sinapse-ai 1.12.2 → 1.14.0

package/.sinapse-ai/development/scripts/security-checker.js

@@ -1,359 +0,0 @@
-/**
- * Security Checker for SINAPSE Developer Meta-Agent
- * Validates generated code and configurations for security vulnerabilities
- */
-
-const path = require('path');
-const yaml = require('js-yaml');
-
-class SecurityChecker {
-  constructor() {
-    // Patterns that indicate potential security issues
-    this.dangerousPatterns = [
-      /eval\s*\(/gi,
-      /Function\s*\(/gi,
-      /new\s+Function/gi,
-      /setTimeout\s*\([^,]+,/gi,
-      /setInterval\s*\([^,]+,/gi,
-      /require\s*\([^'"]/gi, // Dynamic require
-      /import\s*\(/gi, // Dynamic import
-      /child_process/gi,
-      /exec\s*\(/gi,
-      /spawn\s*\(/gi,
-      /\.\.\/\.\.\//g, // Path traversal
-      /process\.env/gi,
-      /__dirname/gi,
-      /__filename/gi,
-    ];
-
-    // SQL injection patterns
-    this.sqlInjectionPatterns = [
-      /;\s*DROP\s+TABLE/gi,
-      /;\s*DELETE\s+FROM/gi,
-      /UNION\s+SELECT/gi,
-      /OR\s+1\s*=\s*1/gi,
-      /'\s+OR\s+'/gi,
-    ];
-
-    // Command injection patterns
-    this.commandInjectionPatterns = [
-      /[;&|`$()]/g,
-      /\$\{.*\}/g,
-      />|</g,
-    ];
-
-    // Safe patterns that should be allowed
-    this.safePatterns = {
-      'eval': [
-        /\/\*.*eval.*\*\//gs, // eval in comments
-        /\/\/.*eval/g, // eval in single-line comments
-        /".*eval.*"/g, // eval in strings
-        /'.*eval.*'/g,
-      ]
-    };
-  }
-
-  /**
-   * Validate generated code for security vulnerabilities
-   * @param {string} code - The code to validate
-   * @param {string} [language='javascript'] - The programming language
-   * @returns {Object} Validation results with valid flag, errors, warnings, and suggestions
-   */
-  validateCode(code, language = 'javascript') {
-    const results = {
-      valid: true,
-      errors: [],
-      warnings: [],
-      suggestions: []
-    };
-
-    // Validate input
-    if (!code || typeof code !== 'string') {
-      results.valid = false;
-      results.errors.push({
-        type: 'invalid_input',
-        message: 'Code must be a non-empty string'
-      });
-      return results;
-    }
-
-    // Check for dangerous patterns
-    for (const pattern of this.dangerousPatterns) {
-      const matches = code.match(pattern);
-      if (matches) {
-        // Check if it's in a safe context
-        let isSafe = false;
-        const patternName = pattern.source.split('\\')[0];
-        
-        if (this.safePatterns[patternName]) {
-          for (const safePattern of this.safePatterns[patternName]) {
-            if (code.match(safePattern)) {
-              isSafe = true;
-              break;
-            }
-          }
-        }
-
-        if (!isSafe) {
-          results.valid = false;
-          results.errors.push({
-            type: 'dangerous_pattern',
-            pattern: pattern.source,
-            matches: matches,
-            message: `Dangerous pattern detected: ${matches[0]}`,
-            line: this._getLineNumber(code, matches.index)
-          });
-        }
-      }
-    }
-
-    // Check for SQL injection (if applicable)
-    if (code.includes('SELECT') || code.includes('INSERT') || code.includes('UPDATE')) {
-      for (const pattern of this.sqlInjectionPatterns) {
-        if (pattern.test(code)) {
-          results.valid = false;
-          results.errors.push({
-            type: 'sql_injection',
-            pattern: pattern.source,
-            message: 'Potential SQL injection vulnerability detected'
-          });
-        }
-      }
-    }
-
-    // Validate input sanitization
-    if (code.includes('req.body') || code.includes('req.query') || code.includes('req.params')) {
-      if (!code.includes('sanitize') && !code.includes('validate') && !code.includes('escape')) {
-        results.warnings.push({
-          type: 'input_validation',
-          message: 'User input detected without explicit sanitization'
-        });
-      }
-    }
-
-    return results;
-  }
-
-  /**
-   * Validate YAML configuration for security issues
-   */
-  validateYAML(yamlContent) {
-    const results = {
-      valid: true,
-      errors: [],
-      warnings: []
-    };
-
-    try {
-      const parsed = yaml.load(yamlContent);
-      
-      // Check for dangerous YAML features
-      if (yamlContent.includes('!!') && !yamlContent.includes('!!str')) {
-        results.warnings.push({
-          type: 'yaml_tags',
-          message: 'YAML tags detected - ensure they are safe'
-        });
-      }
-
-      // Validate structure
-      this.validateYAMLStructure(parsed, results);
-      
-    } catch (error) {
-      results.valid = false;
-      results.errors.push({
-        type: 'yaml_parse',
-        message: `YAML parsing error: ${error.message}`
-      });
-    }
-
-    return results;
-  }
-
-  /**
-   * Validate YAML structure recursively
-   */
-  validateYAMLStructure(obj, results, path = '') {
-    if (typeof obj === 'object' && obj !== null) {
-      for (const [key, value] of Object.entries(obj)) {
-        const currentPath = path ? `${path}.${key}` : key;
-        
-        // Check for command injection in string values
-        if (typeof value === 'string') {
-          for (const pattern of this.commandInjectionPatterns) {
-            if (pattern.test(_value) && !this.isSafeCommandContext(key, value)) {
-              results.warnings.push({
-                type: 'command_injection',
-                path: currentPath,
-                message: `Potential command injection in ${currentPath}`
-              });
-            }
-          }
-        }
-        
-        // Recurse for nested objects
-        if (typeof value === 'object') {
-          this.validateYAMLStructure(_value, results, currentPath);
-        }
-      }
-    }
-  }
-
-  /**
-   * Check if command-like string is in safe context
-   */
-  isSafeCommandContext(key, value) {
-    const safeKeys = ['description', 'comment', 'note', 'help', 'usage'];
-    return safeKeys.some(safe => key.toLowerCase().includes(safe));
-  }
-
-  /**
-   * Validate file paths for security issues
-   */
-  validatePath(filePath) {
-    const results = {
-      valid: true,
-      errors: []
-    };
-
-    // Normalize the path
-    const normalized = path.normalize(filePath);
-
-    // Check for path traversal
-    if (normalized.includes('..')) {
-      results.valid = false;
-      results.errors.push({
-        type: 'path_traversal',
-        message: 'Path traversal detected'
-      });
-    }
-
-    // Check for absolute paths (unless allowed)
-    if (path.isAbsolute(normalized)) {
-      results.errors.push({
-        type: 'absolute_path',
-        message: 'Absolute path detected - use relative paths'
-      });
-    }
-
-    // Check for sensitive directories
-    const sensitivePatterns = [
-      /node_modules/i,
-      /\.git/i,
-      /\.env/i,
-      /private/i,
-      /secret/i,
-      /config/i,
-    ];
-
-    for (const pattern of sensitivePatterns) {
-      if (pattern.test(normalized)) {
-        results.warnings = results.warnings || [];
-        results.warnings.push({
-          type: 'sensitive_path',
-          message: `Path contains potentially sensitive directory: ${pattern.source}`
-        });
-      }
-    }
-
-    return results;
-  }
-
-  /**
-   * Validate user input for common security issues
-   */
-  sanitizeInput(input, type = 'general') {
-    if (typeof input !== 'string') {
-      return input;
-    }
-
-    let sanitized = input;
-
-    // Remove null bytes
-    sanitized = sanitized.replace(/\0/g, '');
-
-    // Type-specific sanitization
-    switch (type) {
-      case 'filename':
-        // Allow only alphanumeric, dash, underscore, and dot
-        sanitized = sanitized.replace(/[^a-zA-Z0-9\-_\.]/g, '');
-        break;
-      
-      case 'identifier':
-        // Allow only alphanumeric, dash, and underscore
-        sanitized = sanitized.replace(/[^a-zA-Z0-9\-_]/g, '');
-        break;
-      
-      case 'yaml':
-        // Escape special YAML characters
-        sanitized = sanitized
-          .replace(/:/g, '\\:')
-          .replace(/\|/g, '\\|')
-          .replace(/>/g, '\\>')
-          .replace(/</g, '\\<');
-        break;
-      
-      case 'general':
-      default:
-        // Basic HTML/script escaping
-        sanitized = sanitized
-          .replace(/&/g, '&amp;')
-          .replace(/</g, '&lt;')
-          .replace(/>/g, '&gt;')
-          .replace(/"/g, '&quot;')
-          .replace(/'/g, '&#x27;')
-          .replace(/\//g, '&#x2F;');
-    }
-
-    return sanitized;
-  }
-
-  /**
-   * Generate security report
-   * @param {Array} validations - Array of validation results
-   * @returns {Object} Comprehensive security report
-   */
-  generateReport(validations) {
-    const report = {
-      timestamp: new Date().toISOString(),
-      summary: {
-        totalChecks: 0,
-        passed: 0,
-        failed: 0,
-        warnings: 0
-      },
-      details: validations
-    };
-
-    // Calculate summary
-    for (const validation of validations) {
-      report.summary.totalChecks++;
-      if (validation.valid) {
-        report.summary.passed++;
-      } else {
-        report.summary.failed++;
-      }
-      report.summary.warnings += (validation.warnings || []).length;
-    }
-
-    report.summary.securityScore = Math.round(
-      (report.summary.passed / report.summary.totalChecks) * 100
-    );
-
-    return report;
-  }
-
-  /**
-   * Get line number from string index
-   * @private
-   * @param {string} text - The text to search
-   * @param {number} index - Character index
-   * @returns {number} Line number (1-based)
-   */
-  _getLineNumber(text, index) {
-    if (!text || index === undefined) return null;
-    const lines = text.substring(0, index).split('\n');
-    return lines.length;
-  }
-}
-
-module.exports = SecurityChecker;

package/.sinapse-ai/development/scripts/template-engine.js

@@ -1,240 +0,0 @@
-/**
- * Template Engine for SINAPSE-FULLSTACK
- * Handles variable substitution, conditionals, and loops for component generation
- * @module template-engine
- */
-
-const fs = require('fs-extra');
-const _path = require('path');
-
-class TemplateEngine {
-  constructor() {
-    this.variablePattern = /\{\{([^}]+)\}\}/g;
-    this.conditionalPattern = /\{\{#IF_([^}]+)\}\}([\s\S]*?)\{\{\/IF_\1\}\}/g;
-    this.loopPattern = /\{\{#EACH_([^}]+)\}\}([\s\S]*?)\{\{\/EACH_\1\}\}/g;
-    this.escapePattern = /\\\{\{([^}]+)\}\}/g;
-  }
-
-  /**
-   * Process a template string with given variables
-   * @param {string} template - The template string
-   * @param {Object} variables - Variables to substitute
-   * @returns {string} Processed template
-   */
-  process(template, variables = {}) {
-    // First, handle escaped braces
-    let processed = template.replace(this.escapePattern, '{{$1}}');
-    
-    // Process loops
-    processed = this.processLoops(processed, variables);
-    
-    // Process conditionals
-    processed = this.processConditionals(processed, variables);
-    
-    // Process simple variables
-    processed = this.processVariables(processed, variables);
-    
-    // Restore escaped braces
-    processed = processed.replace(/\{\{ESCAPED_BRACE_(LEFT|RIGHT)\}\}/g, (match, side) => 
-      side === 'LEFT' ? '{{' : '}}'
-    );
-    
-    return processed;
-  }
-
-  /**
-   * Process loop constructs in template
-   * @private
-   * @param {string} template - Template string
-   * @param {Object} variables - Variables object
-   * @returns {string} Processed template
-   */
-  processLoops(template, variables) {
-    return template.replace(this.loopPattern, (match, loopVar, content) => {
-      const items = this.resolveVariable(loopVar, variables);
-      
-      // Handle non-array values gracefully
-      if (!Array.isArray(items)) {
-        console.warn(`[TemplateEngine] Expected array for loop variable '${loopVar}', got ${typeof items}`);
-        return '';
-      }
-      
-      return items.map((item, index) => {
-        // Create proper loop context with item and metadata
-        const loopVars = {
-          ...variables,
-          ITEM: item,
-          INDEX: index,
-          FIRST: index === 0,
-          LAST: index === items.length - 1,
-          [loopVar.replace('_', '')]: item
-        };
-        
-        // Process nested loops and conditionals
-        let processedContent = this.processLoops(content, loopVars);
-        processedContent = this.processConditionals(processedContent, loopVars);
-        processedContent = this.processVariables(processedContent, loopVars);
-        
-        return processedContent;
-      }).join('');
-    });
-  }
-
-  /**
-   * Process conditional constructs in template
-   * @private
-   */
-  processConditionals(template, variables) {
-    return template.replace(this.conditionalPattern, (match, condition, content) => {
-      const value = this.resolveVariable(condition, variables);
-      
-      // Check for truthy value
-      if (value && (Array.isArray(value) ? value.length > 0 : true)) {
-        return content;
-      }
-      return '';
-    });
-  }
-
-  /**
-   * Process simple variable substitutions
-   * @private
-   */
-  processVariables(template, variables) {
-    return template.replace(this.variablePattern, (match, varName) => {
-      const value = this.resolveVariable(varName.trim(), variables);
-      return value !== undefined ? String(value) : match;
-    });
-  }
-
-  /**
-   * Resolve a variable name to its value
-   * @private
-   */
-  resolveVariable(varName, variables) {
-    // Handle nested paths like "user.name"
-    const parts = varName.split('.');
-    let value = variables;
-    
-    for (const part of parts) {
-      if (value && typeof value === 'object') {
-        value = value[part];
-      } else {
-        return undefined;
-      }
-    }
-    
-    return value;
-  }
-
-  /**
-   * Validate that a template has all required placeholders
-   * @param {string} template - Template to validate
-   * @param {string[]} requiredVars - List of required variable names
-   * @returns {Object} Validation result with {valid: boolean, missing: string[]}
-   */
-  validateTemplate(template, requiredVars = []) {
-    const foundVars = new Set();
-    const missing = [];
-    
-    // Extract all variable names from template
-    let match;
-    const allPatterns = [
-      this.variablePattern,
-      /\{\{#IF_([^}]+)\}\}/g,
-      /\{\{#EACH_([^}]+)\}\}/g
-    ];
-    
-    for (const pattern of allPatterns) {
-      pattern.lastIndex = 0; // Reset regex
-      while ((match = pattern.exec(template)) !== null) {
-        foundVars.add(match[1].trim());
-      }
-    }
-    
-    // Check for missing required variables
-    for (const reqVar of requiredVars) {
-      if (!foundVars.has(reqVar)) {
-        missing.push(reqVar);
-      }
-    }
-    
-    return {
-      valid: missing.length === 0,
-      missing,
-      found: Array.from(foundVars)
-    };
-  }
-
-  /**
-   * Load and process a template file
-   * @param {string} templatePath - Path to template file
-   * @param {Object} variables - Variables to substitute
-   * @returns {Promise<string>} Processed template
-   */
-  async loadAndProcess(templatePath, variables = {}) {
-    const template = await fs.readFile(templatePath, 'utf8');
-    return this.process(template, variables);
-  }
-
-  /**
-   * Escape special characters in user input to prevent injection
-   * @param {string} input - User input to escape
-   * @returns {string} Escaped input
-   */
-  escapeInput(input) {
-    if (typeof input !== 'string') return input;
-    
-    // Escape template syntax
-    return input
-      .replace(/\{\{/g, '\\{{')
-      .replace(/\}\}/g, '\\}}')
-      .replace(/</g, '&lt;')
-      .replace(/>/g, '&gt;')
-      .replace(/"/g, '&quot;')
-      .replace(/'/g, '&#39;');
-  }
-
-  /**
-   * Get all available variables from a template
-   * @param {string} template - Template to analyze
-   * @returns {Object} Object with variables categorized by type
-   */
-  getTemplateVariables(template) {
-    const variables = {
-      simple: [],
-      conditionals: [],
-      loops: []
-    };
-    
-    // Extract simple variables
-    let match;
-    this.variablePattern.lastIndex = 0;
-    while ((match = this.variablePattern.exec(template)) !== null) {
-      if (!match[1].startsWith('#') && !match[1].startsWith('/')) {
-        variables.simple.push(match[1].trim());
-      }
-    }
-    
-    // Extract conditionals
-    const conditionalStartPattern = /\{\{#IF_([^}]+)\}\}/g;
-    while ((match = conditionalStartPattern.exec(template)) !== null) {
-      variables.conditionals.push(match[1].trim());
-    }
-    
-    // Extract loops
-    const loopStartPattern = /\{\{#EACH_([^}]+)\}\}/g;
-    while ((match = loopStartPattern.exec(template)) !== null) {
-      variables.loops.push(match[1].trim());
-    }
-    
-    // Remove duplicates
-    for (const key in variables) {
-      variables[key] = [...new Set(variables[key])];
-    }
-    
-    return variables;
-  }
-}
-
-module.exports = TemplateEngine;