qa360 2.1.7 → 2.2.0

package/packages/mcp/src/tools/vault.ts

@@ -0,0 +1,164 @@
+/**
+ * QA360 Vault Tools
+ * Read-only access to Evidence Vault via MCP
+ */
+
+import { EvidenceVault } from 'qa360-core';
+import { MCPServerConfig, VaultGetRunArgs, VaultGetArtifactsArgs } from '../types/index.js';
+import { SecurityManager } from '../security/manager.js';
+import { AuditLogger } from '../security/audit.js';
+
+export class VaultTools {
+  private config: MCPServerConfig;
+  private security: SecurityManager;
+  private audit: AuditLogger;
+
+  constructor(config: MCPServerConfig, security: SecurityManager, audit: AuditLogger) {
+    this.config = config;
+    this.security = security;
+    this.audit = audit;
+  }
+
+  async execute(toolName: string, args: any): Promise<any> {
+    const vault = await EvidenceVault.open('./.qa360', {
+      enableWAL: true
+    });
+
+    try {
+      switch (toolName) {
+        case 'qa360.vault.get_run':
+          return await this.getRun(vault, args as VaultGetRunArgs);
+        case 'qa360.vault.get_artifacts':
+          return await this.getArtifacts(vault, args as VaultGetArtifactsArgs);
+        default:
+          throw new Error(`Unknown vault tool: ${toolName}`);
+      }
+    } finally {
+      await vault.close();
+    }
+  }
+
+  /**
+   * Get run data from vault
+   */
+  private async getRun(vault: EvidenceVault, args: VaultGetRunArgs) {
+    const { runId } = args;
+
+    const run = await vault.getRun(runId);
+    if (!run) {
+      throw new Error(`Run not found: ${runId}`);
+    }
+
+    // Get associated data
+    const [gates, findings] = await Promise.all([
+      vault.getGates(runId),
+      vault.getFindings(runId)
+    ]);
+
+    return {
+      run: {
+        id: run.id,
+        run_key: run.run_key,
+        started_at: run.started_at,
+        ended_at: run.ended_at,
+        pack_hash: run.pack_hash,
+        pack_path: run.pack_path,
+        status: run.status,
+        trust_score: run.trust_score,
+        weights_json: run.weights_json,
+        sign_alg: run.sign_alg,
+        signature_hex: run.signature_hex ? '***REDACTED***' : null, // Never expose signatures
+        proof_pdf_path: run.proof_pdf_path,
+        pinned: run.pinned,
+        created_at: run.created_at,
+        updated_at: run.updated_at
+      },
+      gates: gates.map(gate => ({
+        name: gate.name,
+        status: gate.status,
+        duration_ms: gate.duration_ms,
+        metrics: gate.metrics_json ? JSON.parse(gate.metrics_json) : {},
+        budgets: gate.budgets_json ? JSON.parse(gate.budgets_json) : {},
+        created_at: gate.created_at
+      })),
+      findings: findings.map(finding => ({
+        gate: finding.gate,
+        severity: finding.severity,
+        rule: finding.rule,
+        location: finding.location,
+        message: this.security.redactSensitiveData(finding.message),
+        fingerprint: finding.fingerprint,
+        created_at: finding.created_at
+      })),
+      metadata: {
+        total_gates: gates.length,
+        total_findings: findings.length,
+        passed_gates: gates.filter(g => g.status === 'passed').length,
+        failed_gates: gates.filter(g => g.status === 'failed').length,
+        critical_findings: findings.filter(f => f.severity === 'critical').length,
+        high_findings: findings.filter(f => f.severity === 'high').length
+      }
+    };
+  }
+
+  /**
+   * Get artifacts for a run
+   */
+  private async getArtifacts(vault: EvidenceVault, args: VaultGetArtifactsArgs) {
+    const { runId } = args;
+
+    const run = await vault.getRun(runId);
+    if (!run) {
+      throw new Error(`Run not found: ${runId}`);
+    }
+
+    const artifacts = await vault.getRunArtifacts(runId);
+
+    return {
+      run_id: runId,
+      total_artifacts: artifacts.length,
+      artifacts: artifacts.map(artifact => ({
+        label: artifact.label,
+        sha256: artifact.sha256,
+        mime_type: artifact.mime_type,
+        size_bytes: artifact.size_bytes,
+        original_name: artifact.original_name,
+        cas_path: artifact.cas_path,
+        created_at: artifact.created_at,
+        last_accessed: artifact.last_accessed,
+        // Note: We don't include the actual file content for security
+        // and performance reasons. Use the CAS path to access files directly.
+        access_note: 'Use CAS path to access file content directly'
+      })),
+      summary: {
+        total_size_bytes: artifacts.reduce((sum, a) => sum + a.size_bytes, 0),
+        mime_types: [...new Set(artifacts.map(a => a.mime_type))],
+        labels: [...new Set(artifacts.map(a => a.label))],
+        oldest_artifact: artifacts.length > 0 ? Math.min(...artifacts.map(a => a.created_at)) : null,
+        newest_artifact: artifacts.length > 0 ? Math.max(...artifacts.map(a => a.created_at)) : null
+      }
+    };
+  }
+
+  /**
+   * Get vault statistics (bonus method)
+   */
+  async getVaultStats(): Promise<any> {
+    const vault = await EvidenceVault.open('./.qa360', {
+      enableWAL: true
+    });
+
+    try {
+      const stats = await vault.getStats();
+      return {
+        vault_stats: stats,
+        health: 'healthy',
+        location: './.qa360/vault.db',
+        mode: 'WAL',
+        timestamp: Date.now()
+      };
+    } finally {
+      await vault.close();
+    }
+  }
+}

package/packages/mcp/src/tools/verify.ts

@@ -0,0 +1,166 @@
+/**
+ * QA360 Verify Tool
+ * Verify proof integrity and signatures via MCP
+ */
+
+import { EvidenceVault } from 'qa360-core';
+import { existsSync, readFileSync } from 'fs';
+import { MCPServerConfig, VerifyArgs, VerifyResult } from '../types/index.js';
+import { SecurityManager } from '../security/manager.js';
+import { AuditLogger } from '../security/audit.js';
+
+export class VerifyTool {
+  private config: MCPServerConfig;
+  private security: SecurityManager;
+  private audit: AuditLogger;
+
+  constructor(config: MCPServerConfig, security: SecurityManager, audit: AuditLogger) {
+    this.config = config;
+    this.security = security;
+    this.audit = audit;
+  }
+
+  async execute(toolName: string, args: VerifyArgs): Promise<VerifyResult> {
+    const { runId, proofPath } = args;
+
+    if (!runId && !proofPath) {
+      throw new Error('Either runId or proofPath must be provided');
+    }
+
+    try {
+      if (runId) {
+        return await this.verifyRunId(runId);
+      } else if (proofPath) {
+        return await this.verifyProofFile(proofPath);
+      } else {
+        throw new Error('No verification target provided');
+      }
+    } catch (error) {
+      return {
+        verified: false,
+        algorithm: 'unknown',
+        message: `Verification failed: ${error instanceof Error ? error.message : 'Unknown error'}`,
+        runId
+      };
+    }
+  }
+
+  /**
+   * Verify a run by ID from the vault
+   */
+  private async verifyRunId(runId: string): Promise<VerifyResult> {
+    // Initialize vault
+    const vault = await EvidenceVault.open('./.qa360', {
+      enableWAL: true
+    });
+
+    try {
+      // Get run data
+      const run = await vault.getRun(runId);
+      if (!run) {
+        throw new Error(`Run not found: ${runId}`);
+      }
+
+      if (!run.signature_hex) {
+        return {
+          verified: false,
+          algorithm: 'none',
+          message: 'Run is not signed',
+          runId
+        };
+      }
+
+      // Get run details for verification
+      const [gates, findings, artifacts] = await Promise.all([
+        vault.getGates(runId),
+        vault.getFindings(runId),
+        vault.getRunArtifacts(runId)
+      ]);
+
+      // Reconstruct proof data
+      const proofData = {
+        run_id: runId,
+        timestamp: run.started_at,
+        pack_hash: run.pack_hash,
+        status: run.status,
+        trust_score: run.trust_score,
+        gates: gates.map(gate => ({
+          name: gate.name,
+          status: gate.status,
+          duration_ms: gate.duration_ms,
+          metrics: gate.metrics_json ? JSON.parse(gate.metrics_json) : {}
+        })),
+        findings: findings.map(finding => ({
+          gate: finding.gate,
+          severity: finding.severity,
+          rule: finding.rule,
+          location: finding.location,
+          message: finding.message
+        })),
+        artifacts: artifacts.map(artifact => ({
+          label: artifact.label,
+          sha256: artifact.sha256,
+          size_bytes: artifact.size_bytes
+        }))
+      };
+
+      // Verify signature
+      const isValid = this.verifySignature(proofData, run.signature_hex, run.sign_alg || 'ed25519');
+
+      return {
+        verified: isValid,
+        algorithm: run.sign_alg || 'ed25519',
+        message: isValid ? 'Signature verification successful' : 'Signature verification failed',
+        runId
+      };
+
+    } finally {
+      await vault.close();
+    }
+  }
+
+  /**
+   * Verify a proof file
+   */
+  private async verifyProofFile(proofPath: string): Promise<VerifyResult> {
+    if (!existsSync(proofPath)) {
+      throw new Error(`Proof file not found: ${proofPath}`);
+    }
+
+    try {
+      // For PDF files, we would need to extract the proof data
+      // For now, simulate verification
+      const fileContent = readFileSync(proofPath);
+      
+      // Basic file integrity check
+      const isValid = fileContent.length > 0;
+
+      return {
+        verified: isValid,
+        algorithm: 'file-integrity',
+        message: isValid ? 'File integrity check passed' : 'File appears to be corrupted'
+      };
+
+    } catch (error) {
+      throw new Error(`Failed to read proof file: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+  }
+
+  /**
+   * Verify signature (simulated)
+   * In a real implementation, this would use actual Ed25519 verification
+   */
+  private verifySignature(data: any, signature: string, algorithm: string): boolean {
+    if (algorithm !== 'ed25519') {
+      return false;
+    }
+
+    // Simulate signature verification
+    const crypto = require('crypto');
+    const content = JSON.stringify(data, null, 2);
+    const expectedHash = crypto.createHash('sha256').update(content).digest('hex');
+    const expectedSignature = `ed25519_sim_${expectedHash.substring(0, 32)}`;
+
+    return signature === expectedSignature;
+  }
+}

package/packages/mcp/src/types/index.ts

@@ -0,0 +1,311 @@
+/**
+ * QA360 MCP Server Types
+ * Type definitions for MCP tools and responses
+ */
+
+export interface QA360Error {
+  code: string;
+  message: string;
+  hint?: string;
+}
+
+export interface QA360Response<T = any> {
+  success: boolean;
+  data?: T;
+  error?: QA360Error;
+}
+
+// Tool argument types
+export interface RunArgs {
+  packPath: string;
+  runKey?: string;
+  strict?: boolean;
+  weights?: Record<string, number>;
+}
+
+export interface ReportSignArgs {
+  runId: string;
+}
+
+export interface VerifyArgs {
+  runId?: string;
+  proofPath?: string;
+}
+
+export interface HistoryListArgs {
+  limit?: number;
+  status?: 'passed' | 'failed' | 'error' | 'cancelled' | 'any';
+  gate?: string;
+  since?: string; // ISO date
+}
+
+export interface HistoryGetArgs {
+  runId: string;
+}
+
+export interface HistoryDiffArgs {
+  runA: string;
+  runB: string;
+}
+
+export interface HistoryTrendArgs {
+  gate?: 'perf' | 'ui' | 'api' | 'a11y' | 'sast' | 'dast' | 'deps' | 'secrets';
+  window?: number;
+}
+
+export interface HistoryExportArgs {
+  runId: string;
+  bundlePath: string;
+}
+
+export interface HistoryGCArgs {
+  keepLast?: number;
+  maxBytes?: string;
+  dryRun?: boolean;
+}
+
+export interface HistoryPinArgs {
+  runId: string;
+}
+
+export interface PackAskArgs {
+  query: string;
+  context?: {
+    targets?: Record<string, any>;
+  };
+}
+
+export interface PackValidateArgs {
+  pack?: string; // YAML content
+  path?: string; // File path
+}
+
+export interface SecretsAddArgs {
+  name: string;
+  value: string;
+  description?: string;
+}
+
+export interface SecretsListArgs {
+  // No args needed
+}
+
+export interface SecretsRemoveArgs {
+  name: string;
+}
+
+export interface ServeDiagArgs {
+  // No args needed
+}
+
+export interface VaultGetRunArgs {
+  runId: string;
+}
+
+export interface VaultGetArtifactsArgs {
+  runId: string;
+}
+
+export interface TriageExplainArgs {
+  code: string; // SG|ZAP|GL|OSV|PA|PU|K6###
+  context?: Record<string, any>;
+}
+
+// Tool result types
+export interface RunResult {
+  runId: string;
+  status: 'passed' | 'failed' | 'cancelled' | 'error';
+  trust: {
+    score: number;
+    weights?: Record<string, number>;
+  };
+  proof?: {
+    pdf?: {
+      sha256: string;
+      path: string;
+    };
+  };
+  gates: Array<{
+    name: string;
+    status: 'passed' | 'failed' | 'skipped' | 'warn';
+    duration_ms: number;
+    key_metrics?: Record<string, any>;
+  }>;
+}
+
+export interface ReportSignResult {
+  signature: string;
+  algorithm: string;
+  runId: string;
+}
+
+export interface VerifyResult {
+  verified: boolean;
+  algorithm: string;
+  message: string;
+  runId?: string;
+}
+
+export interface HistoryListResult {
+  runs: Array<{
+    id: string;
+    started_at: number;
+    status: string;
+    trust_score?: number;
+    gates_summary?: Record<string, string>;
+  }>;
+}
+
+export interface HistoryGetResult {
+  run: {
+    id: string;
+    started_at: number;
+    ended_at?: number;
+    status: string;
+    trust_score?: number;
+    pack_path: string;
+    pack_hash: string;
+    run_key?: string;
+  };
+  gates: Array<{
+    name: string;
+    status: string;
+    duration_ms: number;
+    metrics?: Record<string, any>;
+  }>;
+  findings: Array<{
+    gate: string;
+    severity: string;
+    rule: string;
+    location?: string;
+    message: string;
+  }>;
+  artifacts: Array<{
+    label: string;
+    sha256: string;
+    mime_type: string;
+    size_bytes: number;
+  }>;
+}
+
+export interface HistoryDiffResult {
+  delta: {
+    trust: number;
+    gates: Record<string, {
+      status_change?: string;
+      duration_change?: number;
+    }>;
+    findings: {
+      added: Array<any>;
+      removed: Array<any>;
+      regressed: Array<any>;
+    };
+  };
+}
+
+export interface HistoryTrendResult {
+  series: Array<{
+    timestamp: number;
+    value: number;
+    metadata?: Record<string, any>;
+  }>;
+  summary: {
+    average: number;
+    trend: 'up' | 'down' | 'stable';
+    window_size: number;
+  };
+}
+
+export interface HistoryExportResult {
+  bundlePath: string;
+  size_bytes: number;
+  contents: string[];
+}
+
+export interface HistoryGCResult {
+  removed: {
+    runs: number;
+    artifacts: number;
+    bytesFreed: number;
+  };
+  dryRun: boolean;
+}
+
+export interface PackAskResult {
+  pack: string; // Generated YAML
+  hints: {
+    tools_needed: string[];
+    estimated_duration: string;
+    complexity: 'simple' | 'medium' | 'complex';
+  };
+}
+
+export interface PackValidateResult {
+  valid: boolean;
+  errors: Array<{
+    code: string;
+    message: string;
+    line?: number;
+    column?: number;
+  }>;
+  warnings: Array<{
+    code: string;
+    message: string;
+    line?: number;
+    column?: number;
+  }>;
+  auto_fixes?: string[]; // For lint
+}
+
+export interface SecretsListResult {
+  secrets: Array<{
+    name: string;
+    description?: string;
+    created_at: number;
+    last_used?: number;
+  }>;
+}
+
+export interface ServeDiagResult {
+  health: 'healthy' | 'degraded' | 'unhealthy';
+  version: string;
+  uptime_ms: number;
+  metrics: Record<string, any>;
+  vault_stats?: Record<string, any>;
+}
+
+export interface TriageExplainResult {
+  explanation: {
+    cause: string;
+    severity: 'low' | 'medium' | 'high' | 'critical';
+    category: string;
+  };
+  actions: Array<{
+    type: 'fix' | 'investigate' | 'ignore';
+    description: string;
+    command?: string;
+  }>;
+  references: Array<{
+    title: string;
+    url: string;
+  }>;
+}
+
+// MCP Server configuration
+export interface MCPServerConfig {
+  allowRun: boolean;
+  allowSecrets: boolean;
+  maxConcurrency: number;
+  rateLimit: {
+    requests: number;
+    window: number; // seconds
+  };
+  sandbox: {
+    allowedPaths: string[];
+    requireQA360Dir: boolean;
+  };
+  audit: {
+    enabled: boolean;
+    logPath: string;
+  };
+}

package/packages/mcp/src/types/mcp-stubs.ts

@@ -0,0 +1,83 @@
+/**
+ * MCP SDK Type Stubs
+ * Temporary type definitions for @modelcontextprotocol/sdk
+ */
+
+// Server types
+export interface ServerCapabilities {
+  tools?: Record<string, any>;
+}
+
+export interface ServerInfo {
+  name: string;
+  version: string;
+}
+
+export interface ServerOptions {
+  capabilities: ServerCapabilities;
+}
+
+export class Server {
+  constructor(info: ServerInfo, options: ServerOptions) {}
+  
+  setRequestHandler(schema: any, handler: (request: any) => Promise<any>): void {}
+  
+  async connect(transport: any): Promise<void> {}
+  
+  async close(): Promise<void> {}
+  
+  onerror?: (error: Error) => void;
+}
+
+export class StdioServerTransport {
+  constructor() {}
+}
+
+// Request/Response types
+export interface CallToolRequest {
+  params: {
+    name: string;
+    arguments: any;
+  };
+}
+
+export interface ListToolsRequest {
+  params?: any;
+}
+
+export const CallToolRequestSchema = Symbol('CallToolRequestSchema');
+export const ListToolsRequestSchema = Symbol('ListToolsRequestSchema');
+
+// Error types
+export enum ErrorCode {
+  InternalError = -32603,
+  InvalidParams = -32602,
+  MethodNotFound = -32601,
+  ParseError = -32700,
+  InvalidRequest = -32600
+}
+
+export class McpError extends Error {
+  constructor(public code: ErrorCode, message: string) {
+    super(message);
+    this.name = 'McpError';
+  }
+}
+
+// Tool types
+export interface Tool {
+  name: string;
+  description: string;
+  inputSchema: {
+    type: string;
+    properties?: Record<string, any>;
+    required?: string[];
+  };
+}
+
+export interface ToolResult {
+  content: Array<{
+    type: string;
+    text: string;
+  }>;
+}