qa360 2.2.1 → 2.2.13

package/packages/mcp/src/tools/report.ts

@@ -1,100 +0,0 @@
-/**
- * QA360 Report Tools
- * Sign and manage test reports via MCP
- */
-
-import { EvidenceVault } from 'qa360-core';
-import { MCPServerConfig, ReportSignArgs, ReportSignResult } from '../types/index.js';
-import { SecurityManager } from '../security/manager.js';
-import { AuditLogger } from '../security/audit.js';
-
-export class ReportSignTool {
-  private config: MCPServerConfig;
-  private security: SecurityManager;
-  private audit: AuditLogger;
-
-  constructor(config: MCPServerConfig, security: SecurityManager, audit: AuditLogger) {
-    this.config = config;
-    this.security = security;
-    this.audit = audit;
-  }
-
-  async execute(toolName: string, args: ReportSignArgs): Promise<ReportSignResult> {
-    const { runId } = args;
-
-    try {
-      // Initialize vault
-      const vault = await EvidenceVault.open('./.qa360', {
-        enableWAL: true
-      });
-
-      // Get run data
-      const run = await vault.getRun(runId);
-      if (!run) {
-        throw new Error(`Run not found: ${runId}`);
-      }
-
-      // Get run details for signing
-      const [gates, findings, artifacts] = await Promise.all([
-        vault.getGates(runId),
-        vault.getFindings(runId),
-        vault.getRunArtifacts(runId)
-      ]);
-
-      // Create proof data
-      const proofData = {
-        run_id: runId,
-        timestamp: run.started_at,
-        pack_hash: run.pack_hash,
-        status: run.status,
-        trust_score: run.trust_score,
-        gates: gates.map(gate => ({
-          name: gate.name,
-          status: gate.status,
-          duration_ms: gate.duration_ms,
-          metrics: gate.metrics_json ? JSON.parse(gate.metrics_json) : {}
-        })),
-        findings: findings.map(finding => ({
-          gate: finding.gate,
-          severity: finding.severity,
-          rule: finding.rule,
-          location: finding.location,
-          message: finding.message
-        })),
-        artifacts: artifacts.map(artifact => ({
-          label: artifact.label,
-          sha256: artifact.sha256,
-          size_bytes: artifact.size_bytes
-        }))
-      };
-
-      // Generate signature (simulated for now)
-      const signature = this.generateSignature(proofData);
-
-      await vault.close();
-
-      return {
-        signature,
-        algorithm: 'ed25519',
-        runId
-      };
-
-    } catch (error) {
-      throw new Error(`Failed to sign report: ${error instanceof Error ? error.message : 'Unknown error'}`);
-    }
-  }
-
-  /**
-   * Generate Ed25519 signature (simulated)
-   * In a real implementation, this would use actual cryptographic signing
-   */
-  private generateSignature(data: any): string {
-    const crypto = require('crypto');
-    const content = JSON.stringify(data, null, 2);
-    
-    // Simulate Ed25519 signature by creating a hash
-    // In production, this would use actual Ed25519 private key signing
-    const hash = crypto.createHash('sha256').update(content).digest('hex');
-    return `ed25519_sim_${hash.substring(0, 32)}`;
-  }
-}

package/packages/mcp/src/tools/run.ts

@@ -1,268 +0,0 @@
-/**
- * QA360 Run Tool
- * Execute QA360 packs via MCP
- */
-
-import { EvidenceVault } from 'qa360-core';
-import { existsSync, readFileSync } from 'fs';
-import { resolve } from 'path';
-import { MCPServerConfig, RunArgs, RunResult } from '../types/index.js';
-import { SecurityManager } from '../security/manager.js';
-import { AuditLogger } from '../security/audit.js';
-
-export class RunTool {
-  private config: MCPServerConfig;
-  private security: SecurityManager;
-  private audit: AuditLogger;
-
-  constructor(config: MCPServerConfig, security: SecurityManager, audit: AuditLogger) {
-    this.config = config;
-    this.security = security;
-    this.audit = audit;
-  }
-
-  async execute(toolName: string, args: RunArgs): Promise<RunResult> {
-    if (!this.config.allowRun) {
-      throw new Error('qa360.run tool requires --allow-run flag');
-    }
-
-    const { packPath, runKey, strict = true, weights } = args;
-
-    // Validate pack file exists
-    const resolvedPackPath = resolve(packPath);
-    if (!existsSync(resolvedPackPath)) {
-      throw new Error(`Pack file not found: ${packPath}`);
-    }
-
-    try {
-      // Read and validate pack
-      const packContent = readFileSync(resolvedPackPath, 'utf8');
-      const packHash = this.calculatePackHash(packContent);
-
-      // Initialize vault
-      const vault = await EvidenceVault.open('./.qa360', {
-        enableWAL: true
-      });
-
-      // Begin run with idempotence
-      const { runId, isReused } = await vault.beginRun({
-        run_key: runKey,
-        pack_path: resolvedPackPath,
-        pack_hash: packHash
-      });
-
-      if (isReused) {
-        // Return existing run data
-        const existingRun = await vault.getRun(runId);
-        const gates = await vault.getGates(runId);
-        
-        await vault.close();
-
-        return {
-          runId,
-          status: existingRun?.status as any || 'unknown',
-          trust: {
-            score: existingRun?.trust_score || 0,
-            weights: weights || {}
-          },
-          gates: gates.map(gate => ({
-            name: gate.name,
-            status: gate.status as any,
-            duration_ms: gate.duration_ms || 0,
-            key_metrics: gate.metrics_json ? JSON.parse(gate.metrics_json) : {}
-          }))
-        };
-      }
-
-      // For now, simulate a basic pack execution
-      // In a full implementation, this would parse the pack YAML and execute the actual tests
-      const simulatedGates = await this.simulatePackExecution(packContent, vault, runId);
-
-      // Calculate trust score
-      const trustScore = this.calculateTrustScore(simulatedGates);
-
-      // Finish run
-      await vault.finishRun(runId, {
-        status: trustScore >= 70 ? 'passed' : 'failed',
-        trust_score: trustScore,
-        weights
-      });
-
-      await vault.close();
-
-      return {
-        runId,
-        status: trustScore >= 70 ? 'passed' : 'failed',
-        trust: {
-          score: trustScore,
-          weights: weights || {}
-        },
-        gates: simulatedGates.map(gate => ({
-          name: gate.name,
-          status: gate.status as 'passed' | 'failed' | 'skipped' | 'warn',
-          duration_ms: gate.duration_ms,
-          key_metrics: gate.metrics || {}
-        }))
-      };
-
-    } catch (error) {
-      throw new Error(`Failed to execute pack: ${error instanceof Error ? error.message : 'Unknown error'}`);
-    }
-  }
-
-  /**
-   * Calculate pack hash for idempotence
-   */
-  private calculatePackHash(content: string): string {
-    const crypto = require('crypto');
-    return crypto.createHash('sha256').update(content).digest('hex');
-  }
-
-  /**
-   * Simulate pack execution (placeholder implementation)
-   * In a real implementation, this would parse the pack YAML and execute actual tests
-   */
-  private async simulatePackExecution(packContent: string, vault: EvidenceVault, runId: string): Promise<Array<{
-    name: string;
-    status: string;
-    duration_ms: number;
-    metrics?: Record<string, any>;
-  }>> {
-    const gates: any[] = [];
-
-    // Try to parse basic YAML structure
-    try {
-      // Simple YAML parsing fallback (basic implementation)
-      const pack = this.parseSimpleYaml(packContent);
-      
-      if (pack && pack.gates) {
-        // Simulate execution of each gate
-        for (const [gateName, gateConfig] of Object.entries(pack.gates as Record<string, any>)) {
-          // Simulate gate execution
-          const success = Math.random() > 0.2; // 80% success rate
-          const duration = Math.floor(Math.random() * 3000) + 500; // 500-3500ms
-          
-          const gateResult = {
-            name: gateName,
-            status: success ? 'passed' : 'failed',
-            duration_ms: duration,
-            metrics: {
-              simulated: true,
-              adapter: gateConfig.adapter || 'unknown',
-              timestamp: Date.now()
-            }
-          };
-
-          // Record in vault
-          await vault.recordGate(runId, {
-            name: gateName,
-            status: gateResult.status as 'passed' | 'failed' | 'skipped' | 'warn',
-            duration_ms: duration,
-            metrics_json: JSON.stringify(gateResult.metrics)
-          });
-
-          // Simulate findings for failed gates
-          if (!success) {
-            await vault.recordFinding(runId, {
-              gate: gateName,
-              severity: 'medium',
-              rule: 'simulation-failure',
-              location: `${gateName}:1`,
-              message: `Simulated failure in ${gateName} gate`,
-              fingerprint: `sim-${gateName}-${Date.now()}`
-            });
-          }
-
-          gates.push(gateResult as any);
-          
-          // Small delay to simulate actual work
-          await new Promise(resolve => setTimeout(resolve, 100));
-        }
-      } else {
-        // Default simulation if no gates found
-        const defaultGate = {
-          name: 'default',
-          status: 'passed',
-          duration_ms: 1000,
-          metrics: {
-            simulated: true,
-            default: true
-          }
-        };
-
-        await vault.recordGate(runId, {
-          name: 'default',
-          status: 'passed',
-          duration_ms: 1000,
-          metrics_json: JSON.stringify(defaultGate.metrics)
-        });
-
-        gates.push(defaultGate as any);
-      }
-    } catch (error) {
-      // Fallback to basic simulation
-      const fallbackGate = {
-        name: 'fallback',
-        status: 'passed',
-        duration_ms: 500,
-        metrics: {
-          simulated: true,
-          fallback: true,
-          error: error instanceof Error ? error.message : 'Parse error'
-        }
-      };
-
-      await vault.recordGate(runId, {
-        name: 'fallback',
-        status: 'passed',
-        duration_ms: 500,
-        metrics_json: JSON.stringify(fallbackGate.metrics)
-      });
-
-      gates.push(fallbackGate as any);
-    }
-
-    return gates;
-  }
-
-  /**
-   * Simple YAML parser for basic pack structure
-   */
-  private parseSimpleYaml(content: string): any {
-    try {
-      // Very basic YAML parsing - just for demo purposes
-      // In production, use a proper YAML library
-      const lines = content.split('\n');
-      const result: any = { gates: {} };
-      
-      let currentGate = '';
-      for (const line of lines) {
-        const trimmed = line.trim();
-        if (trimmed.includes(':') && !trimmed.startsWith(' ')) {
-          const [key] = trimmed.split(':');
-          if (key === 'gates') continue;
-          currentGate = key;
-          result.gates[currentGate] = { adapter: 'unknown' };
-        }
-      }
-      
-      return result;
-    } catch {
-      return { gates: { default: { adapter: 'unknown' } } };
-    }
-  }
-
-  /**
-   * Calculate trust score based on gate results
-   */
-  private calculateTrustScore(gates: Array<{ status: string }>): number {
-    if (gates.length === 0) return 0;
-
-    const passedGates = gates.filter(gate => gate.status === 'passed').length;
-    const baseScore = (passedGates / gates.length) * 100;
-
-    // Apply some randomness for simulation
-    const variation = (Math.random() - 0.5) * 20; // ±10 points
-    return Math.max(0, Math.min(100, Math.round(baseScore + variation)));
-  }
-}

package/packages/mcp/src/tools/secrets.ts

@@ -1,198 +0,0 @@
-/**
- * QA360 Secrets Tools
- * Manage secure secrets via MCP (requires explicit permission)
- */
-
-import { MCPServerConfig, SecretsAddArgs, SecretsListArgs, SecretsRemoveArgs, SecretsListResult } from '../types/index.js';
-import { SecretsManager } from 'qa360-core';
-import { SecurityManager } from '../security/manager.js';
-import { AuditLogger } from '../security/audit.js';
-
-export class SecretsTools {
-  private config: MCPServerConfig;
-  private secretsManager!: SecretsManager;
-  private security: SecurityManager;
-  private audit: AuditLogger;
-
-  constructor(config: MCPServerConfig, security: SecurityManager, audit: AuditLogger) {
-    this.config = config;
-    this.security = security;
-    this.audit = audit;
-  }
-
-  async execute(toolName: string, args: any): Promise<any> {
-    if (!this.config.allowSecrets) {
-      throw new Error('Secrets tools require --allow-secrets flag');
-    }
-
-    switch (toolName) {
-      case 'qa360.secrets.add':
-        return await this.add(args as SecretsAddArgs);
-      case 'qa360.secrets.list':
-        return await this.list(args as SecretsListArgs);
-      case 'qa360.secrets.remove':
-        return await this.remove(args as SecretsRemoveArgs);
-      case 'qa360.secrets.doctor':
-        return await this.doctor();
-      case 'qa360.secrets.export_redacted':
-        return await this.exportRedacted();
-      default:
-        throw new Error(`Unknown secrets tool: ${toolName}`);
-    }
-  }
-
-  /**
-   * Add a secret to the vault
-   */
-  private async add(args: SecretsAddArgs) {
-    const { name, value, description } = args;
-
-    // Validate secret name
-    if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
-      throw new Error('Secret name must contain only alphanumeric characters, underscores, and hyphens');
-    }
-
-    // In a real implementation, this would use SecretsManager from qa360-core
-    // For now, simulate the operation
-    const secretsStore = this.getSecretsStore();
-    
-    if (secretsStore.has(name)) {
-      throw new Error(`Secret '${name}' already exists. Use remove first to replace.`);
-    }
-
-    // Simulate encrypted storage
-    secretsStore.set(name, {
-      value: this.encrypt(value),
-      description,
-      created_at: Date.now(),
-      last_used: null
-    });
-
-    return {
-      success: true,
-      name,
-      message: `Secret '${name}' added successfully`,
-      created_at: Date.now()
-    };
-  }
-
-  /**
-   * List all secrets (names only, values redacted)
-   */
-  private async list(args: SecretsListArgs): Promise<SecretsListResult> {
-    const secretsStore = this.getSecretsStore();
-    
-    const secrets = Array.from(secretsStore.entries()).map(([name, data]) => ({
-      name,
-      description: data.description,
-      created_at: data.created_at,
-      last_used: data.last_used
-    }));
-
-    return { secrets };
-  }
-
-  /**
-   * Remove a secret from the vault
-   */
-  private async remove(args: SecretsRemoveArgs) {
-    const { name } = args;
-    
-    const secretsStore = this.getSecretsStore();
-    
-    if (!secretsStore.has(name)) {
-      throw new Error(`Secret '${name}' not found`);
-    }
-
-    secretsStore.delete(name);
-
-    return {
-      success: true,
-      name,
-      message: `Secret '${name}' removed successfully`
-    };
-  }
-
-  /**
-   * Check secrets vault health
-   */
-  private async doctor() {
-    const secretsStore = this.getSecretsStore();
-    const secretCount = secretsStore.size;
-    
-    // Check for common issues
-    const issues: string[] = [];
-    const recommendations: string[] = [];
-
-    if (secretCount === 0) {
-      recommendations.push('No secrets found. Add secrets using qa360.secrets.add');
-    }
-
-    if (secretCount > 50) {
-      recommendations.push('Large number of secrets detected. Consider periodic cleanup.');
-    }
-
-    // Check for old unused secrets
-    const now = Date.now();
-    const oldSecrets = Array.from(secretsStore.entries()).filter(([name, data]) => {
-      const daysSinceCreated = (now - data.created_at) / (1000 * 60 * 60 * 24);
-      return daysSinceCreated > 90 && !data.last_used;
-    });
-
-    if (oldSecrets.length > 0) {
-      recommendations.push(`${oldSecrets.length} secrets are older than 90 days and never used. Consider cleanup.`);
-    }
-
-    return {
-      health: issues.length === 0 ? 'healthy' : 'warning',
-      secret_count: secretCount,
-      issues,
-      recommendations,
-      vault_location: '~/.qa360/secrets.vault',
-      encryption: 'AES-256-GCM'
-    };
-  }
-
-  /**
-   * Export redacted secrets list for audit
-   */
-  private async exportRedacted() {
-    const secretsStore = this.getSecretsStore();
-    
-    const redactedSecrets = Array.from(secretsStore.entries()).map(([name, data]) => ({
-      name,
-      description: data.description,
-      created_at: new Date(data.created_at).toISOString(),
-      last_used: data.last_used ? new Date(data.last_used).toISOString() : null,
-      value: '***REDACTED***'
-    }));
-
-    return {
-      export_timestamp: new Date().toISOString(),
-      total_secrets: redactedSecrets.length,
-      secrets: redactedSecrets,
-      note: 'This export contains redacted data for audit purposes only'
-    };
-  }
-
-  /**
-   * Get secrets store (simulated in-memory storage)
-   * In a real implementation, this would use SecureSecretsManager
-   */
-  private getSecretsStore(): Map<string, any> {
-    // Simulate persistent storage with a static Map
-    if (!(global as any).__qa360_secrets_store) {
-      (global as any).__qa360_secrets_store = new Map();
-    }
-    return (global as any).__qa360_secrets_store;
-  }
-
-  /**
-   * Simulate encryption (in real implementation, use AES-256-GCM)
-   */
-  private encrypt(value: string): string {
-    // In production, this would use actual encryption
-    const crypto = require('crypto');
-    return crypto.createHash('sha256').update(value).digest('hex');
-  }
-}