penthera 1.4.0 → 1.6.0

package/CHANGELOG.md

@@ -4,6 +4,217 @@ All notable changes to Penthera are documented here. Versioning follows [SemVer]
 
 ## [Unreleased]
 
+## [1.6.0] - 2026-10-19
+
+Hardening and reach. An independent 360 review found three high-severity bugs, two of them reproduced; all are fixed with regression tests, and the open code-scanning alerts went from 18 to the 2 that need a second maintainer. `penthera deps` now covers Python, `penthera ui` adds a local dashboard (black or white, in the project blue), and every release passes an internal audit first. 1.5.0 was never published to npm; this release includes it.
+
+### Security
+
+- Cleared the open code-scanning alerts. The community-template regex guard
+  was itself a polynomial regex; it is now a linear scan, and an invalid
+  extractor regex no longer aborts a template. Markdown table cells escape
+  backslashes first (one shared helper). `<script>` extraction is a tokenizer
+  that accepts any case and junk in closing tags. Release workflow: read-only
+  top-level token, hash-verified npm, no dependency cache. Docker base image
+  pinned by digest. fast-check property tests fuzz the untrusted-input parsers.
+
+Fixes from an independent 360 review of `main`. The first three were
+reproduced; each fix has a regression test that fails without it.
+
+- **High: tar desync hid install scripts from the install firewall and
+  `penthera deps`.** A GNU base-256 size field parsed as 0, the reader lost its
+  place, and 512 zero bytes then read as end-of-archive, so `package.json` and
+  everything after it went unscanned and the package looked clean. The tar
+  reader now handles base-256 sizes and pax `size=`, checks every header
+  checksum and fails closed on any anomaly (malformed size, truncation, data
+  after the end marker). A package whose archive or `package.json` cannot be
+  read is reported as "could not be scanned" (high) and always needs approval
+  in `penthera install`; a lockfile `hasInstallScript` that the scan cannot
+  find is a high finding and is always denied (except the known benign case
+  of a package that ships only prebuilt `.node` binaries, like fsevents 2.x)
+- **High: `applyDiff` wrote through a dangling symlink out of the repo.** Every
+  path component is now `lstat`-ed and any symlink is refused; creates use
+  `O_CREAT|O_EXCL|O_NOFOLLOW`
+- **High: `.GIT/` bypassed the `.git` guard on case-insensitive file systems.**
+  Any path segment that is `.git` in any case, at any depth (plus HFS+ and
+  NTFS aliases such as `.git.` and `GIT~1`), is refused, and fix diffs may no
+  longer touch `.gitmodules`
+- PR comments escape HTML, Markdown links and images, `@` mentions, `#` refs
+  and bare URLs in package names, versions, paths and snippets from the
+  lockfile, keep code spans on one line, and cap each field at 200 characters
+- `penthera evidence verify` no longer passes a signed bundle whose signer was
+  not checked: a signature only verifies against `--allowed-signers`, and a
+  manifest that declares a signature with no `.sig` fails. Unsigned bundles
+  pass with an UNSIGNED warning; new `--require-signature` fails them
+- `penthera install` refuses git, hosted-git and tarball-URL specs, and lockfile
+  entries resolved outside the configured registries, unless
+  `--allow-non-registry` is passed. `npm cache add` runs with `--ignore-scripts`
+- `penthera install` applies with `npm ci`, so npm installs exactly the
+  reviewed lockfile and cannot re-resolve before scripts run
+- `penthera deps` now honours `--audience`, `--report-template`, `--evidence`
+  (with `--sign-key`) and `--baseline`, and rejects scan-only flags such as
+  `--memory` with a clear error instead of ignoring them
+- Gzip and tar size limits are enforced while unpacking (`maxOutputLength` on
+  gunzip, per-file and total caps in the tar reader)
+- The pre-commit hook reads `penthera.policy.json` and `penthera.suppress.json`
+  from the git index, warns when an unstaged copy is being ignored, and never
+  follows a staged symlink in agent config out of the repo
+- `--base` refs are validated (no leading `-`, a plain ref charset) and passed
+  after `--end-of-options`, in `penthera deps` and in the GitHub Action's fetch
+- `git status` and friends on a scanned repo (fix apply, evidence bundle git
+  info, `--base` reads) run with `core.fsmonitor=false`, no hooks and no
+  transports
+- The Action only edits marker comments posted by `github-actions[bot]`
+- `--offline` no longer makes DNS TXT/MX lookups for SPF/DMARC
+- Report citations now cover `dependency-risk`, `license`, `agent-config` and
+  the machine-audit categories; `license` findings get their own remediation
+- Docs: `docs/plan.md` lists only what v1.5.0 shipped; top-level `--help`
+  lists `penthera hook`
+
+### Added
+
+- **Internal testing audit** (`npm run audit:internal`), the release gate:
+  tests, benchmark drift, a self-scan against `audit/baseline.json`, a CLI
+  smoke matrix, package contents and size, zero third-party egress offline,
+  supply chain and version/docs checks, written to `audit/REPORT.md`. Runs
+  weekly in CI. See [docs/internal-audit.md](docs/internal-audit.md)
+- **Marketing automation that drafts, never posts** (`docs/marketing.md`): no
+  social-media tokens, no tracking, no auto-posting; every workflow SHA-pinned
+  with least-privilege permissions and a `workflow_dispatch` dry run
+  - Release post drafts: `publish.yml` writes a LinkedIn (~600 characters) and
+    an X/Bluesky (≤280) post from the CHANGELOG section to the job summary and
+    a collapsed "Share this release" section in the GitHub Release
+    (`scripts/marketing/release-post.mjs`)
+  - Incident radar (`incident-radar.yml`, daily): new npm and PyPI malware
+    advisories from the public GitHub Advisory Database become
+    `incident-radar` issues with affected versions, an IOC checklist and a
+    draft "check if you're affected" post. Popular packages get their own
+    issue (at most 5 per run); the rest are batched into one issue
+  - Demo media (`demo-media.yml`): VHS tapes in `assets/tapes/` for a URL
+    scan, `penthera agents` and `penthera deps --diff`, re-rendered on release
+    and opened as a PR
+  - Monthly stats issue (`monthly-stats.yml`): npm downloads, stars, forks,
+    skills.sh installs, dependents and merged PRs, with month-over-month
+    changes and a draft post
+  - Contributor flywheel (`contributor-flywheel.yml`): when fewer than 3
+    `good first issue` issues are open, one reminder lists the
+    `TODO(good-first-issue)` markers in the code
+- **Report footer**: Markdown reports, audience reports, the PR comment and
+  the evidence bundle end with one line, "Checked by Penthera, open-source
+  security for the apps and AI systems you ship". Never in SARIF or JSON.
+  `--no-footer` (or `footer: "false"` in the Action) leaves it off. Evidence
+  bundles now include a `README.md`
+- **Python support for `penthera deps`** (`lib/deps/python/`): reads `uv.lock`,
+  `poetry.lock`, `pdm.lock`, `Pipfile.lock` and `requirements*.txt` (pinned and
+  `--hash` lines, `-r` includes, pip-compile `# via` for direct deps), and the
+  installed `.venv` / `venv` / `--venv <path>` through `dist-info` `METADATA`
+  and `RECORD`, with no pip or interpreter. A Python tokenizer blanks comments
+  and docstrings; patterns cover shell, network, env bulk access and
+  exfiltration, eval/exec/compile, computed imports, unpickling, native
+  extensions, obfuscation (`exec` of base64/zlib payloads, encoded blobs,
+  PyArmor) and the same AI-agent indicators as npm. Install-time and
+  persistence code: `setup.py` custom commands, `.pth` import lines (scored by
+  what the imported module can do), `.pth` files no distribution owns, code that
+  writes `.pth` files, and installed files that no longer match `RECORD`. Same
+  capability ids, findings, diff, PR comment and SARIF as npm; projects with
+  both get one combined report
+- `--diff` / `--base` for Python lockfiles. Old versions come from pip's HTTP
+  cache (sha256 from the lockfile) or uv's cache (recorded hash), else they are
+  marked "not compared"
+- PyPI typosquat check against a vendored list of the top 8,000 PyPI projects
+  (`lib/deps/popular-pypi.json`, PEP 503 normalised, refreshed at release time by
+  `scripts/refresh-popular-pypi.mjs`), including `python-` / `-py` affixes
+
+### Changed
+
+- The live test suites (`pentest-live`, `-recon`, `-adaptive`) are opt-in:
+  they run only with `PENTEST_BASE_URL` or a `pentest.config.js`, instead of
+  probing whatever listens on `localhost:3000` during `npm test`.
+
+### Fixed
+
+- Repo scans skip nested git repositories and worktrees (any subfolder with
+  its own `.git`, such as coding-agent worktrees under `.claude/worktrees`),
+  instead of reporting their files as this repo's, and no longer follow
+  symlinked folders out of the repo.
+- The secret scanner no longer reports a value that is only a template
+  placeholder (`apiKey: "${key}"`, `{{ api_key }}`) as a hardcoded secret.
+- `penthera-scan --help` and `--version` exit 0 instead of starting the wizard.
+- The example workflows in `docs/examples/` pin actions by commit SHA.
+
+### Docs
+
+- README cut from about 45 KB to under 20 KB. It opens with a three-command
+  "Try it in 60 seconds" block, a "Who it is for" table, and a "By the
+  numbers" block (benchmark, rule and test counts, references, release
+  provenance). Per-command detail moved to `docs/commands/` and network use to
+  `docs/privacy.md`.
+- Use-case pages in `docs/use-cases/`: before launch, teams adopting coding
+  agents, open-source maintainers, EU SMEs with NIS2 or CRA duties, agencies.
+- Comparison pages in `docs/compare/` for Socket, Snyk, GitHub Dependabot and
+  code scanning, OWASP ZAP and Semgrep, framed as using the tools together, with
+  sources and a last-checked date.
+- `docs/research/socket-positioning-notes.md`: how Socket presents itself and
+  what Penthera's docs took from it.
+- `npm run docs:numbers` prints the counts quoted in the README.
+
+## [1.5.0] - 2026-10-19
+
+Blocks problems at commit time, adds license policy, and extends the EU
+evidence to the Cyber Resilience Act. The GitHub Action is now ready for the
+Marketplace as "Penthera Security Review". Penthera also has a clearer
+problem statement: open-source security for the apps and AI systems you ship.
+
+### Docs
+
+- Problem statement: "open-source security for the apps and AI systems you
+  ship", organised around three moments (before you deploy, what you build
+  with, after you ship). README, package, plugin, skill and repository
+  descriptions updated. Roadmap gains v1.6.0 "Before you deploy" (preview
+  deployment scanning, `penthera ship`) and v1.7.0 "After you ship"
+  (`penthera watch`). New `docs/plan.md` sets measurable quality gates to v2.0.
+
+### Added
+
+- **`penthera hook install|uninstall|run`**: a pre-commit hook that checks
+  staged content only (the git index): secrets and AI provider keys, the
+  `penthera agents` rules on staged `.mcp.json`, `CLAUDE.md`, `AGENTS.md`,
+  `.cursor/`, `.claude/` and `skills/`, and, when `package-lock.json` is staged,
+  the capability diff against HEAD plus the license policy for the packages the
+  commit adds. Blocks on high and critical by default; one line per finding with
+  a fix hint and a `penthera.suppress.json` id. An existing hook is kept as
+  `pre-commit.pre-penthera`, runs first, and is restored by `uninstall`. Refuses
+  to write into a `core.hooksPath` managed by husky or lefthook without `--force`.
+  `.pre-commit-hooks.yaml` for pre-commit.com. Configured by a new `hook`
+  section in `penthera.policy.json` (`blockOn`, `checks`, `ignore`)
+- **License policy**: `penthera deps --license-policy <preset|file>` and a
+  `licenses` section in `penthera.policy.json` (`preset`, `allow`, `deny`,
+  `allowPackages`, `unknown`). Presets `permissive`, `weak-copyleft-ok` and
+  `no-agpl`. A small SPDX expression parser handles `AND`/`OR`/`WITH`,
+  parentheses, `+` and `LicenseRef-`, and matches deprecated ids (`GPL-3.0`) to
+  their current form. Breaches and `UNLICENSED` are high; missing, custom and
+  non-SPDX licenses are medium. Findings use category `license`; the SPDX id
+  list is vendored (`lib/deps/spdx.json`). CycloneDX SBOM components now carry
+  their license
+- **CRA Article 14 reporting helper** (`penthera --cra-init cra.json`,
+  `penthera --cra cra.json`, `lib/compliance/cra.js`): for an actively exploited
+  vulnerability (24h early warning, 72h notification, final report 14 days after
+  a fix is available) or a severe incident (24h, 72h, final report one month
+  after the notification). Computes due dates in UTC and local time (hours
+  elapsed, days and months on the calendar, DST-safe), flags overdue and late
+  reports, drafts each report against Art. 14(2)/(4) with `NEEDS INPUT` for
+  missing facts, adds an Art. 14(8) user advisory, and can prefill the affected
+  component, purl and CVEs from a Penthera SBOM and scan JSON. NL profile names
+  NCSC-NL and the ENISA Single Reporting Platform. Drafts, not the official
+  form, not legal advice. Guide: `docs/compliance-cra.md`
+- **CycloneDX 1.6 AI-BOM** (`penthera --repo . --aibom aibom.cdx.json`,
+  `lib/whitebox/aibom.js`): AI SDK dependencies, model identifiers in code as
+  `machine-learning-model` components with `modelCard` and file:line evidence,
+  MCP servers as `services`, and Agent Skills and prompt files as hashed `data`
+  components. Offline. Tests validate the output against the official
+  CycloneDX 1.6 schema, vendored in `tests/fixtures/cyclonedx/` (new dev
+  dependency: `ajv`)
+
 ## [1.4.0] - 2026-10-19
 
 The biggest release so far, covering the v1.3.0 "AI toolchain" and v1.4.0
@@ -22,6 +233,22 @@ Requires Node 22+. Upgrading from 1.1.x or 1.2.x needs no config changes.
 
 ### Added
 
+- **`penthera ui [--open] [--port 0] [--project <dir>] [--reports <dir>] [--demo]`**:
+  a local dashboard on 127.0.0.1 (random port, one-time URL), styled as a
+  1-bit early-90s Mac desktop with a terminal inside, in dark and light themes.
+  Overview (posture per project, severity mix, findings over time, time to
+  fix, hosts contacted; a three-step start when there is no data yet),
+  Findings (filters, a plain-words explanation, evidence, sources, fix diff),
+  Run (scan, check dependencies, audit AI tooling, or the fix loop with an
+  Apply / Skip / Stop dialog on every diff, live output over SSE), History
+  (new, fixed and still open between two scans), Dependencies, AI tooling,
+  Evidence (create a bundle from the latest scan, verify in one click,
+  download the auditor report) and Settings. Reads only the chosen folders and
+  `~/.penthera`; no network, no new dependencies, no build step. Host check
+  against DNS rebinding, one-time token swapped for an HttpOnly SameSite=Strict
+  cookie, Origin check and JSON-only bodies on state changes, strict CSP, no
+  CORS, rate-limited unauthenticated requests, allowlisted static files.
+  Penthera scans it clean. `--demo` seeds fake data. See `docs/dashboard.md`
 - **GitHub Action** (`uses: danoszz/penthera@<sha>`, `action.yml`): on PRs that
   change the lockfile it runs `penthera deps --base <PR base>`, upserts one PR
   comment marked `<!-- penthera-deps -->` (edited in place on every push), and