thuban 0.3.3 → 0.4.0

package/dist/packages/crucible/pattern-learner.js

@@ -0,0 +1 @@
+"use strict";const fs=require("fs"),path=require("path"),RULES_DIR=path.join(__dirname,"rules"),COMMUNITY_FILENAME="community-discovered.json",COMMUNITY_FILE=path.join(RULES_DIR,COMMUNITY_FILENAME),MISSED_PATTERNS_FILE=path.join(__dirname,"missed-patterns.json"),MAX_PATTERN_LENGTH=500,MAX_QUANTIFIERS=20,MAX_ALTERNATIONS=30;class PatternLearner{constructor(e={}){this.rulesDir=e.rulesDir||RULES_DIR,this.communityFile=e.communityFile||path.join(this.rulesDir,COMMUNITY_FILENAME),this.missedPatternsFile=e.missedPatternsFile||MISSED_PATTERNS_FILE}_readJsonArray(e){if(!fs.existsSync(e))return[];try{const t=JSON.parse(fs.readFileSync(e,"utf-8"));if(!Array.isArray(t))return[];for(const e of t)e&&"object"==typeof e&&(delete e.__proto__,delete e.constructor,delete e.prototype);return t}catch{return[]}}_writeJsonArray(e,t){fs.mkdirSync(path.dirname(e),{recursive:!0}),fs.writeFileSync(e,JSON.stringify(t,null,2)+"\n","utf-8")}_invalidateRuleCache(){try{delete require.cache[require.resolve("./rule-loader.js")]}catch{}}_nextId(e,t){if(!/^[A-Z]+$/.test(t))throw new Error(`[PatternLearner] _nextId prefix must be uppercase alpha, got: "${t}"`);let r=0;const n=new RegExp(`^${t}(\\d+)$`);for(const t of e){const e=n.exec(t.id||"");e&&(r=Math.max(r,parseInt(e[1],10)))}return t+String(r+1).padStart("MISS"===t?4:3,"0")}_deriveTrigger(e){if(!e||"string"!=typeof e)return null;const t=e.split("\n").map(e=>e.trim()).filter(Boolean).find(e=>!e.startsWith("//")&&!e.startsWith("#")&&!e.startsWith("*")&&!e.startsWith("/*")&&!/^(import|from|using|package|require|namespace)\b/.test(e)&&e.length>=8&&e.length<=240);if(!t)return null;const r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");return this._checkRegexComplexity(r).safe?r:null}_checkRegexComplexity(e){if("string"!=typeof e||!e)return{safe:!1,reason:"pattern must be a non-empty string"};if(e.length>500)return{safe:!1,reason:"pattern exceeds max length of 500 characters"};let t=0,r=0;const n=[];for(let s=0;s<e.length;s++){const i=e[s];if("\\"!==i)if("("!==i){if(")"===i){const r=n.pop();if(!r)continue;const i=/^\{\d+(,\d*)?\}/.exec(e.slice(s+1)),a=e[s+1];if("+"===a||"*"===a||"?"===a||i){if(t++,r.hasQuantifier||r.hasAlternation)return{safe:!1,reason:"nested quantifier detected (potential catastrophic backtracking)"};n.length>0&&(n[n.length-1].hasQuantifier=!0)}continue}if("+"!==i&&"*"!==i&&"?"!==i){if("{"===i){/^\{\d+(,\d*)?\}/.exec(e.slice(s))&&(t++,n.length>0&&(n[n.length-1].hasQuantifier=!0));continue}"|"!==i||(r++,n.length>0&&(n[n.length-1].hasAlternation=!0))}else t++,n.length>0&&(n[n.length-1].hasQuantifier=!0)}else n.push({hasQuantifier:!1,hasAlternation:!1});else s++}return t>20?{safe:!1,reason:`pattern has ${t} quantifiers, exceeding max of 20`}:r>30?{safe:!1,reason:`pattern has ${r} alternations, exceeding max of 30`}:{safe:!0,reason:null}}patternExists(e,t){if(!fs.existsSync(this.rulesDir))return!1;const r=fs.readdirSync(this.rulesDir).filter(e=>e.endsWith(".json"));for(const n of r){const r=this._readJsonArray(path.join(this.rulesDir,n));for(const n of r)if(null==e){if(n.category===t)return!0}else if(n.pattern===e&&n.category===t)return!0}return!1}categoryCovered(e){return this.patternExists(null,e)}recordNewPattern(e={}){const{pattern:t,flags:r="gi",category:n,description:s,language:i=[],severity:a="medium",source:o}=e;if(!t||!n)throw new Error('[PatternLearner] recordNewPattern requires "pattern" and "category"');new RegExp(t,r);const d=this._checkRegexComplexity(t);if(!d.safe)throw new Error(`[PatternLearner] recordNewPattern rejected unsafe pattern: ${d.reason}`);if(this.patternExists(t,n))return{added:!1,reason:"duplicate",id:null};const c=this._readJsonArray(this.communityFile),u=this._nextId(c,"COMM"),l={id:u,pattern:t,flags:r,category:n,description:s||`Community-discovered pattern for "${n}"`,language:i,severity:a,discoveredAt:(new Date).toISOString(),source:o||"crucible-run"};return c.push(l),this._writeJsonArray(this.communityFile,c),this._invalidateRuleCache(),{added:!0,reason:null,id:u,entry:l}}recordDiscoveredIfUncovered(e={}){const{category:t,language:r,content:n,severity:s,seedId:i}=e;if(!t)return{added:!1,reason:"no-category"};if(this.categoryCovered(t))return{added:!1,reason:"already-covered"};const a=this._deriveTrigger(n);return a?this.recordNewPattern({pattern:a,flags:"gi",category:t,description:`Auto-discovered pattern for previously-uncovered category "${t}"`+(i?` (seed ${i})`:""),language:r?[r]:[],severity:s||"medium",source:`crucible-auto-discovery:${i||"unknown"}`}):{added:!1,reason:"no-derivable-trigger"}}recordMissedPattern(e={}){const{seedId:t,content:r,expectedCategory:n,language:s,scannerOutput:i,severity:a="medium",meta:o={}}=e;if(!n)throw new Error('[PatternLearner] recordMissedPattern requires "expectedCategory"');const d=this._readJsonArray(this.missedPatternsFile),c=`${t||""}|${n}|${s||""}`,u=d.find(e=>`${e.seedId||""}|${e.expectedCategory}|${e.language||""}`===c);if(u)return u.timesSeen=(u.timesSeen||1)+1,u.lastSeenAt=(new Date).toISOString(),this._writeJsonArray(this.missedPatternsFile,d),{added:!1,reason:"duplicate-updated",entry:u};const l={id:this._nextId(d,"MISS"),seedId:t||null,expectedCategory:n,language:s||null,severity:a,content:r||null,scannerOutput:i||null,status:"pending",discoveredAt:(new Date).toISOString(),timesSeen:1,meta:o};return d.push(l),this._writeJsonArray(this.missedPatternsFile,d),{added:!0,reason:null,entry:l}}getMissedPatterns(e={}){const t=this._readJsonArray(this.missedPatternsFile);return e.status?t.filter(t=>t.status===e.status):t}reviewMissedPattern(e,t){if("confirmed"!==t&&"rejected"!==t)throw new Error('[PatternLearner] decision must be "confirmed" or "rejected"');const r=this._readJsonArray(this.missedPatternsFile),n=r.find(t=>t.id===e);return n?(n.status=t,n.reviewedAt=(new Date).toISOString(),this._writeJsonArray(this.missedPatternsFile,r),n):null}promoteToScannerRule(e,t={}){const{pattern:r,flags:n="gi",description:s,language:i,severity:a}=t,o=this._readJsonArray(this.missedPatternsFile),d=o.find(t=>t.id===e);if(!d)throw new Error(`[PatternLearner] missed-pattern "${e}" not found`);if("confirmed"!==d.status)throw new Error(`[PatternLearner] missed-pattern "${e}" must be status "confirmed" before promotion (current: "${d.status}")`);if(!r)throw new Error('[PatternLearner] promoteToScannerRule requires an explicit "pattern" regex source');const c=this.recordNewPattern({pattern:r,flags:n,category:d.expectedCategory,description:s||`Promoted from missed-pattern ${e}: ${d.expectedCategory}`,language:i||(d.language?[d.language]:[]),severity:a||d.severity||"medium",source:`learn:${e}`});return c.added&&(d.status="promoted",d.promotedAt=(new Date).toISOString(),d.promotedRuleId=c.id,this._writeJsonArray(this.missedPatternsFile,o)),Object.assign({},c,{missedEntry:d})}autoPromoteMissedPatterns(){const e=this._readJsonArray(this.missedPatternsFile),t=this._readJsonArray(this.communityFile);let r=0,n=0,s=0;const i=[];for(const a of e){if("pending"!==a.status)continue;r++;const e=this._deriveTrigger(a.content);if(!e){a.status="rejected",a.reviewedAt=(new Date).toISOString(),a.reviewNote="auto-review: no derivable pattern from stored content",s++;continue}if(this.patternExists(e,a.expectedCategory)){a.status="rejected",a.reviewedAt=(new Date).toISOString(),a.reviewNote="auto-review: derived pattern already covered by an existing rule",s++;continue}a.status="confirmed",a.reviewedAt=(new Date).toISOString(),a.reviewNote="auto-confirmed: derivable pattern found";const o=this._nextId(t,"COMM");t.push({id:o,pattern:e,flags:"gi",category:a.expectedCategory,description:`Auto-promoted from missed-pattern ${a.id}: ${a.expectedCategory}`,language:a.language?[a.language]:[],severity:a.severity||"medium",discoveredAt:(new Date).toISOString(),source:`learn:${a.id}`}),a.status="promoted",a.promotedAt=(new Date).toISOString(),a.promotedRuleId=o,n++,i.push(o)}return n>0&&(this._writeJsonArray(this.communityFile,t),this._invalidateRuleCache()),r>0&&this._writeJsonArray(this.missedPatternsFile,e),{reviewed:r,promoted:n,skipped:s,promotedIds:i}}}module.exports={PatternLearner:PatternLearner,RULES_DIR:RULES_DIR,COMMUNITY_FILE:COMMUNITY_FILE,MISSED_PATTERNS_FILE:MISSED_PATTERNS_FILE};

package/dist/packages/crucible/report-generator.js

@@ -0,0 +1 @@
+"use strict";const fs=require("fs"),path=require("path"),crypto=require("crypto");function getScannerVersion(){try{return JSON.parse(fs.readFileSync(path.join(__dirname,"..","..","package.json"),"utf-8")).version||"unknown"}catch{return"unknown"}}function calculateCrucibleScore(e={}){let t=0,n=0;if(e.seedResults&&e.seedResults.total>0&&(t+=e.seedResults.detected/e.seedResults.total*100*.4,n+=.4),e.mutationResults&&e.mutationResults.total>0&&(t+=e.mutationResults.killed/e.mutationResults.total*100*.25,n+=.25),e.kennyResults&&(t+=.25*(e.kennyResults.score||0),n+=.25),e.selfAttackResults&&(t+=.1*(e.selfAttackResults.score||0),n+=.1),0===n)return 0;const s=t/n;return Math.round(Math.min(100,Math.max(0,s)))}function scoreColor(e){return e>=90?"#22c55e":e>=70?"#f59e0b":e>=50?"#f97316":"#ef4444"}function scoreLabel(e){return e>=90?"Excellent":e>=70?"Good":e>=50?"Fair":e>=30?"Poor":"Critical"}function esc(e){return String(e||"").replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#039;")}function generateHTML(e){const t=e.title||"Crucible Report",n=e.timestamp||(new Date).toISOString(),s=e.level||"medium",a="number"==typeof e.score?e.score:calculateCrucibleScore(e),r=scoreColor(a),o=scoreLabel(a),d=buildSeedSection(e.seedResults),i=buildMutationSection(e.mutationResults),l=buildKennySection(e.kennyResults),c=buildSelfAttackSection(e.selfAttackResults),p=buildGoldenSection(e.goldenComparison),u=buildDivergenceSection(e.divergenceStats);return`<!DOCTYPE html>\n<html lang="en">\n<head>\n  <meta charset="UTF-8">\n  <meta name="viewport" content="width=device-width, initial-scale=1.0">\n  <title>${esc(t)}</title>\n  <style>\n    :root {\n      --bg: #0f0f0f;\n      --surface: #1a1a1a;\n      --surface2: #242424;\n      --border: #2e2e2e;\n      --text: #e5e5e5;\n      --text-muted: #888;\n      --accent: #f97316;\n      --green: #22c55e;\n      --red: #ef4444;\n      --amber: #f59e0b;\n      --blue: #3b82f6;\n      --purple: #a855f7;\n    }\n    * { box-sizing: border-box; margin: 0; padding: 0; }\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', sans-serif;\n      background: var(--bg);\n      color: var(--text);\n      line-height: 1.6;\n      min-height: 100vh;\n    }\n    a { color: var(--accent); text-decoration: none; }\n    h1, h2, h3 { font-weight: 700; }\n\n    /* ── Header ── */\n    .header {\n      background: linear-gradient(135deg, #1a0a00 0%, #0f0f0f 60%);\n      border-bottom: 1px solid var(--border);\n      padding: 2rem;\n      display: flex;\n      align-items: center;\n      gap: 2rem;\n    }\n    .header-logo {\n      font-size: 2.5rem;\n      font-weight: 900;\n      background: linear-gradient(135deg, #f97316, #ef4444);\n      -webkit-background-clip: text;\n      -webkit-text-fill-color: transparent;\n      letter-spacing: -1px;\n    }\n    .header-info { flex: 1; }\n    .header-info h1 { font-size: 1.5rem; color: var(--text); }\n    .header-meta { color: var(--text-muted); font-size: 0.85rem; margin-top: 0.25rem; }\n\n    /* ── Score gauge ── */\n    .score-gauge {\n      text-align: center;\n      min-width: 120px;\n    }\n    .score-circle {\n      width: 100px; height: 100px;\n      border-radius: 50%;\n      border: 4px solid ${r};\n      display: flex; flex-direction: column;\n      align-items: center; justify-content: center;\n      margin: 0 auto 0.5rem;\n      box-shadow: 0 0 20px ${r}40;\n    }\n    .score-number { font-size: 2rem; font-weight: 900; color: ${r}; }\n    .score-label-small { font-size: 0.7rem; color: var(--text-muted); }\n    .score-grade { font-size: 0.9rem; font-weight: 700; color: ${r}; }\n\n    /* ── Container ── */\n    .container { max-width: 1200px; margin: 0 auto; padding: 2rem; }\n\n    /* ── Summary cards ── */\n    .cards {\n      display: grid;\n      grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));\n      gap: 1rem;\n      margin-bottom: 2rem;\n    }\n    .card {\n      background: var(--surface);\n      border: 1px solid var(--border);\n      border-radius: 8px;\n      padding: 1.25rem;\n    }\n    .card-value { font-size: 2rem; font-weight: 900; }\n    .card-label { font-size: 0.8rem; color: var(--text-muted); text-transform: uppercase; letter-spacing: 0.05em; margin-top: 0.25rem; }\n    .card.green .card-value { color: var(--green); }\n    .card.red .card-value   { color: var(--red); }\n    .card.amber .card-value { color: var(--amber); }\n    .card.blue .card-value  { color: var(--blue); }\n    .card.purple .card-value{ color: var(--purple); }\n\n    /* ── Sections ── */\n    .section {\n      background: var(--surface);\n      border: 1px solid var(--border);\n      border-radius: 8px;\n      margin-bottom: 1.5rem;\n      overflow: hidden;\n    }\n    .section-header {\n      display: flex; align-items: center; justify-content: space-between;\n      padding: 1rem 1.25rem;\n      border-bottom: 1px solid var(--border);\n      cursor: pointer;\n      user-select: none;\n    }\n    .section-header:hover { background: var(--surface2); }\n    .section-title { font-size: 1rem; font-weight: 700; display: flex; align-items: center; gap: 0.5rem; }\n    .section-badge {\n      font-size: 0.75rem; font-weight: 600;\n      padding: 0.2rem 0.6rem; border-radius: 999px;\n      background: var(--surface2); border: 1px solid var(--border);\n    }\n    .section-badge.pass { background: #052e16; border-color: #16a34a; color: var(--green); }\n    .section-badge.fail { background: #450a0a; border-color: #dc2626; color: var(--red); }\n    .section-body { padding: 1.25rem; }\n\n    /* ── Bar charts ── */\n    .bar-chart { display: flex; flex-direction: column; gap: 0.5rem; }\n    .bar-row { display: flex; align-items: center; gap: 0.75rem; }\n    .bar-label { width: 160px; font-size: 0.85rem; text-align: right; color: var(--text-muted); flex-shrink: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }\n    .bar-track { flex: 1; height: 20px; background: var(--surface2); border-radius: 4px; overflow: hidden; position: relative; }\n    .bar-fill { height: 100%; border-radius: 4px; transition: width 0.4s ease; display: flex; align-items: center; padding-left: 8px; font-size: 0.75rem; font-weight: 600; color: white; }\n    .bar-count { font-size: 0.8rem; color: var(--text-muted); min-width: 60px; }\n\n    /* ── Test table ── */\n    .test-table { width: 100%; border-collapse: collapse; font-size: 0.85rem; }\n    .test-table th {\n      text-align: left; padding: 0.5rem 0.75rem;\n      border-bottom: 1px solid var(--border);\n      color: var(--text-muted); font-weight: 600;\n      text-transform: uppercase; letter-spacing: 0.05em; font-size: 0.75rem;\n    }\n    .test-table td { padding: 0.5rem 0.75rem; border-bottom: 1px solid var(--border); vertical-align: top; }\n    .test-table tr:last-child td { border-bottom: none; }\n    .test-table tr:hover td { background: var(--surface2); }\n    .pass-icon { color: var(--green); font-weight: 700; }\n    .fail-icon { color: var(--red); font-weight: 700; }\n    .warn-icon { color: var(--amber); font-weight: 700; }\n    .badge {\n      display: inline-block; font-size: 0.7rem; font-weight: 600;\n      padding: 0.1rem 0.4rem; border-radius: 4px; margin: 0 0.1rem;\n    }\n    .badge-critical { background: #450a0a; color: #fca5a5; border: 1px solid #ef4444; }\n    .badge-high     { background: #431407; color: #fdba74; border: 1px solid #f97316; }\n    .badge-medium   { background: #422006; color: #fcd34d; border: 1px solid #f59e0b; }\n    .badge-category { background: #1e1b4b; color: #a5b4fc; border: 1px solid #6366f1; }\n    .badge-lang     { background: #052e16; color: #86efac; border: 1px solid #22c55e; }\n\n    /* ── Golden comparison ── */\n    .regression { background: #450a0a; border: 1px solid var(--red); border-radius: 6px; padding: 1rem; margin-top: 1rem; }\n    .improvement { background: #052e16; border: 1px solid var(--green); border-radius: 6px; padding: 1rem; margin-top: 1rem; }\n    .neutral { background: var(--surface2); border: 1px solid var(--border); border-radius: 6px; padding: 1rem; margin-top: 1rem; }\n\n    /* ── Collapse toggle ── */\n    .chevron { transition: transform 0.2s; }\n    .collapsed .chevron { transform: rotate(-90deg); }\n    .collapsible-body { display: block; }\n    .collapsed .collapsible-body { display: none; }\n\n    /* ── Responsive ── */\n    @media (max-width: 768px) {\n      .header { flex-direction: column; text-align: center; }\n      .bar-label { width: 100px; }\n    }\n\n    /* ── Footer ── */\n    .footer {\n      text-align: center;\n      padding: 2rem;\n      color: var(--text-muted);\n      font-size: 0.8rem;\n      border-top: 1px solid var(--border);\n    }\n  </style>\n</head>\n<body>\n\n<div class="header">\n  <div class="header-logo">&#x1F525; CRUCIBLE</div>\n  <div class="header-info">\n    <h1>${esc(t)}</h1>\n    <div class="header-meta">\n      Level: <strong>${esc(s)}</strong> &nbsp;|&nbsp;\n      Generated: <strong>${esc(new Date(n).toLocaleString())}</strong> &nbsp;|&nbsp;\n      Branch: <strong>kenny-mode</strong> &nbsp;|&nbsp;\n      Scanner: <strong>v${esc(getScannerVersion())}</strong>\n    </div>\n  </div>\n  <div class="score-gauge">\n    <div class="score-circle">\n      <div class="score-number">${a}</div>\n      <div class="score-label-small">/ 100</div>\n    </div>\n    <div class="score-grade">${esc(o)}</div>\n    <div class="score-label-small">Crucible Score</div>\n  </div>\n</div>\n\n<div class="container">\n  ${buildSummaryCards(e,a)}\n  ${p}\n  ${u}\n  ${d}\n  ${i}\n  ${l}\n  ${c}\n</div>\n\n<div class="footer">\n  Generated by <strong>Thuban Crucible</strong> &mdash; The Fire Test for Security Scanners\n</div>\n\n<script>\n  // Collapsible sections\n  document.querySelectorAll('.section-header').forEach(h => {\n    h.addEventListener('click', () => {\n      h.closest('.section').classList.toggle('collapsed');\n    });\n  });\n<\/script>\n</body>\n</html>`}function buildSummaryCards(e,t){const n=e.seedResults||{},s=e.mutationResults||{},a=e.kennyResults||{},r=n.total>0?Math.round(n.detected/n.total*100):null,o=s.total>0?Math.round(s.killed/s.total*100):null,d=[];return n.total&&(d.push(`<div class="card ${r>=70?"green":"red"}">\n      <div class="card-value">${r}%</div>\n      <div class="card-label">Seed Detection Rate</div>\n    </div>`),d.push(`<div class="card blue">\n      <div class="card-value">${n.total}</div>\n      <div class="card-label">Seeds Tested</div>\n    </div>`)),s.total&&d.push(`<div class="card ${o>=70?"green":"amber"}">\n      <div class="card-value">${o}%</div>\n      <div class="card-label">Mutation Kill Rate</div>\n    </div>`),void 0!==a.score&&d.push(`<div class="card ${a.score>=70?"green":"amber"}">\n      <div class="card-value">${a.score}</div>\n      <div class="card-label">Kenny Score</div>\n    </div>`),d.push(`<div class="card purple">\n    <div class="card-value">${t}</div>\n    <div class="card-label">Crucible Score</div>\n  </div>`),`<div class="cards">${d.join("")}</div>`}function buildSeedSection(e){if(!e)return"";const t=e.total||0,n=e.detected||0,s=e.missed||0,a=e.byLanguage||{},r=e.byCategory||{},o=Object.entries(a).sort(([,e],[,t])=>t.detected/t.total-e.detected/e.total).map(([e,t])=>{const n=t.total>0?Math.round(t.detected/t.total*100):0,s=n>=70?"#22c55e":n>=50?"#f59e0b":"#ef4444";return`<div class="bar-row">\n        <div class="bar-label">${esc(e)}</div>\n        <div class="bar-track">\n          <div class="bar-fill" style="width:${n}%; background:${s}">${n}%</div>\n        </div>\n        <div class="bar-count">${t.detected}/${t.total}</div>\n      </div>`}).join(""),d=Object.entries(r).sort(([,e],[,t])=>t.detected/t.total-e.detected/e.total).map(([e,t])=>{const n=t.total>0?Math.round(t.detected/t.total*100):0,s=n>=70?"#22c55e":n>=50?"#f59e0b":"#ef4444";return`<div class="bar-row">\n        <div class="bar-label">${esc(e)}</div>\n        <div class="bar-track">\n          <div class="bar-fill" style="width:${n}%; background:${s}">${n}%</div>\n        </div>\n        <div class="bar-count">${t.detected}/${t.total}</div>\n      </div>`}).join(""),i=0===s?'<span class="section-badge pass">All seeds detected</span>':`<span class="section-badge fail">${s} missed</span>`,l=(e.tests||[]).slice(0,200).map(e=>`<tr>\n    <td><span class="${e.detected?"pass-icon":"fail-icon"}">${e.detected?"✓":"✗"}</span></td>\n    <td><code>${esc(e.id)}</code></td>\n    <td><span class="badge badge-lang">${esc(e.language)}</span></td>\n    <td><span class="badge badge-category">${esc(e.category)}</span></td>\n    <td><span class="badge badge-${esc((e.severity||"medium").toLowerCase())}">${esc(e.severity)}</span></td>\n    <td style="color:var(--text-muted);font-size:0.8rem">${esc(e.expected)}</td>\n  </tr>`).join("");return`\n<div class="section" id="seed-section">\n  <div class="section-header">\n    <div class="section-title">&#127807; Seed Results <span style="color:var(--text-muted);font-weight:400;font-size:0.9rem">${n}/${t} detected</span></div>\n    ${i}\n    <span class="chevron">&#8964;</span>\n  </div>\n  <div class="collapsible-body section-body">\n    <div style="display:grid;grid-template-columns:1fr 1fr;gap:2rem;margin-bottom:1.5rem">\n      <div>\n        <h3 style="margin-bottom:0.75rem;font-size:0.9rem;color:var(--text-muted);text-transform:uppercase;letter-spacing:0.05em">By Language</h3>\n        <div class="bar-chart">${o||'<div style="color:var(--text-muted)">No data</div>'}</div>\n      </div>\n      <div>\n        <h3 style="margin-bottom:0.75rem;font-size:0.9rem;color:var(--text-muted);text-transform:uppercase;letter-spacing:0.05em">By Category</h3>\n        <div class="bar-chart">${d||'<div style="color:var(--text-muted)">No data</div>'}</div>\n      </div>\n    </div>\n    ${l?`\n    <table class="test-table">\n      <thead><tr>\n        <th></th><th>Seed</th><th>Lang</th><th>Category</th><th>Severity</th><th>Expected</th>\n      </tr></thead>\n      <tbody>${l}</tbody>\n    </table>`:""}\n  </div>\n</div>`}function buildMutationSection(e){if(!e)return"";const t=e.total||0,n=e.killed||0,s=e.survived||0,a=t>0?Math.round(n/t*100):0,r=a>=70?"#22c55e":a>=50?"#f59e0b":"#ef4444",o=(e.tests||[]).slice(0,100).map(e=>`<tr>\n    <td><span class="${e.killed?"pass-icon":"fail-icon"}">${e.killed?"✓":"✗"}</span></td>\n    <td><code>${esc(e.seedId)}</code></td>\n    <td>${(e.applied||[]).map(e=>`<span class="badge badge-category">${esc(e)}</span>`).join(" ")}</td>\n    <td><span class="${e.killed?"pass-icon":"fail-icon"}" style="font-size:0.85rem">${e.killed?"Killed":"Survived"}</span></td>\n  </tr>`).join("");return`\n<div class="section" id="mutation-section">\n  <div class="section-header">\n    <div class="section-title">&#129516; Mutation Kill Rate <span style="color:${r};margin-left:0.5rem">${a}%</span></div>\n    <span class="section-badge ${a>=70?"pass":"fail"}">${n}/${t} killed</span>\n    <span class="chevron">&#8964;</span>\n  </div>\n  <div class="collapsible-body section-body">\n    <div class="bar-chart" style="margin-bottom:1rem">\n      <div class="bar-row">\n        <div class="bar-label">Kill Rate</div>\n        <div class="bar-track">\n          <div class="bar-fill" style="width:${a}%; background:${r}">${a}%</div>\n        </div>\n        <div class="bar-count">${n}/${t}</div>\n      </div>\n      <div class="bar-row">\n        <div class="bar-label">Survival Rate</div>\n        <div class="bar-track">\n          <div class="bar-fill" style="width:${t>0?Math.round(s/t*100):0}%; background:#ef4444">${t>0?Math.round(s/t*100):0}%</div>\n        </div>\n        <div class="bar-count">${s}/${t}</div>\n      </div>\n    </div>\n    ${o?`\n    <table class="test-table">\n      <thead><tr><th></th><th>Seed</th><th>Mutations Applied</th><th>Result</th></tr></thead>\n      <tbody>${o}</tbody>\n    </table>`:""}\n  </div>\n</div>`}function buildKennySection(e){if(!e)return"";const t=e.score||0,n=e.total||0,s=e.passed||0,a=(e.failed,scoreColor(t)),r=Object.entries(e.batteries||{}).map(([e,t])=>{const n=t.total>0?Math.round(t.passed/t.total*100):0,s=n>=70?"#22c55e":n>=50?"#f59e0b":"#ef4444";return`<div class="bar-row">\n      <div class="bar-label">${esc(e)}</div>\n      <div class="bar-track">\n        <div class="bar-fill" style="width:${n}%; background:${s}">${n}%</div>\n      </div>\n      <div class="bar-count">${t.passed}/${t.total}</div>\n    </div>`}).join(""),o=(e.tests||[]).map(e=>{const t=(e.missingDetections||[]).map(e=>`<span class="badge badge-category">${esc(e)}</span>`).join(" "),n=(e.falsePositives||[]).map(e=>`<span class="badge badge-high">${esc(e)}</span>`).join(" ");return`<tr>\n      <td><span class="${e.passed?"pass-icon":e.crashed||e.timedOut?"warn-icon":"fail-icon"}">${e.passed?"✓":e.crashed?"⚡":e.timedOut?"⏱":"✗"}</span></td>\n      <td style="font-size:0.8rem;color:var(--text-muted)">${esc(e.id)}</td>\n      <td>${esc(e.name)}</td>\n      <td><span class="badge badge-lang">${esc(e.battery)}</span></td>\n      <td>${t||n||'<span style="color:var(--text-muted)">—</span>'}</td>\n    </tr>`}).join("");return`\n<div class="section" id="kenny-section">\n  <div class="section-header">\n    <div class="section-title">&#128293; Kenny Mode <span style="color:${a};margin-left:0.5rem">${t}/100</span></div>\n    <span class="section-badge ${t>=70?"pass":"fail"}">${s}/${n} passed</span>\n    <span class="chevron">&#8964;</span>\n  </div>\n  <div class="collapsible-body section-body">\n    <div class="bar-chart" style="margin-bottom:1.5rem">\n      ${r||'<div style="color:var(--text-muted)">No battery data</div>'}\n    </div>\n    ${o?`\n    <table class="test-table">\n      <thead><tr><th></th><th>ID</th><th>Test</th><th>Battery</th><th>Issues</th></tr></thead>\n      <tbody>${o}</tbody>\n    </table>`:""}\n  </div>\n</div>`}function buildSelfAttackSection(e){if(!e)return"";const t=e.score||0,n=(e.crashes||[]).length,s=(e.hangs||[]).length,a=(e.missedDetections||[]).length,r=(e.passed||[]).length,o=scoreColor(t),d=(e.crashes||[]).map(e=>`<tr>\n    <td><span class="fail-icon">⚡</span></td>\n    <td><code>${esc(e.payload)}</code></td>\n    <td>${esc(e.description)}</td>\n    <td style="color:var(--red)">${esc(e.error||"")}</td>\n  </tr>`).join(""),i=(e.hangs||[]).map(e=>`<tr>\n    <td><span class="warn-icon">⏱</span></td>\n    <td><code>${esc(e.payload)}</code></td>\n    <td>${esc(e.description)}</td>\n    <td style="color:var(--amber)">Timed out after ${e.timeout}ms</td>\n  </tr>`).join(""),l=(e.passed||[]).map(e=>`<tr>\n    <td><span class="pass-icon">✓</span></td>\n    <td><code>${esc(e.payload)}</code></td>\n    <td colspan="2">${esc(e.description)}</td>\n  </tr>`).join("");return`\n<div class="section" id="self-attack-section">\n  <div class="section-header">\n    <div class="section-title">&#128481; Self-Attack <span style="color:${o};margin-left:0.5rem">${t}/100</span></div>\n    <span class="section-badge ${n+s===0?"pass":"fail"}">${n} crash, ${s} hang, ${a} missed</span>\n    <span class="chevron">&#8964;</span>\n  </div>\n  <div class="collapsible-body section-body">\n    ${n+s+a+r>0?`\n    <table class="test-table">\n      <thead><tr><th></th><th>Payload</th><th>Description</th><th>Details</th></tr></thead>\n      <tbody>\n        ${d}\n        ${i}\n        ${l}\n      </tbody>\n    </table>`:'<div style="color:var(--text-muted)">No self-attack results</div>'}\n  </div>\n</div>`}function buildGoldenSection(e){if(!e||!e.hasMaster)return"";const t=e.passed?"improvement":"regression",n=e.passed?"✓":"✗",s=(e.lostDetections||[]).map(e=>`<div style="color:var(--red);font-size:0.85rem">&#8722; ${esc(e)}</div>`).join(""),a=(e.newDetections||[]).map(e=>`<div style="color:var(--green);font-size:0.85rem">&#43; ${esc(e)}</div>`).join("");return`\n<div class="section" id="golden-section">\n  <div class="section-header">\n    <div class="section-title">&#127775; Golden Master Comparison</div>\n    <span class="section-badge ${e.passed?"pass":"fail"}">${e.passed?"No regressions":`${e.regressions} regression(s)`}</span>\n    <span class="chevron">&#8964;</span>\n  </div>\n  <div class="collapsible-body section-body">\n    <div class="${t}">\n      <strong>${n} ${esc(e.summary)}</strong>\n      <div style="margin-top:0.5rem;color:var(--text-muted);font-size:0.85rem">\n        Golden from: ${esc(e.goldenTimestamp||"unknown")} &nbsp;|&nbsp;\n        Previous score: ${null!=e.goldenScore?e.goldenScore:"N/A"}\n      </div>\n    </div>\n    ${s?`<div style="margin-top:1rem"><strong style="color:var(--red)">Regressions (lost detections):</strong>${s}</div>`:""}\n    ${a?`<div style="margin-top:1rem"><strong style="color:var(--green)">Improvements (new detections):</strong>${a}</div>`:""}\n  </div>\n</div>`}function buildDivergenceSection(e){if(!e||!e.sampled)return"";const t=null!=e.agreementRate?e.agreementRate:0,n=t>=95?"#22c55e":t>=80?"#f59e0b":"#ef4444",s=(e.divergences||[]).length,a=(e.divergences||[]).map(e=>`<tr>\n    <td><span class="warn-icon">⚠</span></td>\n    <td><code>${esc(e.seedId)}</code></td>\n    <td><span class="badge badge-lang">${esc(e.language)}</span></td>\n    <td><span class="badge badge-category">${esc(e.category)}</span></td>\n    <td style="font-size:0.8rem;color:var(--text-muted)">${esc(e.phase)}</td>\n    <td style="font-size:0.8rem">${esc(JSON.stringify(e.heuristicCategories))}</td>\n    <td style="font-size:0.8rem">${esc(JSON.stringify(e.productionCategories))}</td>\n  </tr>`).join("");return`\n<div class="section" id="divergence-section">\n  <div class="section-header">\n    <div class="section-title">&#128269; Heuristic-CLI Agreement <span style="color:${n};margin-left:0.5rem">${t}%</span></div>\n    <span class="section-badge ${0===s?"pass":"fail"}">${0===s?"No divergences":`${s} divergence(s)`}</span>\n    <span class="chevron">&#8964;</span>\n  </div>\n  <div class="collapsible-body section-body">\n    <div style="color:var(--text-muted);font-size:0.85rem;margin-bottom:1rem">\n      Randomly sampled ${Math.round(100*e.sampleRate)}% of seeds where the fast heuristic\n      (<code>_simulateScan()</code>) reported "detected", then cross-checked against the real\n      production scanner (CodeScanner + HallucinationDetector). Agreement: <strong>${t}%</strong>\n      on ${e.sampled} sampled seed(s). This never affects the headline Crucible score.\n    </div>\n    ${a?`\n    <table class="test-table">\n      <thead><tr><th></th><th>Seed</th><th>Lang</th><th>Category</th><th>Phase</th><th>Heuristic</th><th>Production</th></tr></thead>\n      <tbody>${a}</tbody>\n    </table>`:""}\n  </div>\n</div>`}class ReportGenerator{constructor(e={}){this.outputDir=path.resolve(e.outputDir||process.cwd())}generate(e,t={}){const n=(e.timestamp||(new Date).toISOString()).replace(/[:.]/g,"-").slice(0,19),s=t.filename||`crucible-report-${n}.html`,a=path.basename(s),r=path.join(this.outputDir,a),o=generateHTML(e);return fs.writeFileSync(r,o,"utf-8"),r}generateJSON(e,t={}){const n=e.timestamp||(new Date).toISOString(),s=n.replace(/[:.]/g,"-").slice(0,19),a=t.filename||`crucible-report-${s}.json`,r=path.basename(a),o=path.join(this.outputDir,r),d="number"==typeof e.score?e.score:calculateCrucibleScore(e),i={timestamp:n,score:d,scoreLabel:scoreLabel(d),scannerVersion:getScannerVersion(),level:e.level||"medium",seeds:e.seedResults?{total:e.seedResults.total,detected:e.seedResults.detected,missed:e.seedResults.missed,rate:e.seedResults.total>0?Math.round(e.seedResults.detected/e.seedResults.total*100):null}:null,mutations:e.mutationResults?{total:e.mutationResults.total,killed:e.mutationResults.killed,survived:e.mutationResults.survived,killRate:e.mutationResults.total>0?Math.round(e.mutationResults.killed/e.mutationResults.total*100):null}:null,kenny:e.kennyResults?{score:e.kennyResults.score,passed:e.kennyResults.passed,total:e.kennyResults.total}:null,selfAttack:e.selfAttackResults?{score:e.selfAttackResults.score}:null,golden:e.goldenComparison?{passed:e.goldenComparison.passed,regressions:e.goldenComparison.regressions}:null,divergence:e.divergenceStats&&e.divergenceStats.sampled?{sampleRate:e.divergenceStats.sampleRate,sampled:e.divergenceStats.sampled,agreements:e.divergenceStats.agreements,agreementRate:e.divergenceStats.agreementRate,divergences:e.divergenceStats.divergences}:null};return fs.writeFileSync(o,JSON.stringify(i,null,2),"utf-8"),o}}module.exports={ReportGenerator:ReportGenerator,generateHTML:generateHTML,calculateCrucibleScore:calculateCrucibleScore,scoreColor:scoreColor,scoreLabel:scoreLabel,getScannerVersion:getScannerVersion};

package/dist/packages/crucible/rule-loader.js

@@ -0,0 +1 @@
+"use strict";const fs=require("fs"),path=require("path"),RULES_DIR=path.join(__dirname,"rules"),MAX_PATTERN_LENGTH=500,MAX_QUANTIFIERS=20,MAX_ALTERNATIONS=30;function _checkRegexComplexity(e){if("string"!=typeof e||!e)return{safe:!1,reason:"pattern must be a non-empty string"};if(e.length>500)return{safe:!1,reason:"pattern exceeds max length of 500"};let t=0,n=0;const r=[];for(let a=0;a<e.length;a++){const s=e[a];if("\\"!==s)if("("!==s){if(")"===s){const n=r.pop();if(!n)continue;const s=/^\{\d+(,\d*)?\}/.exec(e.slice(a+1)),i=e[a+1];if("+"===i||"*"===i||"?"===i||s){if(t++,n.hasQuantifier||n.hasAlternation)return{safe:!1,reason:"nested quantifier detected (potential catastrophic backtracking)"};r.length>0&&(r[r.length-1].hasQuantifier=!0)}continue}if("+"!==s&&"*"!==s&&"?"!==s){if("{"===s){/^\{\d+(,\d*)?\}/.exec(e.slice(a))&&(t++,r.length>0&&(r[r.length-1].hasQuantifier=!0));continue}"|"!==s||(n++,r.length>0&&(r[r.length-1].hasAlternation=!0))}else t++,r.length>0&&(r[r.length-1].hasQuantifier=!0)}else r.push({hasQuantifier:!1,hasAlternation:!1});else a++}return t>20?{safe:!1,reason:`pattern has ${t} quantifiers, exceeding max of 20`}:n>30?{safe:!1,reason:`pattern has ${n} alternations, exceeding max of 30`}:{safe:!0,reason:null}}let _compiledPatterns=null;function getPatterns(){if(_compiledPatterns)return _compiledPatterns;const e=fs.readdirSync(RULES_DIR).filter(e=>e.endsWith(".json")).sort(),t=[];for(const n of e){const e=path.join(RULES_DIR,n);let r;try{const t=fs.readFileSync(e,"utf-8");r=JSON.parse(t)}catch(e){throw new Error(`[rule-loader] Failed to read/parse rule file "${n}": ${e.message}`)}if(!Array.isArray(r))throw new Error(`[rule-loader] Rule file "${n}" must export a JSON array, got: ${typeof r}`);for(const e of r){if(e.pattern){const t=_checkRegexComplexity(e.pattern);if(!t.safe){console.warn(`[rule-loader] WARNING: Skipping rule "${e.id}" in "${n}" — ${t.reason}`);continue}}let r,a;try{r=new RegExp(e.pattern,e.flags||"")}catch(t){throw new Error(`[rule-loader] Failed to compile rule "${e&&e.id}" in file "${n}": ${t.message}\n  pattern: ${e&&e.pattern}\n  flags:   ${e&&e.flags}`)}if(e.context)try{a=new RegExp(e.context,e.contextFlags||"")}catch(t){throw new Error(`[rule-loader] Failed to compile context for rule "${e&&e.id}" in file "${n}": ${t.message}`)}t.push({regex:r,category:e.category,id:e.id,description:e.description,language:e.language,severity:e.severity,name:e.name,type:e.type,message:e.message,context:a,skipIfSafe:e.skipIfSafe,skipInTests:e.skipInTests,sourceFile:n})}}return _compiledPatterns=t,_compiledPatterns}function getCodeScannerPatterns(){return getPatterns().filter(e=>"code-scanner-core.json"===e.sourceFile).map(e=>{const t={id:e.id,name:e.name,type:e.type,pattern:e.regex,severity:e.severity,message:e.message};return e.context&&(t.context=e.context),e.skipIfSafe&&(t.skipIfSafe=!0),e.skipInTests&&(t.skipInTests=!0),t})}module.exports={getPatterns:getPatterns,getCodeScannerPatterns:getCodeScannerPatterns};

package/dist/packages/crucible/seeding-engine.js

@@ -0,0 +1 @@
+"use strict";const fs=require("fs"),path=require("path");function mulberry32(e){let t=e>>>0;return function(){t|=0,t=t+1831565813|0;let e=Math.imul(t^t>>>15,1|t);return e=e+Math.imul(e^e>>>7,61|e)^e,((e^e>>>14)>>>0)/4294967296}}const LANG_DIR_MAP={javascript:"js",js:"js",typescript:"ts",ts:"ts",python:"python",py:"python",java:"java",csharp:"csharp",cs:"csharp",go:"go",golang:"go",kotlin:"kotlin",kt:"kotlin",rust:"rust",rs:"rust",php:"php",ruby:"ruby",rb:"ruby"},ALL_LANGUAGES=["js","ts","python","java","csharp","go","kotlin","rust","php","ruby"];function parseSeedHeader(e){const t=e.split("\n").slice(0,20),s={};let r=!1;for(const e of t){const t=e.trim().replace(/^\/\/\s*/,"").replace(/^#\s*/,"").replace(/^\*\s*/,"");if("[CRUCIBLE-SEED]"===t){r=!0;continue}if(!r)continue;const a=t.match(/^(category|severity|language|expected):\s*(.+)$/);if(a&&(s[a[1]]=a[2].trim()),Object.keys(s).length>=4)break}return Object.keys(s).length>=3?s:null}class SeedingEngine{constructor(e={}){this.seedsDir=e.seedsDir||path.join(__dirname,"seeds"),this.prngseed="number"==typeof e.prngseed?e.prngseed:42,this._byLanguage=new Map,this._byCategory=new Map,this._all=[],this._loaded=!1}load(){if(this._loaded)return this._all.length;if(!fs.existsSync(this.seedsDir))throw new Error(`Seeds directory not found: ${this.seedsDir}`);const e=fs.readdirSync(this.seedsDir,{withFileTypes:!0}).filter(e=>e.isDirectory()).map(e=>e.name);for(const t of e){const e=path.join(this.seedsDir,t),s=fs.readdirSync(e).filter(e=>/\.(js|ts|py|java|cs|go|kt|rs|php|rb)$/.test(e)).sort();for(const r of s){const s=path.join(e,r);let a;try{a=fs.readFileSync(s,"utf-8")}catch{continue}const n=parseSeedHeader(a),i={id:`${t}/${r}`,file:s,langDir:t,filename:r,content:a,category:n?.category||"unknown",severity:n?.severity||"medium",language:n?.language||t,expected:n?.expected||""};this._all.push(i),this._byLanguage.has(t)||this._byLanguage.set(t,[]),this._byLanguage.get(t).push(i);const o=i.category;this._byCategory.has(o)||this._byCategory.set(o,[]),this._byCategory.get(o).push(i)}}return this._loaded=!0,this._all.length}get languages(){return this.load(),Array.from(this._byLanguage.keys()).sort()}get categories(){return this.load(),Array.from(this._byCategory.keys()).sort()}get count(){return this.load(),this._all.length}forLanguage(e){this.load();const t=LANG_DIR_MAP[e.toLowerCase()]||e.toLowerCase();return this._byLanguage.get(t)||[]}forCategory(e){return this.load(),this._byCategory.get(e)||[]}forLanguageAndCategory(e,t){return this.load(),this.forLanguage(e).filter(e=>e.category===t)}createPRNG(){return mulberry32(this.prngseed)}_shuffle(e,t){for(let s=e.length-1;s>0;s--){const r=Math.floor(t()*(s+1));[e[s],e[r]]=[e[r],e[s]]}return e}sample(e,t){const s=this.createPRNG(),r=e.slice();return this._shuffle(r,s),r.slice(0,t)}selectForLevel(e,t={}){this.load();let s=this._all.slice();if(t.languages&&t.languages.length){const e=t.languages.map(e=>LANG_DIR_MAP[e.toLowerCase()]||e.toLowerCase());s=s.filter(t=>e.includes(t.langDir))}t.categories&&t.categories.length&&(s=s.filter(e=>t.categories.includes(e.category)));const r=this.createPRNG(),a=s.slice();switch(this._shuffle(a,r),e){case"gentle":default:return a.slice(0,50);case"medium":return a.slice(0,200);case"hell":return a}}stats(){this.load();const e={};for(const[t,s]of this._byLanguage)e[t]=s.length;const t={};for(const[e,s]of this._byCategory)t[e]=s.length;const s={critical:0,high:0,medium:0,low:0};for(const e of this._all){const t=(e.severity||"medium").toLowerCase();s[t]=(s[t]||0)+1}return{total:this._all.length,byLanguage:e,byCategory:t,bySeverity:s}}}module.exports={SeedingEngine:SeedingEngine,mulberry32:mulberry32,parseSeedHeader:parseSeedHeader,ALL_LANGUAGES:ALL_LANGUAGES,LANG_DIR_MAP:LANG_DIR_MAP};

package/dist/packages/crucible/seeds/csharp/seed-001.cs

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: csharp
+// expected: Hardcoded SQL Server connection string with plaintext password
+
+using System.Data.SqlClient;
+
+namespace App.Data
+{
+    public class DatabaseConfig
+    {
+        private const string ConnectionString =
+            "Server=prod-sql.internal;Database=AppDb;User Id=sa;Password=Pr0dS@P@ssw0rd!;";
+
+        public static SqlConnection GetConnection()
+        {
+            return new SqlConnection(ConnectionString);
+        }
+
+        public static void TestConnection()
+        {
+            using var conn = GetConnection();
+            conn.Open();
+            System.Console.WriteLine("Connected to: " + conn.DataSource);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-002.cs

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: csharp
+// expected: Hardcoded AWS credentials stored as string constants
+
+using Amazon;
+using Amazon.S3;
+using Amazon.Runtime;
+
+namespace App.Cloud
+{
+    public class AwsClientFactory
+    {
+        private const string AccessKeyId     = "AKIAIOSFODNN7EXAMPLE";
+        private const string SecretAccessKey = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";
+
+        public static AmazonS3Client CreateS3Client()
+        {
+            var credentials = new BasicAWSCredentials(AccessKeyId, SecretAccessKey);
+            return new AmazonS3Client(credentials, RegionEndpoint.USEast1);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-003.cs

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: csharp
+// expected: Hardcoded JWT signing key embedded in authentication middleware
+
+using Microsoft.IdentityModel.Tokens;
+using System.IdentityModel.Tokens.Jwt;
+using System.Text;
+
+namespace App.Auth
+{
+    public class JwtService
+    {
+        // Vulnerable: secret hardcoded — should come from configuration/vault
+        private const string SigningKey = "my-256-bit-super-secret-jwt-key!!";
+
+        public string GenerateToken(string userId)
+        {
+            var key   = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(SigningKey));
+            var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
+            var token = new JwtSecurityToken(
+                issuer:   "myapp",
+                audience: "myapp-users",
+                expires:  System.DateTime.UtcNow.AddHours(24),
+                signingCredentials: creds);
+            return new JwtSecurityTokenHandler().WriteToken(token);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-004.cs

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: csharp
+// expected: Hardcoded Stripe secret key used for payment processing
+
+using Stripe;
+
+namespace App.Payments
+{
+    public class PaymentService
+    {
+        private const string StripeSecretKey = "sk_live_51HqT4vKZ3VpNm8Yw9fX2rLcD";
+
+        public PaymentService()
+        {
+            StripeConfiguration.ApiKey = StripeSecretKey;
+        }
+
+        public Charge CreateCharge(string token, long amountCents)
+        {
+            var options = new ChargeCreateOptions
+            {
+                Amount   = amountCents,
+                Currency = "usd",
+                Source   = token
+            };
+            return new ChargeService().Create(options);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-005.cs

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: csharp
+// expected: Hardcoded Azure Storage connection string containing account key
+
+using Azure.Storage.Blobs;
+
+namespace App.Storage
+{
+    public class BlobStorageService
+    {
+        private const string AzureStorageConnectionString =
+            "DefaultEndpointsProtocol=https;AccountName=prodstorageacct;" +
+            "AccountKey=dGhpcyBpcyBhIGZha2Uga2V5IGZvciBkZW1vIHB1cnBvc2VzIG9ubHkh;" +
+            "EndpointSuffix=core.windows.net";
+
+        private readonly BlobServiceClient _client;
+
+        public BlobStorageService()
+        {
+            _client = new BlobServiceClient(AzureStorageConnectionString);
+        }
+
+        public BlobContainerClient GetContainer(string name)
+            => _client.GetBlobContainerClient(name);
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-006.cs

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: csharp
+// expected: Hardcoded SendGrid API key for email sending
+
+using SendGrid;
+using SendGrid.Helpers.Mail;
+
+namespace App.Notifications
+{
+    public class EmailService
+    {
+        private const string SendGridApiKey = "SG.aBcDeFgHiJkLmNoPqRsTuVwXyZ.0123456789abcdefghijklmno";
+
+        public async System.Threading.Tasks.Task SendAsync(string to, string subject, string body)
+        {
+            var client  = new SendGridClient(SendGridApiKey);
+            var from    = new EmailAddress("noreply@company.com", "Company");
+            var toAddr  = new EmailAddress(to);
+            var msg     = MailHelper.CreateSingleEmail(from, toAddr, subject, body, body);
+            await client.SendEmailAsync(msg);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-007.cs

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: csharp
+// expected: Hardcoded encryption key and IV stored as byte array constants
+
+using System.Security.Cryptography;
+
+namespace App.Security
+{
+    public class DataEncryptor
+    {
+        // Vulnerable: hardcoded AES key and IV in source code
+        private static readonly byte[] AesKey = new byte[]
+        {
+            0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
+            0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c
+        };
+        private static readonly byte[] AesIv = new byte[]
+        {
+            0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+            0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
+        };
+
+        public static byte[] Encrypt(byte[] data)
+        {
+            using var aes = Aes.Create();
+            aes.Key = AesKey;
+            aes.IV  = AesIv;
+            using var enc = aes.CreateEncryptor();
+            return enc.TransformFinalBlock(data, 0, data.Length);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-008.cs

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: csharp
+// expected: Hardcoded GitHub PAT and Slack webhook URL in integration service
+
+namespace App.Integrations
+{
+    public class IntegrationConfig
+    {
+        public const string GitHubToken       = "ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ012345";
+        public const string SlackWebhookUrl   = "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX";
+        public const string PagerDutyApiKey   = "pdkey-u-AbCdEfGhIjKlMnOpQrStUv";
+
+        public static System.Net.Http.HttpClient CreateGitHubClient()
+        {
+            var client = new System.Net.Http.HttpClient();
+            client.DefaultRequestHeaders.Add("Authorization", $"token {GitHubToken}");
+            client.DefaultRequestHeaders.Add("User-Agent", "MyApp/1.0");
+            return client;
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-009.cs

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: csharp
+// expected: SQL injection via string concatenation in SqlCommand
+
+using System.Data.SqlClient;
+
+namespace App.Data
+{
+    public class UserRepository
+    {
+        private readonly string _connectionString;
+
+        public UserRepository(string connectionString) => _connectionString = connectionString;
+
+        public SqlDataReader FindByUsername(string username)
+        {
+            var conn = new SqlConnection(_connectionString);
+            conn.Open();
+            // Vulnerable: direct string concatenation into SQL
+            var cmd = new SqlCommand(
+                "SELECT * FROM Users WHERE Username = '" + username + "'", conn);
+            return cmd.ExecuteReader();
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-010.cs

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: csharp
+// expected: SQL injection via string.Format building WHERE clause
+
+using System;
+using System.Data.SqlClient;
+
+namespace App.Data
+{
+    public class ProductSearch
+    {
+        private readonly string _conn;
+
+        public ProductSearch(string conn) => _conn = conn;
+
+        public SqlDataReader Search(string keyword, string category)
+        {
+            // Vulnerable: string.Format with unsanitized inputs
+            string sql = string.Format(
+                "SELECT * FROM Products WHERE Name LIKE '%{0}%' AND Category = '{1}'",
+                keyword, category);
+            var connection = new SqlConnection(_conn);
+            connection.Open();
+            return new SqlCommand(sql, connection).ExecuteReader();
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-011.cs

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: csharp
+// expected: SQL injection in login via string interpolation in SqlCommand
+
+using System.Data.SqlClient;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class AuthController : ControllerBase
+    {
+        private readonly string _conn;
+
+        public AuthController(string conn) => _conn = conn;
+
+        [HttpPost("login")]
+        public IActionResult Login(string username, string password)
+        {
+            // Vulnerable: C# interpolated string injected into SQL
+            string sql = $"SELECT Id FROM Users WHERE Username='{username}' AND Password='{password}'";
+            using var connection = new SqlConnection(_conn);
+            connection.Open();
+            using var cmd = new SqlCommand(sql, connection);
+            var result = cmd.ExecuteScalar();
+            return result != null ? Ok("Authenticated") : Unauthorized();
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-012.cs

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: csharp
+// expected: SQL injection via dynamic ORDER BY column from user input
+
+using System.Data.SqlClient;
+
+namespace App.Data
+{
+    public class ReportRepository
+    {
+        private readonly string _conn;
+
+        public ReportRepository(string conn) => _conn = conn;
+
+        public SqlDataReader GetSortedReport(string tableName, string sortColumn, string sortDir)
+        {
+            // Vulnerable: all three parameters injected without validation
+            string sql = "SELECT * FROM " + tableName +
+                         " ORDER BY " + sortColumn + " " + sortDir;
+            var connection = new SqlConnection(_conn);
+            connection.Open();
+            return new SqlCommand(sql, connection).ExecuteReader();
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-013.cs

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: csharp
+// expected: SQL injection in stored procedure exec via string concatenation
+
+using System.Data;
+using System.Data.SqlClient;
+
+namespace App.Data
+{
+    public class AuditService
+    {
+        private readonly string _conn;
+
+        public AuditService(string conn) => _conn = conn;
+
+        public void LogEvent(string userId, string action)
+        {
+            // Vulnerable: building EXEC string manually
+            string sql = "EXEC sp_RecordAudit '" + userId + "', '" + action + "'";
+            using var connection = new SqlConnection(_conn);
+            connection.Open();
+            new SqlCommand(sql, connection).ExecuteNonQuery();
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-014.cs

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: csharp
+// expected: SQL injection via string concatenation in WHERE IN clause
+
+using System.Data.SqlClient;
+
+namespace App.Data
+{
+    public class BatchOrderService
+    {
+        private readonly string _conn;
+
+        public BatchOrderService(string conn) => _conn = conn;
+
+        public SqlDataReader GetOrdersByIds(string rawIds)
+        {
+            // Vulnerable: rawIds like "1,2,3" injected into IN clause
+            string sql = $"SELECT * FROM Orders WHERE Id IN ({rawIds})";
+            var connection = new SqlConnection(_conn);
+            connection.Open();
+            return new SqlCommand(sql, connection).ExecuteReader();
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-015.cs

@@ -0,0 +1,33 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: csharp
+// expected: SQL injection via ADO.NET command text built with user search parameters
+
+using System;
+using System.Data.SqlClient;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class SearchController : ControllerBase
+    {
+        private readonly string _conn;
+
+        public SearchController(string conn) => _conn = conn;
+
+        [HttpGet]
+        public IActionResult Search([FromQuery] string name, [FromQuery] string dept)
+        {
+            // Vulnerable: both query params concatenated into SQL
+            string sql = "SELECT * FROM Employees WHERE Name LIKE '%" + name
+                         + "%' AND Department = '" + dept + "'";
+            using var connection = new SqlConnection(_conn);
+            connection.Open();
+            using var reader = new SqlCommand(sql, connection).ExecuteReader();
+            return Ok("Results fetched");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-016.cs

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: csharp
+// expected: XSS via Response.Write with unescaped user input from query string
+
+using System.Web;
+
+namespace App.Handlers
+{
+    public class GreetingHandler : IHttpHandler
+    {
+        public bool IsReusable => false;
+
+        public void ProcessRequest(HttpContext context)
+        {
+            string name = context.Request.QueryString["name"];
+            context.Response.ContentType = "text/html";
+            // Vulnerable: name reflected without HtmlEncode
+            context.Response.Write("<html><body>");
+            context.Response.Write("<h1>Welcome, " + name + "!</h1>");
+            context.Response.Write("</body></html>");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-017.cs

@@ -0,0 +1,22 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: csharp
+// expected: XSS via Response.Write with search query reflected into HTML
+
+using System.Web;
+using System.Web.UI;
+
+namespace App.Pages
+{
+    public class SearchPage : Page
+    {
+        protected void Page_Load(object sender, System.EventArgs e)
+        {
+            string q = Request.QueryString["q"];
+            // Vulnerable: writing raw query parameter into page output
+            Response.Write("<h2>Results for: " + q + "</h2>");
+            Response.Write("<meta name=\"description\" content=\"" + q + "\">");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-018.cs

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: csharp
+// expected: XSS via MVC action returning raw HTML with user input embedded
+
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    public class ProfileController : Controller
+    {
+        [HttpGet("profile")]
+        public ContentResult ShowProfile(string username, string bio)
+        {
+            // Vulnerable: username and bio embedded without encoding
+            string html = $@"
+<html><body>
+  <h1>{username}</h1>
+  <p>{bio}</p>
+  <script>var user = ""{username}"";</script>
+</body></html>";
+            return Content(html, "text/html");
+        }
+    }
+}