openpitstop 1.0.0

package/dist/pen/types.d.ts

@@ -0,0 +1,112 @@
+/**
+ * pen/types.ts — shared types for `pitstop pen`.
+ *
+ * A pen finding carries its proof with it: the exact attack that was fired
+ * (or the static pattern that was matched), the observed response, and any
+ * sandbox evidence (outbound host / spawn command). Nothing is asserted
+ * without a receipt — that is what separates pen from vibes.
+ */
+export type PenConfidence = "proven" | "indicated" | "heuristic";
+export type PenSeverity = "critical" | "high" | "medium" | "low" | "info";
+export interface PenAttackRequest {
+    method: string;
+    /** Path on the app (without origin), e.g. /api/charge/1 */
+    path: string;
+    payload?: unknown;
+}
+export interface PenResponseEvidence {
+    status?: number;
+    /** First ~300 chars of the response body, sanitized. */
+    snippet?: string;
+    headers?: Record<string, string>;
+}
+export interface PenFinding {
+    id: string;
+    source: "pen-static" | "pen-dynamic";
+    /** xss, sql-injection, missing-auth, ssrf, command-injection, ... */
+    type: string;
+    severity: PenSeverity;
+    confidence: PenConfidence;
+    title: string;
+    description: string;
+    /** Static findings: the file that matched. */
+    file?: string;
+    line?: number;
+    /** Dynamic findings: the route that was attacked. */
+    route?: string;
+    method?: string;
+    /** The exact attack that was fired (dynamic). */
+    attack?: PenAttackRequest;
+    response?: PenResponseEvidence;
+    /** Sandbox evidence: outbound hosts / spawn commands that matched. */
+    outbound?: string[];
+    /** How a human (or the agent loop) can reproduce it by hand. */
+    repro?: string;
+    /** Recommended fix, written for a human or an agent to apply. */
+    fix?: string;
+    /** Set by `--fix` when a deterministic patch was generated. */
+    patchFile?: string;
+    /**
+     * Live-attack verdict for a STATIC finding, applied by the runtime-proof
+     * pass after the dynamic phase: "proven" (a canary-class live attack
+     * confirmed it), "indicated" (live probing produced class-level signals
+     * but no canary), "unproven" (probed with no signal — pattern may be a
+     * false positive), "not-tested" (no live probe exists / app did not boot).
+     */
+    runtimeProof?: "proven" | "indicated" | "unproven" | "not-tested";
+    /** Human note explaining the runtime verdict (and the proof it cites). */
+    runtimeNote?: string;
+    /** For runtime-proven static findings: the dynamic attack class that proved it (e.g. "reflected-xss"). */
+    proofType?: string;
+}
+export interface PenDynamicSummary {
+    status: "ok" | "aborted" | "skipped";
+    note?: string;
+    routesProbed: number;
+    attacks: number;
+    bootMs: number;
+    durationMs: number;
+    outboundEvents: number;
+}
+export interface PenResult {
+    timestamp: string;
+    repo: string;
+    mode: "pen";
+    staticEnabled: boolean;
+    dynamicEnabled: boolean;
+    dynamic: PenDynamicSummary;
+    packages: string[];
+    /** Runtime verification of static findings (absent when the dynamic phase was skipped). */
+    staticProof?: {
+        proven: number;
+        indicated: number;
+        unproven: number;
+        notTested: number;
+    };
+    findings: PenFinding[];
+    summary: {
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+        info: number;
+        proven: number;
+        indicated: number;
+        heuristic: number;
+    };
+}
+export declare const SEVERITY_ORDER: PenSeverity[];
+export declare function summarizeFindings(findings: PenFinding[]): PenResult["summary"];
+/** Sort findings: severity first, proven above indicated above heuristic. */
+export declare function sortFindings(findings: PenFinding[]): PenFinding[];
+/** A route inventory entry for the dynamic phase. */
+export interface PenRoute {
+    method: string;
+    path: string;
+    file: string;
+    line: number;
+    /** True when the path looks sensitive (money/auth/admin). */
+    sensitive: boolean;
+    /** True when the path is login-ish (rate-limit battery applies). */
+    loginLike: boolean;
+}

package/dist/pen/types.js

@@ -0,0 +1,53 @@
+/**
+ * pen/types.ts — shared types for `pitstop pen`.
+ *
+ * A pen finding carries its proof with it: the exact attack that was fired
+ * (or the static pattern that was matched), the observed response, and any
+ * sandbox evidence (outbound host / spawn command). Nothing is asserted
+ * without a receipt — that is what separates pen from vibes.
+ */
+export const SEVERITY_ORDER = [
+    "critical",
+    "high",
+    "medium",
+    "low",
+    "info",
+];
+export function summarizeFindings(findings) {
+    const s = {
+        critical: 0,
+        high: 0,
+        medium: 0,
+        low: 0,
+        info: 0,
+        proven: 0,
+        indicated: 0,
+        heuristic: 0,
+    };
+    for (const f of findings) {
+        if (f.severity === "critical")
+            s.critical++;
+        else if (f.severity === "high")
+            s.high++;
+        else if (f.severity === "medium")
+            s.medium++;
+        else if (f.severity === "low")
+            s.low++;
+        else
+            s.info++;
+        if (f.confidence === "proven")
+            s.proven++;
+        else if (f.confidence === "indicated")
+            s.indicated++;
+        else
+            s.heuristic++;
+    }
+    return s;
+}
+/** Sort findings: severity first, proven above indicated above heuristic. */
+export function sortFindings(findings) {
+    const sevRank = (s) => SEVERITY_ORDER.indexOf(s);
+    const confRank = (c) => (c === "proven" ? 0 : c === "indicated" ? 1 : 2);
+    return [...findings].sort((a, b) => sevRank(a.severity) - sevRank(b.severity) || confRank(a.confidence) - confRank(b.confidence));
+}
+//# sourceMappingURL=types.js.map

package/dist/pen/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/pen/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiGH,MAAM,CAAC,MAAM,cAAc,GAAkB;IAC3C,UAAU;IACV,MAAM;IACN,QAAQ;IACR,KAAK;IACL,MAAM;CACP,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,QAAsB;IACtD,MAAM,CAAC,GAAG;QACR,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,CAAC;KACb,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU;YAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;aACvC,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM;YAAE,CAAC,CAAC,IAAI,EAAE,CAAC;aACpC,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,CAAC,CAAC,MAAM,EAAE,CAAC;aACxC,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK;YAAE,CAAC,CAAC,GAAG,EAAE,CAAC;;YAClC,CAAC,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ;YAAE,CAAC,CAAC,MAAM,EAAE,CAAC;aACrC,IAAI,CAAC,CAAC,UAAU,KAAK,WAAW;YAAE,CAAC,CAAC,SAAS,EAAE,CAAC;;YAChD,CAAC,CAAC,SAAS,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,QAAsB;IACjD,MAAM,OAAO,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,CAAC,CAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CACvG,CAAC;AACJ,CAAC"}

package/dist/report/format.d.ts

@@ -0,0 +1,126 @@
+import type { ScanResult, Cluster } from "../analyzers/types.js";
+import type { IntegrityFinding, Verdict } from "../analyzers/integrity/types.js";
+export interface VerifyMetrics {
+    tests: {
+        total: number;
+        passed: number;
+        failed: number;
+        durationMs: number;
+        coverage?: number;
+    };
+    perf: {
+        buildTimeMs?: number;
+        bundleSizeBytes?: number;
+    };
+    securityCount: number;
+    duplicationCount: number;
+}
+export interface VerifyReport {
+    timestamp: string;
+    repo: string;
+    baselineTimestamp?: string;
+    risk: "High" | "Medium" | "Low";
+    exitCode: number;
+    deltas: {
+        passed: number;
+        failed: number;
+        durationMs: number;
+        coverage: number;
+        buildTimeMs: number;
+        bundleSizeBytes: number;
+        security: number;
+        duplication: number;
+    };
+    baseline: VerifyMetrics;
+    current: VerifyMetrics;
+    /** OpenPitStop score at verify time (baseline vs patched current). */
+    score?: {
+        baseline: number;
+        current: number;
+        delta: number;
+        grade: string;
+    };
+    /** Phase 16 integrity gate result captured by `pitstop verify`. */
+    integrity?: {
+        verdict: Verdict;
+        findings: IntegrityFinding[];
+        summary: {
+            confirmed: number;
+            suspicious: number;
+            total: number;
+        };
+    };
+}
+export interface History {
+    repo: string;
+    scans: ScanResult[];
+    verifies: VerifyReport[];
+}
+export declare function loadHistory(repo: string): History;
+/**
+ * Gather every Phase 16 integrity verdict recorded by the loop (from verify-*.json
+ * and integrity-*.json in `.pitstop/`) and summarize catches vs self-corrections.
+ */
+export declare function collectIntegrity(repo: string): ReportModel["integrity"] | undefined;
+export interface MetricLine {
+    label: string;
+    value: string;
+    color?: "green" | "yellow" | "red" | "dim";
+}
+/** A committed repro test that permanently proves a fix. */
+export interface ReproProof {
+    /** Relative path of the pitstop-repro-*.test.* file. */
+    file: string;
+    /** The finding id (from scan-latest.json) its header links back to. */
+    findingId?: string;
+}
+/** Scan the repo for committed permanent proof files. */
+export declare function loadProofs(repo: string): ReproProof[];
+export interface ReportModel {
+    repo: string;
+    generatedAt: string;
+    latestScan: ScanResult | null;
+    latestVerify: VerifyReport | null;
+    scansCount: number;
+    verifiesCount: number;
+    lines: MetricLine[];
+    clusters: Cluster[];
+    hasVerify: boolean;
+    /** Committed repro tests that permanently prove each fix. */
+    proofs: ReproProof[];
+    /**
+     * Aggregated Phase 16 integrity evidence from every `pitstop verify` (and
+     * `pitstop integrity`) run in `.pitstop/`. A "catch" is any non-CLEAN
+     * verdict; a catch followed by a later CLEAN check is a self-correction the
+     * loop performed on its own. Frame these as a positive — the gate working.
+     */
+    integrity?: {
+        checks: number;
+        catches: number;
+        selfCorrected: number;
+        events: {
+            timestamp: string;
+            verdict: Verdict;
+            findings: IntegrityFinding[];
+        }[];
+    };
+}
+export declare function buildModel(repo: string): ReportModel;
+export declare function renderTerminal(model: ReportModel): string;
+export interface MarkdownOptions {
+    /** Put the root-cause → symptoms clusters directly under the header. */
+    clustersFirst?: boolean;
+    /** One-line context shown under the header (branch, base, PR, etc.). */
+    headerNote?: string;
+    /** Title override (default "Repository Analysis Complete"). */
+    title?: string;
+}
+export declare function renderMarkdown(model: ReportModel, opts?: MarkdownOptions): string;
+export declare function escapeHtml(s: string): string;
+/** Minimal inline-SVG line chart for a metric across scans. */
+export declare function svgTrend(values: (number | null)[], colorHex: string): string;
+/**
+ * Self-contained HTML report (inline CSS, inline SVG charts, zero external
+ * assets) — the artifact you send to a stakeholder and it just works.
+ */
+export declare function renderHtml(model: ReportModel): string;