pinata-security-cli 0.5.3 → 0.6.1

package/dist/index.d.ts

@@ -92,7 +92,12 @@ type Example = z.infer<typeof ExampleSchema>;
  */
 declare const PatternTypeSchema: z.ZodEnum<["ast", "regex", "semantic"]>;
 /**
- * Schema for detection patterns that identify code susceptible to a category
+ * Schema for detection patterns that identify code susceptible to a category.
+ *
+ * The optional `sources` and `sanitizers` fields enable lightweight taint analysis:
+ * when a pattern matches a sink, the scanner checks whether a source (user input)
+ * is present in the same scope and whether a sanitizer intervenes. Without a source,
+ * the match confidence is downgraded. With a sanitizer, the match is suppressed.
  */
 declare const DetectionPatternSchema: z.ZodObject<{
     /** Unique identifier for this pattern */
@@ -111,6 +116,10 @@ declare const DetectionPatternSchema: z.ZodObject<{
     negativePattern: z.ZodOptional<z.ZodString>;
     /** Optional list of framework contexts where this pattern applies */
     frameworks: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Regex patterns identifying taint sources (user input entry points) in the same scope */
+    sources: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Regex patterns identifying sanitizers that neutralize tainted data */
+    sanitizers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {
     id: string;
     description: string;
@@ -120,6 +129,8 @@ declare const DetectionPatternSchema: z.ZodObject<{
     confidence: "high" | "medium" | "low";
     negativePattern?: string | undefined;
     frameworks?: string[] | undefined;
+    sources?: string[] | undefined;
+    sanitizers?: string[] | undefined;
 }, {
     id: string;
     description: string;
@@ -129,6 +140,8 @@ declare const DetectionPatternSchema: z.ZodObject<{
     confidence: "high" | "medium" | "low";
     negativePattern?: string | undefined;
     frameworks?: string[] | undefined;
+    sources?: string[] | undefined;
+    sanitizers?: string[] | undefined;
 }>;
 /**
  * Schema for a detection result (pattern match in code)
@@ -317,6 +330,8 @@ declare const CategorySchema: z.ZodObject<{
         description: z.ZodString;
         negativePattern: z.ZodOptional<z.ZodString>;
         frameworks: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        sources: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        sanitizers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
         id: string;
         description: string;
@@ -326,6 +341,8 @@ declare const CategorySchema: z.ZodObject<{
         confidence: "high" | "medium" | "low";
         negativePattern?: string | undefined;
         frameworks?: string[] | undefined;
+        sources?: string[] | undefined;
+        sanitizers?: string[] | undefined;
     }, {
         id: string;
         description: string;
@@ -335,6 +352,8 @@ declare const CategorySchema: z.ZodObject<{
         confidence: "high" | "medium" | "low";
         negativePattern?: string | undefined;
         frameworks?: string[] | undefined;
+        sources?: string[] | undefined;
+        sanitizers?: string[] | undefined;
     }>, "many">;
     testTemplates: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
@@ -443,6 +462,8 @@ declare const CategorySchema: z.ZodObject<{
         confidence: "high" | "medium" | "low";
         negativePattern?: string | undefined;
         frameworks?: string[] | undefined;
+        sources?: string[] | undefined;
+        sanitizers?: string[] | undefined;
     }[];
     testTemplates: {
         id: string;
@@ -493,6 +514,8 @@ declare const CategorySchema: z.ZodObject<{
         confidence: "high" | "medium" | "low";
         negativePattern?: string | undefined;
         frameworks?: string[] | undefined;
+        sources?: string[] | undefined;
+        sanitizers?: string[] | undefined;
     }[];
     testTemplates: {
         id: string;
@@ -902,6 +925,16 @@ declare const logger: Logger;
  * gap detection, coverage metrics, and Pinata Score calculation.
  */
 
+/**
+ * Verification status of a gap.
+ *
+ * - pending: not yet tested
+ * - confirmed: a generated exploit test FAILS against the code (deterministic proof)
+ * - unconfirmed: a generated exploit test PASSES (could not exploit, but not proven safe)
+ * - unknown: could not generate a working test (manual review needed)
+ * - dismissed: AI pre-filter flagged as likely false positive (still testable)
+ */
+type GapStatus = "pending" | "confirmed" | "unconfirmed" | "unknown" | "dismissed";
 /**
  * A detected gap (missing test coverage)
  */
@@ -938,6 +971,12 @@ interface Gap {
     patternType: "regex" | "ast" | "semantic";
     /** Weighted score for prioritization (severity × confidence) */
     priorityScore: number;
+    /** Verification status -- set by test execution, not AI opinion */
+    status?: GapStatus;
+    /** Mutation score of the generated test (0-100), if measured */
+    mutationScore?: number;
+    /** Evidence from test execution (e.g. error output proving exploit worked) */
+    evidence?: string;
 }
 
 /**

package/dist/index.js

@@ -98,7 +98,11 @@ var DetectionPatternSchema = z.object({
   /** Optional pattern that indicates code is NOT vulnerable (false positive filter) */
   negativePattern: z.string().optional(),
   /** Optional list of framework contexts where this pattern applies */
-  frameworks: z.array(z.string()).optional()
+  frameworks: z.array(z.string()).optional(),
+  /** Regex patterns identifying taint sources (user input entry points) in the same scope */
+  sources: z.array(z.string()).optional(),
+  /** Regex patterns identifying sanitizers that neutralize tainted data */
+  sanitizers: z.array(z.string()).optional()
 });
 z.object({
   /** ID of the pattern that matched */
@@ -833,6 +837,9 @@ var logger = new Logger();
 var __filename$1 = fileURLToPath(import.meta.url);
 dirname(__filename$1);
 
+// src/core/discovery/attack-surface.ts
+logger.child("AttackSurface");
+
 // src/core/index.ts
 var VERSION = "0.4.0";
 
@@ -840,13 +847,13 @@ var VERSION = "0.4.0";
 var DEFAULT_CONFIG = {
   provider: "anthropic",
   apiKey: "",
-  model: "claude-sonnet-4-20250514",
+  model: "claude-opus-4-8",
   maxTokens: 1024,
   temperature: 0.3,
   timeoutMs: 3e4
 };
 var PROVIDER_MODELS = {
-  anthropic: "claude-sonnet-4-20250514",
+  anthropic: "claude-opus-4-8",
   openai: "gpt-4o",
   mock: "mock-model"
 };