qa360 2.2.1 → 2.2.7

package/packages/mcp/src/scripts/verify-settings.ts

@@ -1,242 +0,0 @@
-/**
- * verify-settings.ts - Validate VS Code settings.json idempotence
- * 
- * Ensures:
- * 1. Only ONE qa360 MCP block exists
- * 2. Hash before/after multiple init runs is identical
- * 3. No duplicate entries
- * 4. Backup/restore works correctly
- */
-
-import fs from 'fs-extra';
-import path from 'path';
-import os from 'os';
-import crypto from 'crypto';
-import { parse } from 'jsonc-parser';
-
-interface VerificationResult {
-  passed: boolean;
-  message: string;
-  details?: string;
-}
-
-async function getVSCodeSettingsPath(): Promise<string | null> {
-  const possiblePaths = [
-    // macOS
-    path.join(os.homedir(), 'Library/Application Support/Code/User/settings.json'),
-    path.join(os.homedir(), 'Library/Application Support/Code - Insiders/User/settings.json'),
-    // Linux
-    path.join(os.homedir(), '.config/Code/User/settings.json'),
-    path.join(os.homedir(), '.config/Code - Insiders/User/settings.json'),
-    // Windows
-    path.join(os.homedir(), 'AppData/Roaming/Code/User/settings.json'),
-    path.join(os.homedir(), 'AppData/Roaming/Code - Insiders/User/settings.json')
-  ];
-
-  for (const p of possiblePaths) {
-    if (await fs.pathExists(p)) {
-      return p;
-    }
-  }
-
-  return null;
-}
-
-function hashFile(content: string): string {
-  return crypto.createHash('sha256').update(content).digest('hex');
-}
-
-async function verifyUniqueQA360Block(settingsPath: string): Promise<VerificationResult> {
-  try {
-    const content = await fs.readFile(settingsPath, 'utf-8');
-    const settings = parse(content);
-
-    // Check both possible MCP keys
-    const mcpKey = settings['claude.mcpServers'] !== undefined 
-      ? 'claude.mcpServers'
-      : 'claude.experimental.mcpServers';
-
-    const mcpServers = settings[mcpKey] || {};
-    const qa360Keys = Object.keys(mcpServers).filter(k => k.toLowerCase().includes('qa360'));
-
-    if (qa360Keys.length === 0) {
-      return {
-        passed: false,
-        message: 'No QA360 MCP block found',
-        details: 'Expected exactly one qa360 entry'
-      };
-    }
-
-    if (qa360Keys.length > 1) {
-      return {
-        passed: false,
-        message: 'Multiple QA360 MCP blocks found',
-        details: `Found ${qa360Keys.length} blocks: ${qa360Keys.join(', ')}`
-      };
-    }
-
-    return {
-      passed: true,
-      message: 'Unique QA360 MCP block verified',
-      details: `Key: ${qa360Keys[0]}`
-    };
-  } catch (error) {
-    return {
-      passed: false,
-      message: 'Failed to verify settings',
-      details: error instanceof Error ? error.message : String(error)
-    };
-  }
-}
-
-async function verifyIdempotence(settingsPath: string): Promise<VerificationResult> {
-  try {
-    // Read original
-    const originalContent = await fs.readFile(settingsPath, 'utf-8');
-    const originalHash = hashFile(originalContent);
-
-    // Create backup
-    const backupPath = `${settingsPath}.verify-backup`;
-    await fs.copy(settingsPath, backupPath);
-
-    // Simulate multiple init runs (would need actual CLI execution)
-    // For now, just verify hash stability
-    const currentContent = await fs.readFile(settingsPath, 'utf-8');
-    const currentHash = hashFile(currentContent);
-
-    // Restore backup
-    await fs.copy(backupPath, settingsPath);
-    await fs.remove(backupPath);
-
-    if (originalHash !== currentHash) {
-      return {
-        passed: false,
-        message: 'Settings file changed unexpectedly',
-        details: `Original hash: ${originalHash.substring(0, 16)}...\nCurrent hash: ${currentHash.substring(0, 16)}...`
-      };
-    }
-
-    return {
-      passed: true,
-      message: 'Idempotence verified',
-      details: `Hash: ${originalHash.substring(0, 16)}...`
-    };
-  } catch (error) {
-    return {
-      passed: false,
-      message: 'Failed to verify idempotence',
-      details: error instanceof Error ? error.message : String(error)
-    };
-  }
-}
-
-async function verifyBackupRestore(settingsPath: string): Promise<VerificationResult> {
-  try {
-    const backupDir = path.join(os.homedir(), '.qa360', 'backups');
-    
-    if (!await fs.pathExists(backupDir)) {
-      return {
-        passed: false,
-        message: 'Backup directory not found',
-        details: `Expected: ${backupDir}`
-      };
-    }
-
-    const backups = await fs.readdir(backupDir);
-    const settingsBackups = backups.filter(f => f.startsWith('settings.') && f.endsWith('.json'));
-
-    if (settingsBackups.length === 0) {
-      return {
-        passed: false,
-        message: 'No settings backups found',
-        details: 'Expected at least one timestamped backup'
-      };
-    }
-
-    // Verify latest backup is valid JSON
-    const latestBackup = settingsBackups.sort().reverse()[0];
-    const backupPath = path.join(backupDir, latestBackup);
-    const backupContent = await fs.readFile(backupPath, 'utf-8');
-    
-    try {
-      parse(backupContent);
-    } catch {
-      return {
-        passed: false,
-        message: 'Backup file is not valid JSON',
-        details: `File: ${latestBackup}`
-      };
-    }
-
-    return {
-      passed: true,
-      message: 'Backup/restore verified',
-      details: `Latest backup: ${latestBackup} (${settingsBackups.length} total)`
-    };
-  } catch (error) {
-    return {
-      passed: false,
-      message: 'Failed to verify backup/restore',
-      details: error instanceof Error ? error.message : String(error)
-    };
-  }
-}
-
-async function main() {
-  console.log('🔍 QA360 MCP Settings Verification\n');
-
-  const settingsPath = await getVSCodeSettingsPath();
-
-  if (!settingsPath) {
-    console.error('❌ VS Code settings.json not found');
-    process.exit(1);
-  }
-
-  console.log(`📁 Settings: ${settingsPath}\n`);
-
-  const results: VerificationResult[] = [];
-
-  // Test 1: Unique QA360 block
-  console.log('1️⃣ Verifying unique QA360 MCP block...');
-  const uniqueResult = await verifyUniqueQA360Block(settingsPath);
-  results.push(uniqueResult);
-  console.log(uniqueResult.passed ? '✅' : '❌', uniqueResult.message);
-  if (uniqueResult.details) console.log('  ', uniqueResult.details);
-  console.log();
-
-  // Test 2: Idempotence
-  console.log('2️⃣ Verifying idempotence...');
-  const idempotenceResult = await verifyIdempotence(settingsPath);
-  results.push(idempotenceResult);
-  console.log(idempotenceResult.passed ? '✅' : '❌', idempotenceResult.message);
-  if (idempotenceResult.details) console.log('  ', idempotenceResult.details);
-  console.log();
-
-  // Test 3: Backup/restore
-  console.log('3️⃣ Verifying backup/restore...');
-  const backupResult = await verifyBackupRestore(settingsPath);
-  results.push(backupResult);
-  console.log(backupResult.passed ? '✅' : '❌', backupResult.message);
-  if (backupResult.details) console.log('  ', backupResult.details);
-  console.log();
-
-  // Summary
-  const passed = results.filter(r => r.passed).length;
-  const total = results.length;
-
-  console.log('─'.repeat(60));
-  console.log(`\n📊 Results: ${passed}/${total} checks passed\n`);
-
-  if (passed === total) {
-    console.log('✅ All verifications passed\n');
-    process.exit(0);
-  } else {
-    console.log('❌ Some verifications failed\n');
-    process.exit(1);
-  }
-}
-
-main().catch(error => {
-  console.error('💥 Fatal error:', error);
-  process.exit(1);
-});

package/packages/mcp/src/security/audit.ts

@@ -1,244 +0,0 @@
-/**
- * QA360 MCP Audit Logger
- * Logs all tool calls for security and compliance
- */
-
-import { promises as fs } from 'fs';
-import { resolve, dirname } from 'path';
-import { existsSync, mkdirSync } from 'fs';
-import { homedir } from 'os';
-
-export interface AuditConfig {
-  enabled: boolean;
-  logPath: string;
-}
-
-export interface AuditEntry {
-  timestamp: number;
-  tool: string;
-  args: any;
-  result: any;
-  success: boolean;
-  duration_ms: number;
-  client_info?: {
-    pid?: number;
-    cwd?: string;
-  };
-}
-
-export class AuditLogger {
-  private config: AuditConfig;
-  private logPath: string;
-
-  constructor(config: AuditConfig) {
-    this.config = config;
-    this.logPath = this.resolvePath(config.logPath);
-    
-    if (config.enabled) {
-      this.ensureLogDirectory();
-    }
-  }
-
-  /**
-   * Log a tool call
-   */
-  async logToolCall(
-    toolName: string,
-    args: any,
-    result: any,
-    success: boolean,
-    startTime?: number
-  ): Promise<void> {
-    if (!this.config.enabled) {
-      return;
-    }
-
-    const now = Date.now();
-    const duration = startTime ? now - startTime : 0;
-
-    const entry: AuditEntry = {
-      timestamp: now,
-      tool: toolName,
-      args: this.sanitizeForAudit(args),
-      result: success ? { success: true } : this.sanitizeForAudit(result),
-      success,
-      duration_ms: duration,
-      client_info: {
-        pid: process.pid,
-        cwd: process.cwd()
-      }
-    };
-
-    try {
-      const logLine = JSON.stringify(entry) + '\n';
-      await fs.appendFile(this.logPath, logLine, 'utf8');
-    } catch (error) {
-      console.error('[Audit Logger] Failed to write audit log:', error);
-    }
-  }
-
-  /**
-   * Get recent audit entries
-   */
-  async getRecentEntries(limit: number = 100): Promise<AuditEntry[]> {
-    if (!this.config.enabled || !existsSync(this.logPath)) {
-      return [];
-    }
-
-    try {
-      const content = await fs.readFile(this.logPath, 'utf8');
-      const lines = content.trim().split('\n').filter(line => line.length > 0);
-      
-      const entries = lines
-        .slice(-limit)
-        .map(line => {
-          try {
-            return JSON.parse(line) as AuditEntry;
-          } catch {
-            return null;
-          }
-        })
-        .filter((entry): entry is AuditEntry => entry !== null);
-
-      return entries.reverse(); // Most recent first
-    } catch (error) {
-      console.error('[Audit Logger] Failed to read audit log:', error);
-      return [];
-    }
-  }
-
-  /**
-   * Get audit statistics
-   */
-  async getAuditStats(): Promise<{
-    totalCalls: number;
-    successRate: number;
-    topTools: Array<{ tool: string; count: number }>;
-    recentErrors: AuditEntry[];
-  }> {
-    const entries = await this.getRecentEntries(1000);
-    
-    const totalCalls = entries.length;
-    const successCount = entries.filter(e => e.success).length;
-    const successRate = totalCalls > 0 ? successCount / totalCalls : 0;
-
-    // Count tool usage
-    const toolCounts = new Map<string, number>();
-    entries.forEach(entry => {
-      toolCounts.set(entry.tool, (toolCounts.get(entry.tool) || 0) + 1);
-    });
-
-    const topTools = Array.from(toolCounts.entries())
-      .map(([tool, count]) => ({ tool, count }))
-      .sort((a, b) => b.count - a.count)
-      .slice(0, 10);
-
-    const recentErrors = entries
-      .filter(e => !e.success)
-      .slice(0, 10);
-
-    return {
-      totalCalls,
-      successRate,
-      topTools,
-      recentErrors
-    };
-  }
-
-  /**
-   * Clear old audit entries
-   */
-  async rotateLog(maxEntries: number = 10000): Promise<void> {
-    if (!this.config.enabled || !existsSync(this.logPath)) {
-      return;
-    }
-
-    try {
-      const content = await fs.readFile(this.logPath, 'utf8');
-      const lines = content.trim().split('\n').filter(line => line.length > 0);
-      
-      if (lines.length <= maxEntries) {
-        return;
-      }
-
-      // Keep only the most recent entries
-      const recentLines = lines.slice(-maxEntries);
-      await fs.writeFile(this.logPath, recentLines.join('\n') + '\n', 'utf8');
-      
-      console.log(`[Audit Logger] Rotated log, kept ${recentLines.length} entries`);
-    } catch (error) {
-      console.error('[Audit Logger] Failed to rotate audit log:', error);
-    }
-  }
-
-  /**
-   * Sanitize data for audit logging (remove sensitive info)
-   */
-  private sanitizeForAudit(data: any): any {
-    if (typeof data === 'string') {
-      // Basic redaction for common patterns
-      return data
-        .replace(/Bearer\s+[A-Za-z0-9\-._~+/]+=*/g, 'Bearer ***')
-        .replace(/password["\s]*[:=]["\s]*[^"\s,}]+/gi, 'password: "***"')
-        .replace(/secret["\s]*[:=]["\s]*[^"\s,}]+/gi, 'secret: "***"')
-        .replace(/token["\s]*[:=]["\s]*[^"\s,}]+/gi, 'token: "***"');
-    }
-
-    if (Array.isArray(data)) {
-      return data.map(item => this.sanitizeForAudit(item));
-    }
-
-    if (data && typeof data === 'object') {
-      const sanitized: any = {};
-      for (const [key, value] of Object.entries(data)) {
-        if (this.isSensitiveKey(key)) {
-          sanitized[key] = '***';
-        } else {
-          sanitized[key] = this.sanitizeForAudit(value);
-        }
-      }
-      return sanitized;
-    }
-
-    return data;
-  }
-
-  /**
-   * Check if key contains sensitive information
-   */
-  private isSensitiveKey(key: string): boolean {
-    const sensitiveKeys = [
-      'password',
-      'secret',
-      'token',
-      'key',
-      'auth',
-      'credential',
-      'private',
-      'value'
-    ];
-
-    const lowerKey = key.toLowerCase();
-    return sensitiveKeys.some(sensitive => lowerKey.includes(sensitive));
-  }
-
-  /**
-   * Resolve path with home directory expansion
-   */
-  private resolvePath(path: string): string {
-    if (path.startsWith('~/')) {
-      return resolve(homedir(), path.slice(2));
-    }
-    return resolve(path);
-  }
-
-  /**
-   * Ensure log directory exists
-   */
-  private ensureLogDirectory(): void {
-    const logDir = dirname(this.logPath);
-    if (!existsSync(logDir)) {
-      mkdirSync(logDir, { recursive: true });
-    }
-  }
-}