thuban 0.4.10 → 0.4.11

package/dist/packages/crucible/.golden/golden-master.json

@@ -0,0 +1,414 @@
+{
+  "version": 1,
+  "timestamp": "2026-07-01T11:20:04.329Z",
+  "hash": "8752892137ff7720",
+  "count": 50,
+  "meta": {
+    "score": 100,
+    "level": "gentle",
+    "seeds": 50,
+    "duration": 281
+  },
+  "findings": [
+    {
+      "seedId": "csharp/seed-009.cs",
+      "category": "sql_injection",
+      "severity": "critical",
+      "language": "csharp",
+      "detected": true,
+      "label": "SQL injection via string concatenation in SqlCommand"
+    },
+    {
+      "seedId": "csharp/seed-033.cs",
+      "category": "path_traversal",
+      "severity": "high",
+      "language": "csharp",
+      "detected": true,
+      "label": "Path traversal in file write with user-supplied report name enabling overwrite of arbitrary files"
+    },
+    {
+      "seedId": "csharp/seed-034.cs",
+      "category": "insecure_crypto",
+      "severity": "high",
+      "language": "csharp",
+      "detected": true,
+      "label": "MD5 used for password hashing via MD5.Create()"
+    },
+    {
+      "seedId": "csharp/seed-037.cs",
+      "category": "insecure_crypto",
+      "severity": "high",
+      "language": "csharp",
+      "detected": true,
+      "label": "SHA1 used for HMAC signing instead of SHA256 or higher"
+    },
+    {
+      "seedId": "csharp/seed-042.cs",
+      "category": "deserialization",
+      "severity": "critical",
+      "language": "csharp",
+      "detected": true,
+      "label": "Unsafe deserialization via DataContractSerializer reading from request body"
+    },
+    {
+      "seedId": "csharp/seed-045.cs",
+      "category": "ssrf",
+      "severity": "high",
+      "language": "csharp",
+      "detected": true,
+      "label": "SSRF via HttpClient.GetAsync with user-controlled endpoint URL"
+    },
+    {
+      "seedId": "csharp/seed-048.cs",
+      "category": "xxe",
+      "severity": "critical",
+      "language": "csharp",
+      "detected": true,
+      "label": "XXE via XmlReader without secure settings (DtdProcessing.Parse enabled)"
+    },
+    {
+      "seedId": "go/seed-019.go",
+      "category": "xss",
+      "severity": "high",
+      "language": "go",
+      "detected": true,
+      "label": "XSS via w.Write injecting user input into inline JavaScript variable"
+    },
+    {
+      "seedId": "go/seed-029.go",
+      "category": "path_traversal",
+      "severity": "high",
+      "language": "go",
+      "detected": true,
+      "label": "Path traversal via os.Open with user-supplied filename concatenated to base path"
+    },
+    {
+      "seedId": "go/seed-034.go",
+      "category": "insecure_crypto",
+      "severity": "high",
+      "language": "go",
+      "detected": true,
+      "label": "MD5 used for password hashing via crypto/md5"
+    },
+    {
+      "seedId": "go/seed-036.go",
+      "category": "insecure_crypto",
+      "severity": "high",
+      "language": "go",
+      "detected": true,
+      "label": "SHA1 used for HMAC signing and MD5 for file integrity verification"
+    },
+    {
+      "seedId": "go/seed-042.go",
+      "category": "open_redirect",
+      "severity": "medium",
+      "language": "go",
+      "detected": true,
+      "label": "Open redirect via http.Redirect using user-supplied return URL after password reset"
+    },
+    {
+      "seedId": "go/seed-050.go",
+      "category": "open_redirect",
+      "severity": "medium",
+      "language": "go",
+      "detected": true,
+      "label": "Open redirect via http.Redirect with Referer header used as redirect destination"
+    },
+    {
+      "seedId": "java/seed-009.java",
+      "category": "sql_injection",
+      "severity": "critical",
+      "language": "java",
+      "detected": true,
+      "label": "SQL injection via string concatenation in executeQuery"
+    },
+    {
+      "seedId": "java/seed-034.java",
+      "category": "insecure_crypto",
+      "severity": "high",
+      "language": "java",
+      "detected": true,
+      "label": "MD5 used for password hashing via MessageDigest"
+    },
+    {
+      "seedId": "java/seed-042.java",
+      "category": "deserialization",
+      "severity": "critical",
+      "language": "java",
+      "detected": true,
+      "label": "Unsafe deserialization in JMS message listener via ObjectMessage"
+    },
+    {
+      "seedId": "java/seed-044.java",
+      "category": "xxe",
+      "severity": "critical",
+      "language": "java",
+      "detected": true,
+      "label": "XXE via XMLReader without disabling external entities or DOCTYPE processing"
+    },
+    {
+      "seedId": "java/seed-048.java",
+      "category": "ssrf",
+      "severity": "high",
+      "language": "java",
+      "detected": true,
+      "label": "SSRF via URL.openConnection with user-supplied URL parameter"
+    },
+    {
+      "seedId": "java/seed-049.java",
+      "category": "ssrf",
+      "severity": "high",
+      "language": "java",
+      "detected": true,
+      "label": "SSRF via URL.openStream with user-controlled webhook URL"
+    },
+    {
+      "seedId": "js/seed-014.js",
+      "category": "sql_injection",
+      "severity": "critical",
+      "language": "javascript",
+      "detected": true,
+      "label": "SQL injection via Sequelize literal() with user input"
+    },
+    {
+      "seedId": "js/seed-015.js",
+      "category": "sql_injection",
+      "severity": "critical",
+      "language": "javascript",
+      "detected": true,
+      "label": "SQL injection via bulk IN clause construction with user-supplied IDs"
+    },
+    {
+      "seedId": "js/seed-026.js",
+      "category": "command_injection",
+      "severity": "high",
+      "language": "javascript",
+      "detected": true,
+      "label": "command injection via child_process.exec in scheduled job"
+    },
+    {
+      "seedId": "js/seed-030.js",
+      "category": "path_traversal",
+      "severity": "high",
+      "language": "javascript",
+      "detected": true,
+      "label": "path traversal via user-controlled directory in readdir and readFileSync"
+    },
+    {
+      "seedId": "js/seed-044.js",
+      "category": "eval_abuse",
+      "severity": "critical",
+      "language": "javascript",
+      "detected": true,
+      "label": "eval() called with user-controlled expression string"
+    },
+    {
+      "seedId": "js/seed-046.js",
+      "category": "eval_abuse",
+      "severity": "high",
+      "language": "javascript",
+      "detected": true,
+      "label": "eval() used in JSON reviver to execute serialized function strings"
+    },
+    {
+      "seedId": "js/seed-047.js",
+      "category": "eval_abuse",
+      "severity": "high",
+      "language": "javascript",
+      "detected": true,
+      "label": "eval() inside setTimeout and setInterval with user-controlled string"
+    },
+    {
+      "seedId": "js/seed-052.js",
+      "category": "ssrf",
+      "severity": "high",
+      "language": "javascript",
+      "detected": true,
+      "label": "SSRF via got/superagent with redirect following and user-controlled URL"
+    },
+    {
+      "seedId": "kotlin/seed-019.kt",
+      "category": "xss",
+      "severity": "medium",
+      "language": "kotlin",
+      "detected": true,
+      "label": "WebView evaluateJavascript with unsanitized user string"
+    },
+    {
+      "seedId": "kotlin/seed-032.kt",
+      "category": "path_traversal",
+      "severity": "high",
+      "language": "kotlin",
+      "detected": true,
+      "label": "Download path constructed from user-controlled filename without sanitization"
+    },
+    {
+      "seedId": "kotlin/seed-038.kt",
+      "category": "insecure_crypto",
+      "severity": "medium",
+      "language": "kotlin",
+      "detected": true,
+      "label": "SHA-1 used for certificate pinning and signature verification"
+    },
+    {
+      "seedId": "php/seed-003.php",
+      "category": "hardcoded_secret",
+      "severity": "critical",
+      "language": "php",
+      "detected": true,
+      "label": "Hardcoded AWS credentials and S3 configuration"
+    },
+    {
+      "seedId": "php/seed-017.php",
+      "category": "xss",
+      "severity": "high",
+      "language": "php",
+      "detected": true,
+      "label": "$_POST values echoed directly into HTML form — stored XSS vector"
+    },
+    {
+      "seedId": "php/seed-018.php",
+      "category": "xss",
+      "severity": "high",
+      "language": "php",
+      "detected": true,
+      "label": "print_r or var_dump of user input rendered in HTML context"
+    },
+    {
+      "seedId": "php/seed-029.php",
+      "category": "path_traversal",
+      "severity": "critical",
+      "language": "php",
+      "detected": true,
+      "label": "include() with user-supplied path — local file inclusion / RFI"
+    },
+    {
+      "seedId": "python/seed-001.py",
+      "category": "hardcoded_secret",
+      "severity": "critical",
+      "language": "python",
+      "detected": true,
+      "label": "hardcoded AWS access key and secret key"
+    },
+    {
+      "seedId": "python/seed-029.py",
+      "category": "path_traversal",
+      "severity": "high",
+      "language": "python",
+      "detected": true,
+      "label": "path traversal via open() with unvalidated user-supplied file path"
+    },
+    {
+      "seedId": "python/seed-036.py",
+      "category": "insecure_crypto",
+      "severity": "high",
+      "language": "python",
+      "detected": true,
+      "label": "DES cipher usage and AES-ECB mode with static key"
+    },
+    {
+      "seedId": "python/seed-049.py",
+      "category": "deserialization",
+      "severity": "critical",
+      "language": "python",
+      "detected": true,
+      "label": "pickle.load used with untrusted file upload and shelve with user-controlled key"
+    },
+    {
+      "seedId": "python/seed-052.py",
+      "category": "yaml_injection",
+      "severity": "critical",
+      "language": "python",
+      "detected": true,
+      "label": "yaml.load() without safe_load — RCE via !!python/object tags in YAML"
+    },
+    {
+      "seedId": "ruby/seed-002.rb",
+      "category": "hardcoded_secret",
+      "severity": "critical",
+      "language": "ruby",
+      "detected": true,
+      "label": "Hardcoded database password in database.yml equivalent or initializer"
+    },
+    {
+      "seedId": "ruby/seed-005.rb",
+      "category": "hardcoded_secret",
+      "severity": "high",
+      "language": "ruby",
+      "detected": true,
+      "label": "Hardcoded JWT secret and admin API token"
+    },
+    {
+      "seedId": "ruby/seed-021.rb",
+      "category": "xss",
+      "severity": "high",
+      "language": "ruby",
+      "detected": true,
+      "label": "ActionMailer HTML email built with unescaped user content"
+    },
+    {
+      "seedId": "ruby/seed-028.rb",
+      "category": "command_injection",
+      "severity": "high",
+      "language": "ruby",
+      "detected": true,
+      "label": "Kernel.system called with interpolated hostname for network diagnostics"
+    },
+    {
+      "seedId": "ruby/seed-044.rb",
+      "category": "open_redirect",
+      "severity": "high",
+      "language": "ruby",
+      "detected": true,
+      "label": "redirect_to params[:url] without validation — open redirect"
+    },
+    {
+      "seedId": "rust/seed-011.rs",
+      "category": "unsafe_block",
+      "severity": "critical",
+      "language": "rust",
+      "detected": true,
+      "label": "Unsafe foreign function interface call without input validation"
+    },
+    {
+      "seedId": "rust/seed-044.rs",
+      "category": "crypto_misuse",
+      "severity": "high",
+      "language": "rust",
+      "detected": true,
+      "label": "MD5 crate used for password or data integrity hashing"
+    },
+    {
+      "seedId": "ts/seed-004.ts",
+      "category": "hardcoded_secret",
+      "severity": "critical",
+      "language": "typescript",
+      "detected": true,
+      "label": "hardcoded Stripe secret key and webhook secret in typed service"
+    },
+    {
+      "seedId": "ts/seed-032.ts",
+      "category": "path_traversal",
+      "severity": "high",
+      "language": "typescript",
+      "detected": true,
+      "label": "zip-slip path traversal via user-uploaded archive with unvalidated entry names"
+    },
+    {
+      "seedId": "ts/seed-034.ts",
+      "category": "insecure_crypto",
+      "severity": "high",
+      "language": "typescript",
+      "detected": true,
+      "label": "MD5 used for password hashing in typed auth service"
+    },
+    {
+      "seedId": "ts/seed-048.ts",
+      "category": "ssrf",
+      "severity": "high",
+      "language": "typescript",
+      "detected": true,
+      "label": "SSRF via fetch with unvalidated user-supplied URL"
+    }
+  ]
+}

package/dist/packages/crucible/report-generator.js

@@ -0,0 +1 @@
+"use strict";const fs=require("fs"),path=require("path"),crypto=require("crypto");function getScannerVersion(){try{return JSON.parse(fs.readFileSync(path.join(__dirname,"..","..","package.json"),"utf-8")).version||"unknown"}catch{return"unknown"}}function calculateCrucibleScore(e={}){let t=0,n=0;if(e.seedResults&&e.seedResults.total>0&&(t+=e.seedResults.detected/e.seedResults.total*100*.4,n+=.4),e.mutationResults&&e.mutationResults.total>0&&(t+=e.mutationResults.killed/e.mutationResults.total*100*.25,n+=.25),e.kennyResults&&(t+=.25*(e.kennyResults.score||0),n+=.25),e.selfAttackResults&&(t+=.1*(e.selfAttackResults.score||0),n+=.1),0===n)return 0;const s=t/n;return Math.round(Math.min(100,Math.max(0,s)))}function scoreColor(e){return e>=90?"#22c55e":e>=70?"#f59e0b":e>=50?"#f97316":"#ef4444"}function scoreLabel(e){return e>=90?"Excellent":e>=70?"Good":e>=50?"Fair":e>=30?"Poor":"Critical"}function esc(e){return String(e||"").replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#039;")}function generateHTML(e){const t=e.title||"Crucible Report",n=e.timestamp||(new Date).toISOString(),s=e.level||"medium",a="number"==typeof e.score?e.score:calculateCrucibleScore(e),r=scoreColor(a),o=scoreLabel(a),d=buildSeedSection(e.seedResults),i=buildMutationSection(e.mutationResults),l=buildKennySection(e.kennyResults),c=buildSelfAttackSection(e.selfAttackResults),p=buildGoldenSection(e.goldenComparison),u=buildDivergenceSection(e.divergenceStats);return`<!DOCTYPE html>\n<html lang="en">\n<head>\n  <meta charset="UTF-8">\n  <meta name="viewport" content="width=device-width, initial-scale=1.0">\n  <title>${esc(t)}</title>\n  <style>\n    :root {\n      --bg: #0f0f0f;\n      --surface: #1a1a1a;\n      --surface2: #242424;\n      --border: #2e2e2e;\n      --text: #e5e5e5;\n      --text-muted: #888;\n      --accent: #f97316;\n      --green: #22c55e;\n      --red: #ef4444;\n      --amber: #f59e0b;\n      --blue: #3b82f6;\n      --purple: #a855f7;\n    }\n    * { box-sizing: border-box; margin: 0; padding: 0; }\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', sans-serif;\n      background: var(--bg);\n      color: var(--text);\n      line-height: 1.6;\n      min-height: 100vh;\n    }\n    a { color: var(--accent); text-decoration: none; }\n    h1, h2, h3 { font-weight: 700; }\n\n    /* ── Header ── */\n    .header {\n      background: linear-gradient(135deg, #1a0a00 0%, #0f0f0f 60%);\n      border-bottom: 1px solid var(--border);\n      padding: 2rem;\n      display: flex;\n      align-items: center;\n      gap: 2rem;\n    }\n    .header-logo {\n      font-size: 2.5rem;\n      font-weight: 900;\n      background: linear-gradient(135deg, #f97316, #ef4444);\n      -webkit-background-clip: text;\n      -webkit-text-fill-color: transparent;\n      letter-spacing: -1px;\n    }\n    .header-info { flex: 1; }\n    .header-info h1 { font-size: 1.5rem; color: var(--text); }\n    .header-meta { color: var(--text-muted); font-size: 0.85rem; margin-top: 0.25rem; }\n\n    /* ── Score gauge ── */\n    .score-gauge {\n      text-align: center;\n      min-width: 120px;\n    }\n    .score-circle {\n      width: 100px; height: 100px;\n      border-radius: 50%;\n      border: 4px solid ${r};\n      display: flex; flex-direction: column;\n      align-items: center; justify-content: center;\n      margin: 0 auto 0.5rem;\n      box-shadow: 0 0 20px ${r}40;\n    }\n    .score-number { font-size: 2rem; font-weight: 900; color: ${r}; }\n    .score-label-small { font-size: 0.7rem; color: var(--text-muted); }\n    .score-grade { font-size: 0.9rem; font-weight: 700; color: ${r}; }\n\n    /* ── Container ── */\n    .container { max-width: 1200px; margin: 0 auto; padding: 2rem; }\n\n    /* ── Summary cards ── */\n    .cards {\n      display: grid;\n      grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));\n      gap: 1rem;\n      margin-bottom: 2rem;\n    }\n    .card {\n      background: var(--surface);\n      border: 1px solid var(--border);\n      border-radius: 8px;\n      padding: 1.25rem;\n    }\n    .card-value { font-size: 2rem; font-weight: 900; }\n    .card-label { font-size: 0.8rem; color: var(--text-muted); text-transform: uppercase; letter-spacing: 0.05em; margin-top: 0.25rem; }\n    .card.green .card-value { color: var(--green); }\n    .card.red .card-value   { color: var(--red); }\n    .card.amber .card-value { color: var(--amber); }\n    .card.blue .card-value  { color: var(--blue); }\n    .card.purple .card-value{ color: var(--purple); }\n\n    /* ── Sections ── */\n    .section {\n      background: var(--surface);\n      border: 1px solid var(--border);\n      border-radius: 8px;\n      margin-bottom: 1.5rem;\n      overflow: hidden;\n    }\n    .section-header {\n      display: flex; align-items: center; justify-content: space-between;\n      padding: 1rem 1.25rem;\n      border-bottom: 1px solid var(--border);\n      cursor: pointer;\n      user-select: none;\n    }\n    .section-header:hover { background: var(--surface2); }\n    .section-title { font-size: 1rem; font-weight: 700; display: flex; align-items: center; gap: 0.5rem; }\n    .section-badge {\n      font-size: 0.75rem; font-weight: 600;\n      padding: 0.2rem 0.6rem; border-radius: 999px;\n      background: var(--surface2); border: 1px solid var(--border);\n    }\n    .section-badge.pass { background: #052e16; border-color: #16a34a; color: var(--green); }\n    .section-badge.fail { background: #450a0a; border-color: #dc2626; color: var(--red); }\n    .section-body { padding: 1.25rem; }\n\n    /* ── Bar charts ── */\n    .bar-chart { display: flex; flex-direction: column; gap: 0.5rem; }\n    .bar-row { display: flex; align-items: center; gap: 0.75rem; }\n    .bar-label { width: 160px; font-size: 0.85rem; text-align: right; color: var(--text-muted); flex-shrink: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }\n    .bar-track { flex: 1; height: 20px; background: var(--surface2); border-radius: 4px; overflow: hidden; position: relative; }\n    .bar-fill { height: 100%; border-radius: 4px; transition: width 0.4s ease; display: flex; align-items: center; padding-left: 8px; font-size: 0.75rem; font-weight: 600; color: white; }\n    .bar-count { font-size: 0.8rem; color: var(--text-muted); min-width: 60px; }\n\n    /* ── Test table ── */\n    .test-table { width: 100%; border-collapse: collapse; font-size: 0.85rem; }\n    .test-table th {\n      text-align: left; padding: 0.5rem 0.75rem;\n      border-bottom: 1px solid var(--border);\n      color: var(--text-muted); font-weight: 600;\n      text-transform: uppercase; letter-spacing: 0.05em; font-size: 0.75rem;\n    }\n    .test-table td { padding: 0.5rem 0.75rem; border-bottom: 1px solid var(--border); vertical-align: top; }\n    .test-table tr:last-child td { border-bottom: none; }\n    .test-table tr:hover td { background: var(--surface2); }\n    .pass-icon { color: var(--green); font-weight: 700; }\n    .fail-icon { color: var(--red); font-weight: 700; }\n    .warn-icon { color: var(--amber); font-weight: 700; }\n    .badge {\n      display: inline-block; font-size: 0.7rem; font-weight: 600;\n      padding: 0.1rem 0.4rem; border-radius: 4px; margin: 0 0.1rem;\n    }\n    .badge-critical { background: #450a0a; color: #fca5a5; border: 1px solid #ef4444; }\n    .badge-high     { background: #431407; color: #fdba74; border: 1px solid #f97316; }\n    .badge-medium   { background: #422006; color: #fcd34d; border: 1px solid #f59e0b; }\n    .badge-category { background: #1e1b4b; color: #a5b4fc; border: 1px solid #6366f1; }\n    .badge-lang     { background: #052e16; color: #86efac; border: 1px solid #22c55e; }\n\n    /* ── Golden comparison ── */\n    .regression { background: #450a0a; border: 1px solid var(--red); border-radius: 6px; padding: 1rem; margin-top: 1rem; }\n    .improvement { background: #052e16; border: 1px solid var(--green); border-radius: 6px; padding: 1rem; margin-top: 1rem; }\n    .neutral { background: var(--surface2); border: 1px solid var(--border); border-radius: 6px; padding: 1rem; margin-top: 1rem; }\n\n    /* ── Collapse toggle ── */\n    .chevron { transition: transform 0.2s; }\n    .collapsed .chevron { transform: rotate(-90deg); }\n    .collapsible-body { display: block; }\n    .collapsed .collapsible-body { display: none; }\n\n    /* ── Responsive ── */\n    @media (max-width: 768px) {\n      .header { flex-direction: column; text-align: center; }\n      .bar-label { width: 100px; }\n    }\n\n    /* ── Footer ── */\n    .footer {\n      text-align: center;\n      padding: 2rem;\n      color: var(--text-muted);\n      font-size: 0.8rem;\n      border-top: 1px solid var(--border);\n    }\n  </style>\n</head>\n<body>\n\n<div class="header">\n  <div class="header-logo">&#x1F525; CRUCIBLE</div>\n  <div class="header-info">\n    <h1>${esc(t)}</h1>\n    <div class="header-meta">\n      Level: <strong>${esc(s)}</strong> &nbsp;|&nbsp;\n      Generated: <strong>${esc(new Date(n).toLocaleString())}</strong> &nbsp;|&nbsp;\n      Branch: <strong>kenny-mode</strong> &nbsp;|&nbsp;\n      Scanner: <strong>v${esc(getScannerVersion())}</strong>\n    </div>\n  </div>\n  <div class="score-gauge">\n    <div class="score-circle">\n      <div class="score-number">${a}</div>\n      <div class="score-label-small">/ 100</div>\n    </div>\n    <div class="score-grade">${esc(o)}</div>\n    <div class="score-label-small">Crucible Score</div>\n  </div>\n</div>\n\n<div class="container">\n  ${buildSummaryCards(e,a)}\n  ${p}\n  ${u}\n  ${d}\n  ${i}\n  ${l}\n  ${c}\n</div>\n\n<div class="footer">\n  Generated by <strong>Thuban Crucible</strong> &mdash; The Fire Test for Security Scanners\n</div>\n\n<script>\n  // Collapsible sections\n  document.querySelectorAll('.section-header').forEach(h => {\n    h.addEventListener('click', () => {\n      h.closest('.section').classList.toggle('collapsed');\n    });\n  });\n<\/script>\n</body>\n</html>`}function buildSummaryCards(e,t){const n=e.seedResults||{},s=e.mutationResults||{},a=e.kennyResults||{},r=n.total>0?Math.round(n.detected/n.total*100):null,o=s.total>0?Math.round(s.killed/s.total*100):null,d=[];return n.total&&(d.push(`<div class="card ${r>=70?"green":"red"}">\n      <div class="card-value">${r}%</div>\n      <div class="card-label">Seed Detection Rate</div>\n    </div>`),d.push(`<div class="card blue">\n      <div class="card-value">${n.total}</div>\n      <div class="card-label">Seeds Tested</div>\n    </div>`)),s.total&&d.push(`<div class="card ${o>=70?"green":"amber"}">\n      <div class="card-value">${o}%</div>\n      <div class="card-label">Mutation Kill Rate</div>\n    </div>`),void 0!==a.score&&d.push(`<div class="card ${a.score>=70?"green":"amber"}">\n      <div class="card-value">${a.score}</div>\n      <div class="card-label">Kenny Score</div>\n    </div>`),d.push(`<div class="card purple">\n    <div class="card-value">${t}</div>\n    <div class="card-label">Crucible Score</div>\n  </div>`),`<div class="cards">${d.join("")}</div>`}function buildSeedSection(e){if(!e)return"";const t=e.total||0,n=e.detected||0,s=e.missed||0,a=e.byLanguage||{},r=e.byCategory||{},o=Object.entries(a).sort(([,e],[,t])=>t.detected/t.total-e.detected/e.total).map(([e,t])=>{const n=t.total>0?Math.round(t.detected/t.total*100):0,s=n>=70?"#22c55e":n>=50?"#f59e0b":"#ef4444";return`<div class="bar-row">\n        <div class="bar-label">${esc(e)}</div>\n        <div class="bar-track">\n          <div class="bar-fill" style="width:${n}%; background:${s}">${n}%</div>\n        </div>\n        <div class="bar-count">${t.detected}/${t.total}</div>\n      </div>`}).join(""),d=Object.entries(r).sort(([,e],[,t])=>t.detected/t.total-e.detected/e.total).map(([e,t])=>{const n=t.total>0?Math.round(t.detected/t.total*100):0,s=n>=70?"#22c55e":n>=50?"#f59e0b":"#ef4444";return`<div class="bar-row">\n        <div class="bar-label">${esc(e)}</div>\n        <div class="bar-track">\n          <div class="bar-fill" style="width:${n}%; background:${s}">${n}%</div>\n        </div>\n        <div class="bar-count">${t.detected}/${t.total}</div>\n      </div>`}).join(""),i=0===s?'<span class="section-badge pass">All seeds detected</span>':`<span class="section-badge fail">${s} missed</span>`,l=(e.tests||[]).slice(0,200).map(e=>`<tr>\n    <td><span class="${e.detected?"pass-icon":"fail-icon"}">${e.detected?"✓":"✗"}</span></td>\n    <td><code>${esc(e.id)}</code></td>\n    <td><span class="badge badge-lang">${esc(e.language)}</span></td>\n    <td><span class="badge badge-category">${esc(e.category)}</span></td>\n    <td><span class="badge badge-${esc((e.severity||"medium").toLowerCase())}">${esc(e.severity)}</span></td>\n    <td style="color:var(--text-muted);font-size:0.8rem">${esc(e.expected)}</td>\n  </tr>`).join("");return`\n<div class="section" id="seed-section">\n  <div class="section-header">\n    <div class="section-title">&#127807; Seed Results <span style="color:var(--text-muted);font-weight:400;font-size:0.9rem">${n}/${t} detected</span></div>\n    ${i}\n    <span class="chevron">&#8964;</span>\n  </div>\n  <div class="collapsible-body section-body">\n    <div style="display:grid;grid-template-columns:1fr 1fr;gap:2rem;margin-bottom:1.5rem">\n      <div>\n        <h3 style="margin-bottom:0.75rem;font-size:0.9rem;color:var(--text-muted);text-transform:uppercase;letter-spacing:0.05em">By Language</h3>\n        <div class="bar-chart">${o||'<div style="color:var(--text-muted)">No data</div>'}</div>\n      </div>\n      <div>\n        <h3 style="margin-bottom:0.75rem;font-size:0.9rem;color:var(--text-muted);text-transform:uppercase;letter-spacing:0.05em">By Category</h3>\n        <div class="bar-chart">${d||'<div style="color:var(--text-muted)">No data</div>'}</div>\n      </div>\n    </div>\n    ${l?`\n    <table class="test-table">\n      <thead><tr>\n        <th></th><th>Seed</th><th>Lang</th><th>Category</th><th>Severity</th><th>Expected</th>\n      </tr></thead>\n      <tbody>${l}</tbody>\n    </table>`:""}\n  </div>\n</div>`}function buildMutationSection(e){if(!e)return"";const t=e.total||0,n=e.killed||0,s=e.survived||0,a=t>0?Math.round(n/t*100):0,r=a>=70?"#22c55e":a>=50?"#f59e0b":"#ef4444",o=(e.tests||[]).slice(0,100).map(e=>`<tr>\n    <td><span class="${e.killed?"pass-icon":"fail-icon"}">${e.killed?"✓":"✗"}</span></td>\n    <td><code>${esc(e.seedId)}</code></td>\n    <td>${(e.applied||[]).map(e=>`<span class="badge badge-category">${esc(e)}</span>`).join(" ")}</td>\n    <td><span class="${e.killed?"pass-icon":"fail-icon"}" style="font-size:0.85rem">${e.killed?"Killed":"Survived"}</span></td>\n  </tr>`).join("");return`\n<div class="section" id="mutation-section">\n  <div class="section-header">\n    <div class="section-title">&#129516; Mutation Kill Rate <span style="color:${r};margin-left:0.5rem">${a}%</span></div>\n    <span class="section-badge ${a>=70?"pass":"fail"}">${n}/${t} killed</span>\n    <span class="chevron">&#8964;</span>\n  </div>\n  <div class="collapsible-body section-body">\n    <div class="bar-chart" style="margin-bottom:1rem">\n      <div class="bar-row">\n        <div class="bar-label">Kill Rate</div>\n        <div class="bar-track">\n          <div class="bar-fill" style="width:${a}%; background:${r}">${a}%</div>\n        </div>\n        <div class="bar-count">${n}/${t}</div>\n      </div>\n      <div class="bar-row">\n        <div class="bar-label">Survival Rate</div>\n        <div class="bar-track">\n          <div class="bar-fill" style="width:${t>0?Math.round(s/t*100):0}%; background:#ef4444">${t>0?Math.round(s/t*100):0}%</div>\n        </div>\n        <div class="bar-count">${s}/${t}</div>\n      </div>\n    </div>\n    ${o?`\n    <table class="test-table">\n      <thead><tr><th></th><th>Seed</th><th>Mutations Applied</th><th>Result</th></tr></thead>\n      <tbody>${o}</tbody>\n    </table>`:""}\n  </div>\n</div>`}function buildKennySection(e){if(!e)return"";const t=e.score||0,n=e.total||0,s=e.passed||0,a=(e.failed,scoreColor(t)),r=Object.entries(e.batteries||{}).map(([e,t])=>{const n=t.total>0?Math.round(t.passed/t.total*100):0,s=n>=70?"#22c55e":n>=50?"#f59e0b":"#ef4444";return`<div class="bar-row">\n      <div class="bar-label">${esc(e)}</div>\n      <div class="bar-track">\n        <div class="bar-fill" style="width:${n}%; background:${s}">${n}%</div>\n      </div>\n      <div class="bar-count">${t.passed}/${t.total}</div>\n    </div>`}).join(""),o=(e.tests||[]).map(e=>{const t=(e.missingDetections||[]).map(e=>`<span class="badge badge-category">${esc(e)}</span>`).join(" "),n=(e.falsePositives||[]).map(e=>`<span class="badge badge-high">${esc(e)}</span>`).join(" ");return`<tr>\n      <td><span class="${e.passed?"pass-icon":e.crashed||e.timedOut?"warn-icon":"fail-icon"}">${e.passed?"✓":e.crashed?"⚡":e.timedOut?"⏱":"✗"}</span></td>\n      <td style="font-size:0.8rem;color:var(--text-muted)">${esc(e.id)}</td>\n      <td>${esc(e.name)}</td>\n      <td><span class="badge badge-lang">${esc(e.battery)}</span></td>\n      <td>${t||n||'<span style="color:var(--text-muted)">—</span>'}</td>\n    </tr>`}).join("");return`\n<div class="section" id="kenny-section">\n  <div class="section-header">\n    <div class="section-title">&#128293; Kenny Mode <span style="color:${a};margin-left:0.5rem">${t}/100</span></div>\n    <span class="section-badge ${t>=70?"pass":"fail"}">${s}/${n} passed</span>\n    <span class="chevron">&#8964;</span>\n  </div>\n  <div class="collapsible-body section-body">\n    <div class="bar-chart" style="margin-bottom:1.5rem">\n      ${r||'<div style="color:var(--text-muted)">No battery data</div>'}\n    </div>\n    ${o?`\n    <table class="test-table">\n      <thead><tr><th></th><th>ID</th><th>Test</th><th>Battery</th><th>Issues</th></tr></thead>\n      <tbody>${o}</tbody>\n    </table>`:""}\n  </div>\n</div>`}function buildSelfAttackSection(e){if(!e)return"";const t=e.score||0,n=(e.crashes||[]).length,s=(e.hangs||[]).length,a=(e.missedDetections||[]).length,r=(e.passed||[]).length,o=scoreColor(t),d=(e.crashes||[]).map(e=>`<tr>\n    <td><span class="fail-icon">⚡</span></td>\n    <td><code>${esc(e.payload)}</code></td>\n    <td>${esc(e.description)}</td>\n    <td style="color:var(--red)">${esc(e.error||"")}</td>\n  </tr>`).join(""),i=(e.hangs||[]).map(e=>`<tr>\n    <td><span class="warn-icon">⏱</span></td>\n    <td><code>${esc(e.payload)}</code></td>\n    <td>${esc(e.description)}</td>\n    <td style="color:var(--amber)">Timed out after ${e.timeout}ms</td>\n  </tr>`).join(""),l=(e.passed||[]).map(e=>`<tr>\n    <td><span class="pass-icon">✓</span></td>\n    <td><code>${esc(e.payload)}</code></td>\n    <td colspan="2">${esc(e.description)}</td>\n  </tr>`).join("");return`\n<div class="section" id="self-attack-section">\n  <div class="section-header">\n    <div class="section-title">&#128481; Self-Attack <span style="color:${o};margin-left:0.5rem">${t}/100</span></div>\n    <span class="section-badge ${n+s===0?"pass":"fail"}">${n} crash, ${s} hang, ${a} missed</span>\n    <span class="chevron">&#8964;</span>\n  </div>\n  <div class="collapsible-body section-body">\n    ${n+s+a+r>0?`\n    <table class="test-table">\n      <thead><tr><th></th><th>Payload</th><th>Description</th><th>Details</th></tr></thead>\n      <tbody>\n        ${d}\n        ${i}\n        ${l}\n      </tbody>\n    </table>`:'<div style="color:var(--text-muted)">No self-attack results</div>'}\n  </div>\n</div>`}function buildGoldenSection(e){if(!e||!e.hasMaster)return"";const t=e.passed?"improvement":"regression",n=e.passed?"✓":"✗",s=(e.lostDetections||[]).map(e=>`<div style="color:var(--red);font-size:0.85rem">&#8722; ${esc(e)}</div>`).join(""),a=(e.newDetections||[]).map(e=>`<div style="color:var(--green);font-size:0.85rem">&#43; ${esc(e)}</div>`).join("");return`\n<div class="section" id="golden-section">\n  <div class="section-header">\n    <div class="section-title">&#127775; Golden Master Comparison</div>\n    <span class="section-badge ${e.passed?"pass":"fail"}">${e.passed?"No regressions":`${e.regressions} regression(s)`}</span>\n    <span class="chevron">&#8964;</span>\n  </div>\n  <div class="collapsible-body section-body">\n    <div class="${t}">\n      <strong>${n} ${esc(e.summary)}</strong>\n      <div style="margin-top:0.5rem;color:var(--text-muted);font-size:0.85rem">\n        Golden from: ${esc(e.goldenTimestamp||"unknown")} &nbsp;|&nbsp;\n        Previous score: ${null!=e.goldenScore?e.goldenScore:"N/A"}\n      </div>\n    </div>\n    ${s?`<div style="margin-top:1rem"><strong style="color:var(--red)">Regressions (lost detections):</strong>${s}</div>`:""}\n    ${a?`<div style="margin-top:1rem"><strong style="color:var(--green)">Improvements (new detections):</strong>${a}</div>`:""}\n  </div>\n</div>`}function buildDivergenceSection(e){if(!e||!e.sampled)return"";const t=null!=e.agreementRate?e.agreementRate:0,n=t>=95?"#22c55e":t>=80?"#f59e0b":"#ef4444",s=(e.divergences||[]).length,a=(e.divergences||[]).map(e=>`<tr>\n    <td><span class="warn-icon">⚠</span></td>\n    <td><code>${esc(e.seedId)}</code></td>\n    <td><span class="badge badge-lang">${esc(e.language)}</span></td>\n    <td><span class="badge badge-category">${esc(e.category)}</span></td>\n    <td style="font-size:0.8rem;color:var(--text-muted)">${esc(e.phase)}</td>\n    <td style="font-size:0.8rem">${esc(JSON.stringify(e.heuristicCategories))}</td>\n    <td style="font-size:0.8rem">${esc(JSON.stringify(e.productionCategories))}</td>\n  </tr>`).join("");return`\n<div class="section" id="divergence-section">\n  <div class="section-header">\n    <div class="section-title">&#128269; Heuristic-CLI Agreement <span style="color:${n};margin-left:0.5rem">${t}%</span></div>\n    <span class="section-badge ${0===s?"pass":"fail"}">${0===s?"No divergences":`${s} divergence(s)`}</span>\n    <span class="chevron">&#8964;</span>\n  </div>\n  <div class="collapsible-body section-body">\n    <div style="color:var(--text-muted);font-size:0.85rem;margin-bottom:1rem">\n      Randomly sampled ${Math.round(100*e.sampleRate)}% of seeds where the fast heuristic\n      (<code>_simulateScan()</code>) reported "detected", then cross-checked against the real\n      production scanner (CodeScanner + HallucinationDetector). Agreement: <strong>${t}%</strong>\n      on ${e.sampled} sampled seed(s). This never affects the headline Crucible score.\n    </div>\n    ${a?`\n    <table class="test-table">\n      <thead><tr><th></th><th>Seed</th><th>Lang</th><th>Category</th><th>Phase</th><th>Heuristic</th><th>Production</th></tr></thead>\n      <tbody>${a}</tbody>\n    </table>`:""}\n  </div>\n</div>`}class ReportGenerator{constructor(e={}){this.outputDir=path.resolve(e.outputDir||process.cwd())}generate(e,t={}){const n=(e.timestamp||(new Date).toISOString()).replace(/[:.]/g,"-").slice(0,19),s=t.filename||`crucible-report-${n}.html`,a=path.basename(s),r=path.join(this.outputDir,a),o=generateHTML(e);return fs.writeFileSync(r,o,"utf-8"),r}generateJSON(e,t={}){const n=e.timestamp||(new Date).toISOString(),s=n.replace(/[:.]/g,"-").slice(0,19),a=t.filename||`crucible-report-${s}.json`,r=path.basename(a),o=path.join(this.outputDir,r),d="number"==typeof e.score?e.score:calculateCrucibleScore(e),i={timestamp:n,score:d,scoreLabel:scoreLabel(d),scannerVersion:getScannerVersion(),level:e.level||"medium",seeds:e.seedResults?{total:e.seedResults.total,detected:e.seedResults.detected,missed:e.seedResults.missed,rate:e.seedResults.total>0?Math.round(e.seedResults.detected/e.seedResults.total*100):null,byCategory:e.seedResults.byCategory||{},byLanguage:e.seedResults.byLanguage||{}}:null,mutations:e.mutationResults?{total:e.mutationResults.total,killed:e.mutationResults.killed,survived:e.mutationResults.survived,killRate:e.mutationResults.total>0?Math.round(e.mutationResults.killed/e.mutationResults.total*100):null}:null,kenny:e.kennyResults?{score:e.kennyResults.score,passed:e.kennyResults.passed,total:e.kennyResults.total}:null,selfAttack:e.selfAttackResults?{score:e.selfAttackResults.score}:null,golden:e.goldenComparison?{passed:e.goldenComparison.passed,regressions:e.goldenComparison.regressions}:null,divergence:e.divergenceStats&&e.divergenceStats.sampled?{sampleRate:e.divergenceStats.sampleRate,sampled:e.divergenceStats.sampled,agreements:e.divergenceStats.agreements,agreementRate:e.divergenceStats.agreementRate,divergences:e.divergenceStats.divergences}:null};return fs.writeFileSync(o,JSON.stringify(i,null,2),"utf-8"),o}}module.exports={ReportGenerator:ReportGenerator,generateHTML:generateHTML,calculateCrucibleScore:calculateCrucibleScore,scoreColor:scoreColor,scoreLabel:scoreLabel,getScannerVersion:getScannerVersion};