openpitstop 1.0.0

package/dist/repro/pen.js

@@ -0,0 +1,321 @@
+/**
+ * repro/pen.ts — permanent repro tests for pen findings.
+ *
+ * A pen repro RE-PLAYS the exact attack the pen test fired (same route, same
+ * payload, same sandbox) and asserts the SAFE outcome. While the vuln exists
+ * the test FAILS; after the fix it PASSES. That is the fail-first contract,
+ * applied to a live penetration test.
+ *
+ * The test is always generated as a `node:test` ESM file (like the ledger
+ * repro) because it must boot the app under the pen preload, regardless of the
+ * repo's own test framework.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { reproSlug } from "./ids.js";
+function preloadPath() {
+    return fileURLToPath(new URL("../../templates/pen/preload.cjs", import.meta.url));
+}
+/**
+ * Turn a pen finding into the normalized ReproFinding shape the slug generator
+ * (and any future caller) expects.
+ */
+export function penFindingToRepro(f) {
+    return {
+        id: f.id,
+        source: "pen",
+        severity: f.severity,
+        type: f.type,
+        description: f.title,
+        file: f.file,
+        line: f.line,
+        data: f,
+    };
+}
+const J = (s) => JSON.stringify(s);
+/**
+ * The assertion body for each attack type. Returns JS that must be embedded in
+ * the test; `f` carries the attack + observed evidence, `marker` is a fresh
+ * random marker for THIS replay.
+ */
+function assertionBody(f, marker) {
+    switch (f.type) {
+        case "reflected-xss":
+            return [
+                `assert.ok(!res.body.includes(${J(marker)}), "the XSS payload was reflected UNESCAPED in the response — reflecting user input is live");`,
+            ];
+        case "path-traversal":
+            return [
+                `assert.ok(!res.body.includes("root:x:0:0") && !res.body.includes("[extensions]") && !res.body.includes("; for 16-bit app support"), "the traversal payload leaked a host file inside the response — arbitrary file read is live");`,
+            ];
+        case "command-injection":
+            return [
+                `await sleep(400);`,
+                `const spawns = readOutbound(outboundPath).filter((e) => e.kind === "spawn" && e.cmd && e.cmd.includes(${J(marker)}));`,
+                `assert.equal(spawns.length, 0, "the sandbox recorded the marker inside a child_process spawn: command injection is live: " + JSON.stringify(spawns.map((e) => e.cmd)));`,
+            ];
+        case "ssrf":
+            return [
+                `await sleep(400);`,
+                `const hits = readOutbound(outboundPath).filter((e) => e.kind === "http" && e.host && e.host.includes("ssrf-canary"));`,
+                `assert.equal(hits.length, 0, "the server opened an outbound connection to the canary host: SSRF is live: " + JSON.stringify(hits.map((e) => e.host)));`,
+            ];
+        case "sql-injection":
+        case "nosql-injection":
+            return [
+                `assert.ok(res.status < 500, "the injection payload crashed the server (HTTP " + res.status + ") — input reaches a query raw");`,
+                `assert.ok(res.status !== 200 || !/syntax|unterminated|parse|mongo|sequelize|sqlite|knex|cannot read/i.test(res.snippet), "the injection payload surfaced a DB error in the response");`,
+            ];
+        case "crash-on-input":
+            return [
+                `assert.ok(res.status < 500, "the crafted input crashed the server (HTTP " + res.status + ") — unhandled exceptions are a DoS vector");`,
+            ];
+        case "missing-auth":
+            return [
+                `assert.ok(res.status === 401 || res.status === 403, "the sensitive route answered unauthenticated with HTTP " + res.status + " — anyone can reach it");`,
+            ];
+        case "no-rate-limit":
+            return [
+                `let got429 = 0;`,
+                `for (let i = 0; i < 30; i++) {`,
+                `  const r = await send("POST", ${J(f.attack?.path ?? "/")}, { username: "admin", password: "x-" + i });`,
+                `  if (r.status === 429) got429++;`,
+                `}`,
+                `assert.ok(got429 > 0, "none of the 30 rapid requests were rate-limited (no 429) — credential stuffing is unthrottled");`,
+            ];
+        case "info-leak-header":
+            return [
+                `assert.ok(!res.headers["x-powered-by"], "X-Powered-By leaked the framework — disable it");`,
+            ];
+        case "missing-security-headers":
+            return [
+                `const want = ["x-frame-options", "content-security-policy", "x-content-type-options", "strict-transport-security"];`,
+                `const missing = want.filter((h) => !res.headers[h]);`,
+                `assert.ok(missing.length < 2, "security headers missing: " + missing.join(", "));`,
+            ];
+        default:
+            return [];
+    }
+}
+/** For static secret findings: guard the exact credential string. */
+function secretGuardBody(f, fileRel) {
+    const secretFragment = (f.description.match(/\(([^)]{4,})…\)/) || [])[1] ?? "";
+    const needle = secretFragment.slice(0, 8);
+    if (!needle)
+        return [];
+    return [
+        `const content = readFileSync(${J(fileRel)}, "utf8");`,
+        `assert.ok(!content.includes(${J(needle)}), "the committed credential fragment '" + ${J(needle)} + "' is still in " + ${J(fileRel)} + " — rotate and remove it");`,
+    ];
+}
+/**
+ * Generate (and optionally write) the repro test file for a pen finding.
+ */
+export function generatePenRepro(repo, f) {
+    const isDynamic = f.source === "pen-dynamic" || (f.runtimeProof === "proven" && !!f.attack);
+    const isStaticSecret = f.type === "hardcoded-secret" && f.file;
+    if (!isDynamic && !isStaticSecret) {
+        return {
+            ok: false,
+            reason: "this pen finding is a static heuristic / config observation — there is no live attack to replay. " +
+                "Fix it and re-run `pitstop pen`; the dynamic phase produces replayable repros for live bugs.",
+        };
+    }
+    const r = penFindingToRepro(f);
+    const slug = reproSlug(r);
+    const file = `pitstop-repro-${slug}.test.mjs`;
+    if (isStaticSecret) {
+        const fileRel = path.relative(repo, f.file).replace(/\\/g, "/");
+        const header = [
+            `// OpenPitStop permanent repro test — finding ${f.id}`,
+            `// Linked from .pitstop/pen-latest.json.`,
+            `//`,
+            `// A committed credential guard: while the secret fragment below is present`,
+            `// in the file, this test FAILS. Rotate the secret, remove it, and it PASSES.`,
+        ].join("\n");
+        const body = secretGuardBody(f, fileRel);
+        if (body.length === 0) {
+            return { ok: false, reason: "cannot derive a stable credential fragment from this secret finding" };
+        }
+        const content = [
+            header,
+            ``,
+            `import { test } from "node:test";`,
+            `import assert from "node:assert/strict";`,
+            `import { readFileSync } from "node:fs";`,
+            ``,
+            `test("pitstop repro ${f.id}: no committed secret in ${fileRel}", () => {`,
+            `  ${body.join("\n  ")}`,
+            `});`,
+            ``,
+        ].join("\n");
+        fs.writeFileSync(path.join(repo, file), content, "utf8");
+        return { ok: true, file };
+    }
+    // Dynamic: replay the exact attack under the sandbox and assert the safe outcome.
+    const attack = f.attack;
+    if (!attack) {
+        return {
+            ok: false,
+            reason: "dynamic finding carries no recorded attack to replay (evidence missing from pen-latest.json)",
+        };
+    }
+    // Runtime-proven static findings assert the attack class that proved them
+    // (e.g. a proven xss-sink asserts reflected-xss behavior), not the pattern.
+    const assertFinding = f.proofType ? { ...f, type: f.proofType } : f;
+    const bodyLines = [];
+    // The marker lives inside the ORIGINAL attack payload/path (e.g. gpn12345678).
+    // Reuse it so the replay's proof matches what the pen test observed.
+    const attackSource = JSON.stringify([attack.path, attack.payload ?? null]);
+    const marker = attackSource.match(/gpn\d{7,}/)?.[0] ?? `gpn${Math.floor(Math.random() * 1e8)}`;
+    const isHammer = f.type === "no-rate-limit";
+    const NODE_BASED = [
+        "node", "node.exe", "nodejs", "npm", "npm.cmd", "npx", "npx.cmd",
+        "yarn", "yarn.cmd", "pnpm", "pnpm.cmd", "tsx", "ts-node", "babel-node", "ojs", "vitest", "jest",
+    ].map((s) => J(s)).join(", ");
+    const prelude = [
+        `const REPO = process.cwd();`,
+        `const PRELOAD = process.env.PITSTOP_PEN_PRELOAD;`,
+        `let BASE_URL = null;`,
+        `const NODE_BASED = new Set([${NODE_BASED}]);`,
+        ``,
+        `import { test } from "node:test";`,
+        `import assert from "node:assert/strict";`,
+        `import { spawn } from "node:child_process";`,
+        `import { readFileSync, mkdirSync, existsSync } from "node:fs";`,
+        `import net from "node:net";`,
+        `import path from "node:path";`,
+        ``,
+        `function freePort() {`,
+        `  return new Promise((resolve, reject) => {`,
+        `    const s = net.createServer();`,
+        `    s.unref();`,
+        `    s.on("error", reject);`,
+        `    s.listen(0, () => {`,
+        `      const p = s.address().port;`,
+        `      s.close(() => resolve(p));`,
+        `    });`,
+        `  });`,
+        `}`,
+        `const sleep = (ms) => new Promise((r) => setTimeout(r, ms));`,
+        ``,
+        `function resolveStart() {`,
+        `  const pkg = JSON.parse(readFileSync(path.join(REPO, "package.json"), "utf8"));`,
+        `  const start = (pkg.scripts && pkg.scripts.start) || "";`,
+        `  if (!start) throw new Error("no start script in package.json");`,
+        `  const tokens = start.trim().split(/\\s+/);`,
+        `  if (!NODE_BASED.has(tokens[0])) {`,
+        `    throw new Error("start script runs " + tokens[0] + ", which is not Node-based — refusing");`,
+        `  }`,
+        `  return { cmd: tokens[0], args: tokens.slice(1) };`,
+        `}`,
+        ``,
+        `function controlHas(controlPath, needle) {`,
+        `  if (!existsSync(controlPath)) return false;`,
+        `  try {`,
+        `    return readFileSync(controlPath, "utf8").split(/\\r?\\n/).some((l) => l.includes(needle));`,
+        `  } catch {`,
+        `    return false;`,
+        `  }`,
+        `}`,
+        ``,
+        `function readOutbound(p) {`,
+        `  if (!existsSync(p)) return [];`,
+        `  return readFileSync(p, "utf8").split(/\\r?\\n/).filter(Boolean).map((l) => {`,
+        `    try { return JSON.parse(l); } catch { return null; }`,
+        `  }).filter(Boolean);`,
+        `}`,
+        ``,
+        `async function send(method, p, body) {`,
+        `  try {`,
+        `    const res = await fetch(BASE_URL + p, {`,
+        `      method,`,
+        `      headers: body !== undefined ? { "Content-Type": "application/json" } : undefined,`,
+        `      body: body !== undefined ? JSON.stringify(body) : undefined,`,
+        `      redirect: "manual",`,
+        `      signal: AbortSignal.timeout(6000),`,
+        `    });`,
+        `    const text = await res.text().catch(() => "");`,
+        `    const headers = {};`,
+        `    res.headers.forEach((v, k) => { headers[k] = v; });`,
+        `    return { status: res.status, body: text, snippet: text.slice(0, 300), headers };`,
+        `  } catch (e) {`,
+        `    return { status: 0, body: "", snippet: "", headers: {} };`,
+        `  }`,
+        `}`,
+        ``,
+        `test("pitstop repro ${f.id}: ${assertFinding.type} blocked on ${attack.path}", async () => {`,
+        `  assert.ok(PRELOAD, "PITSTOP_PEN_PRELOAD not set — run this via \`npx openpitstop repro ${f.id}\`");`,
+        ``,
+        `  const start = resolveStart();`,
+        `  const runDir = path.join(REPO, ".pitstop", "repro", new Date().toISOString().replace(/[:.]/g, "-"));`,
+        `  mkdirSync(runDir, { recursive: true });`,
+        `  const controlPath = path.join(runDir, "control.jsonl");`,
+        `  const outboundPath = path.join(runDir, "outbound.jsonl");`,
+        `  const port = await freePort();`,
+        `  BASE_URL = "http://127.0.0.1:" + port;`,
+        ``,
+    ];
+    const boot = [
+        `  const env = {`,
+        `    ...process.env,`,
+        `    NODE_OPTIONS: [process.env.NODE_OPTIONS, "--require=" + PRELOAD].filter(Boolean).join(" "),`,
+        `    PORT: String(port),`,
+        `    PITSTOP_PEN_CONTROL: controlPath,`,
+        `    PITSTOP_PEN_OUTBOUND: outboundPath,`,
+        `    RAZORPAY_KEY_ID: process.env.RAZORPAY_KEY_ID || "rzp_test_pitstop000000",`,
+        `    RAZORPAY_KEY_SECRET: process.env.RAZORPAY_KEY_SECRET || "pitstop_fake_secret",`,
+        `    STRIPE_SECRET_KEY: process.env.STRIPE_SECRET_KEY || "sk_test_pitstop_fake",`,
+        `    NODE_ENV: process.env.NODE_ENV || "test",`,
+        `  };`,
+        `  const child = spawn(start.cmd, start.args, { cwd: REPO, env, stdio: ["ignore", "ignore", "inherit"] });`,
+        `  try {`,
+        `    const deadline = Date.now() + 25000;`,
+        `    let up = false;`,
+        `    while (Date.now() < deadline) {`,
+        `      if (child.exitCode !== null) break;`,
+        `      if (controlHas(controlPath, '"event":"armed"')) {`,
+        `        try {`,
+        `          await fetch(BASE_URL + "/__pitstop_pen_probe__");`,
+        `          up = true;`,
+        `          break;`,
+        `        } catch {}`,
+        `      }`,
+        `      await sleep(150);`,
+        `    }`,
+        `    assert.ok(up, "app did not come up under the sandbox within 25s");`,
+    ];
+    const attackCode = isHammer
+        ? []
+        : [
+            `    const res = await send(${J(attack.method)}, ${J(attack.path)}, ${attack.payload !== undefined ? J(attack.payload) : "undefined"});`,
+        ];
+    const close = [
+        `  } finally {`,
+        `    try { child.kill(); } catch {}`,
+        `  }`,
+        `});`,
+    ];
+    const assertCode = isHammer
+        ? assertionBody(assertFinding, marker)
+        : assertionBody(assertFinding, marker).map((l) => `    ` + l);
+    // header for the test file
+    const headerLines = [
+        `// OpenPitStop permanent repro test — finding ${f.id}`,
+        `// Linked from .pitstop/pen-latest.json.`,
+        `//`,
+        `// REPLAYS the exact attack the pen test fired: ${attack.method} ${attack.path}`,
+        `// and asserts the SAFE outcome. This test MUST FAIL while the vulnerability`,
+        `// exists and MUST PASS only after the fix.`,
+    ];
+    bodyLines.push(...prelude, ...boot, ...attackCode, ...assertCode, ...close);
+    const content = [headerLines.join("\n"), "", ...bodyLines, ""].join("\n");
+    fs.writeFileSync(path.join(repo, file), content, "utf8");
+    return { ok: true, file };
+}
+/** Absolute path of the pen sandbox preload (for run.ts). */
+export function penPreloadPath() {
+    return preloadPath();
+}
+//# sourceMappingURL=pen.js.map

package/dist/repro/pen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pen.js","sourceRoot":"","sources":["../../src/repro/pen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,SAAS,EAAqB,MAAM,UAAU,CAAC;AAExD,SAAS,WAAW;IAClB,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,iCAAiC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACpF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAa;IAC7C,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,KAAK;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAEpD;;;;GAIG;AACH,SAAS,aAAa,CAAC,CAAa,EAAE,MAAc;IAClD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,eAAe;YAClB,OAAO;gBACL,gCAAgC,CAAC,CAAC,MAAM,CAAC,gGAAgG;aAC1I,CAAC;QACJ,KAAK,gBAAgB;YACnB,OAAO;gBACL,oOAAoO;aACrO,CAAC;QACJ,KAAK,mBAAmB;YACtB,OAAO;gBACL,mBAAmB;gBACnB,yGAAyG,CAAC,CAAC,MAAM,CAAC,KAAK;gBACvH,yKAAyK;aAC1K,CAAC;QACJ,KAAK,MAAM;YACT,OAAO;gBACL,mBAAmB;gBACnB,uHAAuH;gBACvH,wJAAwJ;aACzJ,CAAC;QACJ,KAAK,eAAe,CAAC;QACrB,KAAK,iBAAiB;YACpB,OAAO;gBACL,gIAAgI;gBAChI,wLAAwL;aACzL,CAAC;QACJ,KAAK,gBAAgB;YACnB,OAAO;gBACL,wIAAwI;aACzI,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO;gBACL,yJAAyJ;aAC1J,CAAC;QACJ,KAAK,eAAe;YAClB,OAAO;gBACL,iBAAiB;gBACjB,gCAAgC;gBAChC,kCAAkC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,+CAA+C;gBACzG,mCAAmC;gBACnC,GAAG;gBACH,yHAAyH;aAC1H,CAAC;QACJ,KAAK,kBAAkB;YACrB,OAAO;gBACL,4FAA4F;aAC7F,CAAC;QACJ,KAAK,0BAA0B;YAC7B,OAAO;gBACL,qHAAqH;gBACrH,sDAAsD;gBACtD,mFAAmF;aACpF,CAAC;QACJ;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,SAAS,eAAe,CAAC,CAAa,EAAE,OAAe;IACrD,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO;QACL,gCAAgC,CAAC,CAAC,OAAO,CAAC,YAAY;QACtD,+BAA+B,CAAC,CAAC,MAAM,CAAC,8CAA8C,CAAC,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,gCAAgC;KACnK,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,CAAa;IAC1D,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5F,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,CAAC,IAAI,CAAC;IAE/D,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,mGAAmG;gBACnG,8FAA8F;SACjG,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,iBAAiB,IAAI,WAAW,CAAC;IAE9C,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAc,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG;YACb,iDAAiD,CAAC,CAAC,EAAE,EAAE;YACvD,0CAA0C;YAC1C,IAAI;YACJ,6EAA6E;YAC7E,+EAA+E;SAChF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qEAAqE,EAAE,CAAC;QACtG,CAAC;QACD,MAAM,OAAO,GAAG;YACd,MAAM;YACN,EAAE;YACF,mCAAmC;YACnC,0CAA0C;YAC1C,yCAAyC;YACzC,EAAE;YACF,uBAAuB,CAAC,CAAC,EAAE,4BAA4B,OAAO,YAAY;YAC1E,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YACxB,KAAK;YACL,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED,kFAAkF;IAClF,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,8FAA8F;SACvG,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,aAAa,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpE,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,+EAA+E;IAC/E,qEAAqE;IACrE,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;IAE/F,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC;IAE5C,MAAM,UAAU,GAAG;QACjB,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS;QAChE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;KAChG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE9B,MAAM,OAAO,GAAG;QACd,6BAA6B;QAC7B,kDAAkD;QAClD,sBAAsB;QACtB,+BAA+B,UAAU,KAAK;QAC9C,EAAE;QACF,mCAAmC;QACnC,0CAA0C;QAC1C,6CAA6C;QAC7C,gEAAgE;QAChE,6BAA6B;QAC7B,+BAA+B;QAC/B,EAAE;QACF,uBAAuB;QACvB,6CAA6C;QAC7C,mCAAmC;QACnC,gBAAgB;QAChB,4BAA4B;QAC5B,yBAAyB;QACzB,mCAAmC;QACnC,kCAAkC;QAClC,SAAS;QACT,OAAO;QACP,GAAG;QACH,8DAA8D;QAC9D,EAAE;QACF,2BAA2B;QAC3B,kFAAkF;QAClF,2DAA2D;QAC3D,mEAAmE;QACnE,8CAA8C;QAC9C,qCAAqC;QACrC,iGAAiG;QACjG,KAAK;QACL,qDAAqD;QACrD,GAAG;QACH,EAAE;QACF,4CAA4C;QAC5C,+CAA+C;QAC/C,SAAS;QACT,gGAAgG;QAChG,aAAa;QACb,mBAAmB;QACnB,KAAK;QACL,GAAG;QACH,EAAE;QACF,4BAA4B;QAC5B,kCAAkC;QAClC,gFAAgF;QAChF,0DAA0D;QAC1D,uBAAuB;QACvB,GAAG;QACH,EAAE;QACF,wCAAwC;QACxC,SAAS;QACT,6CAA6C;QAC7C,eAAe;QACf,yFAAyF;QACzF,oEAAoE;QACpE,2BAA2B;QAC3B,0CAA0C;QAC1C,SAAS;QACT,oDAAoD;QACpD,yBAAyB;QACzB,yDAAyD;QACzD,sFAAsF;QACtF,iBAAiB;QACjB,+DAA+D;QAC/D,KAAK;QACL,GAAG;QACH,EAAE;QACF,uBAAuB,CAAC,CAAC,EAAE,KAAK,aAAa,CAAC,IAAI,eAAe,MAAM,CAAC,IAAI,kBAAkB;QAC9F,4FAA4F,CAAC,CAAC,EAAE,OAAO;QACvG,EAAE;QACF,iCAAiC;QACjC,wGAAwG;QACxG,2CAA2C;QAC3C,2DAA2D;QAC3D,6DAA6D;QAC7D,kCAAkC;QAClC,0CAA0C;QAC1C,EAAE;KACH,CAAC;IAEF,MAAM,IAAI,GAAG;QACX,iBAAiB;QACjB,qBAAqB;QACrB,iGAAiG;QACjG,yBAAyB;QACzB,uCAAuC;QACvC,yCAAyC;QACzC,+EAA+E;QAC/E,oFAAoF;QACpF,iFAAiF;QACjF,+CAA+C;QAC/C,MAAM;QACN,2GAA2G;QAC3G,SAAS;QACT,0CAA0C;QAC1C,qBAAqB;QACrB,qCAAqC;QACrC,2CAA2C;QAC3C,yDAAyD;QACzD,eAAe;QACf,6DAA6D;QAC7D,sBAAsB;QACtB,kBAAkB;QAClB,oBAAoB;QACpB,SAAS;QACT,yBAAyB;QACzB,OAAO;QACP,wEAAwE;KACzE,CAAC;IAEF,MAAM,UAAU,GAAG,QAAQ;QACzB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE,8BAA8B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI;SACzI,CAAC;IAEN,MAAM,KAAK,GAAG;QACZ,eAAe;QACf,oCAAoC;QACpC,KAAK;QACL,KAAK;KACN,CAAC;IAEF,MAAM,UAAU,GAAG,QAAQ;QACzB,CAAC,CAAC,aAAa,CAAC,aAAa,EAAE,MAAM,CAAC;QACtC,CAAC,CAAC,aAAa,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEhE,2BAA2B;IAC3B,MAAM,WAAW,GAAG;QAClB,iDAAiD,CAAC,CAAC,EAAE,EAAE;QACvD,0CAA0C;QAC1C,IAAI;QACJ,mDAAmD,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE;QACjF,8EAA8E;QAC9E,6CAA6C;KAC9C,CAAC;IAEF,SAAS,CAAC,IAAI,CACZ,GAAG,OAAO,EACV,GAAG,IAAI,EACP,GAAG,UAAU,EACb,GAAG,UAAU,EACb,GAAG,KAAK,CACT,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC"}

package/dist/repro/run.d.ts

@@ -0,0 +1,18 @@
+export interface ReproRunResult {
+    ran: boolean;
+    passed?: boolean;
+    /** Relative path of the test file that ran. */
+    file?: string;
+    /** Exit code from the runner. */
+    exitCode?: number;
+    stdout: string;
+    stderr: string;
+    timedOut?: boolean;
+    framework?: string;
+}
+/**
+ * run.ts — execute a generated repro test against the repo's own test
+ * framework, feeding it everything it needs (e.g. the absolute path to the
+ * ledger sandbox preload, set so the committed test stays runnable in CI).
+ */
+export declare function runRepro(repo: string, file: string): Promise<ReproRunResult>;

package/dist/repro/run.js

@@ -0,0 +1,36 @@
+import path from "node:path";
+import fs from "node:fs";
+import { runTestFile, detectTestFramework, frameworkLabel } from "./framework.js";
+import { preloadPath } from "./generate.js";
+import { penPreloadPath } from "./pen.js";
+/**
+ * run.ts — execute a generated repro test against the repo's own test
+ * framework, feeding it everything it needs (e.g. the absolute path to the
+ * ledger sandbox preload, set so the committed test stays runnable in CI).
+ */
+export function runRepro(repo, file) {
+    const abs = path.join(repo, file);
+    if (!fs.existsSync(abs)) {
+        return Promise.resolve({
+            ran: false,
+            stdout: "",
+            stderr: `repro test file not found: ${abs}`,
+        });
+    }
+    const framework = detectTestFramework(repo);
+    const extra = {
+        PITSTOP_LEDGER_PRELOAD: preloadPath(),
+        PITSTOP_PEN_PRELOAD: penPreloadPath(),
+    };
+    return runTestFile(repo, abs, extra, 150000).then((r) => ({
+        ran: true,
+        passed: r.timedOut ? false : r.code === 0,
+        file,
+        exitCode: r.code,
+        stdout: r.stdout,
+        stderr: r.stderr,
+        timedOut: r.timedOut,
+        framework: frameworkLabel(framework),
+    }));
+}
+//# sourceMappingURL=run.js.map

package/dist/repro/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/repro/run.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAe1C;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,IAAY;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,KAAK;YACV,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,8BAA8B,GAAG,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,KAAK,GAA2B;QACpC,sBAAsB,EAAE,WAAW,EAAE;QACrC,mBAAmB,EAAE,cAAc,EAAE;KACtC,CAAC;IACF,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,GAAG,EAAE,IAAI;QACT,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QACzC,IAAI;QACJ,QAAQ,EAAE,CAAC,CAAC,IAAI;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;KACrC,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/sandbox/proxy.d.ts

@@ -0,0 +1,41 @@
+/**
+ * sandbox/proxy.ts — HTTP(S)_PROXY recording proxy for non-Node apps.
+ *
+ * The Node sandbox (preload.cjs + nock) cannot load into Go/Rust/Python/.NET
+ * processes. For those stacks OpenPitStop boots the app with HTTP_PROXY /
+ * HTTPS_PROXY pointed at this in-process proxy:
+ *
+ *   - every non-loopback outbound request is recorded (JSONL, same shape the
+ *     Node sandbox writes) and NEVER forwarded anywhere real;
+ *   - payment-gateway hosts are answered with a mocked success receipt and the
+ *     call is written to the ledger gateway log (identical LedgerChargeCall
+ *     shape, so evidence.ts is unchanged);
+ *   - SSRF canary hosts are answered and recorded as outbound events;
+ *   - every other host gets a 502 — nothing real ever leaves the machine.
+ *
+ * HONEST CAVEATS (labeled in every report that uses this proxy):
+ *   - only apps whose HTTP clients honor HTTP_PROXY are intercepted (Go,
+ *     Python, Rust, .NET by default; Java/Dart do not by default);
+ *   - native binaries (curl subprocesses) and raw sockets bypass the proxy
+ *     entirely and are NOT observed;
+ *   - HTTPS is a CONNECT tunnel: without a trusted CA we cannot terminate it,
+ *     so https gateway calls are blocked (502) and recorded as blocked —
+ *     a double-charge over HTTPS therefore cannot be proven via this proxy.
+ */
+export interface ProxyOptions {
+    /** JSONL outbound event stream (same shape as the Node sandbox's). */
+    logPath: string;
+    /** Optional control stream: writes `{event:"armed"}` and `{event:"gateway-call"}`. */
+    controlPath?: string;
+    /** Optional ledger gateway receipt stream (LedgerChargeCall JSONL). */
+    gatewayLogPath?: string;
+    /** Hosts that receive mocked gateway success responses. */
+    gatewayHosts: string[];
+    /** Host suffix treated as a canary (e.g. "pitstop.invalid"). */
+    canarySuffix: string;
+}
+export interface RecordingProxy {
+    port: number;
+    close(): Promise<void>;
+}
+export declare function startRecordingProxy(opts: ProxyOptions): Promise<RecordingProxy>;

package/dist/sandbox/proxy.js

@@ -0,0 +1,231 @@
+import http from "node:http";
+import fs from "node:fs";
+const CHARGE_RE = /(?:^|\/)(payments|charges|payment_intents|paymentintents|captures?|transactions)(\/|$|\?)/i;
+function getHeader(headers, name) {
+    const target = name.toLowerCase();
+    for (const k of Object.keys(headers)) {
+        if (k.toLowerCase() === target)
+            return headers[k];
+    }
+    return undefined;
+}
+function deriveKey(method, path, headers, body) {
+    for (const name of [
+        "idempotency-key",
+        "x-idempotency-key",
+        "idempotency",
+        "x-idempotency",
+        "x-razorpay-idempotency",
+    ]) {
+        const v = getHeader(headers, name);
+        if (v != null && v !== "")
+            return String(v);
+    }
+    const b = body;
+    const oid = b && (b.order_id ?? b.orderId ?? b.reference_id);
+    if (oid != null)
+        return String(oid);
+    const m = String(path).match(/\/(payments|charges|payment_intents|transactions)\/([^/]+)/i);
+    if (m)
+        return m[2];
+    return null;
+}
+function isCharge(method, path) {
+    const u = String(method).toUpperCase();
+    if (u === "GET" || u === "HEAD" || u === "OPTIONS")
+        return false;
+    return CHARGE_RE.test(String(path));
+}
+let seq = 0;
+function nextId(prefix) {
+    seq += 1;
+    return (prefix || "req") + "_" + Date.now().toString(36) + "_" + seq;
+}
+function safeBody(raw) {
+    if (Buffer.isBuffer(raw))
+        raw = raw.toString("utf8");
+    if (typeof raw === "string") {
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            return { raw };
+        }
+    }
+    return raw;
+}
+function gatewaySuccess(host, method, path, body, requestId) {
+    const b = body;
+    const amount = b && b.amount != null ? b.amount : 1000;
+    const currency = (b && b.currency) || "INR";
+    const h = String(host).toLowerCase();
+    if (h.includes("razorpay")) {
+        return {
+            id: "pay_" + requestId,
+            entity: "payment",
+            amount,
+            currency,
+            status: /capture|settle/i.test(path) ? "captured" : "authorized",
+            order_id: (b && b.order_id) || null,
+            method: "card",
+            vpa: null,
+            created_at: Date.now() / 1000,
+        };
+    }
+    if (h.includes("stripe")) {
+        return {
+            id: "ch_" + requestId,
+            object: "charge",
+            amount,
+            currency: String(currency).toLowerCase(),
+            status: "succeeded",
+            paid: true,
+            captured: true,
+            requestId,
+            created: Date.now() / 1000,
+        };
+    }
+    if (h.includes("braintree")) {
+        return {
+            id: requestId,
+            object: "transaction",
+            status: "settled",
+            amount: String((Number(amount) || 0) / 100),
+            currencyIsoCode: currency,
+            createdAt: new Date().toISOString(),
+        };
+    }
+    return {
+        id: requestId,
+        object: "payment",
+        status: "succeeded",
+        amount,
+        currency,
+    };
+}
+export function startRecordingProxy(opts) {
+    let seqOut = 0;
+    const append = (file, obj) => {
+        try {
+            fs.appendFileSync(file, JSON.stringify(obj) + "\n");
+        }
+        catch {
+            /* best-effort */
+        }
+    };
+    const logEvent = (kind, extra) => {
+        seqOut += 1;
+        append(opts.logPath, {
+            kind,
+            n: seqOut,
+            at: new Date().toISOString(),
+            ...extra,
+        });
+    };
+    const control = (event) => {
+        if (opts.controlPath)
+            append(opts.controlPath, { at: new Date().toISOString(), ...event });
+    };
+    const isGateway = (host) => opts.gatewayHosts.some((g) => {
+        const gh = g.replace(/^https?:\/\//i, "").toLowerCase();
+        const h = host.toLowerCase();
+        return h === gh || h.endsWith("." + gh);
+    });
+    const isCanary = (host) => host.toLowerCase().endsWith(opts.canarySuffix.toLowerCase());
+    const isLoopback = (host) => /^(localhost|127\.\d+\.\d+\.\d+|::1|0\.0\.0\.0)$/i.test(host);
+    const server = http.createServer((req, res) => {
+        let target;
+        try {
+            target = new URL(req.url ?? "/", "http://localhost");
+        }
+        catch {
+            res.writeHead(400);
+            res.end("pitstop-proxy: unparseable request");
+            return;
+        }
+        const host = target.hostname || String(req.headers.host ?? "").split(":")[0] || "unknown";
+        const path = target.pathname + target.search;
+        const method = String(req.method ?? "GET").toUpperCase();
+        // Loopback targets (e.g. clients ignoring NO_PROXY): forward on-machine.
+        if (isLoopback(host)) {
+            const proxy = http.request({
+                host: target.hostname,
+                port: target.port || (target.protocol === "https:" ? 443 : 80),
+                method,
+                path: target.pathname + target.search,
+                headers: { ...req.headers, host: target.host },
+            }, (upstream) => {
+                res.writeHead(upstream.statusCode ?? 502, upstream.headers);
+                upstream.pipe(res);
+            });
+            proxy.on("error", () => {
+                res.writeHead(502);
+                res.end("pitstop-proxy: loopback forward failed");
+            });
+            req.pipe(proxy);
+            return;
+        }
+        if (isCanary(host)) {
+            logEvent("http", { host, method, path });
+            res.writeHead(200, { "content-type": "text/plain" });
+            res.end("pitstop-canary-hit");
+            return;
+        }
+        if (isGateway(host)) {
+            const chunks = [];
+            req.on("data", (c) => chunks.push(c));
+            req.on("end", () => {
+                const body = safeBody(Buffer.concat(chunks).toString("utf8"));
+                const requestId = nextId("req");
+                const record = {
+                    at: new Date().toISOString(),
+                    host,
+                    method,
+                    path,
+                    key: deriveKey(method, path, req.headers, body),
+                    orderId: body?.order_id ?? null,
+                    requestId,
+                    requestHeaders: { ...req.headers },
+                    requestBody: body,
+                    charge: isCharge(method, path),
+                    responseStatus: 200,
+                    responseBody: gatewaySuccess(host, method, path, body, requestId),
+                };
+                if (opts.gatewayLogPath)
+                    append(opts.gatewayLogPath, record);
+                control({ event: "gateway-call", charge: record.charge, key: record.key, host });
+                logEvent("http", { host, method, path });
+                res.writeHead(200, { "content-type": "application/json" });
+                res.end(JSON.stringify(record.responseBody));
+            });
+            return;
+        }
+        // Unmocked host: blocked. No byte is forwarded anywhere real.
+        logEvent("blocked", { host, method, path });
+        res.writeHead(502, { "content-type": "application/json" });
+        res.end(JSON.stringify({ pitstop: "blocked-unmocked-host", host }));
+    });
+    // HTTPS goes through CONNECT; without a trusted CA we cannot terminate the
+    // tunnel, so every CONNECT is recorded and refused.
+    server.on("connect", (req, socket) => {
+        const host = String(req.url ?? "").split(":")[0] || "unknown";
+        logEvent("blocked", { host, method: "CONNECT", path: req.url ?? "" });
+        socket.write("HTTP/1.1 502 OpenPitStop Proxy Cannot Terminate TLS\r\n\r\n");
+        socket.destroy();
+    });
+    return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => {
+            const port = server.address().port;
+            control({ event: "armed", mode: "proxy", port });
+            resolve({
+                port,
+                close: () => new Promise((r) => {
+                    server.close(() => r());
+                    setTimeout(() => r(), 1000);
+                }),
+            });
+        });
+    });
+}
+//# sourceMappingURL=proxy.js.map