(gitignoreExists).toBe(true);
+        const content = await fs.readFile(path.join(tempDir, '.gitignore'), 'utf-8');
+        (0, vitest_1.expect)(content).toContain('.env');
+        (0, vitest_1.expect)(content).toContain('*.pem');
+    });
+    (0, vitest_1.it)('adds missing patterns to existing .gitignore', async () => {
+        await fs.writeFile(path.join(tempDir, '.gitignore'), 'node_modules/\n');
+        await scanner.scan({ targetDir: tempDir, autoFix: true });
+        const content = await fs.readFile(path.join(tempDir, '.gitignore'), 'utf-8');
+        (0, vitest_1.expect)(content).toContain('node_modules/');
+        (0, vitest_1.expect)(content).toContain('.env');
+        (0, vitest_1.expect)(content).toContain('*.pem');
+    });
+    (0, vitest_1.it)('reports fix was applied for .gitignore', async () => {
+        const result = await scanner.scan({ targetDir: tempDir, autoFix: true });
+        const gitFinding = result.findings.find(f => f.checkId === 'GIT-001');
+        (0, vitest_1.expect)(gitFinding?.fixed).toBe(true);
+    });
+});
+(0, vitest_1.describe)('Auto-fix: Credential replacement', () => {
+    let scanner;
+    let tempDir;
+    (0, vitest_1.beforeEach)(async () => {
+        scanner = new scanner_1.HardeningScanner();
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-test-'));
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    (0, vitest_1.it)('replaces Anthropic API key with env var reference in config.json', async () => {
+        const configPath = path.join(tempDir, 'config.json');
+        await fs.writeFile(configPath, JSON.stringify({
+            apiKey: 'sk-ant-api03-abcdefghijklmnopqrstuvwxyz',
+            name: 'test'
+        }, null, 2));
+        await scanner.scan({ targetDir: tempDir, autoFix: true });
+        const content = await fs.readFile(configPath, 'utf-8');
+        (0, vitest_1.expect)(content).not.toContain('sk-ant-api03');
+        (0, vitest_1.expect)(content).toContain('${ANTHROPIC_API_KEY}');
+    });
+    (0, vitest_1.it)('replaces OpenAI API key with env var reference', async () => {
+        const configPath = path.join(tempDir, 'config.json');
+        await fs.writeFile(configPath, JSON.stringify({
+            openaiKey: 'sk-proj-abcdefghijklmnopqrstuvwxyz123456',
+        }, null, 2));
+        await scanner.scan({ targetDir: tempDir, autoFix: true });
+        const content = await fs.readFile(configPath, 'utf-8');
+        (0, vitest_1.expect)(content).not.toContain('sk-proj-');
+        (0, vitest_1.expect)(content).toContain('${OPENAI_API_KEY}');
+    });
+    (0, vitest_1.it)('creates .env.example with placeholder', async () => {
+        const configPath = path.join(tempDir, 'config.json');
+        await fs.writeFile(configPath, JSON.stringify({
+            apiKey: 'sk-ant-api03-abcdefghijklmnopqrstuvwxyz',
+        }, null, 2));
+        await scanner.scan({ targetDir: tempDir, autoFix: true });
+        const envExamplePath = path.join(tempDir, '.env.example');
+        const envExists = await fs.access(envExamplePath).then(() => true).catch(() => false);
+        (0, vitest_1.expect)(envExists).toBe(true);
+        const content = await fs.readFile(envExamplePath, 'utf-8');
+        (0, vitest_1.expect)(content).toContain('ANTHROPIC_API_KEY=');
+    });
+});
+(0, vitest_1.describe)('Auto-fix: Network security', () => {
+    let scanner;
+    let tempDir;
+    (0, vitest_1.beforeEach)(async () => {
+        scanner = new scanner_1.HardeningScanner();
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-test-'));
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    (0, vitest_1.it)('changes 0.0.0.0 to 127.0.0.1 in mcp.json', async () => {
+        const mcpPath = path.join(tempDir, 'mcp.json');
+        await fs.writeFile(mcpPath, JSON.stringify({
+            servers: {
+                myserver: {
+                    command: 'node',
+                    args: ['server.js', '--host', '0.0.0.0', '--port', '3000']
+                }
+            }
+        }, null, 2));
+        await scanner.scan({ targetDir: tempDir, autoFix: true });
+        const content = await fs.readFile(mcpPath, 'utf-8');
+        (0, vitest_1.expect)(content).not.toContain('0.0.0.0');
+        (0, vitest_1.expect)(content).toContain('127.0.0.1');
+    });
+    (0, vitest_1.it)('reports fix was applied for network binding', async () => {
+        const mcpPath = path.join(tempDir, 'mcp.json');
+        await fs.writeFile(mcpPath, JSON.stringify({
+            servers: {
+                myserver: {
+                    command: 'node',
+                    args: ['--host', '0.0.0.0']
+                }
+            }
+        }, null, 2));
+        const result = await scanner.scan({ targetDir: tempDir, autoFix: true });
+        const netFinding = result.findings.find(f => f.checkId === 'NET-001');
+        (0, vitest_1.expect)(netFinding?.fixed).toBe(true);
+    });
+});
+(0, vitest_1.describe)('Auto-fix: MCP filesystem access', () => {
+    let scanner;
+    let tempDir;
+    (0, vitest_1.beforeEach)(async () => {
+        scanner = new scanner_1.HardeningScanner();
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-test-'));
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    (0, vitest_1.it)('changes root "/" to "./data" in mcp.json', async () => {
+        const mcpPath = path.join(tempDir, 'mcp.json');
+        await fs.writeFile(mcpPath, JSON.stringify({
+            servers: {
+                filesystem: {
+                    command: 'mcp-server-filesystem',
+                    args: ['/']
+                }
+            }
+        }, null, 2));
+        await scanner.scan({ targetDir: tempDir, autoFix: true });
+        const content = await fs.readFile(mcpPath, 'utf-8');
+        const config = JSON.parse(content);
+        (0, vitest_1.expect)(config.servers.filesystem.args).not.toContain('/');
+        (0, vitest_1.expect)(config.servers.filesystem.args).toContain('./data');
+    });
+    (0, vitest_1.it)('changes home "~" to "./" in mcp.json', async () => {
+        const mcpPath = path.join(tempDir, 'mcp.json');
+        await fs.writeFile(mcpPath, JSON.stringify({
+            servers: {
+                filesystem: {
+                    command: 'mcp-server-filesystem',
+                    args: ['~']
+                }
+            }
+        }, null, 2));
+        await scanner.scan({ targetDir: tempDir, autoFix: true });
+        const content = await fs.readFile(mcpPath, 'utf-8');
+        const config = JSON.parse(content);
+        (0, vitest_1.expect)(config.servers.filesystem.args).not.toContain('~');
+        (0, vitest_1.expect)(config.servers.filesystem.args).toContain('./');
+    });
+});
+(0, vitest_1.describe)('Auto-fix: MCP hardcoded secrets', () => {
+    let scanner;
+    let tempDir;
+    (0, vitest_1.beforeEach)(async () => {
+        scanner = new scanner_1.HardeningScanner();
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-test-'));
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    (0, vitest_1.it)('replaces hardcoded API key in MCP env with reference', async () => {
+        const mcpPath = path.join(tempDir, 'mcp.json');
+        await fs.writeFile(mcpPath, JSON.stringify({
+            servers: {
+                myserver: {
+                    command: 'node',
+                    env: {
+                        API_KEY: 'sk-ant-api03-secretkeyhere1234567890'
+                    }
+                }
+            }
+        }, null, 2));
+        await scanner.scan({ targetDir: tempDir, autoFix: true });
+        const content = await fs.readFile(mcpPath, 'utf-8');
+        (0, vitest_1.expect)(content).not.toContain('sk-ant-api03');
+        (0, vitest_1.expect)(content).toContain('${ANTHROPIC_API_KEY}');
+    });
+});
+(0, vitest_1.describe)('Platform detection', () => {
+    let scanner;
+    let tempDir;
+    (0, vitest_1.beforeEach)(async () => {
+        scanner = new scanner_1.HardeningScanner();
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-test-'));
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    (0, vitest_1.it)('detects Claude Code environment', async () => {
+        await fs.writeFile(path.join(tempDir, 'CLAUDE.md'), '# Claude Instructions');
+        const result = await scanner.scan({ targetDir: tempDir });
+        (0, vitest_1.expect)(result.platform).toContain('claude');
+    });
+    (0, vitest_1.it)('detects Cursor environment', async () => {
+        await fs.mkdir(path.join(tempDir, '.cursor'), { recursive: true });
+        await fs.writeFile(path.join(tempDir, '.cursor', 'rules'), 'cursor rules');
+        const result = await scanner.scan({ targetDir: tempDir });
+        (0, vitest_1.expect)(result.platform).toContain('cursor');
+    });
+    (0, vitest_1.it)('detects MCP configuration', async () => {
+        await fs.writeFile(path.join(tempDir, 'mcp.json'), JSON.stringify({ servers: {} }));
+        const result = await scanner.scan({ targetDir: tempDir });
+        (0, vitest_1.expect)(result.platform).toContain('mcp');
+    });
+    (0, vitest_1.it)('returns generic for unknown platform', async () => {
+        const result = await scanner.scan({ targetDir: tempDir });
+        (0, vitest_1.expect)(result.platform).toBeDefined();
+    });
+});
+(0, vitest_1.describe)('Backup and rollback', () => {
+    let scanner;
+    let tempDir;
+    (0, vitest_1.beforeEach)(async () => {
+        scanner = new scanner_1.HardeningScanner();
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-test-'));
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    (0, vitest_1.it)('creates backup before auto-fix', async () => {
+        // Create a config file with exposed credentials
+        const configPath = path.join(tempDir, 'config.json');
+        await fs.writeFile(configPath, JSON.stringify({ apiKey: 'sk-ant-api03-secretkey12345678901234' }));
+        // Run with auto-fix
+        const result = await scanner.scan({ targetDir: tempDir, autoFix: true });
+        // Check backup was created
+        const backupDir = path.join(tempDir, '.hackmyagent-backup');
+        const backupExists = await fs
+            .access(backupDir)
+            .then(() => true)
+            .catch(() => false);
+        (0, vitest_1.expect)(backupExists).toBe(true);
+        // Check backup contains the original file
+        const backups = await fs.readdir(backupDir);
+        (0, vitest_1.expect)(backups.length).toBeGreaterThan(0);
+        // Read the backup and verify it has original content
+        const backupContent = await fs.readFile(path.join(backupDir, backups[0], 'config.json'), 'utf-8');
+        (0, vitest_1.expect)(backupContent).toContain('sk-ant-api03');
+    });
+    (0, vitest_1.it)('backup contains timestamp in folder name', async () => {
+        const configPath = path.join(tempDir, 'config.json');
+        await fs.writeFile(configPath, JSON.stringify({ apiKey: 'sk-ant-api03-secretkey12345678901234' }));
+        await scanner.scan({ targetDir: tempDir, autoFix: true });
+        const backupDir = path.join(tempDir, '.hackmyagent-backup');
+        const backups = await fs.readdir(backupDir);
+        // Backup folder should have timestamp format: YYYY-MM-DD-HHMMSS
+        (0, vitest_1.expect)(backups[0]).toMatch(/^\d{4}-\d{2}-\d{2}-\d{6}$/);
+    });
+    (0, vitest_1.it)('can rollback to previous state', async () => {
+        const configPath = path.join(tempDir, 'config.json');
+        const originalContent = JSON.stringify({ apiKey: 'sk-ant-api03-secretkey12345678901234' });
+        await fs.writeFile(configPath, originalContent);
+        // Run with auto-fix (modifies the file)
+        await scanner.scan({ targetDir: tempDir, autoFix: true });
+        // Verify file was modified
+        const modifiedContent = await fs.readFile(configPath, 'utf-8');
+        (0, vitest_1.expect)(modifiedContent).not.toContain('sk-ant-api03');
+        // Rollback
+        await scanner.rollback(tempDir);
+        // Verify file is restored
+        const restoredContent = await fs.readFile(configPath, 'utf-8');
+        (0, vitest_1.expect)(restoredContent).toBe(originalContent);
+    });
+    (0, vitest_1.it)('rollback restores multiple files', async () => {
+        // Create multiple files
+        await fs.writeFile(path.join(tempDir, 'config.json'), JSON.stringify({ key: 'sk-ant-api03-secret1key1234567890abc' }));
+        await fs.writeFile(path.join(tempDir, 'mcp.json'), JSON.stringify({
+            mcpServers: {
+                test: { env: { API_KEY: 'sk-ant-api03-secret2key1234567890abc' } },
+            },
+        }));
+        // Run auto-fix
+        await scanner.scan({ targetDir: tempDir, autoFix: true });
+        // Rollback
+        await scanner.rollback(tempDir);
+        // Check both files restored
+        const config = await fs.readFile(path.join(tempDir, 'config.json'), 'utf-8');
+        const mcp = await fs.readFile(path.join(tempDir, 'mcp.json'), 'utf-8');
+        (0, vitest_1.expect)(config).toContain('sk-ant-api03-secret1key1234567890abc');
+        (0, vitest_1.expect)(mcp).toContain('sk-ant-api03-secret2');
+    });
+    (0, vitest_1.it)('rollback removes newly created files', async () => {
+        // Create a file with credentials (no .gitignore exists)
+        await fs.writeFile(path.join(tempDir, 'config.json'), JSON.stringify({ key: 'sk-ant-api03-secret' }));
+        // Run auto-fix (creates .gitignore and .env.example)
+        await scanner.scan({ targetDir: tempDir, autoFix: true });
+        // Verify new files were created
+        const gitignoreExists = await fs
+            .access(path.join(tempDir, '.gitignore'))
+            .then(() => true)
+            .catch(() => false);
+        (0, vitest_1.expect)(gitignoreExists).toBe(true);
+        // Rollback
+        await scanner.rollback(tempDir);
+        // Verify .gitignore is removed (it didn't exist before)
+        const gitignoreAfterRollback = await fs
+            .access(path.join(tempDir, '.gitignore'))
+            .then(() => true)
+            .catch(() => false);
+        (0, vitest_1.expect)(gitignoreAfterRollback).toBe(false);
+    });
+    (0, vitest_1.it)('returns backup path in scan result when autoFix is true', async () => {
+        await fs.writeFile(path.join(tempDir, 'config.json'), JSON.stringify({ key: 'sk-ant-api03-secret' }));
+        const result = await scanner.scan({ targetDir: tempDir, autoFix: true });
+        (0, vitest_1.expect)(result.backupPath).toBeDefined();
+        (0, vitest_1.expect)(result.backupPath).toContain('.hackmyagent-backup');
+    });
+    (0, vitest_1.it)('does not create backup when autoFix is false', async () => {
+        await fs.writeFile(path.join(tempDir, 'config.json'), JSON.stringify({ key: 'sk-ant-api03-secret' }));
+        const result = await scanner.scan({ targetDir: tempDir, autoFix: false });
+        (0, vitest_1.expect)(result.backupPath).toBeUndefined();
+        const backupDir = path.join(tempDir, '.hackmyagent-backup');
+        const backupExists = await fs
+            .access(backupDir)
+            .then(() => true)
+            .catch(() => false);
+        (0, vitest_1.expect)(backupExists).toBe(false);
+    });
+    (0, vitest_1.it)('throws error when no backup exists for rollback', async () => {
+        await (0, vitest_1.expect)(scanner.rollback(tempDir)).rejects.toThrow(/no backup found/i);
+    });
+});
+(0, vitest_1.describe)('Dry-run mode', () => {
+    let scanner;
+    let tempDir;
+    (0, vitest_1.beforeEach)(async () => {
+        scanner = new scanner_1.HardeningScanner();
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-test-'));
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    (0, vitest_1.it)('shows what would be fixed without modifying files', async () => {
+        const configPath = path.join(tempDir, 'config.json');
+        const originalContent = JSON.stringify({ apiKey: 'sk-ant-api03-secretkey12345678901234' });
+        await fs.writeFile(configPath, originalContent);
+        const result = await scanner.scan({
+            targetDir: tempDir,
+            autoFix: true,
+            dryRun: true,
+        });
+        // Should report what would be fixed
+        const credFinding = result.findings.find((f) => f.checkId === 'CRED-001');
+        (0, vitest_1.expect)(credFinding?.wouldFix).toBe(true);
+        // File should NOT be modified
+        const content = await fs.readFile(configPath, 'utf-8');
+        (0, vitest_1.expect)(content).toBe(originalContent);
+    });
+    (0, vitest_1.it)('does not create backup in dry-run mode', async () => {
+        await fs.writeFile(path.join(tempDir, 'config.json'), JSON.stringify({ apiKey: 'sk-ant-api03-secretkey1234567890def' }));
+        const result = await scanner.scan({
+            targetDir: tempDir,
+            autoFix: true,
+            dryRun: true,
+        });
+        (0, vitest_1.expect)(result.backupPath).toBeUndefined();
+        const backupDir = path.join(tempDir, '.hackmyagent-backup');
+        const backupExists = await fs
+            .access(backupDir)
+            .then(() => true)
+            .catch(() => false);
+        (0, vitest_1.expect)(backupExists).toBe(false);
+    });
+    (0, vitest_1.it)('reports all fixable issues in dry-run', async () => {
+        // Create multiple fixable issues
+        await fs.writeFile(path.join(tempDir, 'config.json'), JSON.stringify({ key: 'sk-ant-api03-secret1key1234567890abc' }));
+        // No .gitignore (fixable)
+        const result = await scanner.scan({
+            targetDir: tempDir,
+            autoFix: true,
+            dryRun: true,
+        });
+        const wouldFixFindings = result.findings.filter((f) => f.wouldFix);
+        (0, vitest_1.expect)(wouldFixFindings.length).toBeGreaterThanOrEqual(2);
+    });
+    (0, vitest_1.it)('returns dryRun flag in result', async () => {
+        const result = await scanner.scan({
+            targetDir: tempDir,
+            autoFix: true,
+            dryRun: true,
+        });
+        (0, vitest_1.expect)(result.dryRun).toBe(true);
+    });
+});
+(0, vitest_1.describe)('Atomic auto-fix', () => {
+    let scanner;
+    let tempDir;
+    (0, vitest_1.beforeEach)(async () => {
+        scanner = new scanner_1.HardeningScanner();
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-test-'));
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    (0, vitest_1.it)('rolls back all changes if any fix fails', async () => {
+        // Create a config file that can be fixed
+        const configPath = path.join(tempDir, 'config.json');
+        const originalContent = JSON.stringify({ apiKey: 'sk-ant-api03-secretkey1234567890def' });
+        await fs.writeFile(configPath, originalContent);
+        // Create a read-only directory to cause .gitignore creation to fail
+        const readOnlyDir = path.join(tempDir, 'readonly');
+        await fs.mkdir(readOnlyDir);
+        // Mock a scenario where fix would fail by making config.json read-only after backup
+        // For this test, we'll verify the rollback mechanism exists
+        // The actual failure simulation would require more complex setup
+        const result = await scanner.scan({
+            targetDir: tempDir,
+            autoFix: true,
+        });
+        // If fixes succeeded, verify atomicity flag is set
+        (0, vitest_1.expect)(result.atomicFix).toBeDefined();
+    });
+    (0, vitest_1.it)('sets atomicFix to true when all fixes succeed', async () => {
+        await fs.writeFile(path.join(tempDir, 'config.json'), JSON.stringify({ apiKey: 'sk-ant-api03-secretkey1234567890def' }));
+        const result = await scanner.scan({
+            targetDir: tempDir,
+            autoFix: true,
+        });
+        (0, vitest_1.expect)(result.atomicFix).toBe(true);
+    });
+    (0, vitest_1.it)('provides rollback instructions on partial failure', async () => {
+        // Create fixable content
+        await fs.writeFile(path.join(tempDir, 'config.json'), JSON.stringify({ apiKey: 'sk-ant-api03-secretkey1234567890def' }));
+        const result = await scanner.scan({
+            targetDir: tempDir,
+            autoFix: true,
+        });
+        // When autoFix is used, backupPath should be available for manual rollback
+        if (result.findings.some((f) => f.fixed)) {
+            (0, vitest_1.expect)(result.backupPath).toBeDefined();
+        }
+    });
+});
+(0, vitest_1.describe)('Ignore checks', () => {
+    let scanner;
+    let tempDir;
+    (0, vitest_1.beforeEach)(async () => {
+        scanner = new scanner_1.HardeningScanner();
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hackmyagent-test-'));
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    (0, vitest_1.it)('ignores specific check IDs', async () => {
+        // Create file with exposed credential
+        await fs.writeFile(path.join(tempDir, 'config.json'), JSON.stringify({ apiKey: 'sk-ant-api03-secretkey1234567890def' }));
+        // Scan without ignore - should find CRED-001
+        const resultWithCheck = await scanner.scan({ targetDir: tempDir });
+        (0, vitest_1.expect)(resultWithCheck.findings.some((f) => f.checkId === 'CRED-001')).toBe(true);
+        // Scan with ignore - should NOT find CRED-001
+        const resultIgnored = await scanner.scan({
+            targetDir: tempDir,
+            ignore: ['CRED-001'],
+        });
+        (0, vitest_1.expect)(resultIgnored.findings.some((f) => f.checkId === 'CRED-001')).toBe(false);
+    });
+    (0, vitest_1.it)('ignore is case-insensitive', async () => {
+        await fs.writeFile(path.join(tempDir, 'config.json'), JSON.stringify({ apiKey: 'sk-ant-api03-secretkey1234567890def' }));
+        const result = await scanner.scan({
+            targetDir: tempDir,
+            ignore: ['cred-001'], // lowercase
+        });
+        (0, vitest_1.expect)(result.findings.some((f) => f.checkId === 'CRED-001')).toBe(false);
+    });
+    (0, vitest_1.it)('returns list of ignored checks in result', async () => {
+        const result = await scanner.scan({
+            targetDir: tempDir,
+            ignore: ['CRED-001', 'GIT-001'],
+        });
+        (0, vitest_1.expect)(result.ignored).toBeDefined();
+        (0, vitest_1.expect)(result.ignored).toContain('CRED-001');
+        (0, vitest_1.expect)(result.ignored).toContain('GIT-001');
+    });
+    (0, vitest_1.it)('ignores multiple check IDs', async () => {
+        await fs.writeFile(path.join(tempDir, 'config.json'), JSON.stringify({ apiKey: 'sk-ant-api03-secretkey1234567890def' }));
+        const result = await scanner.scan({
+            targetDir: tempDir,
+            ignore: ['CRED-001', 'GIT-001', 'GIT-002'],
+        });
+        (0, vitest_1.expect)(result.findings.some((f) => f.checkId === 'CRED-001')).toBe(false);
+        (0, vitest_1.expect)(result.findings.some((f) => f.checkId === 'GIT-001')).toBe(false);
+        (0, vitest_1.expect)(result.findings.some((f) => f.checkId === 'GIT-002')).toBe(false);
+    });
+    (0, vitest_1.it)('score calculation excludes ignored checks', async () => {
+        await fs.writeFile(path.join(tempDir, 'config.json'), JSON.stringify({ apiKey: 'sk-ant-api03-secretkey1234567890def' }));
+        // Without ignore
+        const resultFull = await scanner.scan({ targetDir: tempDir });
+        // With ignore (ignoring critical check means fewer findings)
+        const resultIgnored = await scanner.scan({
+            targetDir: tempDir,
+            ignore: ['CRED-001'],
+        });
+        // Should have fewer findings when ignoring a check
+        (0, vitest_1.expect)(resultIgnored.findings.length).toBeLessThan(resultFull.findings.length);
+    });
+});
+//# sourceMappingURL=scanner.test.js.map