thuban 0.4.0 → 0.4.2

package/dist/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "thuban",
+  "version": "0.4.2",
+  "description": "The safety layer for AI-coded software. Detect hallucinated APIs, ghost code, tech debt, and architecture drift. One command. Minimal dependencies.",
+  "bin": {
+    "thuban": "./dist/cli.js"
+  },
+  "scripts": {
+    "scan": "node cli.js scan",
+    "test": "node cli.js scan . --json > NUL",
+    "build": "node build.js",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "code-quality",
+    "static-analysis",
+    "ai-hallucination",
+    "hallucination-detection",
+    "ghost-code",
+    "tech-debt",
+    "ai-code-review",
+    "code-health",
+    "pre-commit",
+    "copilot",
+    "cursor",
+    "ai-safety",
+    "developer-tools",
+    "devtools",
+    "linter",
+    "code-scanner"
+  ],
+  "author": "Silverwings Benefits <hello@thuban.dev>",
+  "license": "SEE LICENSE IN LICENSE",
+  "homepage": "https://thuban.dev",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/SilverwingsBenefitsGit/thuban.git"
+  },
+  "bugs": {
+    "url": "https://github.com/SilverwingsBenefitsGit/thuban/issues"
+  },
+  "engines": {
+    "node": ">=16.0.0"
+  },
+  "files": [
+    "dist/cli.js",
+    "dist/packages/scanner/*.js",
+    "dist/packages/crucible/*.js",
+    "dist/packages/crucible/seeds/**",
+    "dist/packages/crucible/.golden/",
+    "dist/packages/crucible/rules/**",
+    "dist/README.md",
+    "dist/LICENSE",
+    "dist/package.json"
+  ],
+  "dependencies": {
+    "@babel/parser": "^8.0.0",
+    "docx": "^9.7.1"
+  },
+  "devDependencies": {
+    "terser": "^5.48.0"
+  }
+}

package/dist/packages/crucible/rules/code-scanner-core.json

@@ -0,0 +1,129 @@
+[
+  {
+    "id": "SEC001",
+    "name": "Hardcoded API Key",
+    "type": "hardcoded_secret",
+    "pattern": "['\"](?:sk-|pk-|xox[pboa]-|AKIA|ghp_|gho_|github_pat_)[a-zA-Z0-9_-]{10,}['\"]|['\"][a-zA-Z0-9]{32,}['\"]",
+    "flags": "",
+    "severity": "critical",
+    "message": "Possible hardcoded API key or secret detected",
+    "context": "(api[_-]?key|apikey|secret[_\\s]*key|token|credential|bearer)",
+    "contextFlags": "i",
+    "skipIfSafe": true
+  },
+  {
+    "id": "SEC001B",
+    "name": "Hardcoded API Key (bare)",
+    "type": "hardcoded_secret",
+    "pattern": "['\"](?:sk-|pk-|xox[pboa]-|AKIA|ghp_|gho_|github_pat_)[a-zA-Z0-9_-]{10,}['\"]",
+    "flags": "",
+    "severity": "critical",
+    "message": "Possible hardcoded API key or secret detected",
+    "skipIfSafe": true
+  },
+  {
+    "id": "SEC002",
+    "name": "Hardcoded Password",
+    "type": "hardcoded_secret",
+    "pattern": "password\\s*[:=]\\s*['\"][^'\"]+['\"]",
+    "flags": "i",
+    "severity": "critical",
+    "message": "Hardcoded password detected",
+    "skipIfSafe": true,
+    "skipInTests": true
+  },
+  {
+    "id": "SEC002B",
+    "name": "Hardcoded Password (JSON key)",
+    "type": "hardcoded_secret",
+    "pattern": "[\"']password[\"']\\s*:\\s*[\"'][^\"']+[\"']",
+    "flags": "i",
+    "severity": "critical",
+    "message": "Hardcoded password detected",
+    "skipIfSafe": true,
+    "skipInTests": true
+  },
+  {
+    "id": "SEC003",
+    "name": "SQL Injection Risk",
+    "type": "sql_injection",
+    "pattern": "\\b(?:SELECT|INSERT\\s+INTO|UPDATE|DELETE\\s+FROM|WHERE)\\b.*(\\$\\{|\\+\\s*['\"]|\\+\\s*\\w+|f['\"].*\\{|%s|%d)",
+    "flags": "i",
+    "severity": "error",
+    "message": "Potential SQL injection - use parameterized queries"
+  },
+  {
+    "id": "SEC004",
+    "name": "eval() Usage",
+    "type": "eval_abuse",
+    "pattern": "\\beval\\s*\\(",
+    "flags": "",
+    "severity": "error",
+    "message": "eval() is dangerous and should be avoided"
+  },
+  {
+    "id": "SEC004B",
+    "name": "eval() Usage (unicode-escaped)",
+    "type": "eval_abuse",
+    "pattern": "\\\\u0065\\\\u0076\\\\u0061\\\\u006[cC]",
+    "flags": "",
+    "severity": "error",
+    "message": "Obfuscated eval() usage (unicode escapes) is dangerous and should be avoided"
+  },
+  {
+    "id": "SEC005",
+    "name": "innerHTML/document.write Assignment",
+    "type": "xss",
+    "pattern": "\\.innerHTML\\s*=|\\bdocument\\.write\\s*\\(",
+    "flags": "",
+    "severity": "warning",
+    "message": "innerHTML/document.write can cause XSS - consider using textContent or sanitization"
+  },
+  {
+    "id": "SEC006",
+    "name": "Disabled Security",
+    "type": "insecure_config",
+    "pattern": "rejectUnauthorized\\s*:\\s*false|verify\\s*=\\s*False|InsecureSkipVerify\\s*:\\s*true",
+    "flags": "",
+    "severity": "error",
+    "message": "SSL certificate validation disabled"
+  },
+  {
+    "id": "SEC007",
+    "name": "Exposed .env Reference",
+    "type": "insecure_config",
+    "pattern": "\\.env['\"]",
+    "flags": "",
+    "severity": "warning",
+    "message": "Direct .env file manipulation - ensure not exposed",
+    "context": "fs\\.(read|write)|path\\.join|open\\s*\\(|os\\.Open",
+    "contextFlags": "i"
+  },
+  {
+    "id": "SEC008",
+    "name": "Unsafe Block (Rust)",
+    "type": "memory_safety",
+    "pattern": "\\bunsafe\\s*\\{",
+    "flags": "",
+    "severity": "warning",
+    "message": "Rust unsafe block - verify memory safety guarantees"
+  },
+  {
+    "id": "SEC009",
+    "name": "Shell Execution (PHP/Ruby)",
+    "type": "command_injection",
+    "pattern": "\\bshell_exec\\s*\\(|\\bpassthru\\s*\\(|`[^`]+`",
+    "flags": "",
+    "severity": "error",
+    "message": "Shell execution function - command injection risk if input unsanitized"
+  },
+  {
+    "id": "SEC010",
+    "name": "Prototype Pollution",
+    "type": "prototype_pollution",
+    "pattern": "\\[\\s*['\"]__proto__['\"]\\s*\\]|\\.__proto__\\s*(=|\\[)|constructor\\s*\\[\\s*['\"]prototype['\"]\\s*\\]|constructor\\.prototype\\s*(=|\\[)|['\"]__proto__['\"]\\s*:",
+    "flags": "",
+    "severity": "error",
+    "message": "Possible prototype pollution via __proto__/constructor.prototype"
+  }
+]

package/dist/packages/crucible/rules/command-injection.json

@@ -0,0 +1,411 @@
+[
+  {
+    "id": "CMD001",
+    "pattern": "exec(?:Sync|FileSync)?\\s*\\([^)]*\\+|os\\.system\\s*\\(|exec\\.Command\\s*\\([^)]*\\+",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection (original)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD002",
+    "pattern": "spawn\\s*\\([^)]*shell\\s*:\\s*true",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — JS/TS: spawn with shell:true, execa",
+    "language": [
+      "js",
+      "ts"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD003",
+    "pattern": "execa(?:\\.command)?\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — JS/TS: spawn with shell:true, execa",
+    "language": [
+      "js",
+      "ts"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD004",
+    "pattern": "subprocess\\s*\\.\\s*(?:call|check_output|Popen|run)\\s*\\([^)]*shell\\s*=\\s*True",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Python: subprocess variants with shell=True, os.popen, paramiko",
+    "language": [
+      "python"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD005",
+    "pattern": "os\\s*\\.\\s*popen\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Python: subprocess variants with shell=True, os.popen, paramiko",
+    "language": [
+      "python"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD006",
+    "pattern": "\\.exec_command\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Python: subprocess variants with shell=True, os.popen, paramiko",
+    "language": [
+      "python"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD007",
+    "pattern": "`[^`]*#\\{[^}]+\\}[^`]*`",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Ruby: backtick with interpolation, system, exec, Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD008",
+    "pattern": "\\b(?:system|exec)\\s*\\(\\s*[\"'`]?[^\"'`\\n]*#\\{|\\b(?:system|exec)\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\+",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Ruby: backtick with interpolation, system, exec, Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD009",
+    "pattern": "\\bIO\\.popen\\s*\\(|Open3\\.\\w+\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Ruby: backtick with interpolation, system, exec, Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD010",
+    "pattern": "Runtime\\s*\\.\\s*getRuntime\\s*\\(\\s*\\)\\s*\\.\\s*exec\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Java/Kotlin: Runtime.exec, ProcessBuilder",
+    "language": [
+      "kotlin",
+      "java"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD011",
+    "pattern": "new\\s+ProcessBuilder\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Java/Kotlin: Runtime.exec, ProcessBuilder",
+    "language": [
+      "kotlin",
+      "java"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD012",
+    "pattern": "Process\\s*\\.\\s*Start\\s*\\(|new\\s+ProcessStartInfo\\s*[({]",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — C#: Process.Start / ProcessStartInfo",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD013",
+    "pattern": "Command\\s*::\\s*new\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Rust: Command::new",
+    "language": [
+      "rust"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD014",
+    "pattern": "\\bshell_exec\\s*\\(|\\bpassthru\\s*\\(|\\bpopen\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — PHP: shell_exec, system, passthru, popen, backtick with variable",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD015",
+    "pattern": "\\bsystem\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\.\\s*\\$|\\bsystem\\s*\\(\\s*\\$",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — PHP: shell_exec, system, passthru, popen, backtick with variable",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD016",
+    "pattern": "`[^`]*\\$(?:_GET|_POST|_REQUEST|_COOKIE|\\w+)[^`]*`",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — PHP: shell_exec, system, passthru, popen, backtick with variable",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD017",
+    "pattern": "exec\\s*\\.\\s*Command\\s*\\([^)]*fmt\\.Sprintf|exec\\s*\\.\\s*Command\\s*\\([^)]*parts\\b",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Go: exec.Command with fmt.Sprintf, user-split args, or /bin/sh -c pattern",
+    "language": [
+      "go"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD018",
+    "pattern": "exec\\s*\\.\\s*Command\\s*\\(\\s*[\"']\\/bin\\/(?:sh|bash)[\"']\\s*,\\s*[\"']-c[\"']",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Go: exec.Command with fmt.Sprintf, user-split args, or /bin/sh -c pattern",
+    "language": [
+      "go"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD019",
+    "pattern": "\\bexec\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\.\\s*\\$|\\bexec\\s*\\(\\s*\\$",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — PHP: exec() with user input",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD020",
+    "pattern": "ProcessStartInfo\\s*\\{[^}]*Arguments\\s*=\\s*\\$[\"']",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "C# command injection: ProcessStartInfo / Process.Start with user input",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD021",
+    "pattern": "Arguments\\s*=\\s*\\$[\"'][^\"']*\\{(?:host|cmd|args|input|filename|email|script)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "C# command injection: ProcessStartInfo / Process.Start with user input",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD022",
+    "pattern": "new ProcessStartInfo\\s*\\(\\s*[\"'][^\"']*(?:bash|sh|cmd)[\"']",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "C# command injection: ProcessStartInfo / Process.Start with user input",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD023",
+    "pattern": "`[^`]*#\\{[^`]*`",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD024",
+    "pattern": "\\bsystem\\s*\\([^)]*#\\{",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD025",
+    "pattern": "\\bexec\\s*\\([^)]*#\\{",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD026",
+    "pattern": "Open3\\.capture2\\s*\\(.*(?:#\\{|cmd)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD027",
+    "pattern": "IO\\.popen\\s*\\([^)]*#\\{",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD028",
+    "pattern": "\\bspawn\\s*\\([^)]*#\\{",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD029",
+    "pattern": "\\bexec\\s*\\(\\s*[\"'][^\"']*[\"']?\\s*\\.\\s*\\$(?:_GET|_POST|host|cmd|ip)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "PHP command injection",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD030",
+    "pattern": "shell_exec\\s*\\([^)]*\\$(?:_GET|_POST|domain|ip|host|cmd|server)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "PHP command injection",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD031",
+    "pattern": "\\bsystem\\s*\\([^)]*\\$(?:_GET|_POST|src|dest|format|file)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "PHP command injection",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD032",
+    "pattern": "passthru\\s*\\([^)]*\\$(?:_POST|_GET|archive|zip|dest)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "PHP command injection",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD033",
+    "pattern": "popen\\s*\\(\\s*[\"'][^\"']*[\"']?\\s*\\.\\s*\\$(?:_GET|pattern|logfile)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "PHP command injection",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD034",
+    "pattern": "exec\\.Command\\s*\\(\\s*[\"'][^\"']*(?:bash|sh)[\"'][^)]*\"-c\"",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Go command injection",
+    "language": [
+      "go"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD035",
+    "pattern": "exec\\.Command\\s*\\(\\s*[\"'][^\"']*(?:sh|bash)[\"'][^)]*cmdStr",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Go command injection",
+    "language": [
+      "go"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD036",
+    "pattern": "cmd\\s*:=\\s*exec\\.Command\\s*\\([^)]*\\+",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Go command injection",
+    "language": [
+      "go"
+    ],
+    "severity": "critical"
+  }
+]

package/dist/packages/crucible/rules/crypto-misuse.json

@@ -0,0 +1,35 @@
+[
+  {
+    "id": "CMISUSE001",
+    "pattern": "use\\s+md5\\b|md5::compute|ecb_encrypt|AesCipher|nonce\\s*=\\s*0\\b",
+    "flags": "i",
+    "category": "crypto_misuse",
+    "description": "crypto_misuse (Rust-specific)",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "CMISUSE002",
+    "pattern": "\\bxor_encrypt\\b|\\bxor_decrypt\\b|\\brot13\\b|\\bcaesar_cipher\\b",
+    "flags": "i",
+    "category": "crypto_misuse",
+    "description": "Rust: crypto misuse (homegrown ciphers)",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "CMISUSE003",
+    "pattern": "struct\\s+Rc4\\b|\\brc4\\b",
+    "flags": "i",
+    "category": "crypto_misuse",
+    "description": "Rust: crypto misuse (homegrown ciphers)",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  }
+]