thuban 0.4.9 → 0.4.11

package/dist/packages/scanner/python_ast_helper.py

@@ -0,0 +1,426 @@
+#!/usr/bin/env python3
+"""
+Thuban Python AST Helper
+
+Reads Python source from stdin, parses it with the built-in `ast` module,
+and prints a single-line JSON report to stdout describing:
+
+  - unused_import       Imported names never referenced anywhere in the file
+  - unused_variable     Local variables assigned in a function but never read
+  - high_complexity     Functions whose McCabe cyclomatic complexity exceeds
+                         COMPLEXITY_THRESHOLD
+  - dead_code           Statements that are unreachable because they follow
+                         an unconditional return/raise/break/continue in the
+                         same block
+  - bare_except         `except:` clauses with no exception type
+  - mutable_default_arg Function parameters defaulting to a mutable literal
+                         (list/dict/set) or list()/dict()/set() call
+
+This script is invoked by packages/scanner/python-ast-analyzer.js as a
+subprocess (one call per Python file). It must never raise past main() -
+on any parse failure it prints {"ok": false, "error": "..."} and exits 0,
+so the caller can treat AST analysis as a best-effort supplement.
+
+Output contract (stdout, single JSON object):
+  {"ok": true, "issues": [{"type": str, "line": int, "name": str|null, "message": str}, ...]}
+  {"ok": false, "error": str}
+"""
+
+import ast
+import json
+import sys
+
+COMPLEXITY_THRESHOLD = 10
+
+TERMINATOR_TYPES = (ast.Return, ast.Raise, ast.Continue, ast.Break)
+
+
+# ─────────────────────────────────────────────────────────────────────────
+#  Unused imports
+# ─────────────────────────────────────────────────────────────────────────
+
+class _UnusedImportChecker:
+    def __init__(self, tree):
+        self.tree = tree
+        self.imports = []          # [{'name', 'line', 'source'}]
+        self.used_names = set()
+        self.dunder_all_names = set()
+
+    def collect(self):
+        for node in ast.walk(self.tree):
+            if isinstance(node, ast.Import):
+                for alias in node.names:
+                    if alias.name == '*':
+                        continue
+                    bound = alias.asname or alias.name.split('.')[0]
+                    self.imports.append({'name': bound, 'line': node.lineno, 'source': ''})
+            elif isinstance(node, ast.ImportFrom):
+                if node.module == '__future__':
+                    continue
+                for alias in node.names:
+                    if alias.name == '*':
+                        continue
+                    bound = alias.asname or alias.name
+                    self.imports.append({'name': bound, 'line': node.lineno, 'source': node.module or ''})
+            elif isinstance(node, ast.Name) and isinstance(node.ctx, ast.Load):
+                self.used_names.add(node.id)
+            elif isinstance(node, ast.Assign):
+                for target in node.targets:
+                    if isinstance(target, ast.Name) and target.id == '__all__' and \
+                            isinstance(node.value, (ast.List, ast.Tuple, ast.Set)):
+                        for elt in node.value.elts:
+                            if isinstance(elt, ast.Constant) and isinstance(elt.value, str):
+                                self.dunder_all_names.add(elt.value)
+
+    def unused(self):
+        issues = []
+        seen = set()
+        for imp in self.imports:
+            name = imp['name']
+            if name.startswith('_'):
+                continue
+            if name in self.used_names or name in self.dunder_all_names:
+                continue
+            key = (name, imp['line'])
+            if key in seen:
+                continue
+            seen.add(key)
+            source_suffix = " from '%s'" % imp['source'] if imp['source'] else ''
+            issues.append({
+                'type': 'unused_import',
+                'line': imp['line'],
+                'name': name,
+                'message': "Unused import: '%s'%s" % (name, source_suffix),
+            })
+        return issues
+
+
+# ─────────────────────────────────────────────────────────────────────────
+#  Per-function analysis: complexity, unused locals, mutable defaults
+# ─────────────────────────────────────────────────────────────────────────
+
+class _ComplexityVisitor(ast.NodeVisitor):
+    """Counts McCabe decision points within a single function's own body,
+    stopping at nested function/lambda boundaries (those are analyzed
+    independently when ast.walk() reaches them on its own)."""
+
+    def __init__(self):
+        self.complexity = 1
+
+    def visit_If(self, node):
+        self.complexity += 1
+        self.generic_visit(node)
+
+    def visit_For(self, node):
+        self.complexity += 1
+        self.generic_visit(node)
+
+    def visit_AsyncFor(self, node):
+        self.complexity += 1
+        self.generic_visit(node)
+
+    def visit_While(self, node):
+        self.complexity += 1
+        self.generic_visit(node)
+
+    def visit_IfExp(self, node):
+        self.complexity += 1
+        self.generic_visit(node)
+
+    def visit_ExceptHandler(self, node):
+        self.complexity += 1
+        self.generic_visit(node)
+
+    def visit_BoolOp(self, node):
+        self.complexity += max(len(node.values) - 1, 0)
+        self.generic_visit(node)
+
+    def visit_comprehension(self, node):
+        self.complexity += len(node.ifs)
+        self.generic_visit(node)
+
+    # Nested scopes get their own complexity computation - don't descend.
+    def visit_FunctionDef(self, node):
+        pass
+
+    def visit_AsyncFunctionDef(self, node):
+        pass
+
+    def visit_Lambda(self, node):
+        pass
+
+
+def _compute_complexity(fn):
+    visitor = _ComplexityVisitor()
+    for stmt in fn.body:
+        visitor.visit(stmt)
+    return visitor.complexity
+
+
+def _is_mutable_default(default):
+    if isinstance(default, (ast.List, ast.Dict, ast.Set)):
+        return True
+    if isinstance(default, ast.Call) and isinstance(default.func, ast.Name):
+        return default.func.id in ('list', 'dict', 'set')
+    return False
+
+
+def _mutable_defaults(fn):
+    issues = []
+    args = fn.args
+    positional = list(getattr(args, 'posonlyargs', [])) + list(args.args)
+    if args.defaults:
+        for arg, default in zip(reversed(positional), reversed(args.defaults)):
+            if _is_mutable_default(default):
+                issues.append({
+                    'type': 'mutable_default_arg',
+                    'line': default.lineno,
+                    'name': arg.arg,
+                    'message': "Mutable default argument '%s' in function '%s' - shared across all calls" % (arg.arg, fn.name),
+                })
+    for arg, default in zip(args.kwonlyargs, args.kw_defaults or []):
+        if default is not None and _is_mutable_default(default):
+            issues.append({
+                'type': 'mutable_default_arg',
+                'line': default.lineno,
+                'name': arg.arg,
+                'message': "Mutable default argument '%s' in function '%s' - shared across all calls" % (arg.arg, fn.name),
+            })
+    return issues
+
+
+class _LocalAssignCollector(ast.NodeVisitor):
+    """Collects simple (single-Name-target) local assignments made directly
+    within a function's own body - not inside nested function/lambda
+    scopes, which own their own locals."""
+
+    def __init__(self):
+        self.assigned = {}   # name -> first assignment line
+        self.declared_global_nonlocal = set()
+
+    def visit_Assign(self, node):
+        if len(node.targets) == 1 and isinstance(node.targets[0], ast.Name):
+            name = node.targets[0].id
+            self.assigned.setdefault(name, node.lineno)
+        self.generic_visit(node)
+
+    def visit_AnnAssign(self, node):
+        if isinstance(node.target, ast.Name) and node.value is not None:
+            self.assigned.setdefault(node.target.id, node.lineno)
+        self.generic_visit(node)
+
+    def visit_For(self, node):
+        if isinstance(node.target, ast.Name):
+            self.assigned.setdefault(node.target.id, node.lineno)
+        self.generic_visit(node)
+
+    def visit_With(self, node):
+        for item in node.items:
+            if item.optional_vars is not None and isinstance(item.optional_vars, ast.Name):
+                self.assigned.setdefault(item.optional_vars.id, node.lineno)
+        self.generic_visit(node)
+
+    def visit_Global(self, node):
+        self.declared_global_nonlocal.update(node.names)
+
+    def visit_Nonlocal(self, node):
+        self.declared_global_nonlocal.update(node.names)
+
+    def visit_FunctionDef(self, node):
+        pass
+
+    def visit_AsyncFunctionDef(self, node):
+        pass
+
+    def visit_Lambda(self, node):
+        pass
+
+
+class _LoadNameCollector(ast.NodeVisitor):
+    """Collects every Name read (Load context) anywhere within a subtree,
+    INCLUDING nested functions/lambdas - a variable captured by a closure
+    still counts as used."""
+
+    def __init__(self):
+        self.loaded = set()
+
+    def visit_Name(self, node):
+        if isinstance(node.ctx, ast.Load):
+            self.loaded.add(node.id)
+        self.generic_visit(node)
+
+
+def _unused_locals(fn):
+    assign_collector = _LocalAssignCollector()
+    for stmt in fn.body:
+        assign_collector.visit(stmt)
+
+    load_collector = _LoadNameCollector()
+    load_collector.visit(fn)
+
+    issues = []
+    for name, line in assign_collector.assigned.items():
+        if name.startswith('_'):
+            continue
+        if name in assign_collector.declared_global_nonlocal:
+            continue
+        if name in load_collector.loaded:
+            continue
+        issues.append({
+            'type': 'unused_variable',
+            'line': line,
+            'name': name,
+            'message': "Variable '%s' is assigned but never used" % name,
+        })
+    return issues
+
+
+# ─────────────────────────────────────────────────────────────────────────
+#  Dead code (unreachable statements)
+# ─────────────────────────────────────────────────────────────────────────
+
+def _check_block(stmts, issues):
+    for i, stmt in enumerate(stmts):
+        if isinstance(stmt, TERMINATOR_TYPES):
+            if i + 1 < len(stmts):
+                nxt = stmts[i + 1]
+                kind = type(stmt).__name__.lower()
+                issues.append({
+                    'type': 'dead_code',
+                    'line': nxt.lineno,
+                    'name': None,
+                    'message': "Unreachable code after '%s' statement" % kind,
+                })
+            break  # only report the first unreachable run per block
+
+
+class _DeadCodeVisitor(ast.NodeVisitor):
+    def __init__(self):
+        self.issues = []
+
+    def visit_Module(self, node):
+        _check_block(node.body, self.issues)
+        self.generic_visit(node)
+
+    def visit_FunctionDef(self, node):
+        _check_block(node.body, self.issues)
+        self.generic_visit(node)
+
+    def visit_AsyncFunctionDef(self, node):
+        _check_block(node.body, self.issues)
+        self.generic_visit(node)
+
+    def visit_If(self, node):
+        _check_block(node.body, self.issues)
+        _check_block(node.orelse, self.issues)
+        self.generic_visit(node)
+
+    def visit_For(self, node):
+        _check_block(node.body, self.issues)
+        _check_block(node.orelse, self.issues)
+        self.generic_visit(node)
+
+    def visit_AsyncFor(self, node):
+        _check_block(node.body, self.issues)
+        _check_block(node.orelse, self.issues)
+        self.generic_visit(node)
+
+    def visit_While(self, node):
+        _check_block(node.body, self.issues)
+        _check_block(node.orelse, self.issues)
+        self.generic_visit(node)
+
+    def visit_Try(self, node):
+        _check_block(node.body, self.issues)
+        for handler in node.handlers:
+            _check_block(handler.body, self.issues)
+        _check_block(node.orelse, self.issues)
+        _check_block(node.finalbody, self.issues)
+        self.generic_visit(node)
+
+    def visit_With(self, node):
+        _check_block(node.body, self.issues)
+        self.generic_visit(node)
+
+    def visit_AsyncWith(self, node):
+        _check_block(node.body, self.issues)
+        self.generic_visit(node)
+
+
+# ─────────────────────────────────────────────────────────────────────────
+#  Suspicious patterns: bare except
+# ─────────────────────────────────────────────────────────────────────────
+
+def _find_bare_except(tree):
+    issues = []
+    for node in ast.walk(tree):
+        if isinstance(node, ast.ExceptHandler) and node.type is None:
+            issues.append({
+                'type': 'bare_except',
+                'line': node.lineno,
+                'name': None,
+                'message': "Bare 'except:' catches all exceptions including SystemExit/KeyboardInterrupt - catch specific exception types instead",
+            })
+    return issues
+
+
+# ─────────────────────────────────────────────────────────────────────────
+#  Entry point
+# ─────────────────────────────────────────────────────────────────────────
+
+def main():
+    source = sys.stdin.read()
+
+    try:
+        tree = ast.parse(source)
+    except SyntaxError as e:
+        print(json.dumps({'ok': False, 'error': 'SyntaxError: %s' % e}))
+        return
+    except Exception as e:  # pragma: no cover - defensive
+        print(json.dumps({'ok': False, 'error': str(e)}))
+        return
+
+    issues = []
+
+    try:
+        importer = _UnusedImportChecker(tree)
+        importer.collect()
+        issues.extend(importer.unused())
+    except Exception:
+        pass
+
+    try:
+        for node in ast.walk(tree):
+            if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                issues.extend(_mutable_defaults(node))
+                complexity = _compute_complexity(node)
+                if complexity > COMPLEXITY_THRESHOLD:
+                    issues.append({
+                        'type': 'high_complexity',
+                        'line': node.lineno,
+                        'name': node.name,
+                        'message': "Function '%s' has cyclomatic complexity %d (threshold %d)" % (
+                            node.name, complexity, COMPLEXITY_THRESHOLD),
+                    })
+                issues.extend(_unused_locals(node))
+    except Exception:
+        pass
+
+    try:
+        dead_code_visitor = _DeadCodeVisitor()
+        dead_code_visitor.visit(tree)
+        issues.extend(dead_code_visitor.issues)
+    except Exception:
+        pass
+
+    try:
+        issues.extend(_find_bare_except(tree))
+    except Exception:
+        pass
+
+    issues.sort(key=lambda i: i.get('line') or 0)
+    print(json.dumps({'ok': True, 'issues': issues}))
+
+
+if __name__ == '__main__':
+    main()

package/dist/packages/scanner/risk-valuation.js

@@ -0,0 +1 @@
+"use strict";const RISK_PROFILES={sqlInjection:{label:"SQL Injection",probability:.35,probabilityLabel:"High",impactMin:12e5,impactMax:32e5,source:"IBM Cost of a Data Breach — breach involving injection/database compromise"},xss:{label:"Cross-Site Scripting (XSS)",probability:.25,probabilityLabel:"Medium",impactMin:3e5,impactMax:9e5,source:"Industry incident-response data — client-side compromise / session hijack"},authBypass:{label:"Authentication Bypass",probability:.3,probabilityLabel:"High",impactMin:5e5,impactMax:15e5,source:"Account takeover remediation + notification cost benchmarks"},hardcodedSecret:{label:"Hardcoded Secret / Credential",probability:.2,probabilityLabel:"Medium",impactMin:2e5,impactMax:8e5,source:"Credential leak incident response + key rotation cost"},hallucinatedApi:{label:"Hallucinated / Phantom API Call",probability:.55,probabilityLabel:"High",impactMin:1e4,impactMax:5e4,source:"Production incident / outage cost for runtime crash"},deprecatedApi:{label:"Deprecated API Usage",probability:.15,probabilityLabel:"Low",impactMin:5e3,impactMax:25e3,source:"Future breakage remediation cost"},injectionGeneric:{label:"Injection / Taint Risk (Generic)",probability:.25,probabilityLabel:"Medium",impactMin:4e5,impactMax:12e5,source:"IBM Cost of a Data Breach — generic injection-class vulnerability"},ghostCode:{label:"Ghost / Dead Code",probability:.05,probabilityLabel:"Low",impactMin:1e3,impactMax:8e3,source:"Maintenance overhead / accidental re-activation risk"},codeClone:{label:"Code Clone / Duplication",probability:.08,probabilityLabel:"Low",impactMin:2e3,impactMax:15e3,source:"Divergent-fix maintenance risk (bug fixed in one clone, not others)"},qualityGeneric:{label:"Code Quality Issue (Generic)",probability:.05,probabilityLabel:"Low",impactMin:500,impactMax:5e3,source:"General defect / maintenance cost"}},DEV_HOURLY_RATE=150;function classifyIssue(e){const i=`${e.message||""} ${e.name||""} ${e.id||""}`.toLowerCase(),t=(e.category||"").toLowerCase();return"info"===e.severity?null:i.includes("sql")&&i.includes("inject")?"sqlInjection":i.includes("xss")||i.includes("cross-site")?"xss":i.includes("auth")&&(i.includes("bypass")||i.includes("missing")||i.includes("weak"))?"authBypass":i.includes("secret")||i.includes("hardcoded")||i.includes("credential")||i.includes("api key")||i.includes("apikey")||"secret"===t||"secret-history"===t?"hardcodedSecret":i.includes("inject")||i.includes("taint")||"security"===t?"injectionGeneric":"quality"===t||"style"===t?"qualityGeneric":null}const FIX_HOURS_BY_TYPE={sqlInjection:3,xss:2,authBypass:4,hardcodedSecret:1,hallucinatedApi:2,deprecatedApi:1.5,injectionGeneric:2.5,ghostCode:.5,codeClone:3,qualityGeneric:.3};function calculateRiskValuation(e={}){const i=e.scanResults||{},t=e.hallResults||{},a=e.ghostResults||{},o=e.cloneResults||{},c={},n=(e,i=1)=>{c[e]||(c[e]=0),c[e]+=i};for(const e of i.issues||[]){const i=classifyIssue(e);i&&n(i)}const s=(t.phantomAPIs||[]).length,l=(t.deprecatedAPIs||[]).length;s>0&&n("hallucinatedApi",s),l>0&&n("deprecatedApi",l);const r=a.totalGhosts||0;r>0&&n("ghostCode",r);const u=o.totalClusters||0;u>0&&n("codeClone",u);const d=[];let p=0,b=0,y=0;for(const[e,i]of Object.entries(c)){if(i<=0)continue;const t=RISK_PROFILES[e];if(!t)continue;const a=i*t.impactMax,o=i*t.impactMin,c=(t.impactMin+t.impactMax)/2,n=i*t.probability*c,s=i*(FIX_HOURS_BY_TYPE[e]||1),l=150*s;p+=a,b+=n,y+=s,d.push({typeKey:e,label:t.label,count:i,probability:t.probability,probabilityLabel:t.probabilityLabel,impactMin:o,impactMax:a,expectedLoss:Math.round(n),fixHours:Math.round(10*s)/10,fixCost:Math.round(l),source:t.source})}d.sort((e,i)=>i.expectedLoss-e.expectedLoss);const h=Math.round(150*y);p=Math.round(p),b=Math.round(b);let m=null,M=null;return h>0&&(m=Math.round((b-h)/h*100),M=Math.round(b/h*10)/10),{byType:d,totalMaxExposure:p,totalExpectedLoss:b,costToFix:h,fixHours:Math.round(10*y)/10,hourlyRate:150,roi:m,roiMultiple:M,hasFindings:d.length>0}}module.exports={calculateRiskValuation:calculateRiskValuation,RISK_PROFILES:RISK_PROFILES,DEV_HOURLY_RATE:150};

package/dist/packages/scanner/scan-history.js

@@ -0,0 +1 @@
+"use strict";const fs=require("fs"),path=require("path"),HISTORY_FILENAME=".thuban-history.json",MAX_ENTRIES=500;function historyPath(e){return path.join(path.resolve(e),HISTORY_FILENAME)}function loadHistory(e){const t=historyPath(e);if(!fs.existsSync(t))return{entries:[]};try{const e=JSON.parse(fs.readFileSync(t,"utf-8"));return Array.isArray(e)?{entries:e}:{entries:Array.isArray(e.entries)?e.entries:[]}}catch{return{entries:[]}}}function recordScan(e,t){const r=historyPath(e),n=loadHistory(e),s={date:(new Date).toISOString(),trustScore:"number"==typeof t.trustScore?t.trustScore:null,crucibleScore:"number"==typeof t.crucibleScore?t.crucibleScore:null,findingsByType:t.findingsByType||{}};n.entries.push(s),n.entries.length>500&&(n.entries=n.entries.slice(n.entries.length-500));try{fs.writeFileSync(r,JSON.stringify({_version:"1.0.0",entries:n.entries},null,2),"utf-8")}catch{}return n.entries}function analyzeTrend(e){const t=(e||[]).filter(e=>"number"==typeof e.trustScore);if(0===t.length)return{hasHistory:!1,isFirstScan:!0,scanCount:0,direction:null,avgMonthlyChange:null,firstScore:null,latestScore:null,totalChange:null,series:[]};if(1===t.length)return{hasHistory:!0,isFirstScan:!0,scanCount:1,direction:null,avgMonthlyChange:null,firstScore:t[0].trustScore,latestScore:t[0].trustScore,totalChange:0,series:t};const r=t[0],n=t[t.length-1],s=n.trustScore-r.trustScore,i=new Date(r.date).getTime(),o=new Date(n.date).getTime(),a=Math.max((o-i)/2592e6,1/30),c=Math.round(s/a*10)/10;let l;return l=Math.abs(s)<2?"flat":s>0?"improving":"declining",{hasHistory:!0,isFirstScan:!1,scanCount:t.length,direction:l,avgMonthlyChange:c,firstScore:r.trustScore,latestScore:n.trustScore,totalChange:Math.round(10*s)/10,series:t}}function recordAndAnalyze(e,t){const r=loadHistory(e).entries,n=analyzeTrend(r),s=analyzeTrend(recordScan(e,t));return s.wasFirstScanBeforeThis=0===r.filter(e=>"number"==typeof e.trustScore).length,s.priorLatestScore=n.latestScore,s}module.exports={recordScan:recordScan,loadHistory:loadHistory,analyzeTrend:analyzeTrend,recordAndAnalyze:recordAndAnalyze,HISTORY_FILENAME:HISTORY_FILENAME};

package/dist/packages/scanner/secret-scanner.js

@@ -0,0 +1 @@
+const fs=require("fs"),path=require("path"),crypto=require("crypto"),EventEmitter=require("events"),{execFileSync:execFileSync}=require("child_process"),GENERATED_OUTPUT_PATTERN=/^thuban-(sbom-(cyclonedx|spdx)|investor-report|scan-results|passport)-.*\.(json|html)$/i,LOCKFILE_NAMES=new Set(["package-lock.json","npm-shrinkwrap.json","yarn.lock","pnpm-lock.yaml","composer.lock","Cargo.lock","Gemfile.lock","poetry.lock","Pipfile.lock","go.sum"]);class SecretScanner extends EventEmitter{constructor(e={}){super();const t=new Set(["rootPath","ignorePatterns","maxFileSize","entropyThreshold","minEntropyLength","includeGitHistory"]),i={};for(const s of Object.keys(e))t.has(s)&&(i[s]=e[s]);this.config={rootPath:i.rootPath||process.cwd(),ignorePatterns:i.ignorePatterns||["node_modules/**",".git/**","dist/**",".next/**","coverage/**"],maxFileSize:i.maxFileSize||1048576,entropyThreshold:i.entropyThreshold||4.2,minEntropyLength:i.minEntropyLength||20,includeGitHistory:void 0===i.includeGitHistory||i.includeGitHistory},this.scanExtensions=new Set([".env",".js",".jsx",".ts",".tsx",".py",".json",".yaml",".yml",".toml",".ini",".conf",".config",".properties",".sh",".bash",".zsh"]),this.ignoredDirectories=["node_modules",".git","dist",".next","coverage",".venv","venv","__pycache__"],this.safeLinePatterns=[/process\.env\./i,/process\.env\[/i,/os\.environ/i,/sample/i,/placeholder/i,/dummy/i,/mock/i,/example/i,/replace[_-\s]?me/i,/replace[_-\s]?with/i,/local-dev-token/i,/changeme/i,/your[_-\s]?key/i,/your[_-\s]?(secret|token|password)/i,/<secret>/i,/<token>/i,/x{8,}/i],this.secretPatterns=[{id:"SECRET001",type:"Stripe Secret Key",severity:"critical",recommendation:"Move this key to a cloud secret manager and load it via environment variables.",pattern:/\bsk_(live|test)_[0-9a-zA-Z]{16,}\b/gi},{id:"SECRET002",type:"Stripe Publishable Key",severity:"high",recommendation:"Verify this publishable key is intended to be public; if not, move it to managed secrets.",pattern:/\bpk_(live|test)_[0-9a-zA-Z]{16,}\b/gi},{id:"SECRET003",type:"AWS Access Key",severity:"critical",recommendation:"Rotate the AWS credential immediately and store replacements in a cloud secret manager.",pattern:/\b(AKIA|ASIA|AGPA|AIDA|AROA|AIPA)[A-Z0-9]{16}\b/g},{id:"SECRET004",type:"GitHub Token",severity:"critical",recommendation:"Revoke the GitHub token and replace it with a managed secret or GitHub App credential.",pattern:/\b(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b/g},{id:"SECRET005",type:"Slack Token",severity:"critical",recommendation:"Rotate the Slack token and move it into a cloud secret manager.",pattern:/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g},{id:"SECRET006",type:"Twilio Credential",severity:"critical",recommendation:"Rotate the Twilio credential and store it in managed secrets.",pattern:/\b(SK|AC)[0-9a-fA-F]{32}\b/g},{id:"SECRET007",type:"Google API Key",severity:"critical",recommendation:"Restrict and rotate the Google API key, then move it to a cloud secret manager.",pattern:/\bAIza[0-9A-Za-z\-_]{35}\b/g},{id:"SECRET007B",type:"OpenAI Project Key",severity:"critical",recommendation:"Rotate the OpenAI project key and move it to a cloud secret manager.",pattern:/\bsk-proj-[A-Za-z0-9\-_]{20,}\b/g},{id:"SECRET007C",type:"Cartesia API Key",severity:"critical",recommendation:"Rotate the Cartesia API key and move it to a cloud secret manager.",pattern:/\bsk_car_[A-Za-z0-9]{16,}\b/g},{id:"SECRET008",type:"JWT Token",severity:"high",recommendation:"Do not hardcode JWTs; issue them dynamically and store signing secrets in managed secrets.",pattern:/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9._-]{8,}\.[A-Za-z0-9._-]{8,}\b/g},{id:"SECRET009",type:"Bearer Token",severity:"high",recommendation:"Move bearer tokens to a cloud secret manager and inject them at runtime.",pattern:/\bBearer\s+[A-Za-z0-9\-._~+/]+=*\b/g},{id:"SECRET010",type:"Private Key",severity:"critical",recommendation:"Remove the private key from source control, rotate it, and store it in a secret manager.",pattern:/-----BEGIN (RSA |DSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/g},{id:"SECRET011",type:"Database Connection String with Password",severity:"critical",recommendation:"Move the connection string to managed secrets and avoid embedding passwords in code or config.",pattern:/\b(?:postgres(?:ql)?|mysql|mssql|mongodb(?:\+srv)?|redis):\/\/[^:\s]+:[^@\s]+@[^'"`\s]+\b/gi},{id:"SECRET012",type:"Webhook Secret",severity:"high",recommendation:"Store webhook secrets in a cloud secret manager and inject them via environment variables.",pattern:/\b(?:whsec_[A-Za-z0-9]+|webhook[_-]?secret[_:=\s'"]+[A-Za-z0-9_\-]{12,})\b/gi},{id:"SECRET013",type:"Hardcoded Password or Secret Assignment",severity:"high",recommendation:"Replace hardcoded credentials with environment variables backed by a cloud secret manager.",pattern:/\b(?:password|passwd|pwd|secret|client_secret|api[_-]?secret|signing[_-]?secret)\b\s*[:=]\s*['"`][^'"`\s][^'"`]{5,}['"`]/gi},{id:"SECRET014",type:"Hardcoded API Key Assignment",severity:"high",recommendation:"Move API keys to a cloud secret manager and reference them through environment variables.",pattern:/\b(?:api[_-]?key|access[_-]?token|auth[_-]?token|token)\b\s*[:=]\s*['"`][A-Za-z0-9_\-./+=]{12,}['"`]/gi},{id:"SECRET015",type:".env File Present",severity:"medium",recommendation:"Ensure .env files are excluded from git and move production secrets to a cloud secret manager.",filePattern:/(^|[\\/])\.env(\.[^\\/]+)?$/i},{id:"SECRET016",type:"LiveKit API Secret",severity:"critical",recommendation:"Rotate the LiveKit API secret and store it in managed secrets.",pattern:/\b(?:LIVEKIT_API_SECRET|livekit[_-]?api[_-]?secret)\b\s*[:=]\s*['"`]?([A-Za-z0-9]{24,})['"`]?/gi}]}async scanAll(){const e=Date.now(),t=await this._discoverFiles(this.config.rootPath),i=[];for(const e of t)i.push(...await this.scanFile(e));return this.config.includeGitHistory&&i.push(...this.scanGitHistory()),{filesScanned:t.length,issues:i,summary:this._summarizeIssues(i),duration:Date.now()-e}}async scanFiles(e){const t=[];for(const i of e)t.push(...await this.scanFile(i));return this.config.includeGitHistory&&t.push(...this.scanGitHistory()),{filesScanned:e.length,issues:t,summary:this._summarizeIssues(t)}}async scanFile(e){const t=[],i=path.relative(this.config.rootPath,e).replace(/\\/g,"/");try{if(fs.statSync(e).size>this.config.maxFileSize)return t;const s=path.basename(e),n=fs.readFileSync(e,"utf8").split(/\r?\n/);for(const r of this.secretPatterns)if(r.filePattern&&r.filePattern.test(e)){if(this._shouldSkipLine(s,i,r))continue;this._isGitIgnored(i)||t.push(this._createIssue({file:e,line:1,type:r.type,severity:r.severity,recommendation:"Add this file to .gitignore and move any production secrets to a cloud secret manager.",id:r.id,match:s,category:"secret"}))}else if(r.pattern)for(let s=0;s<n.length;s++){const o=n[s];if(this._shouldSkipLine(o,i,r))continue;let a;for(r.pattern.lastIndex=0;null!==(a=r.pattern.exec(o));){const i=a[1]||a[0];this._isLikelyPlaceholder(i)||t.push(this._createIssue({file:e,line:s+1,column:a.index,type:r.type,severity:r.severity,recommendation:r.recommendation,id:r.id,match:a[0],category:"secret"}))}}return t.push(...this._scanEntropy(e,n,i)),this._dedupeIssues(t)}catch(t){return[{file:e,line:1,category:"secret",severity:"medium",id:"SECRET_SCAN_ERROR",type:"Secret Scan Error",recommendation:"Verify file permissions and encoding, then rerun the scan.",message:"Failed to scan file for secrets: "+("ENOENT"===t.code?"File not found":"EACCES"===t.code?"Permission denied":"Scan error")}]}}scanGitHistory(){try{const e=execFileSync("git",["log","-p","--all","--full-history","--","."],{cwd:this.config.rootPath,encoding:"utf8",maxBuffer:20971520}),t=[],i=e.split(/\r?\n/);let s=null,n=null;for(const e of i){if(e.startsWith("commit ")){s=e.replace("commit ","").trim();continue}if(e.startsWith("+++ b/")){n=e.replace("+++ b/","").trim();continue}if(!e.startsWith("+")||e.startsWith("+++"))continue;const i=e.slice(1);if(!this._shouldSkipLine(i,n||""))for(const e of this.secretPatterns){if(!e.pattern)continue;let r;for(e.pattern.lastIndex=0;null!==(r=e.pattern.exec(i));){const o=r[1]||r[0];this._isLikelyPlaceholder(o)||t.push({file:n||"unknown",line:null,category:"secret-history",severity:"medium"===e.severity?"high":e.severity,id:`${e.id}_HISTORY`,type:`${e.type} in Git History`,recommendation:"Purge the secret from git history, rotate it, and move it to a cloud secret manager.",message:`Potential secret remains in git history (${s||"unknown commit"})`,commit:s,code:i.trim().slice(0,140)})}}}return this._dedupeIssues(t)}catch(e){return[]}}_scanEntropy(e,t,i){const s=[],n=/['"`]([A-Za-z0-9+/=_\-]{20,})['"`]/g;for(let r=0;r<t.length;r++){const o=t[r];if(this._shouldSkipLine(o,i))continue;let a;for(n.lastIndex=0;null!==(a=n.exec(o));){const t=a[1];if(t.length<this.config.minEntropyLength)continue;if(!/[A-Z]/.test(t)||!/[a-z]/.test(t)||!/[0-9]/.test(t))continue;const i=this._calculateEntropy(t);i>=this.config.entropyThreshold&&s.push(this._createIssue({file:e,line:r+1,column:a.index,type:"High Entropy Secret Candidate",severity:"medium",recommendation:"Review this value, move it to a cloud secret manager if it is a credential, and reference it via environment variables.",id:"SECRET_ENTROPY",match:t,category:"secret",extraMessage:`High-entropy string detected (entropy ${i.toFixed(2)})`}))}}return s}_createIssue({file:e,line:t,column:i,type:s,severity:n,recommendation:r,id:o,match:a,category:c,extraMessage:l}){return{file:e,line:t,column:i,category:c,severity:n,id:o,type:s,recommendation:r,message:l||`${s} detected`,code:"string"==typeof a?a.slice(0,140):""}}async _discoverFiles(e,t=[]){let i=[];try{i=fs.readdirSync(e,{withFileTypes:!0})}catch{return t}for(const s of i){const i=path.join(e,s.name),n=path.relative(this.config.rootPath,i).replace(/\\/g,"/");if(this._shouldIgnore(n))continue;if(s.isDirectory()){await this._discoverFiles(i,t);continue}if(!s.isFile())continue;if(GENERATED_OUTPUT_PATTERN.test(s.name))continue;if(LOCKFILE_NAMES.has(s.name))continue;const r=path.extname(s.name).toLowerCase();(this.scanExtensions.has(r)||s.name.startsWith(".env"))&&t.push(i)}return t}_shouldIgnore(e){const t=e.replace(/\\/g,"/"),i=this.ignoredDirectories;for(const e of i)if(t===e||t.startsWith(`${e}/`)||t.includes(`/${e}/`))return!0;return this.config.ignorePatterns.some(e=>{const i=e.replace(/\\/g,"/"),s=i.replace(/\./g,"\\.").replace(/\*\*/g,".*").replace(/\*/g,"[^/]*");return new RegExp(`^${s}$`).test(t)||t.startsWith(i.replace("/**",""))})}_shouldSkipLine(e,t,i=null){if(!e||!e.trim())return!0;const s=(t||"").replace(/\\/g,"/").toLowerCase();return!!(s.includes("__tests__")||s.includes("/test/")||s.includes("/tests/")||s.endsWith(".spec.js")||s.endsWith(".test.js")||s.endsWith(".spec.ts")||s.endsWith(".test.ts")||s.endsWith(".example")||s.endsWith(".env.example"))||(!i||"SECRET015"!==i.id)&&this.safeLinePatterns.some(t=>t.test(e))}_calculateEntropy(e){const t=new Map;for(const i of e)t.set(i,(t.get(i)||0)+1);let i=0;for(const s of t.values()){const t=s/e.length;i-=t*Math.log2(t)}return i}_isLikelyPlaceholder(e){return!!e&&[/replace[_-\s]?me/i,/replace[_-\s]?with/i,/example/i,/dummy/i,/placeholder/i,/changeme/i,/your[_-\s]?(key|secret|token|password)/i,/local-dev-token/i,/x{8,}/i].some(t=>t.test(e))}_isGitIgnored(e){try{return execFileSync("git",["check-ignore",e],{cwd:this.config.rootPath,stdio:"ignore"}),!0}catch{return!1}}_dedupeIssues(e){const t=new Set;return e.filter(e=>{const i=crypto.createHash("sha1").update(JSON.stringify([e.file,e.line,e.id,e.code,e.commit||""])).digest("hex");return!t.has(i)&&(t.add(i),!0)})}_summarizeIssues(e){return{total:e.length,bySeverity:{critical:e.filter(e=>"critical"===e.severity).length,high:e.filter(e=>"high"===e.severity).length,medium:e.filter(e=>"medium"===e.severity).length},byType:e.reduce((e,t)=>(e[t.type]=(e[t.type]||0)+1,e),{})}}}module.exports=SecretScanner;

package/dist/packages/scanner/sentinel-core.js

@@ -0,0 +1 @@
+const fs=require("fs"),path=require("path"),EventEmitter=require("events");let FileWatcher,CodeScanner,DriftDetector,HealthChecker,AlertManager,SecretScanner;class SentinelCore extends EventEmitter{constructor(e={}){super();const t={...e};delete t.__proto__,delete t.constructor,delete t.prototype,this.config={rootPath:t.rootPath||process.cwd(),watchPatterns:t.watchPatterns||["**/*.js","**/*.ts","**/*.json"],ignorePatterns:t.ignorePatterns||["node_modules/**",".git/**","dist/**",".orion/snapshots/**"],scanIntervalHours:t.scanIntervalHours||6,dailyReportHour:t.dailyReportHour||8,weeklyReportDay:t.weeklyReportDay||1,enableRealtime:!1!==t.enableRealtime,enableScheduled:!1!==t.enableScheduled,alertThreshold:t.alertThreshold||"warning"},this.state={isRunning:!1,lastFullScan:null,lastHealthCheck:null,lastDriftCheck:null,filesWatched:0,issuesFound:[],metrics:{totalScans:0,issuesDetected:0,issuesResolved:0,averageScanTime:0}},this.components={fileWatcher:null,codeScanner:null,driftDetector:null,healthChecker:null,alertManager:null},this.scheduledJobs=[]}async initialize(){console.log("[SENTINEL] Initializing Sentinel Core...");try{return FileWatcher=require("./file-watcher.js"),CodeScanner=require("./code-scanner.js"),DriftDetector=require("./drift-detector.js"),HealthChecker=require("./health-checker.js"),AlertManager=require("./alert-manager.js"),SecretScanner=require("./secret-scanner.js"),this.components.fileWatcher=new FileWatcher(this.config),this.components.codeScanner=new CodeScanner(this.config),this.components.driftDetector=new DriftDetector(this.config),this.components.healthChecker=new HealthChecker(this.config),this.components.alertManager=new AlertManager(this.config),this.components.secretScanner=new SecretScanner(this.config),this._setupEventHandlers(),console.log("[SENTINEL] All components initialized"),{success:!0}}catch(e){return console.error("[SENTINEL] Initialization failed"),{success:!1,error:"Initialization failed"}}}async start(){if(this.state.isRunning)return console.log("[SENTINEL] Already running"),{success:!0,message:"Already running"};console.log("[SENTINEL] Starting Sentinel monitoring...");try{this.config.enableRealtime&&this.components.fileWatcher&&(await this.components.fileWatcher.start(),this.state.filesWatched=this.components.fileWatcher.getWatchedCount()),this.config.enableScheduled&&this._setupScheduledJobs(),await this.runHealthCheck();const e=await this.runFullScan();return this.state.isRunning=!0,this.emit("started",{timestamp:(new Date).toISOString()}),console.log("[SENTINEL] Monitoring active"),console.log(`[SENTINEL] Watching ${this.state.filesWatched} files`),console.log(`[SENTINEL] Initial scan found ${e.issues?.length||0} issues`),{success:!0,filesWatched:this.state.filesWatched,initialIssues:e.issues?.length||0}}catch(e){return console.error("[SENTINEL] Start failed"),{success:!1,error:"Start failed"}}}async stop(){return this.state.isRunning?(console.log("[SENTINEL] Stopping Sentinel monitoring..."),this.components.fileWatcher&&await this.components.fileWatcher.stop(),this.scheduledJobs.forEach(e=>clearInterval(e)),this.scheduledJobs=[],this.state.isRunning=!1,this.emit("stopped",{timestamp:(new Date).toISOString()}),console.log("[SENTINEL] Monitoring stopped"),{success:!0}):{success:!0,message:"Not running"}}async runFullScan(e={}){const t=Date.now();console.log("[SENTINEL] Starting full codebase scan...");const s={timestamp:(new Date).toISOString(),duration:0,filesScanned:0,issues:[],summary:{}};try{if(!this.components.codeScanner)throw new Error("Code scanner not initialized");const e=await this.components.codeScanner.scanAll();if(s.filesScanned=e.filesScanned||0,s.issues.push(...e.issues||[]),this.components.secretScanner){const e=await this.components.secretScanner.scanAll();s.filesScanned+=e.filesScanned||0,s.issues.push(...e.issues||[])}if(this.components.driftDetector){const e=await this.components.driftDetector.detectAll();s.issues.push(...e.issues||[]),this.state.lastDriftCheck=(new Date).toISOString()}return s.duration=Date.now()-t,this.state.lastFullScan=s.timestamp,this.state.metrics.totalScans++,this.state.metrics.issuesDetected+=s.issues.length,this.state.metrics.averageScanTime=(this.state.metrics.averageScanTime*(this.state.metrics.totalScans-1)+s.duration)/this.state.metrics.totalScans,s.summary=this._generateScanSummary(s.issues),this.state.issuesFound=s.issues,await this._processIssues(s.issues),console.log(`[SENTINEL] Scan complete: ${s.filesScanned} files, ${s.issues.length} issues, ${s.duration}ms`),this.emit("scanComplete",s),s}catch(e){return console.error("[SENTINEL] Full scan failed"),s.error="Scan failed",s}}async runQuickScan(e){if(!this.components.codeScanner)return{success:!1,error:"Code scanner not initialized"};console.log(`[SENTINEL] Quick scan on ${e.length} files...`);const t=await this.components.codeScanner.scanFiles(e);return t.issues&&t.issues.length>0&&await this._processIssues(t.issues),t}async runHealthCheck(){if(console.log("[SENTINEL] Running health check..."),!this.components.healthChecker)return{success:!1,error:"Health checker not initialized"};const e=await this.components.healthChecker.checkAll();return this.state.lastHealthCheck=(new Date).toISOString(),e.unhealthySystems&&e.unhealthySystems.length>0&&await(this.components.alertManager?.sendAlert({level:"warning",title:"System Health Issues Detected",message:`${e.unhealthySystems.length} systems are unhealthy`,details:e.unhealthySystems})),this.emit("healthCheck",e),e}async generateDailyDigest(){console.log("[SENTINEL] Generating daily digest...");const e={date:(new Date).toISOString().split("T")[0],timestamp:(new Date).toISOString(),summary:{issuesFound:this.state.issuesFound.length,criticalIssues:this.state.issuesFound.filter(e=>"critical"===e.severity).length,warningIssues:this.state.issuesFound.filter(e=>"warning"===e.severity).length,filesWatched:this.state.filesWatched,lastScan:this.state.lastFullScan,lastHealthCheck:this.state.lastHealthCheck},topIssues:this.state.issuesFound.sort((e,t)=>this._severityScore(t.severity)-this._severityScore(e.severity)).slice(0,10),metrics:this.state.metrics,recommendations:this._generateRecommendations()};return this.components.alertManager&&await this.components.alertManager.sendDigest(e),this.emit("dailyDigest",e),e}async generateWeeklyReport(){console.log("[SENTINEL] Generating weekly report...");const e={weekOf:(new Date).toISOString().split("T")[0],timestamp:(new Date).toISOString(),summary:this.state.metrics,issuesTrend:this._calculateTrend(),codeQuality:await this._assessCodeQuality(),technicalDebt:await this._assessTechnicalDebt(),recommendations:this._generateRecommendations(),fullIssueList:this.state.issuesFound};return this.components.alertManager&&await this.components.alertManager.sendWeeklyReport(e),this.emit("weeklyReport",e),e}getStatus(){return{isRunning:this.state.isRunning,config:this.config,state:{...this.state,componentsLoaded:{fileWatcher:!!this.components.fileWatcher,codeScanner:!!this.components.codeScanner,driftDetector:!!this.components.driftDetector,healthChecker:!!this.components.healthChecker,alertManager:!!this.components.alertManager}},uptime:this.state.isRunning?Date.now()-new Date(this.state.lastFullScan).getTime():0}}_setupEventHandlers(){this.components.fileWatcher&&(this.components.fileWatcher.on("change",async e=>{console.log(`[SENTINEL] File changed: ${e.filePath}`),await this.runQuickScan([e.filePath])}),this.components.fileWatcher.on("error",e=>{console.error("[SENTINEL] File watcher error:",e)})),this.components.codeScanner&&this.components.codeScanner.on("issueFound",async e=>{await this._processIssues([e])})}_setupScheduledJobs(){const e=60*this.config.scanIntervalHours*60*1e3;this.scheduledJobs.push(setInterval(()=>this.runFullScan(),e)),this.scheduledJobs.push(setInterval(()=>this.runHealthCheck(),36e5)),this.scheduledJobs.push(setInterval(()=>{const e=new Date;e.getHours()===this.config.dailyReportHour&&e.getMinutes()<5&&this.generateDailyDigest()},36e5)),this.scheduledJobs.push(setInterval(()=>{const e=new Date;e.getDay()===this.config.weeklyReportDay&&e.getHours()===this.config.dailyReportHour&&e.getMinutes()<5&&this.generateWeeklyReport()},36e5)),console.log(`[SENTINEL] Scheduled jobs: scan every ${this.config.scanIntervalHours}h, daily digest at ${this.config.dailyReportHour}:00`)}async _processIssues(e){for(const t of e)this._meetsThreshold(t.severity)&&this.components.alertManager&&await this.components.alertManager.sendAlert({level:t.severity,title:`[${t.category}] ${t.title||t.message}`,message:t.message,file:t.file,line:t.line,details:t})}_meetsThreshold(e){const t=["info","warning","error","critical"];return t.indexOf(e)>=t.indexOf(this.config.alertThreshold)}_severityScore(e){return{info:1,warning:2,error:3,critical:4}[e]||0}_generateScanSummary(e){return{total:e.length,bySeverity:{critical:e.filter(e=>"critical"===e.severity).length,error:e.filter(e=>"error"===e.severity).length,warning:e.filter(e=>"warning"===e.severity).length,info:e.filter(e=>"info"===e.severity).length},byCategory:e.reduce((e,t)=>(e[t.category]=(e[t.category]||0)+1,e),{})}}_generateRecommendations(){const e=[],t=this.state.issuesFound,s=t.filter(e=>"security"===e.category);s.length>0&&e.push({priority:"high",category:"security",message:`Address ${s.length} security issues before deploying`,issues:s.slice(0,5)});const n=t.filter(e=>"quality"===e.category);n.length>10&&e.push({priority:"medium",category:"quality",message:`Consider refactoring - ${n.length} quality issues detected`,issues:n.slice(0,5)});const i=t.filter(e=>"drift"===e.category);return i.length>0&&e.push({priority:"medium",category:"drift",message:`${i.length} files have drifted from their declared contracts`,issues:i.slice(0,5)}),e}_calculateTrend(){return{direction:"stable",change:0,note:"Trend analysis requires historical data"}}async _assessCodeQuality(){return{score:75,grade:"B",factors:{complexity:70,maintainability:80,documentation:65,testCoverage:40}}}async _assessTechnicalDebt(){return{estimatedHours:40,categories:{refactoring:20,documentation:10,testing:10},priorityItems:[]}}}function createSentinel(e={}){return new SentinelCore(e)}async function main(){const e=createSentinel({rootPath:path.resolve(__dirname,".."),enableRealtime:!0,enableScheduled:!1}),t=await e.initialize();t.success||(console.error("Failed to initialize Sentinel:",t.error),process.exit(1)),await e.start(),console.log("Sentinel status:",e.getStatus()),process.on("SIGINT",async()=>{console.log("\nShutting down Sentinel..."),await e.stop(),process.exit(0)})}require.main===module&&main().catch(console.error),module.exports={SentinelCore:SentinelCore,createSentinel:createSentinel};

package/dist/packages/scanner/supply-chain.js

@@ -0,0 +1 @@
+const fs=require("fs"),path=require("path"),https=require("https"),crypto=require("crypto"),{readJsonSafe:readJsonSafe}=require("./json-file-util.js"),PERMISSIVE_LICENSES=new Set(["MIT","ISC","BSD-2-Clause","BSD-3-Clause","BSD-3-Clause-Clear","BSD-4-Clause","0BSD","Apache-2.0","Unlicense","CC0-1.0","Python-2.0","Zlib","WTFPL","Artistic-2.0","PostgreSQL","blessing","CC-BY-4.0","CC-BY-3.0","OFL-1.1"]),WEAK_COPYLEFT_LICENSES=new Set(["LGPL-2.0","LGPL-2.0-only","LGPL-2.0-or-later","LGPL-2.1","LGPL-2.1-only","LGPL-2.1-or-later","LGPL-3.0","LGPL-3.0-only","LGPL-3.0-or-later","MPL-1.1","MPL-2.0","EPL-1.0","EPL-2.0","CDDL-1.0","CDDL-1.1"]),STRONG_COPYLEFT_LICENSES=new Set(["GPL-1.0","GPL-1.0-only","GPL-1.0-or-later","GPL-2.0","GPL-2.0-only","GPL-2.0-or-later","GPL-3.0","GPL-3.0-only","GPL-3.0-or-later","AGPL-1.0","AGPL-1.0-only","AGPL-1.0-or-later","AGPL-3.0","AGPL-3.0-only","AGPL-3.0-or-later","SSPL-1.0","OSL-3.0"]),UNLICENSED_MARKERS=new Set(["UNLICENSED","UNLICENCED","NONE","NOASSERTION","PROPRIETARY"]);function classifyLicense(e){if(!e||"string"!=typeof e||!e.trim())return"unknown";const t=e.trim();if(UNLICENSED_MARKERS.has(t.toUpperCase()))return"unlicensed";if(/see license in/i.test(t))return"unlicensed";const n=t.replace(/[()]/g," ").split(/\s+(?:OR|AND|WITH)\s+/i).map(e=>e.trim()).filter(Boolean);let s="unknown";const o={unknown:0,permissive:1,"weak-copyleft":2,copyleft:3,unlicensed:3};for(const e of n){let t;t=STRONG_COPYLEFT_LICENSES.has(e)?"copyleft":WEAK_COPYLEFT_LICENSES.has(e)?"weak-copyleft":PERMISSIVE_LICENSES.has(e)?"permissive":UNLICENSED_MARKERS.has(e.toUpperCase())?"unlicensed":"unknown",o[t]>o[s]&&(s=t)}return s}function httpsRequestJSON(e,{method:t="GET",body:n=null,headers:s={},timeout:o=1e4}={}){return new Promise(r=>{let i;try{i=new URL(e)}catch{return r({ok:!1,status:0,error:"invalid URL",data:null})}const a=n?JSON.stringify(n):null,c={hostname:i.hostname,port:443,path:i.pathname+i.search,method:t,headers:Object.assign(a?{"Content-Type":"application/json","Content-Length":Buffer.byteLength(a)}:{},{"User-Agent":"thuban-supply-chain-scanner"},s),timeout:o},l=https.request(c,e=>{let t="";e.on("data",e=>{t+=e}),e.on("end",()=>{if(e.statusCode<200||e.statusCode>=300)return r({ok:!1,status:e.statusCode,error:`HTTP ${e.statusCode}`,data:null});try{r({ok:!0,status:e.statusCode,data:JSON.parse(t)})}catch(t){r({ok:!1,status:e.statusCode,error:`JSON parse error: ${t.message}`,data:null})}})});l.on("timeout",()=>{l.destroy(),r({ok:!1,status:0,error:"timeout",data:null})}),l.on("error",e=>r({ok:!1,status:0,error:e.message,data:null})),a&&l.write(a),l.end()})}async function withConcurrency(e,t,n){const s=new Array(e.length);let o=0;async function r(){for(;o<e.length;){const t=o++;s[t]=await n(e[t],t)}}const i=[];for(let n=0;n<Math.min(t,Math.max(e.length,1));n++)i.push(r());return await Promise.all(i),s}function chunk(e,t){const n=[];for(let s=0;s<e.length;s+=t)n.push(e.slice(s,s+t));return n}function parseSemver(e){if(!e||"string"!=typeof e)return null;const t=e.trim().replace(/^[\^~=vV]+/,""),n=/^(\d+)\.(\d+)\.(\d+)/.exec(t);return n?{major:parseInt(n[1],10),minor:parseInt(n[2],10),patch:parseInt(n[3],10)}:null}function compareSemver(e,t){const n=parseSemver(e),s=parseSemver(t);return n&&s?n.major!==s.major?n.major-s.major:n.minor!==s.minor?n.minor-s.minor:n.patch-s.patch:0}const KNOWN_MALICIOUS_NPM=new Map([["event-stream",{versions:["3.3.6"],reason:"Injected flatmap-stream dependency harvesting Copay wallet credentials (2018)"}],["flatmap-stream",{versions:["0.1.1"],reason:"Malicious payload injected into event-stream dependency chain (2018)"}],["eslint-scope",{versions:["3.7.2"],reason:"Compromised npm account published version stealing npm tokens (2018)"}],["rc",{versions:["1.3.9"],reason:"Supply-chain compromise injecting crypto-clipper malware (Sept 2025 npm incident)"}],["coa",{versions:["2.0.3","2.0.4","2.1.1","2.1.3","3.0.1","3.1.3"],reason:"Compromised maintainer account published credential-stealing payload"}],["ua-parser-js",{versions:["0.7.29","0.8.0","1.0.0"],reason:"Compromised maintainer account published cryptominer/password-stealer (Oct 2021)"}],["node-ipc",{versions:["10.1.1","10.1.2","9.2.2"],reason:'"Protestware" — destructive file-wiping payload targeting Russian/Belarusian IPs (2022)'}],["colors",{versions:["1.4.1"],reason:"Maintainer sabotage — infinite loop / non-ASCII spam payload (Jan 2022)"}],["faker",{versions:["6.6.6"],reason:"Maintainer sabotage — corrupted package output (Jan 2022)"}]]),KNOWN_MALICIOUS_PYPI=new Map([["requests-darwin-lite",{versions:null,reason:"Typosquat of requests exfiltrating credentials"}],["python3-dateutil",{versions:null,reason:"Typosquat of python-dateutil dropping malicious payload (2019)"}],["jeIlyfish",{versions:null,reason:"Typosquat of jellyfish (2019 PyPI typosquat campaign)"}]]),POPULAR_NPM_PACKAGES=["react","react-dom","lodash","express","axios","chalk","commander","debug","request","moment","webpack","babel","eslint","jest","typescript","next","vue","angular","jquery","underscore","async","colors","yargs","inquirer","mongoose","redis","mysql","pg","socket.io","bcrypt","jsonwebtoken","dotenv","cors","body-parser","nodemon","prettier","rimraf","glob","semver","uuid","node-fetch","form-data","qs","minimist","tar","ini","ansi-styles","strip-ansi"];function levenshtein(e,t){if(e===t)return 0;const n=e.length,s=t.length;if(0===n)return s;if(0===s)return n;const o=new Array(s+1);for(let e=0;e<=s;e++)o[e]=e;for(let r=1;r<=n;r++){let n=o[0];o[0]=r;for(let i=1;i<=s;i++){const s=o[i];o[i]=e[r-1]===t[i-1]?n:1+Math.min(n,o[i],o[i-1]),n=s}}return o[s]}const KNOWN_LEGITIMATE_PACKAGES=new Set(["esquery","acorn","espree","estree","eslint-visitor-keys"]);function suspectedTyposquat(e,t){if("npm"!==t)return null;if(e.startsWith("@"))return null;const n=e;if(POPULAR_NPM_PACKAGES.includes(n))return null;if(KNOWN_LEGITIMATE_PACKAGES.has(n))return null;for(const e of POPULAR_NPM_PACKAGES){const t=levenshtein(n,e);if(0!==t&&(t<=(Math.min(n.length,e.length)>=8?2:1)&&Math.abs(n.length-e.length)<=2))return`Name closely resembles popular package "${e}" (edit distance ${t}) — verify this is the intended dependency`}return null}const OSV_ECOSYSTEM_MAP={npm:"npm",pypi:"PyPI",go:"Go",cargo:"crates.io"};async function osvBatchQuery(e,{timeout:t=15e3}={}){const n=new Map;if(0===e.length)return n;const s=chunk(e,500);for(const e of s){const s=e.map(e=>({package:{name:e.name,ecosystem:OSV_ECOSYSTEM_MAP[e.ecosystem]||e.ecosystem},version:e.version})),o=await httpsRequestJSON("https://api.osv.dev/v1/querybatch",{method:"POST",body:{queries:s},timeout:t});o.ok&&o.data&&Array.isArray(o.data.results)&&o.data.results.forEach((t,s)=>{const o=e[s],r=`${o.ecosystem}:${o.name}@${o.version}`;n.set(r,(t.vulns||[]).map(e=>e.id))})}return n}async function osvResolveIds(e,{concurrency:t=10,timeout:n=1e4}={}){const s=[...new Set(e)],o=new Map;return await withConcurrency(s,t,async e=>{const t=await httpsRequestJSON(`https://api.osv.dev/v1/vulns/${encodeURIComponent(e)}`,{timeout:n});t.ok&&t.data&&o.set(e,t.data)}),o}function osvSeverityLabel(e){const t=e?.database_specific?.severity;if(t){const e=String(t).toUpperCase();if("MODERATE"===e)return"MEDIUM";if(["CRITICAL","HIGH","MEDIUM","LOW"].includes(e))return e}const n=(e?.severity||[]).find(e=>/CVSS/i.test(e.type));if(n&&"string"==typeof n.score){const e=/\/A:(N|L|H)/.exec(n.score)||/\/C:(N|L|H)/.exec(n.score);if(e){if("H"===e[1])return"HIGH";if("L"===e[1])return"MEDIUM"}}return"UNKNOWN"}function osvFixedVersion(e,t,n){const s=OSV_ECOSYSTEM_MAP[t]||t;for(const t of e.affected||[])if(t.package&&t.package.ecosystem===s&&t.package.name===n)for(const e of t.ranges||[]){if("SEMVER"!==e.type&&"ECOSYSTEM"!==e.type)continue;const t=(e.events||[]).filter(e=>e.fixed);if(t.length)return t[t.length-1].fixed}return null}const registryCache=new Map;function npmRegistryLookup(e){const t=`npm:${e}`;if(registryCache.has(t))return registryCache.get(t);const n=(async()=>{const t=await httpsRequestJSON(`https://registry.npmjs.org/${encodeURIComponent(e).replace("%40","@")}`,{timeout:1e4});if(!t.ok||!t.data)return null;const n=t.data,s=n["dist-tags"]?.latest||null,o=s?n.versions?.[s]:null;return{latest:s,license:o?.license?.type||o?.license||n.license?.type||n.license||null,deprecated:!!o?.deprecated}})();return registryCache.set(t,n),n}function pypiRegistryLookup(e){const t=`pypi:${e}`;if(registryCache.has(t))return registryCache.get(t);const n=(async()=>{const t=await httpsRequestJSON(`https://pypi.org/pypi/${encodeURIComponent(e)}/json`,{timeout:1e4});if(!t.ok||!t.data)return null;const n=t.data.info||{};let s=n.license&&n.license.trim()?n.license.trim():null;if(!s||s.length>100){const e=(n.classifiers||[]).find(e=>e.startsWith("License :: OSI Approved ::"));e?s=e.split("::").pop().trim():s&&s.length>100&&(s=null)}return{latest:n.version||null,license:s,deprecated:!1}})();return registryCache.set(t,n),n}function cratesRegistryLookup(e){const t=`cargo:${e}`;if(registryCache.has(t))return registryCache.get(t);const n=(async()=>{const t=await httpsRequestJSON(`https://crates.io/api/v1/crates/${encodeURIComponent(e)}`,{timeout:1e4,headers:{"User-Agent":"thuban-supply-chain-scanner (https://thuban.dev)"}});if(!t.ok||!t.data||!t.data.crate)return null;const n=t.data.versions||[],s=n.find(e=>e.num===t.data.crate.max_stable_version)||n[0];return{latest:t.data.crate.max_stable_version||null,license:s?.license||null,deprecated:!!s?.yanked}})();return registryCache.set(t,n),n}function goProxyLookup(e){const t=`go:${e}`;if(registryCache.has(t))return registryCache.get(t);const n=(async()=>{const t=e.split("/").map(e=>e.replace(/[A-Z]/g,e=>"!"+e.toLowerCase())).join("/"),n=await httpsRequestJSON(`https://proxy.golang.org/${t}/@latest`,{timeout:1e4});return n.ok&&n.data?{latest:n.data.Version||null,license:null,deprecated:!1}:null})();return registryCache.set(t,n),n}function registryLookup(e,t){return"npm"===e?npmRegistryLookup(t):"pypi"===e?pypiRegistryLookup(t):"cargo"===e?cratesRegistryLookup(t):"go"===e?goProxyLookup(t):Promise.resolve(null)}function readJSONSafe(e){return readJsonSafe(e,null)}function readTextSafe(e){try{return fs.readFileSync(e,"utf-8")}catch{return null}}function integrityToHex(e){if(!e||"string"!=typeof e)return null;const t=/^sha(?:256|384|512)-([A-Za-z0-9+/=]+)$/.exec(e.split(" ")[0]);if(!t)return null;try{return Buffer.from(t[1],"base64").toString("hex")}catch{return null}}function integrityAlgo(e){return e?e.startsWith("sha512-")?"SHA-512":e.startsWith("sha384-")?"SHA-384":e.startsWith("sha256-")?"SHA-256":null:null}function parseNpmProject(e,t){const n=readJSONSafe(path.join(e,"package.json"));if(!n)return[];const s=new Set([...Object.keys(n.dependencies||{}),...Object.keys(n.devDependencies||{}),...Object.keys(n.optionalDependencies||{}),...Object.keys(n.peerDependencies||{})]),o=new Set(Object.keys(n.devDependencies||{})),r=readJSONSafe(path.join(e,"package-lock.json")),i=[];if(r&&r.lockfileVersion>=2&&r.packages)for(const[e,t]of Object.entries(r.packages)){if(""===e||!e.includes("node_modules/"))continue;if(!t||!t.version)continue;const n=e.lastIndexOf("node_modules/"),r=e.slice(n+13),a=1===(e.match(/node_modules\//g)||[]).length&&s.has(r);i.push({name:r,version:t.version,ecosystem:"npm",direct:a,dev:!!t.dev||a&&o.has(r),license:t.license||null,resolved:t.resolved||null,integrity:t.integrity||null})}else if(r&&r.dependencies){const e=(t,n)=>{for(const[o,r]of Object.entries(t||{}))i.push({name:o,version:r.version,ecosystem:"npm",direct:0===n&&s.has(o),dev:!!r.dev,license:null,resolved:r.resolved||null,integrity:r.integrity||null}),r.dependencies&&e(r.dependencies,n+1)};e(r.dependencies,0)}else if(!t){for(const[e,t]of Object.entries(n.dependencies||{}))i.push({name:e,version:t.replace(/^[\^~]/,""),versionRange:t,ecosystem:"npm",direct:!0,dev:!1,license:null,unresolved:!0});for(const[e,t]of Object.entries(n.devDependencies||{}))i.push({name:e,version:t.replace(/^[\^~]/,""),versionRange:t,ecosystem:"npm",direct:!0,dev:!0,license:null,unresolved:!0})}const a=new Map;for(const e of i){const t=`${e.name}@${e.version}`,n=a.get(t);(!n||e.direct&&!n.direct)&&a.set(t,e)}return[...a.values()]}function parseYarnLock(e,t,n){const s=readTextSafe(path.join(e,"yarn.lock"));if(!s)return[];const o=[],r=s.split(/\n\n+/);for(const e of r){const s=e.split("\n"),r=s[0];if(!r||r.startsWith("#")||!r.includes(":"))continue;const i=s.find(e=>/^\s+version\s+"?/.test(e));if(!i)continue;const a=/"([^"]+)"/.exec(i)||/version\s+(\S+)/.exec(i);if(!a)continue;const c=a[1],l=s.find(e=>/^\s+resolved\s+/.test(e)),u=l?(/"([^"]+)"/.exec(l)||[])[1]:null,p=s.find(e=>/^\s+integrity\s+/.test(e)),d=p?p.replace(/^\s*integrity\s+/,"").trim():null,m=r.replace(/:$/,"").split(",").map(e=>e.trim().replace(/^"|"$/g,"")),h=new Set;for(const e of m){const t=e.lastIndexOf("@"),n=t>0?e.slice(0,t):e;h.add(n)}for(const e of h)o.push({name:e,version:c,ecosystem:"npm",direct:t.has(e),dev:n.has(e),license:null,resolved:u,integrity:d})}return o}function parsePnpmLock(e,t,n){const s=readTextSafe(path.join(e,"pnpm-lock.yaml"));if(!s)return[];const o=[],r=s.split("\n");let i=!1;for(const e of r){if(/^packages:\s*$/.test(e)){i=!0;continue}if(i&&/^\S/.test(e)&&(i=!1),!i)continue;const s=/^\s{2}'?\/?((?:@[^/]+\/)?[^@'\s]+)@([^'\s:]+)'?:/.exec(e);if(!s)continue;const[,r,a]=s;o.push({name:r,version:a.split("(")[0],ecosystem:"npm",direct:t.has(r),dev:n.has(r),license:null,resolved:null,integrity:null})}const a=new Map;for(const e of o)a.set(`${e.name}@${e.version}`,e);return[...a.values()]}function parseRequirementsTxt(e){const t=readTextSafe(path.join(e,"requirements.txt"));if(!t)return[];const n=[];for(const e of t.split("\n")){const t=e.split("#")[0].trim();if(!t||t.startsWith("-"))continue;const s=/^([A-Za-z0-9._-]+)\s*(==|>=|<=|~=|!=)?\s*([A-Za-z0-9.*+!-]*)/.exec(t);if(!s)continue;const[,o,r,i]=s;n.push({name:o,version:"=="===r&&i?i:i||null,ecosystem:"pypi",direct:!0,dev:!1,license:null,unresolved:"=="!==r})}return n}function parsePipfileLock(e){const t=readJSONSafe(path.join(e,"Pipfile.lock"));if(!t)return[];const n=[],s=[["default",!1],["develop",!0]];for(const[e,o]of s)for(const[s,r]of Object.entries(t[e]||{})){const e=(r.version||"").replace(/^==/,"");e&&n.push({name:s,version:e,ecosystem:"pypi",direct:!0,dev:o,license:null,integrity:(r.hashes||[])[0]||null})}return n}function parseGoModDirects(e){const t=readTextSafe(path.join(e,"go.mod")),n=new Set;if(!t)return n;const s=/require\s*\(([\s\S]*?)\)/.exec(t),o=s?s[1].split("\n"):[],r=t.split("\n").filter(e=>/^require\s+\S/.test(e.trim()));for(const e of[...o,...r]){const t=e.replace(/^require\s+/,"").trim();if(!t||t.includes("// indirect"))continue;const s=/^(\S+)\s+(\S+)/.exec(t);s&&n.add(s[1])}return n}function parseGoSum(e){const t=readTextSafe(path.join(e,"go.sum"));if(!t)return[];const n=parseGoModDirects(e),s=new Map;for(const e of t.split("\n")){const t=e.trim().split(/\s+/);if(t.length<2)continue;const[o,r]=t;if(r.endsWith("/go.mod"))continue;const i=r.replace(/^v/,"");s.set(`${o}@${i}`,{name:o,version:i,ecosystem:"go",direct:n.has(o),dev:!1,license:null})}return[...s.values()]}function parseCargoTomlDirects(e){const t=readTextSafe(path.join(e,"Cargo.toml")),n=new Set;if(!t)return n;let s=!1;for(const e of t.split("\n")){const t=e.trim();if(/^\[(dependencies|dev-dependencies|build-dependencies)\]/.test(t)){s=!0;continue}if(/^\[/.test(t)){s=!1;continue}if(!s||!t||t.startsWith("#"))continue;const o=/^([A-Za-z0-9_-]+)\s*=/.exec(t);o&&n.add(o[1])}return n}function parseCargoLock(e){const t=readTextSafe(path.join(e,"Cargo.lock"));if(!t)return[];const n=parseCargoTomlDirects(e),s=[],o=t.split("[[package]]").slice(1);for(const e of o){const t=/name\s*=\s*"([^"]+)"/.exec(e),o=/version\s*=\s*"([^"]+)"/.exec(e),r=/checksum\s*=\s*"([^"]+)"/.exec(e);t&&o&&s.push({name:t[1],version:o[1],ecosystem:"cargo",direct:n.has(t[1]),dev:!1,license:null,integrity:r?r[1]:null})}return s}function toPurl(e,t,n){return`pkg:${{npm:"npm",pypi:"pypi",go:"golang",cargo:"cargo"}[e]||e}/${t.startsWith("@")?t.replace("@","%40"):t}@${n}`}class SupplyChainAnalyzer{constructor(e={}){this.rootPath=e.rootPath||process.cwd(),this.offline=!!e.offline,this.concurrency=e.concurrency||20,this.timeoutMs=e.timeoutMs||15e3}detectEcosystems(){const e=e=>fs.existsSync(path.join(this.rootPath,e));return{npm:e("package.json"),pypi:e("requirements.txt")||e("Pipfile.lock"),go:e("go.sum"),cargo:e("Cargo.lock")}}collectPackages(){const e=[],t=readJSONSafe(path.join(this.rootPath,"package.json"));if(fs.existsSync(path.join(this.rootPath,"package.json"))){const n=fs.existsSync(path.join(this.rootPath,"package-lock.json")),s=fs.existsSync(path.join(this.rootPath,"yarn.lock")),o=fs.existsSync(path.join(this.rootPath,"pnpm-lock.yaml")),r=parseNpmProject(this.rootPath,!n&&(s||o));if(e.push(...r),!n&&t){const n=new Set([...Object.keys(t.dependencies||{}),...Object.keys(t.devDependencies||{})]),r=new Set(Object.keys(t.devDependencies||{}));s?e.push(...parseYarnLock(this.rootPath,n,r)):o&&e.push(...parsePnpmLock(this.rootPath,n,r))}}return fs.existsSync(path.join(this.rootPath,"Pipfile.lock"))?e.push(...parsePipfileLock(this.rootPath)):fs.existsSync(path.join(this.rootPath,"requirements.txt"))&&e.push(...parseRequirementsTxt(this.rootPath)),fs.existsSync(path.join(this.rootPath,"go.sum"))&&e.push(...parseGoSum(this.rootPath)),fs.existsSync(path.join(this.rootPath,"Cargo.lock"))&&e.push(...parseCargoLock(this.rootPath)),e}async analyze(){const e=this.collectPackages(),t=e.filter(e=>e.version&&!e.unresolved);let n=new Map,s=new Map,o=!0;if(!this.offline&&t.length>0)try{n=await osvBatchQuery(t.map(e=>({name:e.name,version:e.version,ecosystem:e.ecosystem})),{timeout:this.timeoutMs});const e=[...n.values()].flat();s=await osvResolveIds(e,{concurrency:this.concurrency,timeout:this.timeoutMs})}catch{o=!1}else t.length>0&&(o=!1);const r=new Map;for(const t of e)r.set(`${t.ecosystem}:${t.name}`,{ecosystem:t.ecosystem,name:t.name});const i=new Map;this.offline||await withConcurrency([...r.values()],this.concurrency,async({ecosystem:e,name:t})=>{try{const n=await registryLookup(e,t);n&&i.set(`${e}:${t}`,n)}catch{}});const a=[];for(const t of e){const e=`${t.ecosystem}:${t.name}`,o=i.get(e),r=t.license||o?.license||null,c=classifyLicense(r),l=`${t.ecosystem}:${t.name}@${t.version}`,u=n.get(l)||[],p=[],d=[];for(const e of u){const n=s.get(e);/^MAL-/.test(e)?d.push(n?.summary||`Flagged malicious by OSV (${e})`):n?p.push({id:e,severity:osvSeverityLabel(n),summary:n.summary||null,fixedVersion:osvFixedVersion(n,t.ecosystem,t.name),aliases:n.aliases||[]}):p.push({id:e,severity:"UNKNOWN",summary:null,fixedVersion:null,aliases:[]})}const m="npm"===t.ecosystem?KNOWN_MALICIOUS_NPM.get(t.name):"pypi"===t.ecosystem?KNOWN_MALICIOUS_PYPI.get(t.name):null;!m||m.versions&&!m.versions.includes(t.version)||d.push(m.reason);const h=0===d.length?suspectedTyposquat(t.name,t.ecosystem):null,f=o?.latest||null,y=!!(f&&t.version&&compareSemver(t.version,f)<0),g=parseSemver(t.version)?.major,v=parseSemver(f)?.major,S=y&&"number"==typeof g&&"number"==typeof v?Math.max(0,v-g):0,C=p.reduce((e,t)=>{const n={CRITICAL:4,HIGH:3,MEDIUM:2,LOW:1,UNKNOWN:0};return(n[t.severity]||0)>(n[e]||0)?t.severity:e},"UNKNOWN");let P="none";d.length>0||"CRITICAL"===C?P="critical":"HIGH"===C?P="high":"MEDIUM"===C?P="medium":"LOW"===C||p.length>0?P="low":"copyleft"===c?P="medium":("unlicensed"===c||h)&&(P="low"),a.push({name:t.name,version:t.version,ecosystem:t.ecosystem,direct:!!t.direct,dev:!!t.dev,license:r,licenseCategory:c,latestVersion:f,outdated:y,majorVersionsBehind:S,deprecated:!!o?.deprecated,cves:p,malicious:d.length>0,maliciousReasons:d,suspectedTyposquat:h,riskLevel:P,resolved:t.resolved||null,integrity:t.integrity||null,purl:toPurl(t.ecosystem,t.name,t.version)})}a.sort((e,t)=>{const n={critical:4,high:3,medium:2,low:1,none:0};return n[t.riskLevel]-n[e.riskLevel]||e.name.localeCompare(t.name)});const c=this._buildSummary(a,o);return{generatedAt:(new Date).toISOString(),rootPath:this.rootPath,ecosystemsDetected:Object.entries(this.detectEcosystems()).filter(([,e])=>e).map(([e])=>e),networkAvailable:o,packages:a,summary:c}}_buildSummary(e,t){const n=e.filter(e=>e.direct),s=e.filter(e=>!e.direct),o=e.flatMap(e=>e.cves.map(t=>({...t,package:e.name,version:e.version}))),r={CRITICAL:0,HIGH:0,MEDIUM:0,LOW:0,UNKNOWN:0};for(const e of o)r[e.severity]=(r[e.severity]||0)+1;const i={permissive:0,"weak-copyleft":0,copyleft:0,unlicensed:0,unknown:0};for(const t of e)i[t.licenseCategory]=(i[t.licenseCategory]||0)+1;const a=e.filter(e=>e.malicious),c=e.filter(e=>!e.malicious&&e.suspectedTyposquat),l=e.filter(e=>e.outdated),u=e.filter(e=>e.deprecated),p=e.filter(e=>"copyleft"===e.licenseCategory||"weak-copyleft"===e.licenseCategory),d=e.filter(e=>"unlicensed"===e.licenseCategory||"unknown"===e.licenseCategory);return{totalDirect:n.length,totalTransitive:s.length,totalPackages:e.length,totalCVEs:o.length,criticalCVEs:r.CRITICAL,highCVEs:r.HIGH,mediumCVEs:r.MEDIUM,lowCVEs:r.LOW,unknownSeverityCVEs:r.UNKNOWN,maliciousCount:a.length,suspectedTyposquatCount:c.length,outdatedCount:l.length,majorVersionsBehindCount:l.filter(e=>e.majorVersionsBehind>0).length,deprecatedCount:u.length,licenseBreakdown:i,copyleftCount:p.length,unlicensedCount:d.length,networkAvailable:t}}generateCycloneDX(e,t={}){const n=t.componentName||path.basename(this.rootPath),s=t.componentVersion||"0.0.0",o=`urn:uuid:${crypto.randomUUID()}`,r=e.packages.map(e=>{const t=integrityAlgo(e.integrity),n=integrityToHex(e.integrity),s={type:"library","bom-ref":e.purl,name:e.name,version:e.version,purl:e.purl,scope:e.dev?"excluded":"required"};return e.license&&"unknown"!==e.licenseCategory?s.licenses=[{license:{id:e.license}}]:e.license&&(s.licenses=[{license:{name:e.license}}]),t&&n&&(s.hashes=[{alg:t,content:n}]),(e.cves.length>0||e.malicious)&&(s.properties=[{name:"thuban:riskLevel",value:e.riskLevel},{name:"thuban:cveCount",value:String(e.cves.length)},{name:"thuban:malicious",value:String(e.malicious)}]),s}),i=[];for(const t of e.packages)for(const e of t.cves)i.push({id:e.id,source:{name:"OSV"},ratings:[{source:{name:"OSV"},severity:e.severity.toLowerCase()}],description:e.summary||void 0,affects:[{ref:t.purl}],...e.fixedVersion?{recommendation:`Upgrade to ${e.fixedVersion} or later`}:{}});return{bomFormat:"CycloneDX",specVersion:"1.5",serialNumber:o,version:1,metadata:{timestamp:e.generatedAt,tools:[{vendor:"Thuban",name:"Thuban Supply Chain Scanner",version:"1.0.0"}],component:{type:"application",name:n,version:s}},components:r,...i.length>0?{vulnerabilities:i}:{}}}generateSPDX(e,t={}){const n=t.componentName||path.basename(this.rootPath),s=`https://thuban.dev/spdx/${crypto.randomUUID()}`,o=e=>e.license&&/^[A-Za-z0-9.+-]+$/.test(e.license)?e.license:"NOASSERTION",r=e.packages.map((e,t)=>({SPDXID:`SPDXRef-Package-${t}-${e.name.replace(/[^A-Za-z0-9.-]/g,"-")}`,name:e.name,versionInfo:e.version,downloadLocation:e.resolved||"NOASSERTION",licenseConcluded:o(e),licenseDeclared:o(e),copyrightText:"NOASSERTION",externalRefs:[{referenceCategory:"PACKAGE-MANAGER",referenceType:"purl",referenceLocator:e.purl}]})),i=r.map(e=>({spdxElementId:"SPDXRef-DOCUMENT",relationshipType:"DESCRIBES",relatedSpdxElement:e.SPDXID}));return{spdxVersion:"SPDX-2.3",dataLicense:"CC0-1.0",SPDXID:"SPDXRef-DOCUMENT",name:`${n}-sbom`,documentNamespace:s,creationInfo:{created:e.generatedAt,creators:["Tool: Thuban-Supply-Chain-Scanner-1.0.0"]},packages:r,relationships:i}}}module.exports={SupplyChainAnalyzer:SupplyChainAnalyzer,classifyLicense:classifyLicense,toPurl:toPurl,suspectedTyposquat:suspectedTyposquat};

package/dist/packages/scanner/support-bot.js

@@ -0,0 +1 @@
+const fs=require("fs"),path=require("path"),os=require("os"),https=require("https"),{execSync:execSync}=require("child_process"),readline=require("readline"),KB=require("./support-knowledge.js"),C={reset:"",bold:"",red:"",green:"",yellow:"",blue:"",cyan:"",gray:""};function ok(e){return`  ${C.green}✓${C.reset} ${e}`}function warn(e){return`  ${C.yellow}⚠${C.reset} ${e}`}function fail(e){return`  ${C.red}✗${C.reset} ${e}`}function safeExec(e){try{return execSync(e,{encoding:"utf8",timeout:1e4,stdio:["pipe","pipe","pipe"]}).trim()}catch{return null}}function parseSemver(e){const o=(e||"").match(/(\d+)\.(\d+)\.(\d+)/);return o?{major:Number(o[1]),minor:Number(o[2]),patch:Number(o[3])}:null}function countFiles(e){try{return fs.readdirSync(e).filter(o=>{try{return fs.statSync(path.join(e,o)).isFile()}catch{return!1}}).length}catch{return-1}}function wordOverlap(e,o){const s=new Set(e.toLowerCase().split(/\s+/).filter(Boolean)),t=new Set(o.toLowerCase().split(/\s+/).filter(Boolean));if(0===s.size||0===t.size)return 0;let n=0;for(const e of s)t.has(e)&&n++;return n/Math.max(s.size,t.size)}class SupportBot{constructor(e={}){this.rootPath=e.rootPath||process.cwd(),this.verbose=e.verbose||!1,this.smart=e.smart||!1,this._thubanVersion=null}async semanticQuery(e){const o=process.env.OPENAI_API_KEY,s=process.env.PINECONE_API_KEY;if(!o||!s){try{const o=await this._httpPost("europe-west2-orion-os-479912.cloudfunctions.net","/thuban-api/support/query",{},{query:e,topK:3});if(o.data&&o.data.results)return o.data.results}catch{}return null}try{const t=await this._httpPost("api.openai.com","/v1/embeddings",{Authorization:`Bearer ${o}`},{model:"text-embedding-3-small",input:e});if(!t.data||!t.data.data)return null;const n=t.data.data[0].embedding,r=await this._httpPost("thuban-kb-es8yjbx.svc.aped-4627-b74a.pinecone.io","/query",{"Api-Key":s},{vector:n,topK:3,includeMetadata:!0});return r.data&&r.data.matches?r.data.matches.map(e=>({score:e.score,type:e.metadata.type,...e.metadata})):null}catch(e){return this.verbose&&console.error(`${C.gray}  Semantic search error: ${e.message}${C.reset}`),null}}_httpPost(e,o,s,t){return new Promise((n,r)=>{const a=JSON.stringify(t),i=https.request({hostname:e,path:o,method:"POST",timeout:1e4,headers:{...s,"Content-Type":"application/json","Content-Length":Buffer.byteLength(a)}},e=>{let o="";e.on("data",e=>o+=e),e.on("end",()=>{try{n({status:e.statusCode,data:JSON.parse(o)})}catch{n({status:e.statusCode,data:o})}})});i.on("error",r),i.on("timeout",()=>{i.destroy(),r(new Error("timeout"))}),i.write(a),i.end()})}async diagnose(){const e=[],o=[],s=[],t={},n=safeExec("node --version"),r=parseSemver(n);t.nodeVersion=n||"unknown",r&&r.major>=16?e.push(ok(`Node.js ${n} (requires >= 16)`)):r?s.push(fail(`Node.js ${n} — version 16+ required`)):s.push(fail("Node.js not found"));const a=safeExec("npm --version");t.npmVersion=a||"unknown",a?e.push(ok(`npm v${a}`)):o.push(warn("npm not found — install via Node.js installer"));const i=safeExec("git --version"),c=i?i.replace(/^git version\s*/,""):null;t.gitVersion=c||"unknown",c?e.push(ok(`Git v${c}`)):o.push(warn("Git not found — some features require Git"));const l=this._readThubanVersion();t.thubanVersion=l||"unknown",l?e.push(ok(`Thuban v${l}`)):o.push(warn("Could not determine Thuban version")),this._thubanVersion=l;const u=os.platform(),d=os.arch(),p=os.release();t.os=u,t.arch=d,t.release=p;const g=this._formatOS(u,p,d);e.push(ok(`OS: ${g}`));try{fs.accessSync(this.rootPath,fs.constants.R_OK),e.push(ok("Target path exists and is readable"))}catch{s.push(fail(`Target path not readable: ${this.rootPath}`))}const h=countFiles(this.rootPath);h>=0&&(0===h?o.push(warn("Target directory is empty")):this.verbose&&e.push(ok(`${h} file(s) in target directory`))),fs.existsSync(path.join(this.rootPath,"package.json"))?e.push(ok("package.json found")):s.push(fail("No package.json found in target directory")),this._hasCodeFiles(this.rootPath)||o.push(warn("No .js or .ts files found in target directory"));const f=this._checkDiskSpace();!1===f.ok?o.push(warn(`Low disk space: ${f.free} available`)):f.free&&this.verbose&&e.push(ok(`Disk space: ${f.free} available`)),/\s/.test(this.rootPath)&&o.push(warn("Path contains spaces — may cause issues with some commands"));try{fs.accessSync(this.rootPath,fs.constants.W_OK),this.verbose&&e.push(ok("Write permissions on target directory"))}catch{o.push(warn("No write permissions on target directory"))}const $={passed:e,warnings:o,failed:s,systemInfo:t};return this._printDiagnosticReport($),$}_printDiagnosticReport(e){console.log(""),console.log(`  ${C.bold}THUBAN SYSTEM DIAGNOSTIC${C.reset}`),console.log(`  ${C.gray}────────────────────────${C.reset}`),console.log("");for(const o of e.passed)console.log(o);for(const o of e.warnings)console.log(o);for(const o of e.failed)console.log(o);console.log("");const o=[];e.passed.length&&o.push(`${C.green}${e.passed.length} passed${C.reset}`),e.warnings.length&&o.push(`${C.yellow}${e.warnings.length} warning${1!==e.warnings.length?"s":""}${C.reset}`),e.failed.length&&o.push(`${C.red}${e.failed.length} failed${C.reset}`),console.log(`  ${o.join(", ")}`),console.log("")}query(e){return this._queryLocal(e)}async queryAsync(e){const o=this._queryLocal(e);if(o.confidence>=.7)return o;if(this.smart){const o=await this.semanticQuery(e);if(o&&o.length>0&&o[0].score>.35){const e=o[0];return{type:e.type||"faq",data:{question:e.question||e.title||e.name||"",answer:e.answer||e.fix||e.description||"",category:e.category||"general",source:"pinecone",score:e.score,alternatives:o.slice(1).map(e=>({type:e.type,title:e.question||e.title||e.name||"",score:e.score}))},confidence:Math.min(e.score+.3,1)}}}return o}_queryLocal(e){if(!e||"string"!=typeof e)return{type:"none",data:null,confidence:0};const o=e.trim().toLowerCase();if(!o)return{type:"none",data:null,confidence:0};if(KB.patterns&&Array.isArray(KB.patterns))for(const e of KB.patterns)if(e.regex&&new RegExp(e.regex,"i").test(o))return{type:e.type||"troubleshooting",data:e,confidence:1};let s=null,t=0;if(KB.faq&&Array.isArray(KB.faq))for(const e of KB.faq){const n=e.keywords||[];let r=0;for(const e of n)if(o===e.toLowerCase()){r=1;break}if(r<1)for(const e of n)(o.includes(e.toLowerCase())||e.toLowerCase().includes(o))&&(r=Math.max(r,.7));r<.7&&e.question&&wordOverlap(o,e.question)>.5&&(r=Math.max(r,.5)),r>t&&(t=r,s=e)}let n=null,r=0;if(KB.errors&&Array.isArray(KB.errors))for(const e of KB.errors){const s=(e.code||"").toLowerCase(),t=(e.message||"").toLowerCase();if(s&&o.includes(s)){n=e,r=1;break}if(t&&o.includes(t)&&(n=e,r=Math.max(r,.7)),e.keywords)for(const s of e.keywords)o.includes(s.toLowerCase())&&(r=Math.max(r,.5),n=e)}let a=null,i=0;if(KB.commands&&Array.isArray(KB.commands))for(const e of KB.commands){const s=(e.name||"").toLowerCase();if(s&&o.includes(s)){a=e,i=o===s?1:.7;break}if(e.aliases)for(const s of e.aliases)o.includes(s.toLowerCase())&&(a=e,i=.7)}const c=[{type:"faq",data:s,confidence:t},{type:"error",data:n,confidence:r},{type:"command",data:a,confidence:i}].filter(e=>null!==e.data);return c.sort((e,o)=>o.confidence-e.confidence),c.length>0&&c[0].confidence>0?c[0]:{type:"none",data:{suggestions:(KB.faq||[]).slice(0,3).map(e=>({question:e.question,keywords:e.keywords}))},confidence:0}}async startInteractive(){const e=this._readThubanVersion()||"0.0.0",o=readline.createInterface({input:process.stdin,output:process.stdout});console.log(""),console.log(`  ${C.cyan}╔══════════════════════════════════════╗${C.reset}`),console.log(`  ${C.cyan}║${C.reset}   ${C.bold}THUBAN Support Assistant${C.reset}          ${C.cyan}║${C.reset}`),console.log(`  ${C.cyan}║${C.reset}   v${e} · Type 'help' or 'exit'   ${C.cyan}║${C.reset}`),console.log(`  ${C.cyan}╚══════════════════════════════════════╝${C.reset}`),console.log(""),console.log(`  ${C.bold}Quick actions:${C.reset}`),console.log(`    ${C.cyan}[1]${C.reset} Run system diagnostic`),console.log(`    ${C.cyan}[2]${C.reset} Installation help`),console.log(`    ${C.cyan}[3]${C.reset} Scan not working`),console.log(`    ${C.cyan}[4]${C.reset} Understanding results`),console.log(`    ${C.cyan}[5]${C.reset} Monitor/watch mode guide`),console.log(`    ${C.cyan}[6]${C.reset} Commands reference`),console.log(`    ${C.cyan}[7]${C.reset} Report a bug (thuban feedback)`),console.log("");const s={1:"diagnose",2:"installation",3:"scan-not-working",4:"understanding-results",5:"monitor-mode",6:"commands",7:"report-bug"},t=()=>new Promise(e=>{o.question(`  ${C.bold}You:${C.reset} `,o=>{e(o?o.trim():"")})}),n=()=>new Promise(e=>{o.question(`\n  ${C.gray}Did this help? (y/n/more):${C.reset} `,o=>{e(o?o.trim().toLowerCase():"")})});let r=!0;for(;r;){const e=await t();if(!e)continue;const o=e.toLowerCase();if("exit"===o||"quit"===o){console.log(`\n  ${C.cyan}Goodbye! Run 'thuban support' anytime.${C.reset}\n`),r=!1;break}if("help"===o){this._printHelp();continue}if("diagnose"===o||"1"===o){await this.diagnose();continue}if(s[o]&&"1"!==o){const e=s[o];if("report-bug"===e){console.log(`\n  ${C.cyan}To report a bug, run:${C.reset}`),console.log("    thuban feedback 'describe your issue'\n");continue}this._handleSlugQuery(e);const t=await n();this._handleFollowUp(t,e);continue}const a=this.query(e);if(this._printQueryResult(a),a.confidence<.5)console.log(`\n  ${C.yellow}I couldn't find an exact match. Try:${C.reset}`),console.log(`    • ${C.cyan}thuban support --diagnose${C.reset} (run diagnostics)`),console.log(`    • ${C.cyan}thuban feedback 'describe your issue'${C.reset} (report to the team)`);else{const e=await n();this._handleFollowUp(e,null)}}o.close()}_readThubanVersion(){const e=[path.join(__dirname,"package.json"),path.join(__dirname,"..","package.json"),path.join(__dirname,"..","..","package.json")];for(const o of e)try{const e=fs.readFileSync(o,"utf8"),s=JSON.parse(e);if(s.version)return s.version}catch{}return null}_formatOS(e,o,s){return`${{win32:"Windows",darwin:"macOS",linux:"Linux",freebsd:"FreeBSD"}[e]||e} ${o} (${s})`}_hasCodeFiles(e){try{return fs.readdirSync(e).some(e=>/\.(js|ts|jsx|tsx|mjs|cjs)$/.test(e))}catch{return!1}}_checkDiskSpace(){const e="win32"===os.platform();try{if(e){const e=safeExec(`wmic logicaldisk where "DeviceID='${(path.parse(this.rootPath).root||"C:\\").charAt(0)}:'" get FreeSpace /format:value`);if(e){const o=e.match(/FreeSpace=(\d+)/);if(o){const e=parseInt(o[1],10);return{ok:e>536870912,free:`${(e/1073741824).toFixed(1)} GB`}}}}else{const e=safeExec(`df -h "${this.rootPath}" 2>/dev/null`);if(e){const o=e.split("\n");if(o.length>=2){return{ok:!0,free:o[1].split(/\s+/)[3]||"unknown"}}}}}catch{}return{ok:null,free:null}}_printHelp(){console.log(""),console.log(`  ${C.bold}Available commands:${C.reset}`),console.log(`    ${C.cyan}help${C.reset}       — Show this help message`),console.log(`    ${C.cyan}diagnose${C.reset}   — Run full system diagnostic`),console.log(`    ${C.cyan}1-7${C.reset}        — Quick action shortcuts`),console.log(`    ${C.cyan}exit${C.reset}       — Exit the support assistant`),console.log(""),console.log(`  ${C.bold}Or type any question:${C.reset}`),console.log('    "How do I scan a project?"'),console.log('    "What does error E001 mean?"'),console.log('    "scan command options"'),console.log("")}_handleSlugQuery(e){if(KB.troubleshooting&&Array.isArray(KB.troubleshooting)){const o=KB.troubleshooting.find(o=>o.slug===e);if(o){if(console.log(""),console.log(`  ${C.bold}${o.title||o.slug}${C.reset}`),console.log(`  ${C.gray}${"─".repeat(40)}${C.reset}`),o.summary&&console.log(`\n  ${o.summary}`),o.steps&&o.steps.length>0){console.log("");for(let e=0;e<o.steps.length;e++){const s=o.steps[e];console.log(`    ${C.cyan}${e+1}.${C.reset} ${s.description||s.text||""}`),s.fix&&console.log(`       ${C.gray}→ ${s.fix}${C.reset}`)}}return void console.log("")}}const o=this.query(e);this._printQueryResult(o)}_printQueryResult(e){if(console.log(""),"none"===e.type){if(e.data&&e.data.suggestions&&e.data.suggestions.length>0){console.log(`  ${C.yellow}No exact match found. Did you mean:${C.reset}`);for(const o of e.data.suggestions)console.log(`    • ${o.question||o.keywords?.join(", ")||"(untitled)"}`)}else console.log(`  ${C.yellow}No results found.${C.reset}`);return void console.log("")}const o=e.data;switch(e.type){case"faq":console.log(`  ${C.bold}${o.question||"FAQ"}${C.reset}`),o.answer&&console.log(`  ${o.answer}`),o.example&&console.log(`\n  ${C.gray}Example:${C.reset} ${o.example}`);break;case"error":console.log(`  ${C.bold}${C.red}Error: ${o.code||"Unknown"}${C.reset}`),o.message&&console.log(`  ${o.message}`),o.cause&&console.log(`\n  ${C.yellow}Cause:${C.reset} ${o.cause}`),o.fix&&console.log(`  ${C.green}Fix:${C.reset} ${o.fix}`);break;case"command":if(console.log(`  ${C.bold}${C.cyan}${o.name||"Command"}${C.reset}`),o.description&&console.log(`  ${o.description}`),o.usage&&console.log(`\n  ${C.gray}Usage:${C.reset} ${o.usage}`),o.options&&Array.isArray(o.options)){console.log(`\n  ${C.bold}Options:${C.reset}`);for(const e of o.options)console.log(`    ${C.cyan}${e.flag||e.name}${C.reset}  ${e.description||""}`)}break;case"troubleshooting":if(console.log(`  ${C.bold}${o.title||o.slug||"Troubleshooting"}${C.reset}`),o.response&&console.log(`  ${o.response}`),o.steps&&Array.isArray(o.steps))for(const e of o.steps)console.log(`    • ${e}`);break;default:console.log(`  ${C.gray}(${e.type})${C.reset} ${JSON.stringify(o)}`)}e.confidence<1&&e.confidence>=.5&&console.log(`\n  ${C.gray}(confidence: ${Math.round(100*e.confidence)}% — results may be approximate)${C.reset}`),console.log("")}_handleFollowUp(e,o){if(e)switch(e){case"y":case"yes":console.log(`\n  ${C.green}Great! Anything else?${C.reset}\n`);break;case"n":case"no":console.log(`\n  ${C.yellow}Sorry about that. Try describing your issue differently,`),console.log(`  or run '${C.cyan}thuban feedback${C.reset}' to report it.${C.reset}\n`);break;case"more":this._showRelatedEntries(o)}}_showRelatedEntries(e){if(!KB.faq||!Array.isArray(KB.faq))return void console.log(`\n  ${C.gray}No additional entries available.${C.reset}\n`);const o=KB.faq.filter(o=>o.slug!==e).slice(0,5);if(0!==o.length){console.log(`\n  ${C.bold}Related topics:${C.reset}`);for(const e of o)console.log(`    • ${e.question||e.keywords?.join(", ")||e.slug||"(untitled)"}`);console.log("")}else console.log(`\n  ${C.gray}No additional entries available.${C.reset}\n`)}}module.exports=SupportBot;